24:I[10321,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/3xfwong8gg51p.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T503,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic — Falcon Sandbox Report — Score 100/100 — Sample 737edb7dd8ba…","description":"Malicious verdict for sandbox report 5adb25aa7ca3…. Malware family: Trojan.Generic. Threat score 100/100. 11 malicious and 16 suspicious behavioral indicators across 58 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/737edb7dd8ba6a9a2c54eed0a4e806c8d344e17e13427afed0b24a724af51939/5adb25aa7ca3e128295cf997","keywords":["Malicious","Trojan.Generic","sandbox report","malware analysis","MITRE ATT\u0026CK","737edb7dd8ba6a9a2c54eed0a4e806c8d344e17e13427afed0b24a724af51939"],"about":{"@type":"SoftwareApplication","name":"9afb2870-sample","applicationCategory":"PE32 executable (GUI) Intel 80386, for MS Windows","identifier":"737edb7dd8ba6a9a2c54eed0a4e806c8d344e17e13427afed0b24a724af51939","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","sandboxEnvironment":"Windows 7 32 bit","behavioralIndicators":{"malicious":11,"suspicious":16,"totalSignatures":58},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAiIiAiICAAIgAAAAAAAAAAAAIgAAAAACIAAAAAAAAB3d3d3AAAIAIiAAAAAAAd3iIiIiHdwgIAAiAAAAAd3eIiIiIiHd3AACIAAAAB3iHd4iIiIiIh3AAAAAAAHeId3eIiIiIeIh3AAAAAAd4d3d3iIiIiIiIh3AAAAAHiHd3d4iIiIiIiIhwAAAAd4d3d3d4iIiIiIiIdwAAAHd3d3d3d4iIiIiIiHcAAAB4iHd3d3d3iIiIiIiHAAAHiIiHd3d3d3eIiIiIiHAAB4iIiIh3eAAHeIiIiIhwAAeIiIiIh4iAAHiIiIiIcACHiIiIiHeIiIB3iIiIiHAIh4iIiIh3iIAAd4iIiIhwCIeIiIiIh4AAiHeIiIiIcAiHiIiIiId4gId3d4iIiHAAh4iIiIiId3d3d3d3eIhwAIB4iIiIiIh3iId3d3eHAACAd4iIiIiIiIh3d3d3dwAAAHeIiIiIiIiIeHd3eHcAAACHiIiIiIiIiId3d4h4CACAB3iIiIiIiIiId3eHcIiAAAB3iIiIiIiIiHeIdwgAgAAAB3iIiIiIiIh4h3gIAAAAAAh3d4iIiIiId3cAAAAAAAAICHd4iIiIh3cAAAAAAAAAAIAAB3d3d3gIAAAAAAAAAAAACAAAgACACAAAAAAAAAAAAAAIAAgIAAAAAAAAD//ggA//+P6P/AAgD/gAAc/gAAOfwAAD/4AAAP8AAAD+AAAAfgAAAH4AAAA+AAAAPAAAADwACAA8AAYAOAACADAAAAAwADgAMAAAADgAAAAwAAAAOgAAADoAAABKAAAACQAAAA+AAAFvgAABL8AAB/+AAA//7wBf//zsn///Nb/w==26:T52c,EnumSystemLocalesW@KERNEL32.dll at 53154-1508-03019502 GetUserDefaultLCID@KERNEL32.dll at 53154-1055-03019F14 EnumSystemLocalesW@KERNEL32.dll at 53154-1087-0301D6F8 GetUserDefaultLCID@KERNEL32.dll at 53154-1082-0301DD6D EnumSystemLocalesW@KERNEL32.dll at 53154-1084-0301D793 EnumSystemLocalesW@KERNEL32.dll at 53154-1083-0301D68F EnumSystemLocalesW@KERNEL32.dll at 53154-1061-03019413 GetUserDefaultLCID@KERNEL32.dll at 53154-1576-0301D6DC EnumSystemLocalesW@KERNEL32.DLL at 00047647-00003048-65481-931-0301D793 EnumSystemLocalesW@KERNEL32.DLL at 00047647-00003048-65481-930-0301D68F EnumSystemLocalesW@KERNEL32.DLL at 00047647-00003048-65481-1355-03019502 GetUserDefaultLCID@KERNEL32.DLL at 00047647-00003048-65481-902-03019F14 EnumSystemLocalesW@KERNEL32.DLL at 00047647-00003048-65481-934-0301D6F8 EnumSystemLocalesW@KERNEL32.DLL at 00047647-00003048-65481-908-03019413 GetUserDefaultLCID@KERNEL32.DLL at 00047647-00003048-65481-929-0301DD6D GetUserDefaultLCID@KERNEL32.DLL at 00047647-00003048-65481-1423-0301D6DC EnumSystemLocalesW@KERNEL32.DLL at 00051562-00002132-17936-931-0301D793 GetUserDefaultLCID@KERNEL32.DLL at 00051562-00002132-17936-902-03019F14 EnumSystemLocalesW@KERNEL32.DLL at 00051562-00002132-17936-930-0301D68F EnumSystemLocalesW@KERNEL32.DLL at 00051562-00002132-17936-908-0301941327:T832,"" queries volume information of unknown location at 00047647-00003048-0000010C-108926376 "" queries volume information of unknown location at 00047647-00003048-0000010C-108926425 "" queries volume information of unknown location at 00047647-00003048-0000010C-108926469 "" queries volume information of unknown location at 00047647-00003048-0000010C-108926515 "" queries volume information of unknown location at 00047647-00003048-0000010C-108926558 "" queries volume information of unknown location at 00047647-00003048-0000010C-108926601 "" queries volume information of unknown location at 00047647-00003048-0000010C-108926643 "" queries volume information of unknown location at 00047647-00003048-0000010C-108926686 "" queries volume information of unknown location at 00047647-00003048-0000010C-108926728 "" queries volume information of unknown location at 00047647-00003048-0000010C-108926771 "" queries volume information of unknown location at 00047647-00003048-0000010C-108926815 "" queries volume information of unknown location at 00047647-00003048-0000010C-108926857 "" queries volume information of unknown location at 00047647-00003048-0000010C-108926900 "" queries volume information of unknown location at 00047647-00003048-0000010C-108926942 "" queries volume information of unknown location at 00047647-00003048-0000010C-108926985 "" queries volume information of unknown location at 00047647-00003048-0000010C-108927027 "" queries volume information of unknown location at 00047647-00003048-0000010C-108927070 "" queries volume information of unknown location at 00047647-00003048-0000010C-108927112 "" queries volume information of unknown location at 00047647-00003048-0000010C-108927155 "" queries volume information of unknown location at 00047647-00003048-0000010C-10892719928:T53b,"" touched file "C:\Windows\M-505059720970246082475082628448545" "" touched file "C:\Windows\M-505059720970246082475082628448545\winmgr.exe" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\62ccv3C\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\en-US\propsys.dll.mui" "" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "cmd.exe" touched file "C:\Windows\System32\en-US\cmd.exe.mui" "cmd.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "winmgr.exe" touched file "C:\Windows\M-505059720970246082475082628448545\winmgr.exe"29:T91f,Heuristic match: "siiifibiiegiiciib.ws" Heuristic match: "siiifibiiegiiciib.su" Heuristic match: "siiifibiiegiiciib.ru" Heuristic match: "siiifibiiegiiciib.nl" Heuristic match: "siiifibiiegiiciib.kz" Heuristic match: "siiifibiiegiiciib.in" Heuristic match: "rohgoruhgsorhugih.ws" Heuristic match: "rohgoruhgsorhugih.su" Heuristic match: "rohgoruhgsorhugih.ru" Heuristic match: "rohgoruhgsorhugih.nl" Heuristic match: "rohgoruhgsorhugih.kz" Heuristic match: "rohgoruhgsorhugih.in" Heuristic match: "oeihefoeaboeubfuo.ws" Heuristic match: "oeihefoeaboeubfuo.su" Heuristic match: "oeihefoeaboeubfuo.ru" Heuristic match: "oeihefoeaboeubfuo.nl" Heuristic match: "oeihefoeaboeubfuo.kz" Heuristic match: "oeihefoeaboeubfuo.in" Heuristic match: "oeabocbeogoaehgoi.ws" Heuristic match: "oeabocbeogoaehgoi.su" Heuristic match: "oeabocbeogoaehgoi.ru" Heuristic match: "oeabocbeogoaehgoi.nl" Heuristic match: "oeabocbeogoaehgoi.kz" Heuristic match: "oeabocbeogoaehgoi.in" Heuristic match: "iapghahpnpnapcipa.ws" Heuristic match: "iapghahpnpnapcipa.su" Heuristic match: "iapghahpnpnapcipa.ru" Heuristic match: "iapghahpnpnapcipa.nl" Heuristic match: "iapghahpnpnapcipa.kz" Heuristic match: "iapghahpnpnapcipa.in" Heuristic match: "goiaegodbuebieibg.ws" Heuristic match: "goiaegodbuebieibg.su" Heuristic match: "goiaegodbuebieibg.ru" Heuristic match: "goiaegodbuebieibg.kz" Heuristic match: "goiaegodbuebieibg.in" Heuristic match: "eghoabeogbuaeofua.ws" Heuristic match: "eghoabeogbuaeofua.su" Heuristic match: "eghoabeogbuaeofua.ru" Heuristic match: "eghoabeogbuaeofua.nl" Heuristic match: "eghoabeogbuaeofua.kz" Heuristic match: "eghoabeogbuaeofua.in" Heuristic match: "ageihehaioeoaiegj.ws" Heuristic match: "ageihehaioeoaiegj.su" Heuristic match: "ageihehaioeoaiegj.ru" Heuristic match: "ageihehaioeoaiegj.nl" Heuristic match: "ageihehaioeoaiegj.kz" Heuristic match: "ageihehaioeoaiegj.in" Heuristic match: "aefobfboabobfaoua.ws" Heuristic match: "aefobfboabobfaoua.su" Heuristic match: "aefobfboabobfaoua.ru" Heuristic match: "aefobfboabobfaoua.kz" Heuristic match: "aefobfboabobfaoua.in" Heuristic match: "abvainvienvaiebai.ws" Heuristic match: "abvainvienvaiebai.su" Heuristic match: "abvainvienvaiebai.ru" Heuristic match: "abvainvienvaiebai.kz" Heuristic match: "abvainvienvaiebai.in"2a:T838,"" wrote 32 bytes to a remote process "C:\9afb2870-sample.exe" (Handle: 76) "" wrote 52 bytes to a remote process "C:\9afb2870-sample.exe" (Handle: 76) "" wrote 4 bytes to a remote process "C:\9afb2870-sample.exe" (Handle: 76) "" wrote 1024 bytes to a remote process "C:\9afb2870-sample.exe" (Handle: 76) "" wrote 22016 bytes to a remote process "C:\9afb2870-sample.exe" (Handle: 76) "" wrote 12800 bytes to a remote process "C:\9afb2870-sample.exe" (Handle: 76) "" wrote 2560 bytes to a remote process "C:\9afb2870-sample.exe" (Handle: 76) "" wrote 2048 bytes to a remote process "C:\9afb2870-sample.exe" (Handle: 76) "" wrote 32 bytes to a remote process "C:\Windows\M-505059720970246082475082628448545\winmgr.exe" (Handle: 192) "" wrote 52 bytes to a remote process "C:\Windows\M-505059720970246082475082628448545\winmgr.exe" (Handle: 192) "" wrote 4 bytes to a remote process "C:\Windows\M-505059720970246082475082628448545\winmgr.exe" (Handle: 192) "winmgr.exe" wrote 32 bytes to a remote process "C:\Windows\M-505059720970246082475082628448545\winmgr.exe" (Handle: 76) "winmgr.exe" wrote 52 bytes to a remote process "C:\Windows\M-505059720970246082475082628448545\winmgr.exe" (Handle: 76) "winmgr.exe" wrote 4 bytes to a remote process "C:\Windows\M-505059720970246082475082628448545\winmgr.exe" (Handle: 76) "winmgr.exe" wrote 1024 bytes to a remote process "C:\Windows\M-505059720970246082475082628448545\winmgr.exe" (Handle: 76) "winmgr.exe" wrote 22016 bytes to a remote process "C:\Windows\M-505059720970246082475082628448545\winmgr.exe" (Handle: 76) "winmgr.exe" wrote 12800 bytes to a remote process "C:\Windows\M-505059720970246082475082628448545\winmgr.exe" (Handle: 76) "winmgr.exe" wrote 2560 bytes to a remote process "C:\Windows\M-505059720970246082475082628448545\winmgr.exe" (Handle: 76) "winmgr.exe" wrote 2048 bytes to a remote process "C:\Windows\M-505059720970246082475082628448545\winmgr.exe" (Handle: 76)2b:Tf82,Found malicious artifacts related to "220.181.87.80": ... URL: http://220.181.87.80/ (AV positives: 9/67 scanned on 04/13/2018 19:52:06) URL: http://photobeat.su/ (AV positives: 4/67 scanned on 04/05/2018 20:19:47) URL: http://220.181.87.80/k.exe (AV positives: 10/67 scanned on 03/31/2018 19:33:14) URL: http://auoegfiaefuageudn.ru/ (AV positives: 2/67 scanned on 03/13/2018 13:36:26) URL: http://xjpakmdcfuqe.ru/ (AV positives: 5/66 scanned on 12/01/2017 20:16:51) File SHA256: 5b1cb6acbd68c911e15adc8f4bbacf1ec4efc16e (Date: 04/11/2018 05:15:22) File SHA256: 21f2b8f84c566749bf7076598cde0492 (Date: 04/11/2018 05:15:22) File SHA256: f00a375ef54f6b0223b6f9a5dc00f0df941dd54ab6e353a982c9c18fe8891129 (Date: 04/11/2018 05:15:22) File SHA256: 340f86c78f56fb71ca0a111b10ccd40baa0ab8c85cac241af27194b6f7b4be3c (Date: 04/11/2018 05:15:22) File SHA256: b982d79da5f8a8e5667d643ffad767bd (Date: 04/11/2018 05:15:22) File SHA256: adbf62843d57df8558d35addb08ca052cd9e27dd7ac5f565fd90b05119b53011 (AV positives: 58/66 scanned on 04/03/2018 05:40:35) File SHA256: fa422a185168193606f71ed2ba5355f5f1aed45333c6b0c1e6c323a101030c0b (AV positives: 15/66 scanned on 04/03/2018 05:27:04) File SHA256: fe9c5bb24122d6a81239be3719b1c6583f534d5b7fe6d2a199835a64cc7951f9 (AV positives: 60/67 scanned on 04/02/2018 19:02:42) File SHA256: f7cea8b9d6d8a19974a95dbb996bb022561298458d0db39a183def82aee6334d (AV positives: 59/65 scanned on 04/02/2018 19:01:49) File SHA256: f1a3684c5d31dac6f6bf9186bbb165c41cd0e81613db838b5080a2831c7b9a3d (AV positives: 60/67 scanned on 04/02/2018 19:00:06) File SHA256: e82c52f279163b1f01fa50732438724e313e67053b24c0f712cefe923c563c9e (Date: 03/29/2018 23:03:57) File SHA256: 5ff1a8a5464bafbae155f3ab63d07b903c3d0a90ef467905013c415724c2feb7 (Date: 03/29/2018 21:49:36) File SHA256: 04023ff653ecbc08e55d51d31adf110627fb36245d330cbcaffa9d7076a7de37 (Date: 03/29/2018 21:49:26) File SHA256: 6e5de2363825ea1f2d921dd6b76aca80b52327bfb0e80e9de2ecbce7abc0989d (Date: 03/29/2018 21:49:01) File SHA256: ecd49bc92640d9f74eb1d7a73bdcce05bc3fe71ad2948a385d1e1efd04d586c6 (Date: 03/14/2018 18:01:58) Found malicious artifacts related to "173.230.130.175": ... URL: http://download.recover-files.ws/setup-cure-files.exe (AV positives: 2/67 scanned on 04/21/2018 11:55:25) URL: http://mostwatched.ws/crafts/fabric-embellishments.html (AV positives: 4/67 scanned on 04/21/2018 11:34:44) URL: http://www.img502.imageshack.us.img502.ws/cb/w.php?f=c6300&e=4 (AV positives: 3/67 scanned on 04/21/2018 11:25:27) URL: http://www.img502.imageshack.us.img502.ws/cb/w.php?f=c6300&e=0 (AV positives: 3/67 scanned on 04/21/2018 11:24:01) URL: http://www.img502.imageshack.us.img502.ws/cb/w.php?f=435d4&e=0 (AV positives: 3/67 scanned on 04/21/2018 10:24:18) File SHA256: 6549b3d719627cb128a558de2c5693c17de4a2a42700f9368a971a51f4aa2204 (AV positives: 54/68 scanned on 04/20/2018 11:05:01) File SHA256: 75f74c0360077cbbbc3dab8d8ec43fea614a9a38abe558f3da218bb755c9ec1b (Date: 04/17/2018 04:43:58) File SHA256: 5015393447a4a317ce8c5748bd0e57231080e270ce7da11b2ee5ad31d2389d69 (Date: 04/17/2018 02:01:36) File SHA256: db28ad609a7a14e858534fea95df56625a917e68a2a158202b3c28fb40bd2dda (Date: 04/17/2018 00:42:13) File SHA256: 344e5af768fd87406f6a1358b1ecabc5e206a518e151244cef425c8b696feab2 (Date: 04/16/2018 22:00:30) File SHA256: a8705be2b826a79cccc905655bea046c4f7e0af0483e9ae8b02adec17e55b09a (Date: 04/16/2018 21:56:13) File SHA256: 21575d42eace3e9b42d6a46479932a78849f6816384a9e300200ec4c8c216b55 (AV positives: 11/67 scanned on 04/11/2018 05:16:24) File SHA256: e77f2676d4fe116dd582e733e2d2d1603c8905dc3529696e65775409952f95d5 (AV positives: 50/66 scanned on 04/11/2018 04:45:22) File SHA256: 693c5627f624067ef7db1387327da807eae279778c9a7120320e6202369eb9ed (AV positives: 58/67 scanned on 04/10/2018 09:51:30) File SHA256: c7e42cbe9b6c7b3e20edcc0f555b93efcc507d5af6cd84ca84675c45012364e7 (AV positives: 44/67 scanned on 04/09/2018 21:56:17)2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAiIiAiICAAIgAAAAAAAAAAAAIgAAAAACIAAAAAAAAB3d3d3AAAIAIiAAAAAAAd3iIiIiHdwgIAAiAAAAAd3eIiIiIiHd3AACIAAAAB3iHd4iIiIiIh3AAAAAAAHeId3eIiIiIeIh3AAAAAAd4d3d3iIiIiIiIh3AAAAAHiHd3d4iIiIiIiIhwAAAAd4d3d3d4iIiIiIiIdwAAAHd3d3d3d4iIiIiIiHcAAAB4iHd3d3d3iIiIiIiHAAAHiIiHd3d3d3eIiIiIiHAAB4iIiIh3eAAHeIiIiIhwAAeIiIiIh4iAAHiIiIiIcACHiIiIiHeIiIB3iIiIiHAIh4iIiIh3iIAAd4iIiIhwCIeIiIiIh4AAiHeIiIiIcAiHiIiIiId4gId3d4iIiHAAh4iIiIiId3d3d3d3eIhwAIB4iIiIiIh3iId3d3eHAACAd4iIiIiIiIh3d3d3dwAAAHeIiIiIiIiIeHd3eHcAAACHiIiIiIiIiId3d4h4CACAB3iIiIiIiIiId3eHcIiAAAB3iIiIiIiIiHeIdwgAgAAAB3iIiIiIiIh4h3gIAAAAAAh3d4iIiIiId3cAAAAAAAAICHd4iIiIh3cAAAAAAAAAAIAAB3d3d3gIAAAAAAAAAAAACAAAgACACAAAAAAAAAAAAAAIAAgIAAAAAAAAD//ggA//+P6P/AAgD/gAAc/gAAOfwAAD/4AAAP8AAAD+AAAAfgAAAH4AAAA+AAAAPAAAADwACAA8AAYAOAACADAAAAAwADgAMAAAADgAAAAwAAAAOgAAADoAAABKAAAACQAAAA+AAAFvgAABL8AAB/+AAA//7wBf//zsn///Nb/w==2d:Td854,iVBORw0KGgoAAAANSUhEUgAABEwAAAJYCAIAAAD39ORaAACAAElEQVR42uy9f6if5Z3mfyNBJGRLCVlxRUTcUopIVzrdjtsRccV1HbdjHbfrdDudTibbdTqu6zgZa631V4zRxJj4u2rTdmptx7apxhg1iuNacUvXzUoRV0S6MoRSRCSIiEgoIV+/LVPu6/Wc8/58PuecJOckr4vrj3ie57mf+76fJ8n1yuecy9ao19Iv9z7//Na7tRfDi1rv008Pt/bZdKkj0iP0eviUFt53Ojx9XLqtS8dOLlnSekMvvhiGPvaxcGvbSoe2bw/XJ994Y/ioo8Kt/ar3okWtd2sPplNHpT+Qbk+nN4fz2vPOC+/eHeYzaj9P7+iNBQ7Wuz4Nbem9N9Xa3/XGxra//MvwHXeEv/WtMC6+6abwn/5p+NRTw/g9efLJYbxYZ5wRPuus8Kc/Hf6TPwmfeWb4yCPDs9G/+BfhP/7j8Oc/H169OrxpU/j228M33xzGxt53X/ib3wzfdVcYN8LRb3wjfM89YcwKQ/3wh+EtW8IPPBD+3vfCmPMtt4QxjW9/O/z1r4e/853w/feHv//9MF5g7OSPfhT++78P/+AHYVyL9WI3MA1sXS7hJ6nZvKHXpvb+rzZzb9kyV953fw3+P6XmQk2p/SIhR8gRcoQcIUfIEXKEHCHn/9f7f4L/ztKIkKOEHCFHyBFyhBwhR8gRcoQcIUcJOUrIEXKEHCFHyBFyhBwhR8gRcoQcpYQcIUfIEXKEHCFHyBFyhBwhR8hRCnoznKCCLP7rX4eR5PCXZjss3e5LZ+hloFwVXtrCR6fbq71/9avWuy1LM09vDb/PG70RkRHN8yii6YDxcp/z2iuuCCO4MzFjY3MoPLJnnw0jqXPbP5luZ/ceBHcoHtm997be2LrB44beSN+WTn0ivGNHGLhY02NNNa+80noPTn6q97p1rTeg/YtfDPPV+bu/C2/eHEYYveaa8J13hvEYEChhZMSHHw4jMiKM1kNhCY88Ev7xj8MIsgjQuC/26u67w4jXSPngBzyFtWvDeKIbN4YxMmYFXoJxMp4vmBa8hGthoAhABQiE54sn+NBDYdAFnj6OYmRs3a23hrFAkAluhBcJk4S3bg3nJI2YSgk5SsgRcoQcIUfIEXKEHCFHKSXkKCFHyBFyhBwhR8gRcoQcpZSQo4QcIUfIEXKEHCFHyBFylBJylBJyhBwhR8gRcoQcIUfIUUrIUYe8EAoHeiHcl4wMU+5p6XZLGjorHd1rI0LwB8OIH8gqe0shT+O+OBkR+XOfC69YER7kaXRzxfJXrWq92b5FvZx+sTLA7NT0SaWPTbdzwomLgKsjjgjv2RNuHwq/+24YDwUtX+DSwQMNmORTwAKTDzHUbbe13uyLY2/bk+mV6ct7c1aIbojmyKZ43REKwQBIzOj1QghGkxWGAi/BNQI9+GC4jteYFVAEBhGhE6xu7sI0cBTh+ytfCX/1q2GgJhrSwHj1buDoY4+F8YxAgICcuqYPLwM2Fm8OjHcSbFm/KvWNsCKQCcC7BuB6r3KfjZhKCTm/1Sz7FfuGxnGGmq7RcfZNj0rIEXKEHCFHyBFyhByl1LyGnPF73sdkg+kGHHn5+HefaKjhyUKOkCPkCDlCjpAj5Ag5Qo5SBznkjAkA40POlP8p5Ag5Qo6QI+QIOUKOkCPkKKUOGOQMvzjdhzMjP7GZEnKGF9afJhUkVg813bByjpAj5Ag5Qo6QI+QIOUKOUoc65ExHPiN/YGb49TEvHPPToZFDjUNNamINcOLp3vgrprUNvUd1ZF2Qvqw3QnB9LRgAoQiwgSYrENFgzll6licvXRo+6qjK2Dr01DEio2sOc84+MfAD55wBuh3XwtT9vesVcYE5SbSNtfZAuHwKrLwjAULl0bxR/chIj9yrZ8Lgw4mUCESqwX1rusDrjpOR43EyisuefDKM+qlHHw0//ngYN0JEBmsBVBC+MSus6LvfDQNjsEAYZVwYGeutEQgjozEMk6xLwMAAGzaEQUQ33FAZwACow8aiIW0i188I6wXF4emjeg4bC6jDNECAGArAf/XVYbw55WtmxFRqgf5MzpRwMj54jDPg+N/PNuYlQo6QI+QIOUKOkCPkCDlCjlJCzlgfvEx35pQ8Mx0/7CPIGTkHIUfIEXKEHCFHyBFyhBwhRykhZ+rvUhvzx1r2M+TMrKVAyBFyhBwhR8gRcoQcIUfIUeoQhZy6UWCc70ab2Q/SjMkt48zBdjUhR8gRcoQcIUfIEXKEHKX8mZwRPWYTtauNWYk25fjjfDgzcg4z+D/2qHG0LQ2hrStOrgvERiFB6Jhjwsy1GZFRkwNg+NWvWu/WNvXGnAdLiAViVm+/HR70esWc66Ot/TR9dhoPZVVvjIy8MWJjARupAU1VGpy8PJw3wskEJM4qdmNAU9jJZ3vv2tV649q33gq39ovw0hYeIUzjzN7cnE+kT04jqiLIohQL8RrXohIOdIGREa/vvDOMFiwEWaRPvIUABgyFa8EP+O2NxIxciyXgRigBQ5EXdgOZGNuOpjI8hbrlDMYjg3EjPNBbbgmDLTEUdmOiQjyUy9XrvemmMJ7R2rVhTBLvFeAKTx9vDv4RDmyJ5QPLhRylFhTkTPQ5zwHUyP9X6X4eRwk5Qo6QI+QIOUKOkKOUWniQIwwoIUfIEXKEHCFHyBFyhBylDhLI8eMOJeQIOUKOkCPkCDlCjpCj1MH57WpKCTlCjpAj5Ag5Qo6QI+QoJeSoQ0Bnnx1uH0gfls7OKDZo4dqsCOO1iPU51FNPhYEi+Iu+fTi8Y0d49+7wiCVkGEUF3IDTnuyNNNLa1b2RoJYtCz/7bHjvJKqLvNgn1h5LB8Tu2dN6Y5LIopzGSS3c3uiNoXDf559vvSE8hQEPv5GOkfHI3ngjjL1CNhvo1d4DiF3ZG0cHXYLZrVdXSH31q2HEegQ7wAaqq5BN8VLW9WKYJNJnXS+Go2g5Q+rFyEi98ERwVbec1US0cWMYu4G9AiDVXWQYCruBadRACGNkbA7WCxKrr0VTGV4kPEHAcz1n7ORE7wb2uaa43EkjplJCjhJyhBwhR8gRcoQcIUfIUUrtP8jpG5b99YH9tZAj5Ag5Qo6QI+QIOUKOUspPcpSQI+QIOUKOkCPkCDlCjlJCjlJCjpAj5Ag5Qo6QI+QIOUoJOUqFjjwyvHRpGCnw6qvDn/tceJA+9/TGUVyLBNkWt96IqhhqwB6RelEpNGCtKC4DL7X2Zu/HHmu9R7BH25x+ufeg1e2WMNrGPhJ+5pkw6uPY+sX15j7n8gmE7an0hWGOnCrb1fDIsBsrV4ZBJhAeyqCKLZ4gXuDW7g0n8SKLttPSwONj09SG3pdc0nq3hx8O1yG4LltD+sS1db5ERoQBDOvXh8EPyKYI0EifdVQF8qEjC7MCAeJGdYBGUsfm4GRMA3MGiuChwHigNT3CeL5btoQxjRpjsCIQPzYHO4kbYRqPPBLG2w7ixVEMhSWA4YHW2GcczX02Yio1nyFnVNxSSsgRcoQcIUfIEXKEHCFHqUMMcsY8f8qRZSohR8gRcoQcIUfIEXKEHKXUfIQc/KI+beQXlZAj5Ag5Qo6QI+QIOUKOUuqAQQ7O+e1/jvNFIUfIEXKEHCFHyBFyhBwhRym1YCCn/oWQc9Ao4tegBSsS86uvtt5Irnjt8PcgguyATFaHGRmR48EPCO5QXIv7onwMSxigyJvpB8Ifa2HARuLEGWe03rgRfwPnbmDOg1a3VPbjYeQaF3EUrh/322+H8RTee6/1bu29cALSXXeFW9sSBmwclW7Lwwlmq1aFsaIB8uGBxopAYvitAfO9Qo6vUy9KonAyjGyKrURwBzBgVoiMOBmum9ngGgkAG8jEcA0b2A3EemwOVoRtx40QvuuhsLE4GZPEXuFGOBkGAGM38Iwwq/qRgcOBInXFH6aB1xs3whKwwHrOeGQlaRsxlRJy/JkcIUfIEXKEHCFHyBFyhByl1MKGnN+N7M/kCDlCjpAj5Ag5Qo6QI+Qopfx2NSXkCDlCjpAj5Ag5Qo6Qo5Q6QJAzHcYIOUKOkCPkCDlCjpAj5Ag5SqkFDDnDn7SxXe3gF/qmjjgizEapTOqLFrXexx0XHsTciJu40YB5Xk5vS0d/GiaJQNkWpam7e7PzjWVrsfyXXmq9B21jCWZ5dFDzVZHn4sWtN8X7Ppi+rfe557berV0ZRqtbAkNdiQY8HjFniK/ZBWkwbQgvIf7s27On9R4MdUkaEHtxOPcZN8Kbg+Xzvfp4uk6uNbcg2CH2wXWfGAIl+rXWrg3fckv4zjvDdfsWboQwWsdr7NU994TR+YatA9XgvsjiSOr1ydjJr389jKeAJdSNYUA+zKquYkNTWU1ENZeCamqYxLWYJMr06sa/+gXG88XJt94axhPMGxkxlZrPkKOUkCPkCDlCjpAj5Ag5Qo5SQo5SQo6QI+QIOUKOkCPkKKWEHCXkCDlCjpAj5Ag5Qo6Qo5QScpSQI+QIOUKOkCPkCDlCjlJKyFH7Rdu2hdlZkdVV6NeCBpVZn+29YkXrPYjmP+9dN4bVpWdI25dcEsZ9MdSGDeHBJONGCP2/+EWYwJDXYp8HQHhfuMSnd99tvQdglrGetXVfTKNALJ4gpkHGy2sH5SfrC/PkvBFCIKqqjjwyzDq1dmbvuiCufbT1rutc/vEfW2/UA3LkJG0eRbCrueXuu8M4WtdP3X57uGYehEL0mCH1Ys6I13WdGhIzQjCOgmrqOSO4Y+vgOppjKMzq0UfDP/pRGKCCoxMBQ82HCP34nYPQX1fA1U1lWBHmjKEAwHiCmDNmhZNBj3ifweEbN4axdUKOUkKOEnKEHCFHyBFyhBwhR8hRSgk5SsgRcoQcIUfIEXKEHCFHKSXkKCFHyBFyhBwhR8gRcoQcpYQcpYQcIUfIEXKEHCFHyBFylBJylCLm9B5gTES3QdqOLI7CNDZKZWEajpJb8kY7d4bZrpbTqEkMCNTamvSe3ued13oz1h+WzoqwY48N89oT0ovDd9wRxl5deml4oGd6s7YOc8YDPTqdiDtowHs1vSqNfrwX0zh5exjTaN8K55zBpWAPvFdf+lIYL8MAnqGY8+7drfeNN1YGW6JAi61fSJAAlTVrwkiByJf41wIgAeAKcbPu1wLz1P1pWDD4Aa5nhcSMx4/ONywf3WvYdiwBG1vPGbO6994wth3XYoF4+nUX2USAhGngCT7+ePiRR8I15OBGAEKwFtAazwjkifXWeFxX7WEauSIjplJCjhJyhBwhR8gRcoQcIUfIUUotGMjJby2ZyZnjj6CEHCFHyBFyhBwhR8gRcpRS+wNy8ItJzxx/BCXkCDlCjpAj5Ag5Qo6Qo5T6f/uHcPr/HP+LxdeVkCPkCDlCjpAj5Ag5Qo5Sar5ATv0LIeeg0XO9kafZcpaplwj0gdYbbWMIlCiYQjh5/vlwXU3WPtZ6D3q9ngp/pPU+44xwa18Kc70hhP66IgzTwN+/7ah06kMfCg90QXra7y79zW7ETu7a1XovWRJmMxt0XLq90HvQF1fp1VfDg60LEReTD4Ga7cTwK6+EB8T7dLicBpB+AN7nhnMoXgskuPbaMIBp3bowgh1i3xNPhJERkfKRAhG+0WQFEEftFYIsFlizVt2mhwCNpD5RCdiWLWFsXV1cBtS85powkjrmDOSDAQxYAqYBmsKNcC0eClgLLI2ngKFg3BcPtC7iw1E8IzwFGD11uBbGKyrkKCXkCDlCjpAj5Ag5Qo6QI+QIOUqpgwlyfpeRxschIUfIEXKEHCFHyBFyhBwhRynlJzlKyBFyhBwhR8gRcoQcIUcpIWe/tKuN/0Xb1YQcIUfIEXKEHCFHyBFylFLzDnLwf7kpGMb/T87Bo0EIXp++PL2hN9uoEnJauzDMHB9puy1t4ZzGoF0twuiqVa03b/TBMMLJiSeGX3ghzDzdzur9xhutMBcIZcsZGA8rQiZGoti6NYy6PFTPISNRR4bBAIN2tfpFQrsaSOzi3jVc7S3V2v3peDcGc65GJpmAl/IoeKm1z/QGmOCt47uBrIZ8iayGTIz2rZoukBHrUIgbYZI4ipHrLjJEc9AFXmhkYvSYAflAYgjuePuxz1gRZoUsDnoEa4EBcO3DD4dxLdALv9vxQIETMLa9LlvDjbBXV1wRvvXWMJaAoYB8N90Uxu8NvBv188U+YxrY523bwtkmZ8RU6uCGHCXkCDlCjpAj5Ag5Qo6Qo5QScpSQI+QIOUKOkCPkCDlCjlJKyFFCjpAj5Ag5Qo6QI+QIOUopIUcJOUKOkCPkCDlCjpAj5Cgl5Cg1lm7pjbjJjJgh+K23wmAeXLt0aRgn477IiIMwGkVeOPmYY8KDay8JJwLh6Mc+1noPGrR+3Rugwm4uFrVtSYeuvDJct7rVsFG32OHonj2td2uX9q6fb82WeEaDarKVYfa2xV7hVTnssPA554RPPz2Mp0BQyUd20UVh3GjQvfZiGq/Kg+l4gdsjj4QBG3X6BHsgyCKpY6i77gqjbA2EACNtI8fjvji5HhnsgdSLxIyawuuvD2NkTBJAiPsCGNBiB4PxsF7s89q14Q0bwuAHIAH6LsEA110XRgMetq5+CngZ8E5iJ7F8bGzNaQAVHMW1NaUDU+tJ5slGTKWEHCXkCDlCjpAj5Ag5Qo6Qo5QScpSQI+QIOUKOkCPkCDlCjlJKyFFCjpAj5Ag5Qo6QI+QIOUoJOUoJOUKOkCPkCDlCjpAj5Cgl5CjVXk9H/EKuRTaFcTJLzzL1IqqhyAv1Uwjf+IuPafvYMDLxIMfHjV5/vfVGVGsnhUEIqGIjXC1qYUAOESgj8sdb7wF6QVFMhxUNOu4QzWM38FBYplfWxwE1B619KQBDVs/hcXPO+bgHqrrmBgBc9sV9uPVetChcMy1eUbb2IY0h9tUBGsGurvmq4yZ+T6KbC4ES3VwI/RgZR8EtOIp4vWlTGMEdR2EMheXXfAjXDFBzGnYSYAZQwcl1BxqWgFcFTXSoJsO1gDrcqC6Iw0uIa/ES1vfFxmI3MDKqBfGK4jXDu5HIZ8RUan5Dzt7S+0rDYFB/XQk5Qo6QI+QIOUKOkCPkKKUODOTUlPK7o3MIOSNjxnSHxp+VEnKEHCFHyBFyhBwhR8hRyk9y9t8nOcOYUfxnzTZCjpAj5Ag5Qo6QI+QIOUKOUoc05EzJEqCI4jOTKUPClJcX7DEln0xKUEKOkCPkCDlCjpAj5Ag5Qo5SQs5oyBn5mcl0v65PEHLmi9asCQNyBkVeF/Revbr1fj+s9R5wywXpdeEMhWzfyiDL9Pl+0O982mnhum0MfzvjN87bb4fBaSg6GsT6u9KVuM8nplkBN0HZ2quvhgEb9fNl6VlOA9VkeNwIzK2d0Xv37tYb08DRwYv0VDowBg8FQw2oJmZFXmJ/Wq1N4XyCWCC3/etfDyONIebWJWB1gkRkhJEvcV/MCo1hWELdgYaOP5yMBeJfGpBrkXqxhJqmYKy3Xj5YC/yAo/hDFv1pGBkLBLfUk8TJW7aEwQDw1q1h0DJeJPz2xlOobwQArqEOe4WNrSvg6t8LWQFnxFTqIP52teI7vqYEhumOjrx8Uj4Z+TGRkCPkCDlCjpAj5Ag5Qo6Qo5SQMxnkTPQj/tN9klN/x9osQUjIEXKEHCFHyBFyhBwhR8hRSsiZDHJm8EHNRLwxDggJOUKOkCPkCDlCjpAj5Ag5Sgk5k7WrjfNZzSx/JmckO43/rW62qwk5Qo6QI+QIOUKOkCPkKCXkzBBy9nW72siPjPz/5OxX3Xhj+IMfDCNB4q/F1pb3RgimlqUn0aiar7d7n3NO682Ts21sw4YwyriQTXHyqC4yaHk6ZoWngKROAmyfSsdQSCMYGQg04hPVk8ODBQY+cZLHhXEU992xo/UeUE3Fabt2hbEbn/lM613rzDPDixeHufxshGvtnd41iDKb1h1oEwVK5DwkV4RgVGY9/ngYsIG6LURzVJPhD46bbqqMXItXdu3aMGIuDPYA1YDTyvYt8hKuxcm47w03hME8+Lci7BXoEYVp9TRqqMOKcC12EtOoi8uwhLouD0exQFAN7pugQjzGUbyT2flmxFRqfkOOUkKOkCPkCDlCjpAj5Ag5Sgk5Sgk5Qo6QI+QIOUKOkKOUEnKUkCPkCDlCjpAj5Ag5Qo5SSshRQo6QI+QIOUKOkCPkCDlKKSFH7Q9lZdaJJ4aREZ99tvVuJ4QRVffsab3bSenUe++FmbZZL/ZA70E0j0yMOb/5ZnjvJMJuYCj0aw1qzaDoMVu6tPXGyPCSJeGaTIAT4CWU2mGvMDLq4zCN558PD0AFvW3V04dbu6g3Qm9rb/Sue9uIuEe23iedFF63LozdGKBmyeF8+XMaSGPoIrv55jCSHKIbeAkoAlD55jfDKD0DeyCbgqYyMpJ5MGcwwBVXhFeuDGNWQD4sHwSI9Zb9WmSPL385/LWvhRHNse3YDXQ44ihmBRS5/vowGADLB9PCNTyDH7AbeGR1px+2HevF1oGIQDV1px+O4r546/DG5m8NI6ZSQo4ScoQcIUfIEXKEHCFHyFFKCTlKyBFyhBwhR8gRcoQcIUcpJeQoIUfIEXKEHCFHyBFyhBylhBylhBwhR8gRcoQcIUfIEXKUEnLUIa9PfjK8aFG4tS+mK61YEUbc/OlPwyecEG7tyd6XXtp6X3ttuB2bLidJ2MhYj6ou0NR554UHquZ8ySVhtG8hfIMtMRRM5cij5gyt7o0CMRwlILXnex97bOs9qLz7bG88fewGXhU8X0wD3VSD5/tc77rybtAHWHXr8aHkfQlXnFVsbN371FCQh+iGfPmd74QxFIyTkXox8n33hZGYMTL4AZkYJW9YPtZb97ZhGpgzTgY/IBPj5JofcF+Uj+Eolg+2rKdRUw2uRejHfUG8ADPsMx5o/dbBWGA9Ml5CvBuYZN2uhgXijS3Xa8RUal5Dzt7SB05T9NCWX1dCjpAj5Ag5Qo6QI+QIOUoJOXMAOTNAjvqS3x2dQ8iZ8ptxiu/TGX595KyEHCFHyBFyhBwhR8gRcpRSfpKz/z7JGZJM8Z812wg5Qo6QI+QIOUKOkCPkCDlKHSqf5Pz2F/gMZEqWAEUUn5lM+WHLlJcX7DHlZCYlKCFHyBFyhBwhR8gRcoQcIUepQxFyhhRRQ87Iz0ym+3V9gpBzoPRyOMPZqlXh1l4If7BVbj9Lv5G+NJzXgpUHxWVrejNfnhLm0UXhAU5EGB3VvbYpnSmfu5FwxfYtdJEt740lcBontcpHpRG+Dw8vWxZGbR2Tel470NPpDb2xhCuvbL1xFMvHJFEBV/fU4Slg5LPPDuOfA3DfuonuoovCqE9jGkN0QzRHwRTaqGA0WSGq1nHzhhsqX3ddGBVwiOZYwuOPhx99NIwuMhzFtci1Nagg5oJMNm4M4yFhRTBQG41wt94aRmEa6sXALdgNvCr1rMA8eBkADFgCXqQaRK+5JvyVr4QxMl4zvJN4kfAU8FsDNIWTYZycO2nEVOrQ+SRnnG/0qoFhBgPOjE9Gfkwk5Ag5Qo6QI+QIOUKOkCPkKCXkTAY5E/2I/3Sf5NTfsTZLEBJyhBwhR8gRcoQcIUfIEXKUEnLaXH2AM+knOUXlwMgf3RFyhBwhR8gRcoQcIUfIEXKUEnLGhZzpflxnbn8mZyQ7TTRb29WEHCFHyBFyhBwhR8gRcpQScmYCOfu6XW3kR0b+f3LmuPM79/S2dKTtwclber/3XuuN2DcAlTt6H3FE6z2AqzcrZ9q++OIw/u5+9tlwazvSVVHbYYeFKeBEO783t+641nvnzvBAl6VDRx4ZRvcaqsmWLAlj23EUPvroMKrJkIK4XhJRPEGUvI24NiG2tQfDJ7bwCBKLOrV2WguXeuutMO5bg1nbsCGMjHjVVWEEWRR5Yd/Xrg0jQSIxg3kQkRFGAQxbtoQfeCCMSeK+iPWYRt0nBuNGmCRmhdYvLAHXYmPRRIc5g0y2bQvjvrUffjgMUAGnYa+AMTgZfxTiaH0tgAGvyt13h0FxeAlxI+wziAg3AjzjKEYWcpRauJCjlJAj5Ag5Qo6QI+QIOUKOUkKOUkKOkCPkCDlCjpAj5CilhBwl5Ag5Qo6QI+QIOUKOkKOUEnKUkCPkCDlCjpAj5Ag5Qo5SSshR+0XHh4kTCIWZxVGZhWza2lnpSi++GB4IVWzfCh/bwm17OvTSS2HEenav1QSYm3PWWeF2cniwOcuLwjT0xYEfRuxV1rjhZDzfuhNsFADH0x/MquxeK1+kwZKqo/UjA6UjbqHkDftMyMnXbLAb+Yri2o+Gf/nLMEMh+tOQ5BBzcXLdoIWhwEu33x7GtXUpFkbGUPUkEc0xMuI1jKEQkSfaHFxbl9qhPw0jA5DQCVb34+GhIJoDruqngKFwX+wkrq0xBntVoxcWiKHuvz+MFWFkDIVJ4mS8hChby5ONmEoJOUrIEXKEHCFHyBFyhBwhRykl5CghR8gRcoQcIUfIEXKEHKWUkKOEHCFHyBFyhBwhR8gRcpQScpQScoQcIUfIEXKEHCFHyFFKyFEq27dGKDujbrwxjL/4kKfrAN3aisoZ3AdzviN9Ye+9pZjFU0gyrV3Ze3AUQ12eBqdB69Lv9B6V4y9KP5X+fO8VK1pvMN4IgUyOTJea7EaL0rl1b7/derf22XQllMtBLD1r/xhOasXrjZdhgHwoxMtXZXX6uuvCN9wQnuhkUB1oCnETkRFUg3gNo7gMbWMoPQPV1FVsSMwbN05gLLDuE6vxCRH52mvDNYjeemsYN8JDAXqtWRPG465vVI+MOeMNRgcadhK8BJqqi9rwFPC3SI1e9SPDemFMMhdoxFRqPkPO+2GtsFJCjpAj5Ag5Qo6QI+QIOUoJOXOjf0qS037by3SH+q/gF0rIEXKEHCFHyBFyhBwhRykhZx5BTvGfNdsIOUKOkCPkCDlCjpAj5Ag5Sgk540LOb/lhyk9XpvzUpTh/SoCZjmQK+PGTHCFHyBFyhBwhR8gRcoQcpYScWUHOdJ+ijPz1pHwi5MwzLUtnoGQ2RcxtPw0nAg1YBbE3/bF0GQoHHVkT5ek3ew9O/rt0aPv28PsQlH6jdAghGEnmnXfCg6HuS1+dvr/3AAkeS7/Ue0BTcRRpBHPmJPF80a6WtWatXdCbc/5Aur2Whvb0BtVgCQOaio0FTZx3XnjQ6Vc9X/AS/jmAsa/uyEJkrIMdCqYQgmEkZty3JqK6IA6/YzdsCNchGHVbKOOqSQzXYglgrc2bw7jRgw+GH388jGsfeiiMWWFkdK9hN3Dyj34UxsgPPxzGJOv14lpsXb2xeKFRLvfDH4YxjUceCT/2WBjEu2VLZUyj3uf8XWbEVOqg/yRnJFeM/PqYfFJ8OiTkCDlCjpAj5Ag5Qo6QI+QoJeTMI8jp0WWWICTkCDlCjpAj5Ag5Qo6QI+QoJeTMr09ypvrxByFHyBFyhBwhR8gRcoQcIUcpdaAhZ7pfjwM5kwKS7WpCjpAj5Ag5Qo6QI+QIOUoJOfsWcsb8+Zkp/3c39Wcy/n9y5ovwcdvixa33IPWiQOy23gh2vPak9AhtCieJDRJk9IlhCa293BulWHX45hL2hk8/PcwKuHKfW3sh/et0AAPmjOW/9FIY1XOvvhpGNMe1pAsybcwKmzNgnufScS2q9oATre3uvWNH6w1hc5BzgIt4N/giLUnnM0IxHd4rLHDE74Wl6dkEWYRCJEjkyyeeCOMoUiDue999YZyMoWCkXjBAHb6feioM2KizOBAI+4xZYdtxdOvWMLYdBXGY5D/8Qxg3wk5ikth2vN8YCluHWWHbt20LY+sw8pNPhjFU/ebUz6h+CoAc3PfRR8PYuh//OIwnmAWARkyl5jPkKCXkCDlCjpAj5Ag5Qo6Qo5SQo5SQI+QIOUKOkCPkCDlKKSFHCTlCjpAj5Ag5Qo6QI+QopYQcJeQIOUKOkCPkCDlCjpCjlBJy1H4R68XSg2i+uXed5F55JfzLX4bZvsV8+dn0l9LP9l63rvVubXtvUk27vPeomvOo2xqc/K30g+lU0hS2nSMnqLS2K53VZMktgzq1c3vjGS1ZEh4I9XGxwAEAx6wuv7z1rtc7eIJvpqPkbYC48YyQrvEyAEWQvgYr2hLON3ZwMvRWbxSGEXExjzr2IbnedFMYJyPYISMiBSKa4yiarDBUfW3dr4X11oVpOBn3RerFbtTNbMjTOBlHQQjoMcPJeGS4LwgBC8Re4b41e+C+NQHiZCwBHWg1p2EoLAFH6yo2nFw34OFGmCTeyRzZiKmUkKOEHCFHyBFyhBwhR8gRcpRSQo4ScoQcIUfIEXKEHCFHyFFKCTlKyBFyhBwhR8gRcoQcIUcpIUcpIUfIEXKEHCFHyBFyhBylhByl6hKwE1s4g+w557TeuBa5Fu1bhCtSTWpx+iPpo8NMnwkMYK1BYr43vb43e9vAaYkxaAxDy9mI9i1CzhvpM8NsdQuKQxvToMcMFWHnpqNM79prW+/W9oSxG9mQNuBDYBv4MF6zwauyrTc47eMfD7fTwrt3h1t7Pryo9eacs2vu7LPDfJHwirYd6bPCyIjf+EYYj/Cee8J33hlGZESwy0YpnozIiPt+/ethgBmyad2RhfuiQAzLv/vucF0CBtept66PwySxdfW19XpBF7fcEt64MXzbbWFMA1QDBqghtmaAiQAYs8Iritcb12LOeGR4J3Eyll+/wOClXL4RUykhZzb6yW80+0Hqr4+8xZxMQ8gRcoQcIUfIEXKEHCFHKbU/IOcnA80MGPYd5MwhzMwYcvb/woUcIUfIEXKEHCFHyBFylFIzh5x9Rx37GXL23Sc5Qo6QI+QIOUKOkCPkCDlCjlILHnJ++3V8vDP8wKc/bbpzhp8XTXnr4UyGJ/QjTHmX+o7jzKT4UEvOEXKEHCFHyBFyhBwhR8hRamFDzpT8MCV4TPmfI389A8ipfz3+rYe/rk8Qclrd+jXojEIIzlBIRSa+8cbWG8CAUDgIwUi9K9NVB9ogE4euvjpMQsikvmxZmCsiAVa1deiaw9GlS8OoF9uwofUepVW968o7ZHGA6CCax6wGj+yB9H3puHbPntYb7IGR6xq31p4qnS/Sh1oYIplcmU4dFR5M8unwshZum8J1CxbyJXIe8jSQYNOmCfzNb4YxK7Sr1WVcNXtgqJoBgE+4EdALufbee8PI4iAT3AjbXpfL4b533RXGQwHG4Lc3Nha1ZmAAvAwol8MkJwIkPLL65Bqe6zK9ujywfih4gjWm4s1JEjNiKrVAfyZnunxf5/5Jr6q/YWw2kDMn0xByhBwhR8gRcoQcIUfIEXKUOti+Xe0QhJyihkHIEXKEHCFHyBFyhBwhR8hRSsj5yZi4Mj8/yfFncoQcIUfIEXKEHCFHyBFylBJyJvthmDbqf0EzEmz23c/kFHdUQo6QI+QIOUKOkCPkKKUOqp/JKU6bqF1tHH6YGeTsi3Y1ISeEfDnIausL8+QM/c8/H66Hqslk587w4PLN6a29n3229a6TOjrQcHINZitWtN7nnRdu7a3eA0KI1MvdSBBFEx3qxbgbSXHLl4eR1Bnj+TJAF6TfTEcjHFaEBwqfdVa4HZtur4ezie7ww8No3hvohXSFqXfcER68hMvTyZ2rwhSaypDyEd3q0jOUraHnCjcC1eBaGESEDjTsTs0e69aFL788/OUvh1euDOModhazwnqRxes+McRrHEViBgNs2xbG0a1bw3VTGeCq7k/DyVjC7beHr7++8nXXhVGtWJ+Mh4Jr8U8peBluvTVc9+PhKcCorcN9c5JGTKXmOeTsH83428DG+f+T7p/5CzlCjpAj5Ag5Qo6QI+QIOUoJORN/VqOEHCFHyBFyhBwhR8gRcpRSCxhy/HhEyBFyhBwhR8gRcoQcIUcptVAhRwk5Qo6QI+QIOUKOkCPkKKWEHDWfxd6nOgVWobC1y9KfC/NGMRRC/0svtd7tlPBhh4VbO733IJpH29htt7XeI8JoEgJGHoDZs+nYDSxw8eLWe28pTPL448NI29u3t94ghAEu7kpHJdreSTSKS98oPCjiqzS47129f/Wr1htvHVrdBk8wHhkqsvDPAe3D6UQ+9GnhcfO+yIirV4fxUtbp84YbwkiQYI86qaPXC7VXcN1kVVd11SVguBFORt0WQn99IyAQ8jSWD7q4//4w5vzww2GgJl73tWvDePpXXRUGXSDHT/R8MUnsJHYDFXAABryEqLDES4g/gsGlQHrMCn+6oU0OrwoeCnYjn74RUykhRwk5Qo6QI+QIOUKOkCPkKKX2H+T0dcn++sD+WsgRcoQcIUfIEXKEHCFHKeUnOUrIEXKEHCFHyBFyhBwhRykhRykhR8gRcoQcIUfIEXKEHKWEHKWg+8PvR67Og0B5eW82WVFr0u/2HlwLQIpr8ZfmYFYv9x4cvTCdYnNXzXiBBKNCP679Ve/ByfEUEGsHWTwfGXVfuiSErCYb1LhtTb/Yu4acEUVtSY/LloUxDVw7gNjY52OOab05yRwZR9Geh98LPLoo/Pbb4UGdWlTecahvfzuM8F13r9Vh9KabwmXBFLMprkU2RTMbEiRgA91rKFtDzL355jDmjJR/zTVhMB6quoCeyNOYJPYZzwgjY87r14fxULB1QCAcxTRQeYeRgROoU8NR0BRWBGrF1uFlwKzuvbcy9urKK8N43HhGeNu/+93KNYjmUSOmUvMacn7v9yrvR40TeOa5DoIlCDlCjpAj5Ag5Qo6QI+QoJeS0ceLKmOfsBwiZ8j+n+/rsbyHkCDlCjpAj5Ag5Qo6Qo5RakJBT5/v+60Wq2f+Qsy9uLeQIOUKOkCPkCDlCjpCjlFrYkDODz0CmPGfKcfoINGUoKsLS8OtTfqX4en3f/tAhyzlCjpAj5Ag5Qo6QI+QopYScCSBnus9/Zvnrib5dbZwx5/a73RaW7u09YaHWBekH02/2ZuxDvM4UiCBbTwP5Em1j7bgWzlkNYv3mdJy8a1frPRB248nw0S2c9WJok7v44jA6wdri8JIl4UF3WSxhcHIcJWwkP+Do4GXA0w+R044PDygO2hLORwZgwKzwIpEu8PT5qpzZ++yzW2+8z++8Ex5sDt6rp8LAmE2bwmAApG1k4pqIcDISJMhk69YwTgZOIKqiQAy8BMipoyruW+8GQjBiLk5G6kWRF8rHUOSFo3XnG4yNxSTrodBThyVgY2skwMbWhFDDBu4LfMLTB02hEQ5GYRp2A79TQGJgPNw3XyQjplJCzqTfMDbmf863rws5Qo6QI+QIOUKOkCPkKKUOLcgZv3Wg+N6zMT+ZmfR8IUfIEXKEHCFHyBFyhBwhRykhZ7J8PxH/jDnsmBCy3z4REnKEHCFHyBFyhBwhR8hRSi14yJku+s/yZ3VG/ojOzH5mZg5/JmfMmQs5Qo6QI+QIOUKOkCPkKKUWJORM1z9Wf/PY+JAzJ+1qwz604be3TdSuJuTUITj01lvhN94Iv/deGIESEXnQkVWVnuFaBErcCEfRkdXa0+kM0Ezq0duGQq3W7uo9CgiDPcgtmadxtPbgkaFdLZYAmqoxpq41w30nw+PECYx8+unhV18N11Vs6G3Dtg8eyp4wXpWc5JtvhuvauhGvN4TU+8MfhpF6H3kkjKObN4fBLbURoDEUJomjuBYRGTfCnAEMGAq7gWls2RJG+MbI2DoYN0KARtsY6BFsiSyOSWKBwCdsDsAM00AzW93Lh863Sy8NX355GNR6yy1hjIytw+bUvASMqWv6UNRWAxI639auDefJRkyl5jXkzBuNUyc7z8uaZ7AEIUfIEXKEHCFHyBFyhByl1EELOTODiqaEHCFHyBFyhBwhR8gRcpQScoQcJeQIOUKOkCPkCDlCjpCjlJCjlJAj5Ag5Qo6QI+QIOUKOUkKOOpj14fAgnJ3de/Hi1ht/8Q10fvi01nvnzjDLx7J7jdmUzWxVX1xrl/X+9a9b7927wyPat3DfPDoI0LcVXrmy9WYl2kmtNxIFloBZ3XFHuLVdve+6q/UelMutDmfoZz8eCBBwdWLrjbYtdtzVVWycZFSTrVvXenMneW3eN4kITxBwxSUkAqEQb6J/O2B0w/NGdRXCNwrTZkM16NfCyIiMCLII38i1CP2YBk7GUAjQwBhkYhzFtegiq5ePoZDFUeSFGwGfwFoYCgiEawF1GAqoiTnX5Infz2CAjRvDGzaE8ZvhttvC9QuMXr7rrgvjKGaFo8A29KfVv63yzTFiKiXkKCFHyBFyhBwhR8gRcoQcpZSQo4QcIUfIEXKEHCFHyBFylFJCjhJyhBwhR8gRcoQcIUfIUUrIUUrIEXKEHCFHyBFyhBwhRykhR6l2afr+3mCA7dvDg+KyL/VGZEQKxF/0GGoADFm9dmy4tfXhbGZD2dpktVc5VDsqPMCJ03ujeq61db2xQMR6TJK78YEWTg1C/zO98QSfeSZMumATXdDF00+33ngoA6qJZwR+WLMm3Nry3vVetRPCr70WxrWIWyOYNh83KA4VcAPwPq/34KGk6jo1TLrMaiQEDIU8DdjAtej1qnvbMA2cXEMO/izAnGEMha3DNOreNoT+utcLK6pPhsEeWELdF1dvDm6EkTFnMAC6yAAqN90UxsuA+07UrobXDGwJY5/xe6HmcKzoK18JZ5ucEVOpeQ05115beT9qylA6s3H2z42UkCPkCDlCjpAj5Ag5SqmDE3KKSDk8oaCLuQKPccYRcoQcIUfIEXKEHCFHyBFylBJyRgNDATlzBSdCjpAj5Ag5Qo6QI+QIOUKOUmrfQg5i5JTwMDPqmDKmThdfp0u2RdyVc4QcIUfIEXKEHCFHyBFylBJyZg4543xL23Q/NtP/Yk5+LeTMkQ6fxNko1RalJxlqEIIhNHe9OIlDyIQEs+wxQ+rdtSuMOiIk9cHvEMxqU+/Bydn6VXeCJWzgoWBW4CXUEXEauG/yQ30UW/fee+F6VtRHwqgTw4127AiP4MNs/MNRIH39QHGUbYH5Ai9b1nrzgV5zTRh/fF99dfjKK8O49qqrKuNaHMVQX/vaBL7iijCoDiG4Du6oF8O1CMFIvffcE8bJiNdo30LzIOI1mtnqzjfcCEPVjXA4WpMYSt7uuy+MacC4L8ikhg08QQw10TSwsfXJmMZEhXhwXmvEVOoQh5xxfuh/Bp8ITfdtciO/LuQIOUKOkCPkCDlCjpAj5Cgl5MwZ5EwKMLOEnOJDJCFHyBFyhBwhR8gRcoQcIUcpIWfhQY7dA0KOkCPkCDlCjpAj5Ag5Sgk5c9OuVvx6nB/LmfOfySmmpIQcIUfIEXKEHCFHyBFylBJy2sjGszFb0UZ2D+yjdjUhZw60t9QZZ7TeOMqCqfZOb8QPDNXaBelIkHv2tN5IroyMJU0hubZPpIkTn+mNAI2k3tpzvTHJt98OA5BwFAiEWfHkU8K477ZtYVDNYL2r0lEgdsoprfcrr4R//vMwR2bz3rbeI+AqPdj23enbetf4BGpti9MQC9Ne671yZeuNaWAkvM9cI6Ibaq/qpF6XUyFuoo0KARrBfTb5cqJr8ScF0nbdkIaTUS+G3wzoMaur53AjTKO+ETgNJyNt16EfI2NW8ERla1jvo4+GsTmYZA2i+IclrBeP+xvfCNf4hGlggTWXlo/MiKnUvIaceZaZD6YbCTlCjpAj5Ag5Qo6QI+QopQ5pyFFCjpAj5Ag5Qo6QI+QIOUopIUcJOUKOkCPkCDlCjpAj5Cgl5Cgl5Ag5Qo6QI+QIOUKOkKOUkKPUUFeHP9DCmaeXLAkjuR55ZOs90LY04vXm3pdd1nojEw+6qt5Or09DWU22tIVTxxwTHqTeALPnn2+9W3sjjYa0EKJ5bQx1wgmtd2sPpnPb8XzbZeGjW7it7I2nD+YZ1IbkU/ho633EEWEQILgUJ2NknDzYqzgZpV84+fXXw/VTGKx3eW+c/LGPhXltnS8RZBEokfKRL3Ey8uVtt1W+884wyAQJEkdvvz2M4jKwFmZ1xx1hFIhhRYj1iMiI9ZgkpoHlX3dd+NZbw6hxw7YjmmMJ+IcH+Oabw9hnPG4UxH3722FMcuPGMO6L3xtr11ZGOSaurY051xCLbceLBObB48bvIzzfJCIjplJCjhJyhBwhR8gRcoQcIUfIUUoJOUrIEXKEHCFHyBFyhBwhRykl5CghR8gRcoQcIUfIEXKEHKWEHKWEHCFHyBFyhBwhR8gRcpQSctQhLzR3MSNmrEeg3LkzXPe2tXZp78G1z/RGKBwkV+T4p3uzQYtCq9v6woAcFrWlXnyxMnZy0Bj2cpgdaLPRk+lLemOSl1wSHmz7yjSeQkDd6tWtdzs2jLcOvEQQzfuSPE8ND4jo7t6vvdZ6Y1YYec2aMN7nweYELm7Y0Hojm3EaaDlDJRqi6qZNYQyNrirEPiRI3AgnY1ZgD+TLxx4LI4vjRgAV5HggAfhhIiK69towYBpHr78+jBuBW264IYyR8erUuIgHivvWFWFPPhmuaRlGQxpgAyc/8UQYzWyYFY7ivQKX4mj9btRlelg+iunwiuZ9jZhKzWvI+T//p/J+1D8F2rkccPbXzvmshBwhR8gRcoQcIUfIEXKUUvMdcjKOzuqcOaemOblWyBFyhBwhR8gRcoQcIUfIUeqQg5waBvD1MU8TcoQcIUfIEXKEHCFHyBFylFIHAHLGAZiZnTPdhz8jvz4SVMYZeUwwE3KEHCFHyBFyhBwhR8hRSgk5E0DOlL8e+ZMzxS/qkYufwxFyphDDaKII/l5AghzgRLR+IX0hUCJBtfZCekvvl15qvQ87LIyAgaOtnZPe2huFWigfO/ro8EBVrMcCUUeENrls+uHJo0reIscP6DFb3YhPcXTp0tZ7MNT96UvSoQ98ILxnT/icc8J4r0CAeM0Qa9tRYcyZzJPLHywwHsqA0oHHeGOfSZ/fewQgIfZt3RpGVsNRGFEVxnsG9gACIarizwJEZFyLiIxJYuTt28OYM2gKubY+GetFnsbJiNc4CjLByDiKB4qTsQQ0wqHzDc8IrnvbUIkG1sKsapoCXeBPN4yMP/qxQGwsVoSCuJp5sO0TvYT5AhsxlTrEIWecn8mpxxl5VQFOY448swkIOUKOkCPkCDlCjpAj5Cil/CRnJudM981mIyFn+PW9Awk5Qo6QI+QIOUKOkCPkCDlKCTkHDHLG/Pr4n+TM8qMkIUfIEXKEHCFHyBFyhByl1MEGOcWPvsymXW2cn8kZec7Iq4qf6rFdTcgRcoQcIUfIEXKEHCFHqUMacupmszb5/ydnnHa16S6Z83Y1IWcsLVkSXrQojFC4bFl4sPVIgRt6I30CY5jjj08vSrf7wjyawsh58hlnhNtxaab87b2ZXHNkbOxAsYTTT2+92yfCo7rmYttxXzwycNrAITSGDZ5vRYCYxkc/GgZ7jHqvogEPRDRYYO5yBioUd7UPpj8W3lsKDF+fTMJH/EJJ1OOPhxGgkYmxJMQ+ZETETRzFLNH6hYiMk3EU1WSI5nU2rZu7QIA182AamCSyOIgIm4OTMY2aSzFJ5Hg8QdTlYetwbc0eQAJcixXV+4yXEK5r3DAU3nawNKaBG+H38733hnEUjzuXb8RUal5DzrzRyJ+xOeCzUkKOkCPkCDlCjpAj5Ag5Sgk5M0cLqUHIEXKEHCFHyBFyhBwhRykl5CghR8gRcoQcIUfIEXKEHKWEHKWEHCFHyBFyhBwhR8gRcpQScpR6X5eFs16sqKf4Tdy8MV0JgDQY6vXeNTAMmqxyCSgQOy0NIspCLdx39+5wa0+Hl7beK1aE2dwFTiNOYFa5ooz1A6rJ/jRqVe9ByVsIHWiXXRZup6RzCTt2tN54CmjAw9FNm8KsRMv+NKwXK3r33XBrF4dzKBJRzmrNmnA7IQ0AZm1dbA42licj9SKqom8KSR0nAwkQzeuuKiAB4iayKYIskADohaNYAmZVl7whE8PI07gvRoaxk9gcTKPeZ7zQeILwRPVxNRDiZOwGCAH3xV6BiMBaNfHi+QI26rcOT6FGTUwDk8Q08E7efHNvI6ZSQo4ScoQcIUfIEXKEHCFHyFFKCTlKyBFyhBwhR8gRcoQcIUcpJeQoIUfIEXKEHCFHyBFyhBylhBylhBwhR8gRcoQcIUfIEXKUEnKUanel3yz8yiut9+LFYRRMMZqf2nqjcAgjv/VWeJAgUyhMQ0dWeV+0fgG9Xnyx9caNGIKTl0awxzHpzMREEawI2LY3vHp1GNfyKOc8QdnaoOQtTkZUw/NtR4e/8IUwmfbIdG4sQeWIMOoBJwIzqmztAw+T03Jk7kYdc8tWqBEMgJHraxEK62lkRmS+RBZH+IbR64X7om0MhICYi6GwIuxGvTmYxj33hG+/PYxerzvuCONoXYgH43fs3/5tGGVrIIQbbghffnl43bowniAWeOutYRzFQ7nttjCmgZZGvCoY6qqrwtdeG8ZOYp/xim7cGM5rjZhKCTnzVj/5jWZ87b6+hZAj5Ag5Qo6QI+QIOUKOUmomkPOT1HRfny6pT3ftHHLIPoWcGd+32JD9uQQhR8gRcoQcIUfIEXKEHKWEnBGh/Hf/OU40n8218xxyZnytkCPkCDlCjpAj5Ag5Qo5S6uCBnOk+2/ntL373lenu2F9bDzXdbOtrx1n4lJOc8hOt/vyRNz0oOUfIEXKEHCFHyBFyhByl1KECOVOOWXwzGwihnsY4105JOzOe5HRDFefv58+j5oWuvjqMbi5EN/iXvwzXRV51oLzrrjCS6yCpR3JlvkRSZ1XXmb0H14bY3FXCFeI16sUuuij8mc+EW3s2HUKuI4kBgcrWL/DDySeHW7uiNwvxcr1vvx0mAWKvKLDW9t6gqVE1fYFAAxKDKqQHAo2678u98VDwXnFWeN2RPhHOkLaRp5Ev164No/ULuRb5EpERJyP1Ylbf+U74llvC69eH0b6FXi8sAakX68WscCPsJJAAk8SNMA3sBuAKS/j618OYBkAFcAXjRthn/JkLBsAfHJgkkA9Pv278g/FAgZqYxp13hnEtkA/XwlhvDZM5ZyOmUv5MzvigMj6DzYyF5nDk2axCyBFyhBwhR8gRcoQcIUcptf8+yZlNLp8ZcuwjyBlJaEKOkCPkCDlCjpAj5Ag5Qo5SQs5CgpwZf5+ekCPkCDlCjpAj5Ag5Qo6Qo9ShCzmz/+ax4ideJr12/J8Cmm60cX5SaAaQc/ATjpAj5Ag5Qo6QI+QIOUqphQI5s/mZnIIHcEJx4civjHOLMf9nOON0vo0JOfvu/xo0rxSp94wzWmFktUHO29Ybf+EOmGdTYdz3U58KD4L7A+kQiAiZ8Lzzwoi5mEZr96VDhI12Qe8VK1pvhH5s7KuvhgeEUEVz9A+9vwHpyOKDJ3h/b2RxnkxcxOb8rHd9LbYOJyPzsxItiYhvN4rp8qFggWSPj6Tbr3sPtu6ydFUAyEY4BDuEM+RpHAW3IDHDSK4gExwFeiGpI20jIiN8o0GrbjnDyJs3h5GYEa9x8g9+EK5vhHY1bA54CcyDk2ucwAO9/vow/sDC72f8Y8l114XxhywmCdcrwu86GAvE833oofCPfxzGPuNVwebgKJ4+hsJ90aSJSearYsRUap5DzqGsGoHm5Lv4ZnALIUfIEXKEHCFHyBFyhByllJCzz1nooCcWIUfIEXKEHCFHyBFyhBylhJxD8TMfCUfIEXKEHCFHyBFyhBwhRykhRwk5Qo6QI+QIOUKOkCPkKKWEHLUQtCONnquKPQYtZyFERgQ55Dx0cwFj6tKz1tb3xlAMlCNCcPLfG+EBXN2f3tD7mGNab4QTbB1SPk4eQM4t4SUt3FamwR7L0xHckWRGFdNBGDnQC9Vkr7wSbseFB5VoQSYrV7bexx8fHuzVBemKxFp7Oh3vFSH21HSud/fu1huvGeIlq6uQIIEx+I2EHI8yLuS8bdvCSPkIo1u2hB9+OIx8WVd1YZKYBvzEE+FHHgljGqjMwlB1zMXysV7cF+vF0cceC2MoLB+PGyPXTxAUVy8B68XI9ZwBDNhYPF+AN14k3BfL//73w3iR8LbjZCAu/lRF1V75ThoxlRJylJAj5Ag5Qo6QI+QIOUKOUmr/QQ4amf31Afy1kCPkCDlCjpAj5Ag5Qo5Syk9ylJAj5Ag5Qo6QI+QIOUKOUkKOUkKOkCPkCDlCjpAj5Ag5Sgk5SkFRiYYEuWdPGN1cg2ovAFLky7pBa3Btjpx0Ufe2XX55GDdasqT1Rp5eujRcx3pszrvvhgeVcamjw6AazLnmpXZSGCe39lRvXMss3nal10/iJISsJkNQxwKRoPhuJCFcdFGY5HlC+OSTw3tLgYdxFFEN2z6ibO3EFsbbjtiHzarjNUIwUiAYAA1pt98eRlTFUEAvHEWexsk1xeG+aITDUeRaTAMPCXSB5WOf0euFa+uCODwjPJS6Lw4jY6i6mqweCl1k4AeMjFcFwHDlleGNG8PAiZtvDt92WxjTwFHUX+JluPPOMO6LJjrU1t1ySzjfSSOmUvMZcn5Syhz/O/0mfighR8gRcoQcIUfIEXKEHKUOdsiZMvr3X8y/vqf44nQjTHmovmrK+cwVnAg5Qo6QI+QIOUKOkCPkCDlKHSqQg/Tff2V4qP76lIw0zmlCjpAj5Ag5Qo6QI+QIOUKOUkLOAYCccVBkokOTQs50HwSN8/VxPp6ackOEHCFHyBFyhBwhR8gRcpRSC+/b1cAh8xNyQF/jfNw0418fEkLqRVK/994w6rZefbX1po4ND1JgwBX6ppjUszILQ731Vuu9aFF4oDvSUbc1WBFAJZaPaeDvUKJI7gb6xEYVlwVOXHJJ6w1t2BAG5Iy60Yu9B6V2sXwW4iW24eRjj229B6V2v+o9aFd7oTdmVXNL+0QLt8d64+Qzz2y98SLhvjW0s4otkY8bi2KrGlTQN4WjwAl0kT36aBgxt66uQqzHNO65JwwywSQRc3Ff3Og73wljgZhG3VQGBsA0ENyxIjAPuAU3wqzqOdfteXW53PbtYZyMSeJaGAvEu4GyNdwIrIVrMQ08blxbYyp28q67woBnMC3wKQnfiKnUIQs59Ycek0LOmD+TM0VcGfu73cb5nroxvy7kCDlCjpAj5Ag5Qo6Qo5RawJAz6XepzRhyZvMzOdPBz3TfllZ/wjPyfCFHyBFyhBwhR8gRcoQcpZSQs88hZ5xxZvyJjZAj5Ag5Qo6QI+QIOUKOUuqggpw5+Y6vfdquNt23zA0/0pnoZ2/8JEfIEXKEHCFHyBFyhByl1CEEOW2e/X9yRraoFefP4AeNDnLV4YxZbWl4EEYv6Y2/U9qiMK796EfDiPWDG61Kb0mjAi5av8AAWH7dcoa+OCR19LbVBXFtWZipNzNxW5zObq5161rv5cvDgwa8shAv0Qu1dVjvAAgfCL+/A50xybprDn1L4CU8ffQB1my5a1eYj+yIdKI1MXWE4p0cvBvg7vytgniN2IcqOsTcJ54I10EWQz32WPjxx8M4itQLAyeQehGR6xxfG3wIY85AL1R1oV2tTsww/oUDBj7ddFP4qqvC11xTGe83/hUKO4mnUNe4gS3rKjacjG2vuQWggmng+YK0Qby4EY7ibYdzzkZMpeYz5Cgl5Ag5Qo6QI+QIOUKOkKOUkKOUkCPkCDlCjpAj5Ag5SikhRwk5Qo6QI+QIOUKOkCPkKKWEHCXkCDlCjpAj5Ag5Qo6Qo5QSctR+0tW9gRMDuri/N/7CBRHt2BHeuTOMdjXM6cknw2CAUZMMIYsPTg5u+fWvW2+m/ESvrVtbbzAA0zYCdJaeYZKAq8E0qmvRXUQgTNR85ZUwxL3KlI/gvmxZGFq9Ojygx+i4+/nPW2/UuGFjL7wwPCCieL51FduKFa036+PqtsDc2FNOCQ/Wm5NEZLz77jCSHF47pM+6XgxHEWTrQIkSsLp7rU7MOIpXFifD3/teuB4KeRonA1SuvDKM33Ugb4AK3m+0yYE98KfbP/xDGM+3BgY8I6wIW4dZgeKwsRgZjxu1ZvinI0wDJ998cxichtcMXIqiNsy5hlj8tsqjRkylhBwl5Ag5Qo6QI+QIOUKOkKOUEnKUkCPkCDlCjpAj5Ag5Qo5SSshRQo6QI+QIOUKOkCPkCDlKCTlKCTlCjpAj5Ag5Qo6QI+QoJeQolfnypZda77feCuPkQXT7Vm+E4GefDUPAGPASAjTue/zxrTdnldn06KPDmOQVV4RPPz28e3f4fRbr/eabrXdrz/bGrHBfHEW8xtEaJ/ZOIlw7AIZ43HwZ0DaW9XH1fQdtY5/tzV6+9lb6ivTy3osXt964EY7iWgAh5nzMMa03XtH6rcM0MFS7/fYw8jRav5DzkOMRZGGkfARojIxci6eCkZGnMef77gsjjOJGiLnYHBiJuT4Z4Ruggg40XIsVITHjkcEYCuEbRjMb5oz74ii4BcYjw1BAESzh1lvDOIp3o36fcTIeN3YD98W19bajpRDX5tM3Yio1nyHn2lILJW0PQ9ehPA0hR8gRcoQcIUfIEXKEHKWEnNlCznTJZ8qvTxmW6gRVXDUDuphynkKOkCPkCDlCjpAj5Ag5Qo5SQs4UyX7SX4+PB/UJQo6QI+QIOUKOkCPkCDlCjlJCztxAznSxvgCJOYScKcesPxEaCTnTXT7O10eO89tfF3MTcoQcIUfIEXKEHCFHyFFKCTn8xZS/Hn9u0/160vMnmtKC1J494YsuCtdpu7WX01WTFQhh0HJ2WTrSZ13GhaMYGcU/v/xlGNU+aEhjJs7kWpe8DRa4s/eo0H9B+qzeo260qfeaNa13a2+md4SzIqwtDdcvQy2kXMQtPKP24fBggWvSsSI+0GyiQ4zHXuHawX1f742T8ftoIqZlUkdyRThDFsfJdcEU0mdNF3XqRYBGbxs2ui7jQkcWRq5JDOtFrsVQuHaiKrYf/CCMOaP07LHHwg8/HMZeYSjU5WEaeGR1Px7WW3frYZ9hTBJDYevwTtZ79aMfhetuPdwXf6zggeJ9xsuQczZiKiXkDMFgH/1MznQ0MvIfrMe/fJzbjfl1IUfIEXKEHCFHyBFyhByllJ/kjPVJzkheGhPApvv2szE/4Rl5vpAj5Ag5Qo6QI+QIOUKOUkrIGQ05sykeGHM5M/7ERsgRcoQcIUfIEXKEHCFHKTXfIefAtqvVP5Mz/r1GXj78SGein73xkxwhR8gRcoQcIUfIEXKUUgsJcmbw/8lZ0O1qxfljtqsdJKqzKYq8zj47jGBX49OImq/DWri9mN6c/nzvQRh9Jr29N7IpFggSQzZDBRx1Urju5hoUtT2YDuFaoFcNkziKhrRdu8L1yIsWtd41W7ZTwzj5xhtbb1ArGA8jAxgw1HPPhXfuDA8U3DIAwu3pL/Y+7LDWu77RiCo2JDlkU/R6oW8KHVl4v+teLyBBXU5Vx00kVyyh7shCRK5ZC7PCirB8xOu6Lw73BV185zth3AgLnKiZDcYCkePxFBDcsUCEfiyhRqCaPDEywAyAhHcDN9q6Nfzoo2EgEB7KQw+FMSssAc83d9KIqdR8hhylhBwhR8gRcoQcIUfIEXKUEnKUEnKEHCFHyBFyhBwhRykl5CghR8gRcoQcIUfIEXKEHKWUkKOEHCFHyBFyhBwhR8gRcpRSQo7aLzrllHB9lOEsu8hGNYZVCIQgi6MrVoRb+2zvdeta79Ye6H3lla035ozGsFdeCYMuuPwjW2+c3D6WhhLqcF+gF9aLo1gC9KlPhdsRYcwZFPfuu2EcBRHh5OOPD2OSdVEbCTD3qqY4TLJGa2z74I1d1XuiNjk8BcAkXxWkfHTPoUAM8RqpFyVgiH0YGbEPwIAONFRmIZqjIA5zRryua80wK6AImAc4AU4De9QYUzeVATZqQkA0x8l4Cth2HMV9wUs4GSgyUV0e9nn9+jD2uX4o+BMZfYA1AeI1q/EY9627BG+5JZwnGzGVEnKUkCPkCDlCjpAj5Ag5Qo5SSshRQo6QI+QIOUKOkCPkCDlKKSFHCTlCjpAj5Ag5Qo6QI+QoJeQoJeQIOUKOkCPkCDlCjpCjlJCjDnmhMK0uEEOS++QnW2+WrR2bbrt7Yyhcu2pVGCm/LW69ed/Dw1jRYOTd6TW9kXoR6zErnIwFXnhh611HZJRx1U8BAXoi1LziivAgqS9PR+XdiHY1uJ2bjuKy009vvVt7qjd246WXwnXHXTsmPFjgp9Jv9B78XohZDY6u743utbYozGnUWQ1pG/yA2IeMiKEQNxFzcTJCIeImrq3zdF0+VofvepJYPuJ1zWnARcR6jAx+qBeIR1YXxNVPHxVhIDHQFI5ivbgRjPcKcAXXI9d9cWBLEC/a1Z54IoyiNuDxli3hxx4Lo8YtG+GMmErNZ8jZ+78qL0QN/zH0YLqdkCPkCDlCjpAj5Ag5Qo5San9AznTfajEOFcw5JEw54PCLc3VfIUfIEXKEHCFHyBFyhByl1MEGOX3KHyfx72sqEHKEHCFHyBFyhBwhR8gRcpQScmYOOQU8TPnztFN+ZcoMhgGn/LCoOH8iyJnu537H+fpE8xdyhBwhR8gRcoQcIUfIUUoteMiZ8teTnj8lwxTjHPB5FvM/iJRIMOgxC61eHWaubZvSb4bzRu248KAh7Y10FKbhWkzj2WfDrX0xjGm0rek96dAAkEKD3Xg5XdVttbalN4aqcWJw39h2FnnVzyh7zAY5/sFwFrXVqFlDHSAHaWTQNXdfbxS1Yb14ZKQLvgxPpVv5jyJXpxMI8xVFpx/vi6yGUIhuLvSnIeYijNatXyATVHUhfeJaBMqHHgrjvps3hzEyhsK1jzwSRuhHNxeWj5Oxk5gzrgWooCAORxHccV8YSR2zyvDNa7E59fPFAmGMjPcKI+P35MMPh7E5dZkeHiiopkSRESvCa1YfTSA0Yip1yELOPv36mPedMmaMAzP7aF1CjpAj5Ag5Qo6QI+QIOUopIWfvON9mNstPckZ++9mYn/CMOR8hR8gRcoQcIUfIEXKEHKWUkLMPv11toha4ST+xEXKEHCFHyBFyhBwhR8hRSi0kyCna1ebwZ11GQsXsP8mZaPzZ/OyQkCPkCDlCjpAj5Ag5Qo5Sar5DzjjVZ1N+D9hE7Wr1t6vN5pOccVrUxvk2uYna3g4GIRS+8koYaYyJOTujfv7zMP62OuOM8DvvhBGR8WwwK5T3DFJ+CvmyJJMTTggj9AOfMEkgAUrAcDJqzVinlnNGFh2wx4ZwVs8NNufy9NnpSp/5TLh9JN1W9Wa9WHuh9FlpzCpOxl6hfAsUNwCkEIbC861RE1za2ubeNXmC09jchXwJBkBWA5kgfNcZETdCUkf4xu86FHlhZAyFAA2oQ48ZTq5zLTYHeRpDAWNwFBuLo9hJ5Hg8BfAD5lzzEiaJ0jMAMFrOcC1mhdcMTwHX1qCCd6PmJfz5hSXgKDgNQIi3DoiL3cBLiOebL78RU6n5DDn7Tofu/0DmEJGQI+QIOUKOkCPkCDlKKSFHCTlCjpAj5Ag5Qo6QI+QopYQcJeQIOUKOkCPkCDlCjpCjlJofkKOEHCFHyBFyhBwhR8gRcpRSQo5aOAJstPZq4Vtuab0R+xDrEezYvpXdXO2o8CBQomytrjW7tDd6zDAy6SKxrR0bRglYOz6dYsrHyBB2o+a0eqhJtGZNeNGicGsXpC/rjW3HUAj9Z57ZemO9vJZcujn9ZuEaRKHzzmu9EbZJYvkyYK8uuyyMp49aQmIquqoQ3BE3EVURgm++ObxxYxgZsaYaIBAS8733hpEg60o0xGsMhRAMuMJuYM4YCk/0ppvCGBn3xbXof7z++vD69eENG8K4Lx4KfOutYUwSs4LvvDNcYxtwApPEi1T3p9XYhlcUuIiXH+8GNhazwnrhG24I3357OOHKiKmUkKOEHCFHyBFyhBwhR8gRcpRSQo4ScoQcIUfIEXKEHCFHyFFKCTlKyBFyhBwhR8gRcoQcIUcpIUcpIUfIEXKEHCFHyBFyhBylhBx1yGuQTV8vDCR4++1wa19MR+sX8iUDZQb3k08Oo6gNR2+8MYyhVq0Kn3JKGJVCrV3de9u21hsxF0f3TqL2Prh1xhKeeioMPfdceEAmj6WvSMfRJ59svdFiB4xhNGe72oO9X3219QamYusGmJpMmxV/rT3Ve/fu1ntw8qb0+vS6NLQ8HcIDreFq6dLWu7V7w0iB6IwCigBUEFXxQoMucC14CRiD2iukbURz/H5GVAUv4b41a6Eyq54zcu1XvhK+5powMnHdRQZ8uuuucN2BhmvxFOqtwwMFt+D54s3BEnAj8APmjBXh37fqSjQ8QRytC/HQRIdrcTI2FvfFyWW3nhFTqfkMOXu3bCl8iMT16f6XPv6vfoQcIUfIEXKEHCFHyBFylDoUISe/OWgOGGP2aDF1OBRyhBwhR8gRcoQcIUfIEXKUEnL2D5/sO5YYc2QhR8gRcoQcIUfIEXKEHCFHKSFnNAZM9ykKvjg8rT9/ykF+++uZfUQz3YDFjebqAyshR8gRcoQcIUfIEXKEHKXUAoacIcZM+ev646BxBhkJWuP85zgznO7uh7IQ+87tPSqr3ZeOa197rfVmj1m7rTdiLmqvRgBDey/9cu9BgN7WGwj0zDNhKiGntdW9OSuenFV1h7Vw29L7tttabwgBY9DMdn9vlEK1k8N4KIg92ElsHWb1s5+FCTnHhS+9NAy4GpAJFAsEXbR2S+8lS1rvEdh2ZBiVaOyaywo4vmZLwjwKI9jVpVjIteiqevDBMIZCKERyRfhGGIUxZ3Rk4b4YGUtAFRuyKSCnJkDEXEwDk8TW1RVwmFWdp3EjjAxPxAC4Fu8GYBLXAmNwtC7xq5v38NbhZOwzblSzNLrm6to6UCuuxYuUNmIqdQj+TE6BE+OjyKRfn/T7zca/0Zz/1JCQI+QIOUKOkCPkCDlCjlJq/kJO8dlI/a1oBwRyxpnVdJ/k+B1rQo6QI+QIOUKOkCPkCDlKHdKQM/5HK/sNcmZ8I6lGyBFyhBwhR8gRcoQcIUepQ/Rnckb+2Mxc/UzO7CFn0p8aGvOngIQcIUfIEXKEHCFHyBFylFIH58/kjN+uNmXf2sx+4Geib1crvhvNdrXxtDg8QAIg0BuF33uv9UaAHjSGYeTN6TiKRzvgpfvTb/YeBOgz03ntMS3cXgjnXgGQQCaYMzYW17aT0rl8ZvF2WTqEWA+qIbewIS3uu3Nn6w1QwZwPOyw8mGTwMGvrqAfTT6XPSuczAorkyzAgolfCyS2AnMGfL6vSeAzhZcsqs6oLWQ1kghSIuIahEFWRa2tgQNsYZgVuQerFA0boRwieiC5g3Be7cfPNYdSLYQnANoxcoyZSPkAFGwuqQejHQ8HJNTBgCThaUw2Mtw5GU1ndY4YHihvVTxC7gY1FBVzd6We7mlILFnKUEnKEHCFHyBFyhBwhR8hRSshRSsgRcoQcIUfIEXKEHKWUkKOEHCFHyBFyhBwhR8gRcpRSQo4ScoQcIUfIEXKEHCFHyFFKCTlqPylSYFvUwkSCK3svWtR64+RBKIwb7drVerfD02UJ2CWXhFt7Oows3t5On92bkzy8VT4+3b6ULkdul6eRxbekf9gbsEEQzUkSn4AEmeO5V6eGcSMYSfW558KtrUvHegfkiZNBNa+nP9sbBIh3cs2aMB4KK+D48t8Rzrq8004L33hjGHsF8kTYZghGVkOeRnRDCK6b2dBkhQRZp08MVd8XtVdf+ELlz3++8l/8RWUM9Wd/Fr788jA2FnPG5nz722EQEY6CAbCxCO7Y57rFDu8GXgYwLSaJWI8yPdAybgRsw+Ou3436NcONMEnsJBYIqsHIQHq0ycFr1/Y2Yiol5CghR8gRcoQcIUfIEXKEHKWUkKOEHCFHyBFyhBwhR8gRcpRSQo4ScoQcIUfIEXKEHCFHyFFKyFFKyBFyhBwhR8gRcoQcIUcpIUeptiZ9fu9BUv9WOGPfMceEqb1hjpxDDbq5YpK8Ea/d03uwBNBF6sTwiEmekj4qDeW1L7wQxrXo9SJrsdfu/PSmMDdnkvWWS0BSB7e8+24Y12KBF18cxjQmOhk7Oerpx06OeNtTWD5L7dqG3m+80XrzoaC4DAYw3H57GAE6oxsr/zAyTkYIxrW33hrGydgOzHnDhjBGxopwo/roxo1h8AOQAMvHrHAUN1q/PozwjeWvWxfGUdwIJ9ebg22vjaeAaeBkYDoQCOvFbuAlxFD4DYwFYhrXXx+uXwb8GwbK9OonmDZiKjWfIUdAUkKOkCPkCDlCjpAj5Ag5Sgk5U2uKbLOPL1RCjpAj5Ag5Qo6QI+QIOUoJOUKOEnKEHCFHyBFyhBwhR8hRSsgZD1SGCWf4ReSfEdFICTlCjpAj5Ag5Qo6QI+QopebPJzlgmyHnTEc+amGozmoIlGzuyqw2yHkRvnEt/uJ7773wfsvxENbLFWX7Vo1AaN8a0a+VeRrXIgYMCLDaDT6ycjfQYlc/XyzhF78Iz243KqbFUK3d1RsJ6p13wqMQKF6zwY1mwcNL0hAeMIL7DTeEEZER7PC8a0DCUeRLnAzjRth3PFEsARET12JFYABsDk5GvMaccd9rrgmDea67Loz7okAM68U0ari69tpwTY94Rlg+rsVRLL9+67Dt2EksAbOqXwZsLGaFaWAoHMU0AGZALzyFbHUzYip1yELOlP8p5Ag5Qo6QI+QIOUKOkCPkKKUW8Cc5xbex+TM5Qo6QI+QIOUKOkCPkCDlKqQX8Sc44H+koIUfIEXKEHCFHyBFyhByl1AGGnOIDmek+rhFyhBwhR8gRcoQcIUfIEXKUUgsGcmbQrjblhWoB6N57w+2jafR61cGOJWCrCw+q2Nb3rtmjHZdGoPxEus6XWbeF++7a1XrzRrlXy5aF6+auo45qvWu25DRyn5HFd+8O79wZnmj5ZLxc/muvhQdIUBeX/Sod2FajNbYOb86AeGMa2Jx2cpqKWdWEP2gpjAXiCXI3kCCRAjONte9+N4wwihYsxL665QxhFEa+rANlXYqFoeB77gnjWvAS7os/zkBxdYsd1ovwjd62738/jDnjWuxVPcm6EK8O/dgNYAzK9DArLAEj44HiWmwdXjO8k+DDurYOewVsq5sGsbHly2DEVGo+Q45SQo6QI+QIOUKOkCPkCDlKCTlKCTlCjpAj5Ag5Qo6Qo5QScpSQI+QIOUKOkCPkCDlCjlJKyFFCjpAj5Ag5Qo6QI+QIOUopIUftFyG6DZJ6dTJCcH20Llur8endd1tv8FJNCO2YcD1njLx4ces9KHmLeP3KK603lvDqq613fV8Q4Gwa4XDyAEUu7z2HRDR4+rHAfYcxIxr/PhkmbORLiPvO5s3BxvK+dVRF7EOTFQIlMjFiLoiozsRYIWIu0ieOIvUi1yKpo2mxjrmIqpgzlo9ZYflI6rgvlo99BhLU+1zjIh4oHgpuBFCp68XqSrS6ew1zxk5iGpjzmjVh3KjumkMxHR4KpoF/DsCcsRuYcz4yI6ZSQo4ScoQcIUfIEXKEHCFHyFFKCTlKyBFyhBwhR8gRcoQcIUcpJeQoIUfIEXKEHCFHyBFyhBylhBylhBwhR8gRcoQcIUfIEXKUEnKUWhSuyaSOmzt2hNupaXav7e59+OGtdzss/POfh1vbkf7H3oPethfCH2zhPPr66603AKneOtS4YUVHHBEe7MaGdAizOuywMCIiCYHlcrFXA5woF4itI2ys641Z4YGSTNrT6RdKv1H4sstabz5BzDlXxDdnb7otD7+PiL3LlxCz4suAIIsUiIxYZ9M6biKLP/BAGL1tOBlx89vfDtdFXoj1ZdxkNv3e98L33x9G6Rlm9cMfhrHeGia/8Y0wwjfy9Le+FUb3GhgPTxBzxiSxhAcfDONo7R//OIw5P/xwGNcCNbHALVvCf//3YZAJth3Lx8l4vYG4gMma0zCrH/ygtxFTqfkMOf+j1Bwm4t+0vyohR8gRcoQcIUfIEXKEHKXUIQM5UpCQI+QIOUKOkCPkCDlCjlJKyFFCjpAj5Ag5Qo6QI+QIOUoJOfsMcn5LKf/0/yVvv/t19z8rb8OvT/eV6b6ohBwhR8gRcoQcIUfIEXKUEnL2H+QMEWXKX0/5Ac50X/dznoUBOe2oMCMjo+pZYQZ3KFLgokWtNzMxozlr3tLQXb3PPrv1bh9Ntyt6M30m1OFvdk6Dm7Mz/UD4yBbOxPzTn4Zb+0X6S71R5LV7dxj7vHlzuC0N161u4FJE09Z2paHE43wZ8MgQXbAE1pqdEMYTxLWDaZwb5gsc+AQgHDTvXZKeRKALxL5MYwzBCNAIdt/8ZhhJHYESqRd0gVlhKHAasjiWgN9IDz0URrzGyTiKrXvkkfCPfhQGa4FqMA2EfhBCjSJYL37XAQm2bg0DJ9BEhxXVk4QxKwxVv2YgBDwULAF8iJcQu4Gh8NbhoeBazBl79a/+VbiUEVOpQ+qTnEkpZTrI8ZvZhBwhR8gRcoQcIUfIEXKUUgsGcqb8NrYhxkz33W5KyBFyhBwhR8gRcoQcIUcpIWceQY7fribkCDlCjpAj5Ag5Qo6Qo5Sav5CDz2em+xGd6T6xGedndYY/7aOEHCFHyBFyhBwhR8gRcpQScg4A5IzTroZPcsY5TR16ygR5/PHh+uQTTgg/9lh4Qn0uPfMltPZc+qVwhm8sgUPBJ6bbZ8P1tdQzaQg9dSgruzxd6jS0jWGoX6VxXxwFAmEobPvP0s+mcS20PY2RIdwoHzePYoEYGQA8d/r93w//1V+FL700vHJl+KKLwv/tv4Vx9ItfrHzJJeGLLw5/9rPh888PX3hhGENhCTh6ww3hv/7r8H/6T5X/7M/Cf/qn4eXLw3/+52FM4+qrw1jRFVeEcTJu9JnPhDHJa6+tjH8PwNGvfS38la+Er7sujGuxBGw7Ws42bAhff31l3Oiqq8JYEcoD6+Xj5LzvHGa1/6GUmlxmZCXkCDlCjpAj5Ag5Qo6Qo5SQo5SQI+QIOUKOkCPkCDlCjlJCjlJCjpAj5Ag5Qo6QI+QIOUoJOUoJOUKOkCPkCDlCjpCjlBJy1HwQsynCGXq9EM6eT9cZEUEWGRE3wsjQpenX0pjkq2nootLYDejNdNzo9ddb71EokvpgmH1iZIBJNKK2bnmYc74xnTo6TUB6JV3TI4Ah9YE09VZ6ouWXOjk9QmenE62xXgTKtWvDSJCIffA114TrkRH7kLYRGRFGcfKVV4braWBkXIveNiRmRPPLLw/jWtSpIZr/l/8S/r3fq/yHfxj+/OfDQBEAEm50wQXhL385jI39278N40Zf+lIYXWT/9/+GUT2HP1bQpPk3fxPGM8JTwAMFiJ57bvjjHw+ffHIYlP7JT4b/4A8q/9EfhVesCGOfc71GTKWEHCXkCDlCjpAj5Ag5Qo6Qo5QScpSQI+QIOUKOkCPkCDlCjlJKyFFCjpAj5Ag5Qo6QI+QIOUoJOUoJOUKOkCPkCDlCjpAj5Cgl5Cg1om2sTvl1SVSdxcsgS26BXk9PtKJadRlXfV9QHASKgwB1G9L1Q6mf0cvpEjbqGy1r4RqQoOPS0GGlyeHlyLh2URpH99+/HZTrRVL/z/85jBIwVJMhbSNe4yhGxlBo7qpPhj/3uQmMWeHoX/xFGLP6whfCGOpP/iSMRjhEczAPqtgAZjD4EEfrAjHQBWrNgBM1XQDqQCannRY+9dQwjgInAAynnx7GUGecET7ppPCHPhQG5Pzzfx6eSP/sn4X/5b8MY5JYwr/9t72NmErNZ8j5TqnZ/F29d+9eMUDIEXKEHCFHyBFyhBwhRyl1CEGOFCTkCDlCjpAj5Ag5Qo6Qo5QScpSQI+QIOUKOkCPkCDlCjlJCzn6EnL2pKb8+3Vem+6IScoQcIUfIEXKEHCFHyFFKHRjIGTLMlJ/YjPy6n/MsTNVhdBb68IfDq1eHd+4Mt1PTZJ5f90ZG2r49fOSRYRT/tI+mSRebe599duv9wAPhwSTRNXdXGkIFHLjlnXQNSFBdeVdrdRralC4B6fBWuV0YBgOMuPbidI18NcTOBunrfS6PIo195CPhxYvDE+lf/+vwffeF0b5V+7nnwv/7f4cnGqr2T38a/p//M1xfu21bGPQIFPnqV8PgB7Sc/ff/HgZroUDs058On3NO+Lzzwv/xP4ZxLRAXR4Ein/pU+K/+KoySNxS1ASaXL68MlsbRiy8OY4F//MdhLAE+//ww0BrTwMlYIKaRG2vEVOrQgZxxKGU6yPGb2YQcIUfIEXKEHCFHyBFylFILBnKm/Da2IcZM991uSsgRcoQcIUfIEXKEHCFHKTWPIMdvVxNyhBwhR8gRcoQcIUfIUUotGMgZflxT/0zOOD+rg9OUkCPkCDlCjpAj5Ag5Qo5S6sBAThujXQ2f5Ixzmpq3qsNZ3XIG1QViL6ahuhJtNpOsr30pDe1KQ3XZWn3fOjG/m57DBzqbo/U+n5ueSGvS0LfS0LrwCCK6Oj2RgnhH3ShWBDymEM5QEYY8XbecIfbhHwBwtK5xw1FERhyF67iJo7gWk4SxOZgzRq5hA9fWnW+I5hgZARqTxFFATp3F633+r/81/Jd/GUZPHSDni18M42RwC07GfS+4IIyjMEb+8z8P13AFY0UrVoQxZzhPNmIqNZ8hRykhR8gRcoQcIUfIEXKEHKWEHKWEHCFHyBFyhBwhR8hRSgk5SsgRcoQcIUfIEXKEHCFHKSXkKCFHyBFyhBwhR8gRcoQcpZSQo+Yj80yik9IjQuF96a3pSXT4JG73pyfREem2Mjzivj8sXeqD6aXpEfd9sDfatkYpMWbEjSZ6gvVbV1eizUZ1bV0N3j9NTwTAqSuvDF97bXjlyjAiI7IpXMe+idJnHYIRN9HrddFF4UsuCaOMC77wwjBazjDUX/91GPfFtbgRjmIoGC2NOIpZ1ZPE0b/5mzAmiWuxORgK7HHGGeFPfCL8yU+G/82/CePk3//9MEr8Pv7x8Mknh//gD8L4BwAgH3CxLluDgYvlyUZMpYQcJeQIOUKOkCPkCDlCjpCjlBJylJAj5Ag5Qo6QI+QIOUKOUkrIUUKOkCPkCDlCjpAj5Ag5Sgk5Sgk5Qo6QI+QIOUKOkCPkKCXkKDWZNqQnCoUTFbVBN6Ynum8dZFenJ5rzHenZrLcuppvNxu5IT6B168KjqCZAZfHi1nsi3X9/eNR9f5auS/xKHZ0ecd/ne4MmJlNda4ajiH21zz03/KlPhdEYhgRZd77VDWmoJkNyrYNsfaOJTkbMrXvMsFfYnPpaFKbhWoyMhF1jKugR/Wkw3kIcBdOWbWMjisuATzU8161uX/pSuB4ZQ9Xlcri23A0jplLzGXKuKzVXAXfvb1SfIAYIOUKOkCPkCDlCjpAj5CilFgbk9AAzHcwIOUKOkCPkCDlCjpAj5Ag5SqkFCTl+kiPkCDlCjpAj5Ag5Qo6Qo5RaSJCzN4WvDD/VwVF8XTAQcoQcIUfIEXKEHCFHyFFKHUjI6ckEvx5+YjPRyWo+6phjwqOC3Qvp5ekJtGhReNR9f56GXk5PRAj1yM+noboTrL5v3b41czIZlfLrTrB6zrVqmNyZnsP7TtJjNtl9Z/N860a4x8J1+qwTJDIxTkbLGQIlYl99FCMDvc45J3zWWeE//MMwWAv+9KfD/+E/hHEy7osbwX/0R2Ec/ff/PnzmmWFUk2GBqAjDJAE5mAZcLx+u14tp4Eb1nDEUlv/v/l24nlX9uDENDIWtw8mY1Re+EF61Krx1a3j79t5GTKUOHciZ8j+ng5yRJyshR8gRcoQcIUfIEXKEHKXUgoccv11NyBFyhBwhR8gRcoQcIUcpdbBBjt+uJuQIOUKOkCPkCDlCjpCjlDpgkDP8BMafyRFyhBwhR8gRcoQcIUfIUUodJJDTpilMm45b/r/2zj9Y67rM+9eQOS7jujwMa0TEssSaoRKZsqaEhIiIP0IiJDQkNUJCJCIyJBQRkYwQCRFZRGKJiFhDIiWXjMjMzBjHcRjGGKdxGMdxGodxHMZxGB5mex73835/D9c533MOcji83vP6w4v7/v7+nnNfr/s+9yXT1Y7xnCMMGiRE7C2xjmLbNiFiasmAAVHy9NNCdBF27BBefVXYskWI85SOgs/m6qu4t2xQhpRURmYtVyzrSmbPjpLevYWIeSWvvx4l0U/Rjvnaa6MkYmXJunVRcuutgmXGDGH+fMGG6T33XJT4BY1hig3Eu1cZLZwSQixWNGcqnpVKjViTX/0tqb/phit10kk59Pu95Le/FZ59VrDz/swzGb//vWCP/uEPwh//KOTbze8G29Cf/iTYmvNDsJ3cvl146inBTp0ta2fDVmWHYDtpx5ufZ9vu734n2KP5k+03o23X9jlflR1Rvs92YleuFB5+WHjoIWHKFGHwYOGTnxTs19n48cLAgYI9unixcN99wre+Jdgvu2nTSmgxCWnLknPkgqUgOUgOkoPkIDlIDpKD5BBCjnnJafAv0AiSg+QgOUgOkoPkIDlIDiHkGP4khz82Q3KQHCQHyUFykBwkB8khhLTPP1cjSA6Sg+QgOUgOkoPkIDmEECSHtJscFGwuTiPpKvg4tVhQcuaZURIxu8Q6dZ8Ip0+OHiF0VhrJTOVGZWLJG29EScRQZbyyteStt6LEDkEH/0SHDhk1Ixtavz5KrA2I2Ke0JLLd1aujJGKUcuSSDUxz1awXcZ6DaXx44Nixgv0w2JSzefOE664Tvv1twS6w3VhPPCE8+aTw3/9dA1v2V78SfvlLYfNm4Re/EGyvbJ9tzYY92XZy61bB9uqxx4R77hFGjRLskl1zjXD11Rm27Je/LNiGbNkxYwR71GaRjRyZka/KsL0aPVqwiXA2ec/ePFC78Ldhpk4V7Oa/4QYhHy1ow9auukq4884SWkxCkByC5CA5SA6Sg+QgOUgOkkMIQXIIkoPkIDlIDpKD5CA5SA4hBMkhSA6Sg+QgOUgOkoPkIDmEIDmEIDlIDpKD5CA5SA6Sg+QQguQQMkiJ1UqrpZHWXNs+aworgpQt6w+eKFSyXmnFBnq34h21YslHhD2vpJbqM8GyRw8ciJIW2XGdHLntxqE7raByNmzU3lE63lWrhO9+V/jc54SePYXPfla46CLh0ksFa4KvuEKw4YnGsGGCdczDhwu2XRtTOHOmMH26cNNNwte/LkyeLNxyi3DbbYJtyMZt2Xat27ZHDevFTTWHDhUuuUSwc2XYskOGCDZt7IILBLsZbFlbs60qx8Zu2m1m89PseG27drz5k21DdkS2rGF37MUXC7pmWkxC2rLk3JiGRp4gOUgOkoPkIDlIDpLTJMmJ+Mt70IASguQQJAfJQXKQHCQHyUFykBxCCJJDkBwkB8lBcpAcJAfJQXIIQXKOsOT8vREqO6Jqg9SU5xAkB8lBcpAcJAfJQXKQHEJIW5Gcqs/Yf1efUz6ENxwvqdXY5WbSo4ewfbuQL3vaaULE35TciEzqnlHmKnsUa5FfUJ5TFisvK+ZatqwZ0TrlDUWW3bMnSiqx4zUxe0uxR20nH1XsXO1VrlXuVV5RzB5tzXa5bdnlyhLFzqRdoxoy2aLYcKrLLhOsObM+zx7Nn2wzsr70JcHGXn3zm4LpxJQpws0312D+fGHRImHJEmHpUuG++wRb9v77hWXLhJUrBVuzLfvAA4LtVb4bixcLP/iBcPvtwsKFgu2z7YbtZL7Pxg9/KNiydlHsyXaA9uR77xXyq5DvpD3ZduPuuwW7gT/wASHPv/1bCS0mIcfVJzmHK5v+HILkIDlIDpKD5CA5SA6S8785eOiV8/9DSdnOymNOcpI/V0NykBwkB8lBcpAcJAfJQXKQHErKY1JyGvxzNSSHIDlIDpKD5CA5SA6Sg+RQUrZdyWnipzSJ5PCdHCQHyUFykBwkB8lBcpAcJIcSyTk2JKcpf64WTFdrP9FpVC3Jtm2Cp6fSmpmvtF4G2SS6lsR68Raki9KSqAHOmCG04r1RieniU0pb/NGw2WPW1jaSkxSbRWYqYls691zBBmqNHi3YjKy+fYV+/YQzzhBqxQa1zZ4t2IC4WundW7B97tZNyGMHaDv51a8Klo4dBdvuOedkfOxjwqc+JdgAsauvFqyPt8t98snCP/6j8KEPCSaxc+dmXHON8OEPC0cudrnHjhVsAp7NIbTZesb48cJVV5U8QghpKHe+X6H7JkgOkoPkIDlIDpKD5CA5hCA5hCA5SA6Sg+QgOUgOkoPkEILkECQHyUFykBwkB8lBcpAcQpAcJIcgOUgOkoPkIDlIDpKD5BCC5CA5pE3EJmjVynQl9SVvkUcobdHTPP2U1swy5TXFjOglZW+CjZ577jkhuiuxTegagl/uwSWdOkVJxKSSp56KkhEjhI0bBWsRbRKdLRvnKacqnYR33hG6dhWmTxdWrRIiVpRYy2TDt8xTKjP9VgkXXCB07ixYTj1VsKa/f3/BjMh8yRrZoUMFHT8VH/2o8JGPNB/rmHNMzC68ULBpcoMHCyZXgwYJNnpuzBjBtPXBBwV71Lptmxhm7/f84Q+C/Uz+8Y/Cs89m/PnPwp/+JDz/vGBrNn7/e8EetX028jXnT7ZHf/c74ZlnBHuynQ07fDsiW/PTT5e0pDm7kRDS4tCLEyQHyUFykBwkB8lBctq05MTBeI9q2Uirly7b7kvOxnFbEoLkIDlIDpKD5CA5SA6Sg+RQIjmEIDlIDpKD5CA5SA6Sg+QgOZRIDkFykBwkB8lBcpAcJAfJQXKQHEokhxyr8W4sxpXYxB0bdROxQ7lXGawsLDn99CjZs0ewXmX/fqFDByFiU8maNVFSaVW3lyxbFiXWfa5YESU9ewoLFwpuJudHSZ8+QvQQVq8WKiOjXlcWldhenX228OKLQvfuQvQXdu0SbFLXnDlCly6CTUizUxcxRxFtmzAhSiImKruEQTbj7kZlc4ndSBGPKmtLrGWym//NN4WIWYqY56RJUWKOt3y5EL/5jWDdmPHb3wraqzXSBVo/bU3hzp1C3iLbqmxD1pvmraphe2UbslXZ4dujtlct6dSNHTuEfM25P+RWkyuBnZwcW9YOIVeC/ADzy23YEeU3cH5y7BbNdzLVRb72TUhbHjwwNM2R6I0PHkS8kBwkB8lBcpAcJAfJOfYlh/fUKSnb7Cc5SA5BcpAcJAfJQXKQHCQHyaGkRHKQHILkIDlIDpKD5CA5SA7tJiXlcSA5f7eXg/+T9/7lvTQoOQ0+ofx3VALJQXKQHCQHyUFykBwkh5KS8mhKTlVgGvzvRp9QfTJpc3n7bcFGk9n8ITOTiCdLzjwzSix33CFYTxwDQugr2BSsqVOFtWuFiOEltl2XuoOhP3WCNf22qgEDBJu3FDFN0Dlme/cKNuPuhBOixDQm4p0Sb757KmoIL70UJZXZejr1K7YIh3SrYPNm4ZVXhOgl1NruuHFREjGkZObMKLGRYOvWCda3230V8VTJ1q1RErG4xHTRBrX5YDoVb7vb/ecoVxHrAo28286bfutra/WmeS9e61GzmlpGlI8IM2xZU89aM9DMS7dvF+wa/epXgr2lcdddgo1xe+IJwY7ol78U5s0TbAJgK2K/Cu0A81NnJye/Rrla5/eVvR2QrpmvfRNynAweqH4a02B5OIFBbJAcJAfJQXKQHCQHyTmWJIf31Ckpj58/V2vwT9EO90kOkoPkIDlIDpKD5CA5SA6SQ0lJeSxJTv40JAfJQXKQHCQHyUFykBwkh5KSss1JzuEmCjT4FR2+k4PkIDlIDpKD5CA5SA6SQ0lJeQxLDtPV2ns6K57ZJZUucH7J/PlREgOVGFVir0cmKjb0zHQi4sWSkSOjZOlSIWJNyb59UXLggOBtvU/QklXFaVEyY4awZYtgjU2nToLtVcQS4ZAxFlgnY8LgshF7S/72tygxQbLWZeVKoTKIb4MiM9/i5BBiSol76amCNVS2G1deKdjNEDGvxFZlvlQZtvamcqvQOwQdpnfqqVFik9nMtU4+WWhECcwB8llk+aoM0wnzJZuvlbtHrSFvtYZx5ZJjXa+N28pXlc9ey8e45UdkFyW/oLXmp9luWB+fT96zVeV2kZPfG0Y+qK2WeOfL5s6TXiO+9k1IWx48QAiSg+QgOUgOkoPkIDnNkRzeU6ekbLOf5BCC5CA5SA6Sg+QgOUgOkkNJieQQguQgOUgOkoPkIDlIDu0mJSWSQ5AcJAfJQXKQHCQHyUFyKCkpkRzSdtOvnxCxoqRXryixtm/jxiixeWKrVkWJdduzZ0dJt27ClCmCd59do2TwYCHimRKTjT17BPO0iGuVccpzJddeGyW2V+YAa9ZESXQRXntNsGV3746SyhS7oSX790dJ5UzOKbHm25Tv0UeFimq+oUxUXlc2K3KAPgPtbKEyx2ySYHP5YqMio/ZseGDEMEFl0ibg9e4t2M1QWbPchDal0IyoRUPPrJG1R62vraUTtmw+9soOIZ8IZ11+bnF2NvLONReG/OTkQpgfr/lhflHsiHIHyJe1AXH5Aebkp90ezWf61bJHG0xnnmbWmitffgPbXil87ZsQBg8QJAfJQXKQHCQHyUFy2pvk8J46JSWf5BAkB8lBcpAcJAfJQXKQHEpKSiSHIDlIDpKD5CA5SA6Sg+RQUlIiOQTJQXKQHCQHyUFykBwkh5ISySGkGXlB0ZFZ/aPE5phZTjpJ8FFsg5SOgk39evJJoTL0THpTex28/nohugm2VzbnyvfZB8TtVFaXuE6cINhObt4sVE7sAuXyknHjosQm4EX3EOKvip5Jvb4uDH0FM147Vzb0zOa2+WQ2UwI9z2YXGzYIpl5xnqJD3jp3jhI7ObbmiPEl1kBGTBV0u6ecItiZPP10YepUwVuuWtO3cnIHyIUhH6j1m98I9mg+fStvr1vS9Oeryu0xd568j8+XreUeeaeeD8TLl7XDr+WWuabmOlFLJu2I7NF8VbkPpzcSX/smpE0PHjiYQgiSg+QgOUgOkoPkIDkNSg7vqVNStt1Pcg4266H3nqKh70dykBwkB8lBcpAcJAfJoaSkbBuS0+BnOE2TnKQkSA6Sg+QgOUgOkoPkIDmUlJTtR3IO9wlP/o+2hgZX/vf/KJ/c9HUe7skEyUFykBwkB8lBcpAcJIeSEslpxEMO99/Ne/Lhnn+4RWrtAGlO7DXlvPMEb6CtoVRRic7Cpk2CvUqaitgMtOikxJ6Sysy3bcprJdZQnnaaEKcLJ5wg2Pg41yedJhfxbsm990bJwoWCWVyPHsLLLwtxmjBwoHCoRy7xyV1+Jl9RxpR06hQlEU+V2IC4JUuEiBEpixXRienToyRiV0n//lEyYoQQMV3oGUIMEQ6dkBK9r/x+1utru2EmZifWztUddwg2e62R1jx3j1oNZa1H02lUjcy5sn02xc+HvOUmZpP4bDfyxt2e/Oc/C7Yb+cg7W7MdYH4ItbQtp9ZINNvJWmPr8tl6tfwwv4HzK5hfo1r3ZGW6GiGkTQ8eaJnkNONDmKabUq1/b8Y6CZKD5CA5SA6Sg+QgOc2UHN5Tp6Q8Hj7JOdzfqjX4wUszjKiu5DR9BwiSg+QgOUgOkoPkIDlIDiUlktMKH5g0W2aa8UlOU3aeIDlIDpKD5CA5SA6Sg+RQUjJCusbXZlr4nZz8uzr5d3Ia3QGC5CA5SA6Sg+QgOUgOkkNJ2b4kpwX/M9CqJ1QnnjV7upo9OfmYiOlqRyM6b+rAAcEGeZ14ohBdBGs/zHkGDBCGDROs67UXr4jJJTNnRsn8+cKgQcLKlUKcqMRmZZTyojKnZPjwKLFz5cPW3MS0+dbtuuTomfQWWfcqYp4yq8SmydmZrHiL5PLLhYiZJePHR0l0FWx6XsS4krFjo6QyIG61IueqY8coMbeMU5TYW7JnT5TYn8beemuU2Pw0OxumXkOGCC+9JLhM1uryjbyhrLXmWs2oNZTWQNcaqJV3+bUGl+XUOt58BlotT8vPZO4PtUQ032d7QyufvZbPbas1484ebckBmrfkBmg7afrE4AFCjqHBA4QgOUgOkoPkIDlIDpLTDMnhPXVKyrb7SQ4hSA6Sg+QgOUgOkoPkIDmUlEgOIUgOkoPkIDlIDpKD5NBuUlIiOQTJQXKQHCQHyUFykBwkh5KSEskhbTZLlwoRm0p69owSm1Tm48Vs9toAYfduwZoiG00WsaBkw4YosXbT+umI50teeCFKzKa6d4+SFSuEyhi35YoZ0ZqSefOiJOIdZbIiruUHqBPD+vYVrCuI2K0MFc6Okm7dBGshbPTcpEmCzV57660oiR6KH++ikl27osRc+vTThT59hIhJylbl8RL3cD2x7sM6em716iixUWzWUJ15phDnCz7iL+9NczOxxs4ms+VtX62RWfksst/+VshNLG+v8+OtJRv5ucpbc8MO0M5zfgVbIle1djKfkGYn1tZsB2jL5naRH2B+BWudjVbckD7K174JYfAAQXKQHCQHyUFykBwkp71JDu+pU1LySQ5BcpAcJAfJQXKQHCQHyaGkpERyCJKD5CA5SA6Sg+QgOUgOJSUlkkOQHCQHyUFykBwkB8lBcigpkRxCamfMGCHizZL9+6MkOig6Isxnr9kQMJtz1UuwSVZz5ggmOdYyLlsmRLxQMnRolMyeLUSMVp4ssRfNRYuEOE0x5XP1mqjMVpaW2KSyxx8XbECc2dRJJwkLFgimE9FJePVVoV8/wZ4cMbJk4cIoibhSmV/y+utR8vbbgs2p8+36wLRlJSNHRknEa8rUkjVrosSUz25gG4lWudsnKMNKfJyano1G2k3rTfM5ZnmXX2tQW25EeVtvk6xqtdfmD7XGx9Vq61symS13y/xc5a25rcqmnNWyi3yOmXlLfjPkU87y025PbomZ1Lon7SZMt8vXvglpy4MHDsbBBDp5guQgOUgOkoPkIDlITsOSw3vqlJRt9pOcxGSaIjkHD75PIvS+bYggOUgOkoPkIDlIDpKD5FBStgfJafAzHCSHIDlIDpKD5CA5SA6Sg+RQUh6/klP+/77LsnymPafBh2zNByupLoVuIDlIDpKD5CA5SA6Sg+RQUiI5R0RyGvzUxSyoef9d/SQneYi8T5k/X+jRQxg9WojYoWxRZpXs3RslEdcLOrkrugs2fsrmiUWsE3TO1b59gk8qi5eUfSX+5JOFadOEiJ0lvqyamClBxCplnKKGYGPrzKZiTolPSOsrDB4szJ0ruJfG0yXueHozmJdWbpXpJQMHRsm2bcLGjYL58JVXCm6tXZSYorxcYjZl6jVrllAZLfiCslb5a4lNKTxwQGhknFrejOZNYT7WrNZ2aw1qy9dcqxk1bDfyncyxZfPdyFUz3+da9tiSAXH5hnJ7zEUldx77AW6J8v3614Jdo/xGyh9NTyxf+yakjQ8eeN8kp9EFm/LviA2Sg+QgOUgOkoPkIDltQnJ4T52Skk9yWldy+HM1JAfJQXKQHCQHyUFykBxKSiSnvUkOn+ogOUgOkoPkIDlIDpKD5FBSIjlHcIT0kfhOThP/XA3JQXKQHCQHyUFykBwkB8mhpERyxGRa8j8DrSs5daerJX+cxp+rHe30F6zPswFiK1YIZhcRe0s2bYoSmwl27bWCTaOKWFLy179Gib2kmre8+26URNxYUtnuJuWdEnuVtFbVZpHZgLjoo8RWZbmgKtKxoxDxlKBN/6FfFCWvvCLYBe3eXbBWrTI9Tzr1F1+MkjhBMePVy21iZvPidu8WbEBc5ZeO6qIPW3u2xM5G5Y6VYXp2FXzZWFFiomJq3b+/ELFIWS9Yn1fLavLeNO8vc0PIR7Hlu5FP0DKd+M1vBBu2ZhuyaWO5Ahn5k2uNNbNH7UzaIdjJyYfL2U7mwlDL8fLdsCPKZ83lA9Nsn2uZZ63znPtS7rR6RHztm5C2PHjgfQs2guQgOUgOkoPkIDlITruSHN5Tp6Rss5/kIDkEyUFykBwkB8lBcpAcJIeSEslBcgiSg+QgOUgOkoPkIDm0m5SUx73kECQHyUFykBwkB8lBcpAcSkpKJIe04ezaJURP4dRThYiZJfPmRckJJ5s9AisAACH5SURBVAgRu0vuvTdKrN20VysbxmWvsHG2ULGat0r27ImSbt0E6+NfeilKIiaVWC9uXa+t6o03osSHj3m3PbekX78omThRsNO+f79gzhPnKLGnpGvXKPEn+04uKJkxI0oiNpQsWBAlJrE2Ic0ePfHEKDn5ZOHRR4WIwSUDBkSJW1y8W2Kz5mycWufOQgxUYoYyv2T8+Ch55x0h4oCQz+bKO8harXnuPPl4sbzbriUbtpP5EZkDWKuaC2GtLr/Wac/totaqcrfMV5X7YW4m+Z2TO08tubIjyncjd9p82fxmSKfJ8bVvQhg8QJAcJAfJQXKQHCQHyWlvksN76pSUfJJDkBwkB8lBcpAcJAfJQXIoKSmRHILkIDlIDpKD5CA5SA6SQ0lJieQQJAfJQXKQHCQHyUFykBxKSiSHkNqZOlUYO1awVrVLFyFiv/JGibX1vXoJb78tRGcl7i3p0SNKbFU2e836+I0bo8Scx3rTiJ3K6yU2miwGKL6sjERbujRKKg6wrMR20rr8deuEiLWKzqnT6XnWM0TMKzERtXvDzrOtypTgb38TbMadeenllws2mc12w8bWVTx8aMmbb0aJnedRo6KkMk5tcoldfTPPiHUlEyZEicnVli1R0kg3lne9tQaI5bO50vFTjRiCddv5staLW6v61FOCPTn3FjvA3KZs2bytrzW3zVaVq1fuPPkcs/zw8xspv69szfZugT36xBNCfhPacMxf/1qwy21Pzm8V26t89poeEV/7JqQtDx64seNfElq9Meb/loPkIDlIDpKD5CA5SE47kRzeU6ekbLOf5CQm0xTJqfyPKN5XybG1YVBIDpKD5CA5SA6Sg+QgOZSUSM7/M5kGP8NpouTU0owjKjkEyUFykBwkB8lBcpAcJIeSEsk5gpLT4Cc8jT6h/PfDfWSU/EtTtt70jRIkB8lBcpAcJAfJQXKQHEpKJEcMpMH/bvQJDT75cFupu/UGjetwGkayLFsmmOREvFZiL4vnny9EjC7ZuTNKIraVLFkSJTZebMSIKLEpZ9b0226sXSvYSLQDB4SIEcouQQ0hTlZiScmrr0ZJp07CIZ1UNisvl2zYECU25WzuXKHiS+KHU6ZEiR2gDWqLMxU9wMq9Ixdl+PAosQFxEWNK7MmuBD0Ek6uZMwU3k15CZVzeW8oqZZqyr6QyIU28pW/fKLEfnIhFyl7BOkjrxmo1o/lgK+t6bbv2aK35adbW56vK99l601wn8sa91snJJSe/Cna8hh1R3nzbsvkcs3z0XH7J8mF6thtmF488ItgwwVrYlMbHHhPstOdnMh8tmKomX/smpI0PHmih5DT6iU2DOtFEb8nNqhny0+yNEiQHyUFykBwkB8lBckRyeE+dkvJ4+CTncH8t1pIPZ3Kbai3J4c/VkBwkB8lBcpAcJAfJQXIoKZGcaLarNGPBI/SJTVO2RZAcJAfJQXKQHCQHyUFyKCmPuxHSjX4r5nB/rta87+Q08ZOcfIV8JwfJQXKQHCQHyUFykBwkh5KyPUtOS/5noFUlSKaftcp0tQY30YzZbvy5Wssjjd2iRVFy/fVCxPYSe01ZtUrIh3H17i3YKLborcSEElOgXbsEm7hjjawNELMZWaZA69cLd9wh2PQtmxdn/nDOOUJ0EXy8WPytZPr0KLFOJmKBskNZrrxYYjPQ+vQRTjxRqGjbbsVG7T1e0hIzGTlSiFhcMm5clJjTmnjb2Lpu3YTK8MBnS9w8401BZ76tWCFEX0VPTiPdmHXbdvnz9joXlbxlzMd85RPDbEPWT+ddfj4xLHeP3JdyTPnynbRHc2HIr2B+RPmEtHzmm23ogQeE3D0mTxbsV6E5T36b1RoQV+u050P88ouie8XXvglpy4MHCEFykBwkB8lBcpAcJKc5ksN76pSUbfaTHEKQHCQHyUFykBwkB8lBcigpkRxCkBwkB8lBcpAcJAfJod2kpERyCJKD5CA5SA6Sg+QgOUgOJSUlkkPabuyVfflyoVcvIeLyEptyVhmYdqCkQ4coidhQMmpUlNisqspuDCuxztXc45RToiTi+pItW6LEJrNZm9uzZ5S04lwv69QjhpSYH0Z3JQYrMl1t//4oqRzgSEVGwM2fHyXRT7BBfEuXChHTS7p3j5LopviUs1nKs4ocr93AphOVAYA2L07WbJMG7YJG7FRWl5guWoto7x34EeVtfd6a50aUjxezBjpvN+1E5+21rco2ZN1nPvPNzsb27cJ99wktGfNlfP/7gm03P+3mALnG5FaTT0jLz7NdwV/8QvjBDwT7aV+8WFi4ULjnHsEmPN55Z4a9/WOP2m4Yt98u2G7YTtq9Ye9vKXztmxAGDxAkB8lBcpAcJAfJQXLam+TwnjolJZ/kECQHyUFykBwkB8lBcpAcSkpKJIcgOUgOkoPkIDlIDpKD5FBSUiI5BMlBcpAcJAfJQXKQHCSHkhLJIaR2TFQi3imx1q3SjF5ZsnNnlESsKPFmVDtmW3PHjlFiTaENxbJ9joFR4gd4gmAHaGt2udI1R2xUpK23wXSVbnt2SeXUyZpNrioj7+TJrhO2z/0VPRsRIxQ7QJknlk/ec0HyNcuqtm2LknxVEyYIb7whxGnCjBmC3ZPmwzZNLuJRRVI5/AnKaMWij951V0atHnHuXGH2bOG73xVspqGRr9laZGs3rYm0Jtia0fvvF6w3NcwX087V93nWLMHOxre/LdhAQDs5dhWs+bbt2pPths6FwR419/je9wQ7ObYhmw6Zq4it2a6Rbcj2ysa4Pfhghg0itLfKjG9+U7DhmHa8dufYHavnma99E9K2Bw/8JaX1c/Dg0RGvg/8T3ATJQXKQHCQHyUFykJzWkRzeU6ekbMOf5PylWQ+JObyXoyU5ja4TvUFykBwkB8lBcpAcJAfJoaQ83iSnwc9w/lLXLpriEkgOkoPkIDlIDpKD5CA5SA4lJeUxIzn2Lw1+yHO4D38SX2r086L3/vHv/2HPrC5b99MnguQgOUgOkoPkIDlIDpJDSYnkRFUqGv3vWutp9MlV+Wn6CklTcrkySpFYp37SSULEcMUyPGWykjWFlVlkdRpKPd4rr4yS1atr0LWrUJm+JbEn23aNiBcSKtu1yG7kG6p1vLWw3XjhhSipHK8OiBsQCZVldytiU/mGKo/OVwan3KjIozbUrpHLbU2/9ZfWuFuvZsvefbdgvmRdYO4etUTFGkqbtWctsh3gVVcJH/6w8JGPCGedJQweLAwfLnzxi8JXviKYLttEvFtuyZg6VZg2TTBfMm67LWP6dMHWPGWKcNNNwg03CId6iBJ71A7fDtC2e+utwne+I9h7CaYituabbxbsEL76VcEOYcwY4eqrBZvRecUVwqWXJvC1b0La/OCBIyU5R/Tfm72SZvyJHUFykBwkB8lBcpAcJMclh/fUKSmP209yGvxTMSQHyUFykBwkB8lBcpAcJIeSkvKYlJxaswqQHCQHyUFykBwkB8lBcpAcSkrKNjFCOp8WUOu7Oo1+baaJgwf4Tg6Sg+QgOUgOkoPkIDlIDiXlcS45zf+fgeZzz2pNV7OpaC2ZrtaUf2e6Wktj3af1prX62l27hDzWnNS6Qd99N0oqse7T5npZrk2xkVmZPlWUb6QiGTFCqOyk7YZF9qpHjyiJGKpkx+vj42LM+8XGlGlKtqp9+6LE00nReYAV/CopY5Vcre3JtqFhwoUXCtbH27w8Gxf42c8K1l9aj2gOYLI1cqRw0UWC9YWjRwvXXitYL57LVT4xzJY17MlmgCZXtl3DJoalw7ji+98XTAhtJ226mmHnatAgwa6Cicp11wn29k/uPF/+smCG8IUvCBdfLNhefe1rwqRJgu2kOY95uI2Ay+fU2UQ4W9augvm/PsrXvglp24MHjrGgJUgOkoPkIDlIDpKD5LQJyeE9dUrKNvxJzrEkNnz2guQgOUgOkoPkIDlIDpJDSUnZfj7AwXCQHCQHyUFykBwkB8lBcigpKduP5BAkB8lBcpAcJAfJQXKQHEpKSiSHvK8ZUmKtS/7kSgOaD1uzMW7y5DlzomTlyoyIFxNmzYoSz0AljXVB69cLeZYtEyw2nahWbAySpUMHwY0nvb62bL4qv7raMp1wgpDn0UeFJUuEPNZtVuanSayfrEzty2JOa/ogv7srv779bFgDbaPJHnxQsF7N2r589pq1fffck2FTv6xzveYaweaY2eUfP16wrvcznxFOPVX40IcEm75lLbLNf+zYUejXTzC7+Pznhc6dhdNPF+xNGnv03HOFyy4TTESHDBFszbaTJnV2f9uq7HLb76CxYwWbcbdihfCjHwkmSLbsAw8IP/6xYAdoT163TrDZa5dcItgRbdwo2K9+0/If/rCEr30TwuABguQgOUgOkoPkIDlITnuTHN5Tp6TkkxyC5CA5SA6Sg+QgOUgOkkNJSYnkECQHyUFykBwkB8lBcpAcSkpKJIcgOUgOkoPkIDlIDpKD5FBSIjmE1M711ws2n8bStatgI8Ksk7HYjCib9GNNkcWaE2vNrVW1WNtjjWze19qy1rmOGSNE7C6x5tN64unTBfOlxx8X7LRbY7N2rTBsmGD7bJ3qmjWCPdnmeFkLYU+eOlWwPn7LFsGS33WbNgm1lvV91tx6q2AXxdqtfLvWi+YCbOPEYsMGwWTD2vqHHhI2bxbMiGy3TNN//nPBlrUrasvadu1O+s53BFNPu6J2B+cD0x57TLBTZ0PPzPFsWbtItpP33SfYz6TdWLYhW9YMwaZSarftV8FkwwTYuvz//E/B7ML2ypZ9+GHB3kkyX7K9sifb8doVtFvFrr5hZ8Mu909/KtiJtZ20ZRW+9k1IWx48cDCFECQHyUFykBwkB8lBchqWHN5Tp6Rss5/kHGzWQ//7nEoafX6zm+paG2rKtvhfiyI5SA6Sg+QgOUgOkoPkUFK2W8lp8DOcJkpOXVFpieS0rqIgOUgOkoPkIDlIDpKD5CA5lJRITlM94e//bp+6VD+HafBph1tz8oQGP+HJt1LrQyGC5CA5SA6Sg+QgOUgOkkNJieRkvtHg05otOVV1SZ6Q7AypF+t6ly8XGmnONPbyZMO4bFl71Jpge3TVKsEaaHuFtd7UXvisG7EXOxvkZRuyQ9i6VTj7bMGWtQ1FHFAk1slYQ5VPObMraBfFXCs/VzblrEsXIdcJ6wltYpZl+3bB+mebXJWLiu1z//6CPWq/L+1GGjhQyGPn+fLLBYuph++WnUq7Ktb2WctoPyrWuT7yiGA35c9+JtiGzB/yn7qf/ESwVVkvbtu1nbSfOlvW7hW7+++/X/jlLwV7ssmVHaD107ZXNsjLJobZTtrJmTtXsHNl27X7LJ/LZxfFfsmaA9g+m6jYbti5srNh96TJpL2/ZZMl7W63VU2cKHz964Ld7cbNNwv6Q8jXvglp44MHWig5DX5VJhGSJnpL07+T0+hKam2FIDlIDpKD5CA5SA6S0yTJ4T11Ssrj88/VWl1ymrctJAfJQXKQHCQHyUFykBwkh5ISyTk6klN+fwbJQXKQHCQHyUFykBwkB8mhpKQ8OiOkW11ymrjOw32xB8lBcpAcJAfJQXKQHCQHyaGkPN4lpyX/M9BmfCcneVotcTrcbjTdrJiu1qJYQ2UTd/LYi6a9lOex17JcriKeL8m7/Ho/K8d35swR8rzyilD3/3hVplMnoZLMAG0eYK3ra+Zpd53ZlA1b69ZNePJJYehQwSYN2k/K7NmC74e1m2PHCtddJ1gvbpOsLrlEuOwywX7abbzYhRcKd94p2Ow1G4DYsaNw6aWCjUc891zBYm79qU8JPXoIFtuNT3xC+Jd/ESwf+pCQb3fwYOGaa4SLLxY++1nBlrXTbo9+6UuCTVo880zB9vmCC4TPfU748pcFcw+7r+66S7DJe6ZednubXJmJmcXlzmPj48zEnnhCMJdW1eRr34S05cEDbTBYB5KD5CA5SA6Sg+QgOceA5PCeOiVlm/0kB8MhSA6Sg+QgOUgOkoPkIDmUlEjOkdIbDAfJQXKQHCQHyUFykBwkh5KSsr19kkOQHCQHyUFykBwkB8lBcigpKZEccjQyZowwc6ZgL0+GDYmy0WT5LB9riuzRTZsEsxrrkcaNE+xF02J9nU3rsTlAFttJi3WbNjHr/POFSpYrmn7Cvn1CLanL/XDYMMGebB2U9d5mJgMGREnE2yX5rDnrc0ye/RqlVpP3wHGKEn9V3PJKXn89SuIEJc1rrwnxi18IdvfnndzPfy7YVDvr8+xn8rHHhPxRezvEHrXdsJ206/3QQ4JNwbKRaPZrxeZ6mXp961uCPfrVrwomG2ZTI0YI9stu1CjhYx8TzjpLsFl73/ymYCPRTBhsypndG//1XxnW1tuvJPtBsp86u9z2qF1BO4T58wU7kyZX9nvE3h744heFG24QbLTi5MmC/XL/xjcEfTJf+yaEwQMEyUFykBwkB8lBcpCc9iY5vKdOScknOQTJQXKQHCQHyUFykBwkh5KSEskhSA6Sg+QgOUgOkoPkIDmUlJRIDkFykBwkB8lBcpAcJAfJoaREcgipnw6K5sABwTq57dsFy7vvCpadO4VGlrWdzBtKfdQUqB0QsVkZkmD9hvlSxJySY+LwbejZ7t0ZffoItR41bDKbUdG2uSXdu0eJ2YQ3Z9ZPG3b8c+cKNrjta18TbILWodeYkptuEmyQ16RJgu2GtZs33yyYTtSKTUizoWc2Ic2u6NlnC//+78LAgcJFFwn5YLqrrqqBSY6NRLviCsGebA5gV8EadzvtdvVtLqGN6bO3jkw27FFzPDs5Nk3O5sX17y/YCDi7ZOecI9gVNOydpPPOEz75SaFXrxK+9k0IgwcIkoPkIDlIDpKD5CA57U1yeE+dkpJPcgiSg+QgOUgOkoPkIDlIDiUlJZJDkBwkB8lBcpAcJAfJQXIoKSmRHILkIDlIDpKD5CA5SA6SQ0mJ5BBSO7X6y4OafM0H00TMLrFBXhV9GqGkJqZ5+mkhN6J6Quh+uE3JlrXXbmtN89iMu1xTKwe4rrXYujVK7FFr5PJVzZoVJZUnXKnIo9bWNrLbPUKwRweGkK/KJ7PJ/ex3e36NOnUSLJ07C5/+tGBj7C69VLCO2frpkSMFa80HDxas6f/CFwQbXGZTzmxoo40XM6xxt99Bpl72qC1rBnjHHYI92QzQlMCefMstgmmqYU/+zGcES9euwhlnCIMGCSZmNovMxpqNHi2YqJji2vHa2bBzZT/tdquY4prVXHCBYCryz/8s2IRHu/p2E9pOmonpyeFr34QweIAgOUgOkoPkIDlIDpLT3iSH99QpKfkkhyA5SA6Sg+QgOUgOkoPkUFJSIjkEyUFykBwkB8lBcpAcJIeSkhLJIUgOkoPkIDlIDpKD5CA5lJRIDiH1Y01wC+aY1eu2W2IXtUSlJY/GgSOGNc2PKvuUlmwoM89GznOtS5YbYEuWbcl91ZI7J93JyvDAt5XBJfZkX3bMmBoMHy6YqJgw2GQ26wKtR7RG1gZq2YZMNkyuTOJt7JXZ1A03CLaTw4YJ//RPwllnCUOHCtZ82xFZW2+7YX5oh2BDwD76UcGWtSl2dkFtyJsNHzMHsGv09a8LJle2oXPPFWwGmp06OwS7ZJ/7nGD3hrm0ebhtyFZlFmeP2l59/vOCDVuzwXSm5epLfO2bEAYPECQHyUFykBwkB8lBctqb5PCeOiUln+QQJAfJQXKQHCQHyUFykBxKSkokhyA5SA6Sg+QgOUgOkoPkUFJSIjkEyUFykBwkB8lBcpAcJIeSEskhpHYqvRo5ClmyRKiVWiPvWnHZfKhdK95mLVm2coDpBLx0WWuZai372mtR4rGhWDYVqm9f4YMfFI7z2MkxPvABwWJTzi68UDj1VMFy3nmCtfWnny5YbNrYV74imE1ZzHlMckwIbY6ZDXmz6WoWG+J3222C7bPdk2aANtRuwgTBrNX0+PbbBRNgu0b9+gm2XZv416tXCV/7JoTBAwTJIUgOkoPkIDlITnuTHN5Tp6TkkxyC5BAkB8lBcpAcJAfJoaSkRHIIkkOQHCQHyUFykBwkh5KSEskhSA6Sg+QgOUgOkoPkIDmUlEgOIS2Nda4vvijUWnb7dqFWU2gvT7WWteE9ed5+W+jRQ8izb58Q8ZaS5Y03hIjnFMmuXULE44qmt/DMM0Ijy8Ya5XklW7ZDB6Gyz1sVy46SLVuiJOJJxXJ9yZNPRknE00qWyh1rh59lxw6h1rLeFM6ZI8ycKZxxhvDxjwvf/rbwne8ItuwnPiFYI2vYk/v0EWbNEmzZfLt2gLbP9mRblTXBaSPr58r2+dZbBZsXt2iRYBuyIW82xm3xYmHGDMGWnThRWLVKsH22tv7mm4Uf/UiYNk3o3VuwZX/8Y8H22ZY117Jl7fraL1nzlrVrBTvPtqydq/XrBbuRunUT9BrxtW9CGDxAkBwkB8lBcpAcJAfJaW+Sw3vqlJR8kkOQHCQHyUFykBwkB8lBcigpKZEcguQgOUgOkoPkIDlIDpJDSUmJ5BAkB8lBcpAcJAfJQXKQHEpKJIeQ2nn2WeFQR63kkdY8HylUs0eskRUrhDxr1gi1sm6dUCsbNwp1r5JSK5k+NZY6nXprbrclyx6tc9WCZR9+WJg8WbDxUzaKze5+a2Q//GHB3gBYulQwMzGNsZlgd90lTJ0q9O8vWBP8ta8JNjHMNOZLXxKuv14YPFjo2VOwgWk2tm74cMGaYDOiq68WRo4U/s//Ef71XwU7hHysWefOwjXXCGPGCPmy5g926vJlbX7addcJ+bK2oXxZO3W23XHjhHy7do3sJ8XSsWMJX/smhMEDBMlBcpAcJAfJQXKQnPYmObynTknJJzkEyUFykBwkB8lBcpAcJIeSkhLJIUgOkoPkIDlIDpKD5CA5lJSUSA5BcpAcJAfJQXKQHCQHyaGkRHIIaY7mtKApPAZyME3Llp0t9AjhKMUmOb1vqYxTy/Luu0KePXsEy6ZNgsUm/lkWLBD27xcsy5YJte4cf3iAMmiQ0A7StatgQ8AuukiwOWbGFVcIX/iCYI3sxRcLffsKJ50ktGK6dxdOO00w1bRheobl85/PsDeWrMu3++ryy4VJk4RPf1qYMEGwJw8ZItgcM7uCNvHPdsOU3mbc2fGah9sUO7s37MlXXinoXvG1b0IYPECQHCQHyUFykBwkB8lpb5LDe+qUlHySQ5AcJAfJQXKQHCQHyUFyKCkpkRyC5CA5SA6Sg+QgOUgOkkNJSYnkECQHyUFykBwkB8lBcpAcSkokh5Bm5HVFcscdguWtt4S8c33pJcHy+OOCzUzKO8hVq6LE8vzzQp4NG4R8u48+GiUtib3+5lm+XMizebNgefllIb8oeXr1EixLlghHS3G3b4+SWsZ7BDNrVobd39/4hjB/vrBokWDd50MPCdOnCzffLNjcNnvUtnv77cKhV6+ShQsFm75lA7XuuUewOWbWud55p2D6ZAdoTfCnPiXYAZpc2Qi4sWMFa/ptnNpllwkf/ahgA9M+8QnB9vn88wU7OSY5tqHcl1oxNlzOzqTpk428O+ssoSWxM2noBeVr34QweIAgOUgOkoPkIDlIDpLT3iSH99QpKfkkhyA5SA6Sg+QgOUgOkoPkUFJSIjkEyUFykBwkB8lBcpAcJIeSkhLJIUgOkoPkIDlIDpKD5CA5lJRIDiG1s3KlYJkyRbA0NiPrVaXWss8rtZY9IJweJTt2CIf6fGV+ifVIGzcK550nmC6aAo0fL1ibZ7GWqZJ3FMm99wqV7FYsO5UjJRutuObVq4Vc2i179wovvih06CDkWbtW8JswjzXQprzWjFp7fdVVgt1Y11wjWENp7bV1n7ahm24SbM02qG7ePMFG/t1/v2C3rL2zYvpkj86cKZjU2aO33CLYXC9zLTt80wnzFpsnZr8aLrlEsKFnI0YI9qjdGx//uJDPizvnHGHcOMFuhj59BItt1+66oUMFO1fTpglm6WatdquYHtsbPD/4gWA3sP0s2M2gl5uvfRPC4AGC5CA5SA6Sg+QgOUhOe5Mc3lOnpOSTHILkIDlIDpKD5CA5SA6SQ0lJieQQJAfJQXKQHCQHyUFykBxKSkokhyA5SA6Sg+QgOUgOkoPkUFIiOYTUzsSJwhFsZHsqLcoeZZIyQ5kuHLKRkri1xF5SI2Yppm1TlEWKbLcyx2y2Yq35ZGWCMlFZqsh23347SjwnKzFNWaLY2bC9kmWtV6kc7zZFjveZZ6IkYmZJRSdkN7p1ixLbq8rdbntlx6vXd1AIvqzdDBY7seuFz3xGsIFa1k/bGLt/+AfBpm+ZWxvWx48aJZxxhmDq9cADgrmmvXeS96Z33y2Y89iaf/xjwcb2/fCHwtKlwoMPCjY+7j/+Q/jJT4Sf/Uywu9Am4NnhP/KIYIdg2JNtVWvWCD/9qbBunfDww4LtZL5dO+0/+pFgT7Y159gR2Wm3Ddnx5ifHhmPaNbKTo/fksfhF7aGEtKPQjRMkB8lBcpAcJAfJQXJaX3La5lvdueTc2PEv70FJeUyXdOMEyUFykBwkB8lBcpAcJAfJoURyCEFykBwkB8lBcpAcJAfJoaREcgiSg+QgOUgOkoPkIDlIDpJDSYnkkHaSiqhMFU4KwR6NYYr1xFsVTQcltpf07h0l7i0ec54bE7ZsiRJznoiFitiFzS6qmImpiDTBlcldImbWE1bOpOV65RVFdqN//yipnMnliuyzDZczu+jSJUoixgv9QmhECVYpcgjvvBMldrn3748SuygV5bPdmJDyjDJTMY3Jb1G9D+16Wy9uXaD1tdaMGtYU2oasR3zoIcFaZOs+Desvbbbg+vWCrdmaUWu+rc01bzEjMn2yR+09DFuVYRaX+5KdOlvWHrWLYs23Ha+Rq5eddrMLW5Vt1/Yq30nbrl19uwntXNldl6/KjtewnwW7c2yf7TZT+No3IQweIEgOkoPkIDlIDpKD5LQ3yeE9dUpKPskhSA6Sg+QgOUgOkoPkIDmUlJRIDkFykBwkB8lBcpAcJAfJoaSkRHIIkoPkIDlIDpKD5CA5SA4lJZJDSDMyVLFebZ8i3fZpp0VJRSHGKpIdO4TGul5pVadNixJrRl94IUqsRR4+PErsiCozweyIdCiWOp69stuZ7NMnSmyfO3eOEmvc58yJkopb2iUzmRR9sm6zInUmOXJyFiyIEt+ua4x0+TYSzLfbKQT1h4oQylizffuipJ4Qdg1Bb7PKaZfYGLMWxRo76wLnzxfuuUewtt56U3vUsMbdesR8gJg17nfcIdg+33mncPvtgk1X+/73hUWLBHvyvHkZ9uS5c4X77hPsh98EyU67HaCt2Y539mzhttsEO3V2cmxZOxu2k/Zkw3bStmtPtt2wZb/7XcH2ym4zu6CGzcezq/C97wlmj/aoTQv84AeF/FWQEMLgAYLkIDlIDpKD5CA5SE47kxzeU6ekbHmJ5BAkB8lBcpAcJAfJQXKQHEpKJAfJIUgOkoPkIDlIDpKD5CA5lJRIDiFIDpKD5CA5SA6Sg+QgOZSUSA4hhBBCyPH0Vh/tFyGEEEIIIQTJIYQQQgghhBAkhxBCCCGEEEKQHEIIIYQQQghBcgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIeR4zf8FEqpFku6aqDgAAAAASUVORK5CYII=2e:T820,w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K92f:T820,w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K930:T820,w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K91b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"job_id":"5adb25aa7ca3e128295cf997","environment_id":100,"environment_description":"Windows 7 32 bit","size":339968,"type":"PE32 executable (GUI) Intel 80386, for MS Windows","type_short":["peexe","executable"],"type_short_id":"exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"9afb2870-sample","md5":"08d78deba297c5f83213bbed9a428ecd","sha1":"b8600a5e3a6e1690f32077b78cee44427f64aa74","sha256":"737edb7dd8ba6a9a2c54eed0a4e806c8d344e17e13427afed0b24a724af51939","sha512":"b6e9e64b85e0623b594c57490c932ffefec2c190c34381476340f2cb44adeb77dff5ffbcd1061635cf570e84c10cf7e0da5a59b81afa34f5621586e6c5e4d924","ssdeep":"6144:3J+HqZBIE03J4oaUyqfpd9AtuJmYs0zl4pPk5PAk1rtIKjmBaFE:3J+Hq6ioaUzfjkusYJh4pcRAkttVmBwE","imphash":"bad5743b77280b9f5d650b3616fbb39c","entrypoint":"0x30012cc","entrypoint_section":".text","image_base":null,"subsystem":null,"image_file_characteristics":[],"dll_characteristics":[],"major_os_version":null,"minor_os_version":null,"av_detect":69,"vx_family":"Trojan.Generic","url_analysis":false,"analysis_start_time":"2018-04-21T13:51:25+00:00","threat_score":100,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[],"is_certificates_valid":false,"certificates_validation_message":"No signature was present in the subject. (0x800b0100)","domains":["siiifibiiegiiciib.ws","siiifibiiegiiciib.su","siiifibiiegiiciib.ru","siiifibiiegiiciib.nl","siiifibiiegiiciib.kz","siiifibiiegiiciib.in","rohgoruhgsorhugih.ws","rohgoruhgsorhugih.su","rohgoruhgsorhugih.ru","rohgoruhgsorhugih.nl","rohgoruhgsorhugih.kz","rohgoruhgsorhugih.in","oeihefoeaboeubfuo.ws","oeihefoeaboeubfuo.su","oeihefoeaboeubfuo.ru","oeihefoeaboeubfuo.nl","oeihefoeaboeubfuo.kz","oeihefoeaboeubfuo.in","oeabocbeogoaehgoi.ws","oeabocbeogoaehgoi.su","oeabocbeogoaehgoi.ru","oeabocbeogoaehgoi.nl","oeabocbeogoaehgoi.kz","oeabocbeogoaehgoi.in","iapghahpnpnapcipa.ws","iapghahpnpnapcipa.su","iapghahpnpnapcipa.ru","iapghahpnpnapcipa.nl","iapghahpnpnapcipa.kz","iapghahpnpnapcipa.in","goiaegodbuebieibg.ws","goiaegodbuebieibg.su","goiaegodbuebieibg.ru","goiaegodbuebieibg.kz","goiaegodbuebieibg.in","eghoabeogbuaeofua.ws","eghoabeogbuaeofua.su","eghoabeogbuaeofua.ru","eghoabeogbuaeofua.nl","eghoabeogbuaeofua.kz","eghoabeogbuaeofua.in","ageihehaioeoaiegj.ws","ageihehaioeoaiegj.su","ageihehaioeoaiegj.ru","ageihehaioeoaiegj.nl","ageihehaioeoaiegj.kz","ageihehaioeoaiegj.in","aefobfboabobfaoua.ws","aefobfboabobfaoua.su","aefobfboabobfaoua.ru","aefobfboabobfaoua.kz","aefobfboabobfaoua.in","abvainvienvaiebai.ws","abvainvienvaiebai.su","abvainvienvaiebai.ru","abvainvienvaiebai.kz","abvainvienvaiebai.in"],"compromised_hosts":["220.181.87.80","173.230.130.175"],"hosts":["220.181.87.80","173.230.130.175"],"total_network_connections":2,"total_processes":5,"total_signatures":58,"extracted_files":[{"name":"gwhroqkhwu","file_path":null,"file_size":341308,"md5":"a010fe45a1198e2b0c54c34039abbae3","sha1":"ce17bdac8b4856defee28c27309cbb28e5066600","sha256":"3053ae22aec4e737cebee0967b0bb48352673a9ba02c7329256ed252860ff87a","sha512":"547451c17281f4785b6c3bf0826cacf08b58d9854486cd9c804f45ff0db9ce68568efaa5187ed399edc38d9689d6013a4ae072782e417d013896b6bdac46b226","type_tags":["peexe","executable"],"description":"PE32 executable (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Trojan.Generic","av_matched":58,"av_total":68,"file_available_to_download":true,"download_link":"/bff/report/5adb25aa7ca3e128295cf997/download/dropped-file?key=79baca530723561bb521382cc484acc8dbee1258e66ad23a51f3ea9d5208588d9cc3d0f2e25f0c4b9d564bdf28d55ee2a6bba61cf17fda66f307f9418500246cbd55d69cae","submit_link":"/bff/report/5adb25aa7ca3e128295cf997/submit/dropped-file?key=79baca530723561bb521382cc484acc8dbee1258e66ad23a51f3ea9d5208588d9cc3d0f2e25f0c4b9d564bdf28d55ee2a6bba61cf17fda66f307f9418500246cbd55d69cae","has_overview":false,"extended_details":{"filename":"gwhroqkhwu","size":341308,"description":null,"architecture":"32 Bit","ssdeep":"6144:3J+HqZBIE03J4oaUyqfpd9AtuJmYs0zl4pPk5PAk1rtIKjmBaFEO:3J+Hq6ioaUzfjkusYJh4pcRAkttVmBwp","imphash":"bad5743b77280b9f5d650b3616fbb39c","authentihash":"875965e7ada9667c09d558857f2d0dd4d36f7d1f1de1322cf45c1cf09cf44ee4","entrypoint_bytes":null,"packer":"VC8 -> Microsoft Corporation","version_info":[],"file_sections":[{"name":".text","entropy":6.61920310576,"virtual_address":"0x1000","virtual_size":"0x2f85e","raw_size":"0x2fa00","md5":"e1766fca6b92eafd3533cbfcaa2a666e"},{"name":".rdata","entropy":5.1949466563,"virtual_address":"0x31000","virtual_size":"0x853e","raw_size":"0x8600","md5":"b3eeb639a30298cabaf62a2980d64513"},{"name":".data","entropy":2.25734133237,"virtual_address":"0x3a000","virtual_size":"0x4338","raw_size":"0xa00","md5":"716b9fcdf6b82f6e5f891871efb7f967"},{"name":".gfids","entropy":3.28178660328,"virtual_address":"0x3f000","virtual_size":"0x16c","raw_size":"0x200","md5":"78022499e82f94e71cb3af90d2681d3e"},{"name":".rsrc","entropy":6.93719496057,"virtual_address":"0x40000","virtual_size":"0x17fc2","raw_size":"0x18000","md5":"8548983c0a242dd761062ba25c6852dd"},{"name":".reloc","entropy":6.59458944084,"virtual_address":"0x58000","virtual_size":"0x1ed4","raw_size":"0x2000","md5":"0211e32e44ca24064d732092b4302f20"}],"file_imports":[{"module":"KERNEL32.dll","functions":["CloseHandle","CompareStringW","CreateFileW","CreateThread","DecodePointer","DeleteCriticalSection","EncodePointer","EnterCriticalSection","EnumSystemLocalesW","ExitProcess","FindClose","FindFirstFileExA","FindFirstFileExW","FindNextFileA","FindNextFileW","FlushFileBuffers","FreeEnvironmentStringsW","FreeLibrary","GetACP","GetAtomNameW","GetCommandLineA","GetCommandLineW","GetConsoleCP","GetConsoleMode","GetCPInfo","GetCurrentProcess","GetCurrentProcessId","GetCurrentThread","GetCurrentThreadId","GetDateFormatW","GetEnvironmentStringsW","GetExitCodeProcess","GetFileInformationByHandle","GetFileType","GetLastError","GetLocaleInfoW","GetModuleFileNameA","GetModuleFileNameW","GetModuleHandleExW","GetModuleHandleW","GetOEMCP","GetProcAddress","GetProcessAffinityMask","GetProcessHeap","GetProcessId","GetProcessTimes","GetStartupInfoW","GetStdHandle","GetStringTypeW","GetSystemTimeAsFileTime","GetSystemTimes","GetThreadTimes","GetTimeFormatW","GetUserDefaultLCID","HeapAlloc","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSectionAndSpinCount","InitializeSListHead","InterlockedFlushSList","InterlockedPushEntrySList","IsDebuggerPresent","IsProcessorFeaturePresent","IsValidCodePage","IsValidLocale","LCMapStringW","LeaveCriticalSection","LoadLibraryExW","LocalAlloc","MultiByteToWideChar","OutputDebugStringA","OutputDebugStringW","QueryPerformanceCounter","RaiseException","RtlUnwind","SetConsoleCtrlHandler","SetEnvironmentVariableA","SetEnvironmentVariableW","SetFilePointerEx","SetLastError","SetProcessShutdownParameters","SetStdHandle","SetUnhandledExceptionFilter","TerminateProcess","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnhandledExceptionFilter","WaitForSingleObjectEx","WideCharToMultiByte","WriteConsoleW","WriteFile"]},{"module":"WINHTTP.dll","functions":["WinHttpCloseHandle","WinHttpOpen"]}],"file_exports":[]}},{"name":"edakubnfgu","file_path":null,"file_size":341618,"md5":"38c683c2277ffec6b199035c9649b4b7","sha1":"9ede2b4b5550ced0d62efc1159acf2cf55467056","sha256":"81b22a2f5c51c30555b608ebe59f49ca9b929232f75f69375036e994300e54b9","sha512":"018b8d226384add634348de7e6e2b90fe2ab2c5c73f4bdb4ed08be5d3c5808852ecbf410ae25eabd9a81b9ed2c82eb0fad3ba17c1335733c6836927d3f002686","type_tags":["peexe","executable"],"description":"PE32 executable (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Trojan.Generic","av_matched":22,"av_total":67,"file_available_to_download":true,"download_link":"/bff/report/5adb25aa7ca3e128295cf997/download/dropped-file?key=a179ae523b7f8391b425b66f35b368d8dd57f905aa06fb2b8a44247bf3dcc8b5ffd2a212141baf8f8fb5b8c03207eb63aeed3d787d8e2132017bf96ef861accfb801753abf","submit_link":"/bff/report/5adb25aa7ca3e128295cf997/submit/dropped-file?key=a179ae523b7f8391b425b66f35b368d8dd57f905aa06fb2b8a44247bf3dcc8b5ffd2a212141baf8f8fb5b8c03207eb63aeed3d787d8e2132017bf96ef861accfb801753abf","has_overview":false,"extended_details":{"filename":"edakubnfgu","size":341618,"description":null,"architecture":"32 Bit","ssdeep":"6144:3J+HqZBIE03J4oaUyqfpd9AtuJmYs0zl4pPk5PAk1rtIKjmBaFE5:3J+Hq6ioaUzfjkusYJh4pcRAkttVmBwy","imphash":"bad5743b77280b9f5d650b3616fbb39c","authentihash":"e89899c3afaea79b5dc08ab208b236bef45fbc281180ff6e9b6bd8c3ca00de40","entrypoint_bytes":null,"packer":"VC8 -> Microsoft Corporation","version_info":[],"file_sections":[{"name":".text","entropy":6.61920310576,"virtual_address":"0x1000","virtual_size":"0x2f85e","raw_size":"0x2fa00","md5":"e1766fca6b92eafd3533cbfcaa2a666e"},{"name":".rdata","entropy":5.1949466563,"virtual_address":"0x31000","virtual_size":"0x853e","raw_size":"0x8600","md5":"b3eeb639a30298cabaf62a2980d64513"},{"name":".data","entropy":2.25734133237,"virtual_address":"0x3a000","virtual_size":"0x4338","raw_size":"0xa00","md5":"716b9fcdf6b82f6e5f891871efb7f967"},{"name":".gfids","entropy":3.28178660328,"virtual_address":"0x3f000","virtual_size":"0x16c","raw_size":"0x200","md5":"78022499e82f94e71cb3af90d2681d3e"},{"name":".rsrc","entropy":6.93719496057,"virtual_address":"0x40000","virtual_size":"0x17fc2","raw_size":"0x18000","md5":"8548983c0a242dd761062ba25c6852dd"},{"name":".reloc","entropy":6.59458944084,"virtual_address":"0x58000","virtual_size":"0x1ed4","raw_size":"0x2000","md5":"0211e32e44ca24064d732092b4302f20"}],"file_imports":[{"module":"KERNEL32.dll","functions":["CloseHandle","CompareStringW","CreateFileW","CreateThread","DecodePointer","DeleteCriticalSection","EncodePointer","EnterCriticalSection","EnumSystemLocalesW","ExitProcess","FindClose","FindFirstFileExA","FindFirstFileExW","FindNextFileA","FindNextFileW","FlushFileBuffers","FreeEnvironmentStringsW","FreeLibrary","GetACP","GetAtomNameW","GetCommandLineA","GetCommandLineW","GetConsoleCP","GetConsoleMode","GetCPInfo","GetCurrentProcess","GetCurrentProcessId","GetCurrentThread","GetCurrentThreadId","GetDateFormatW","GetEnvironmentStringsW","GetExitCodeProcess","GetFileInformationByHandle","GetFileType","GetLastError","GetLocaleInfoW","GetModuleFileNameA","GetModuleFileNameW","GetModuleHandleExW","GetModuleHandleW","GetOEMCP","GetProcAddress","GetProcessAffinityMask","GetProcessHeap","GetProcessId","GetProcessTimes","GetStartupInfoW","GetStdHandle","GetStringTypeW","GetSystemTimeAsFileTime","GetSystemTimes","GetThreadTimes","GetTimeFormatW","GetUserDefaultLCID","HeapAlloc","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSectionAndSpinCount","InitializeSListHead","InterlockedFlushSList","InterlockedPushEntrySList","IsDebuggerPresent","IsProcessorFeaturePresent","IsValidCodePage","IsValidLocale","LCMapStringW","LeaveCriticalSection","LoadLibraryExW","LocalAlloc","MultiByteToWideChar","OutputDebugStringA","OutputDebugStringW","QueryPerformanceCounter","RaiseException","RtlUnwind","SetConsoleCtrlHandler","SetEnvironmentVariableA","SetEnvironmentVariableW","SetFilePointerEx","SetLastError","SetProcessShutdownParameters","SetStdHandle","SetUnhandledExceptionFilter","TerminateProcess","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnhandledExceptionFilter","WaitForSingleObjectEx","WideCharToMultiByte","WriteConsoleW","WriteFile"]},{"module":"WINHTTP.dll","functions":["WinHttpCloseHandle","WinHttpOpen"]}],"file_exports":[]}},{"name":"phqghumeay","file_path":null,"file_size":341198,"md5":"f50087282f9f59925e6dea11db054855","sha1":"d7bc58d238468adf77f48f874f1003fa8039a783","sha256":"2424b198dea9396a6a654f638d83e5e646093667060ea3146810e259f78051dd","sha512":"55bbe56fc059e9d75c831a167460a452b4fbc527481c175321e3b04ccac10fedd9113013a95b139d3e5170ba23ee88fcd5602c7f72f78f3cd1a628826910b06a","type_tags":["peexe","executable"],"description":"PE32 executable (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Trojan.Generic","av_matched":22,"av_total":67,"file_available_to_download":true,"download_link":"/bff/report/5adb25aa7ca3e128295cf997/download/dropped-file?key=e6885266247531439ad0f00507c6c1295fead7f799a4af822e159f580a2d5ecf929581ce80d7bba62341873d4d6dae9dd864b66ba2480bb7d27d81f4dab259c94f1ef10d34","submit_link":"/bff/report/5adb25aa7ca3e128295cf997/submit/dropped-file?key=e6885266247531439ad0f00507c6c1295fead7f799a4af822e159f580a2d5ecf929581ce80d7bba62341873d4d6dae9dd864b66ba2480bb7d27d81f4dab259c94f1ef10d34","has_overview":false,"extended_details":{"filename":"phqghumeay","size":341198,"description":null,"architecture":"32 Bit","ssdeep":"6144:3J+HqZBIE03J4oaUyqfpd9AtuJmYs0zl4pPk5PAk1rtIKjmBaFEM7:3J+Hq6ioaUzfjkusYJh4pcRAkttVmBwt","imphash":"bad5743b77280b9f5d650b3616fbb39c","authentihash":"e9098fe6f0a2cf57b0214c98cc5edae22aba7ca292377c8f3d57264fabcbf015","entrypoint_bytes":null,"packer":"VC8 -> Microsoft Corporation","version_info":[],"file_sections":[{"name":".text","entropy":6.61920310576,"virtual_address":"0x1000","virtual_size":"0x2f85e","raw_size":"0x2fa00","md5":"e1766fca6b92eafd3533cbfcaa2a666e"},{"name":".rdata","entropy":5.1949466563,"virtual_address":"0x31000","virtual_size":"0x853e","raw_size":"0x8600","md5":"b3eeb639a30298cabaf62a2980d64513"},{"name":".data","entropy":2.25734133237,"virtual_address":"0x3a000","virtual_size":"0x4338","raw_size":"0xa00","md5":"716b9fcdf6b82f6e5f891871efb7f967"},{"name":".gfids","entropy":3.28178660328,"virtual_address":"0x3f000","virtual_size":"0x16c","raw_size":"0x200","md5":"78022499e82f94e71cb3af90d2681d3e"},{"name":".rsrc","entropy":6.93719496057,"virtual_address":"0x40000","virtual_size":"0x17fc2","raw_size":"0x18000","md5":"8548983c0a242dd761062ba25c6852dd"},{"name":".reloc","entropy":6.59458944084,"virtual_address":"0x58000","virtual_size":"0x1ed4","raw_size":"0x2000","md5":"0211e32e44ca24064d732092b4302f20"}],"file_imports":[{"module":"KERNEL32.dll","functions":["CloseHandle","CompareStringW","CreateFileW","CreateThread","DecodePointer","DeleteCriticalSection","EncodePointer","EnterCriticalSection","EnumSystemLocalesW","ExitProcess","FindClose","FindFirstFileExA","FindFirstFileExW","FindNextFileA","FindNextFileW","FlushFileBuffers","FreeEnvironmentStringsW","FreeLibrary","GetACP","GetAtomNameW","GetCommandLineA","GetCommandLineW","GetConsoleCP","GetConsoleMode","GetCPInfo","GetCurrentProcess","GetCurrentProcessId","GetCurrentThread","GetCurrentThreadId","GetDateFormatW","GetEnvironmentStringsW","GetExitCodeProcess","GetFileInformationByHandle","GetFileType","GetLastError","GetLocaleInfoW","GetModuleFileNameA","GetModuleFileNameW","GetModuleHandleExW","GetModuleHandleW","GetOEMCP","GetProcAddress","GetProcessAffinityMask","GetProcessHeap","GetProcessId","GetProcessTimes","GetStartupInfoW","GetStdHandle","GetStringTypeW","GetSystemTimeAsFileTime","GetSystemTimes","GetThreadTimes","GetTimeFormatW","GetUserDefaultLCID","HeapAlloc","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSectionAndSpinCount","InitializeSListHead","InterlockedFlushSList","InterlockedPushEntrySList","IsDebuggerPresent","IsProcessorFeaturePresent","IsValidCodePage","IsValidLocale","LCMapStringW","LeaveCriticalSection","LoadLibraryExW","LocalAlloc","MultiByteToWideChar","OutputDebugStringA","OutputDebugStringW","QueryPerformanceCounter","RaiseException","RtlUnwind","SetConsoleCtrlHandler","SetEnvironmentVariableA","SetEnvironmentVariableW","SetFilePointerEx","SetLastError","SetProcessShutdownParameters","SetStdHandle","SetUnhandledExceptionFilter","TerminateProcess","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnhandledExceptionFilter","WaitForSingleObjectEx","WideCharToMultiByte","WriteConsoleW","WriteFile"]},{"module":"WINHTTP.dll","functions":["WinHttpCloseHandle","WinHttpOpen"]}],"file_exports":[]}},{"name":"rgjqmvnkyr","file_path":null,"file_size":341058,"md5":"773988ef02b8a7abfb158ea2c6d03ed7","sha1":"84297194bda0ecb972ca0f415345dec504b6a453","sha256":"e5251977e94b8c1d708f0a271d1f00525193c69006dd35086ac60d00f9c925f9","sha512":"64c57eeee1e0eb529dea5cb9efc84fec60b8a941168c35a960f21227a5b7206d38845b01856354f173bc3b6a77b425f3c6a2397eb1365bdcfdd3827841d108e0","type_tags":["peexe","executable"],"description":"PE32 executable (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":2,"threat_level_readable":"malicious","group":"malicious","av_label":"Trojan.Generic","av_matched":22,"av_total":67,"file_available_to_download":true,"download_link":"/bff/report/5adb25aa7ca3e128295cf997/download/dropped-file?key=d67489e525b696496d306ea7e0fe6f4d4cc31bace9510df95ac4395d24cc6fc1a292ca0ecc704ee234d717e69d1e6da96e9a058cbdff1892f11b4f26a7670b628f7c531e8b","submit_link":"/bff/report/5adb25aa7ca3e128295cf997/submit/dropped-file?key=d67489e525b696496d306ea7e0fe6f4d4cc31bace9510df95ac4395d24cc6fc1a292ca0ecc704ee234d717e69d1e6da96e9a058cbdff1892f11b4f26a7670b628f7c531e8b","has_overview":false,"extended_details":{"filename":"rgjqmvnkyr","size":341058,"description":null,"architecture":"32 Bit","ssdeep":"6144:3J+HqZBIE03J4oaUyqfpd9AtuJmYs0zl4pPk5PAk1rtIKjmBaFEs:3J+Hq6ioaUzfjkusYJh4pcRAkttVmBwb","imphash":"bad5743b77280b9f5d650b3616fbb39c","authentihash":"5f525b68e0aba9f7a190144294040cce90ff68c68dc49934b128fb69e257449b","entrypoint_bytes":null,"packer":"VC8 -> Microsoft Corporation","version_info":[],"file_sections":[{"name":".text","entropy":6.61920310576,"virtual_address":"0x1000","virtual_size":"0x2f85e","raw_size":"0x2fa00","md5":"e1766fca6b92eafd3533cbfcaa2a666e"},{"name":".rdata","entropy":5.1949466563,"virtual_address":"0x31000","virtual_size":"0x853e","raw_size":"0x8600","md5":"b3eeb639a30298cabaf62a2980d64513"},{"name":".data","entropy":2.25734133237,"virtual_address":"0x3a000","virtual_size":"0x4338","raw_size":"0xa00","md5":"716b9fcdf6b82f6e5f891871efb7f967"},{"name":".gfids","entropy":3.28178660328,"virtual_address":"0x3f000","virtual_size":"0x16c","raw_size":"0x200","md5":"78022499e82f94e71cb3af90d2681d3e"},{"name":".rsrc","entropy":6.93719496057,"virtual_address":"0x40000","virtual_size":"0x17fc2","raw_size":"0x18000","md5":"8548983c0a242dd761062ba25c6852dd"},{"name":".reloc","entropy":6.59458944084,"virtual_address":"0x58000","virtual_size":"0x1ed4","raw_size":"0x2000","md5":"0211e32e44ca24064d732092b4302f20"}],"file_imports":[{"module":"KERNEL32.dll","functions":["CloseHandle","CompareStringW","CreateFileW","CreateThread","DecodePointer","DeleteCriticalSection","EncodePointer","EnterCriticalSection","EnumSystemLocalesW","ExitProcess","FindClose","FindFirstFileExA","FindFirstFileExW","FindNextFileA","FindNextFileW","FlushFileBuffers","FreeEnvironmentStringsW","FreeLibrary","GetACP","GetAtomNameW","GetCommandLineA","GetCommandLineW","GetConsoleCP","GetConsoleMode","GetCPInfo","GetCurrentProcess","GetCurrentProcessId","GetCurrentThread","GetCurrentThreadId","GetDateFormatW","GetEnvironmentStringsW","GetExitCodeProcess","GetFileInformationByHandle","GetFileType","GetLastError","GetLocaleInfoW","GetModuleFileNameA","GetModuleFileNameW","GetModuleHandleExW","GetModuleHandleW","GetOEMCP","GetProcAddress","GetProcessAffinityMask","GetProcessHeap","GetProcessId","GetProcessTimes","GetStartupInfoW","GetStdHandle","GetStringTypeW","GetSystemTimeAsFileTime","GetSystemTimes","GetThreadTimes","GetTimeFormatW","GetUserDefaultLCID","HeapAlloc","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSectionAndSpinCount","InitializeSListHead","InterlockedFlushSList","InterlockedPushEntrySList","IsDebuggerPresent","IsProcessorFeaturePresent","IsValidCodePage","IsValidLocale","LCMapStringW","LeaveCriticalSection","LoadLibraryExW","LocalAlloc","MultiByteToWideChar","OutputDebugStringA","OutputDebugStringW","QueryPerformanceCounter","RaiseException","RtlUnwind","SetConsoleCtrlHandler","SetEnvironmentVariableA","SetEnvironmentVariableW","SetFilePointerEx","SetLastError","SetProcessShutdownParameters","SetStdHandle","SetUnhandledExceptionFilter","TerminateProcess","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnhandledExceptionFilter","WaitForSingleObjectEx","WideCharToMultiByte","WriteConsoleW","WriteFile"]},{"module":"WINHTTP.dll","functions":["WinHttpCloseHandle","WinHttpOpen"]}],"file_exports":[]}},{"name":"gtbvjyxphi.bat","file_path":"%TEMP%\\gtbvjyxphi.bat","file_size":144,"md5":"3734a826576df39c1114c9a26abf2f75","sha1":"6638ba284c39a3287dc1ca785d029e02be13afe1","sha256":"269f9a744a32e17b4ca11b9d793f4fad8f881894502882e1c674e3b4831bd22e","sha512":"58bd8dd675d183de3de59273086efa92478a57f3de1bdc43402e586846d5d1e48d68493565c814cfa7ab46ea7fb73ea5dfdc7708b7172d594a245890ee7c87da","type_tags":["text"],"description":"ASCII text, with CRLF line terminators","runtime_process":"cmd.exe (PID: 3360)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5adb25aa7ca3e128295cf997/download/dropped-file?key=6314390e049574f62600253a6be43361ef96427411a1e6eb8677d4c717b6e800cb10a7db364dd9936658deecec4926db7d86d583e852ce45174210f82f9ab1dec93e1e12bdb1eacbfa","submit_link":"/bff/report/5adb25aa7ca3e128295cf997/submit/dropped-file?key=6314390e049574f62600253a6be43361ef96427411a1e6eb8677d4c717b6e800cb10a7db364dd9936658deecec4926db7d86d583e852ce45174210f82f9ab1dec93e1e12bdb1eacbfa","has_overview":false,"extended_details":null},{"name":"desktop.ini","file_path":"%USERPROFILE%\\Desktop\\desktop.ini","file_size":0,"md5":null,"sha1":null,"sha256":null,"sha512":null,"type_tags":["empty"],"description":"empty ","runtime_process":"9afb2870-sample.exe (PID: 3680)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null}],"file_metadata":{"file_compositions":["1 .OBJ Files (COFF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 24210)","1 .BAS Files compiled with C2.EXE 5.0 (Visual Basic 6) (build: 24210)"],"imported_objects":["5 .LIB Files generated with LIB.EXE 9.00 (Visual Studio 2008) (build: 30729)","17 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 24123)","29 .OBJ Files (OMF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 24123)","17 .OBJ Files (OMF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 24123)"],"file_analysis":["File contains Visual Basic code","File appears to contain raw COFF/OMF content","File is the product of a small codebase (1 files)"],"total_file_compositions_imports":96},"processes":[{"uid":"00047647-00003048","parentuid":null,"name":"9afb2870-sample.exe","normalized_path":"C:\\9afb2870-sample.exe","command_line":null,"sha256":"737edb7dd8ba6a9a2c54eed0a4e806c8d344e17e13427afed0b24a724af51939","av_label":"Trojan.Generic","av_matched":46,"av_total":66,"pid":"3048","icon":"$25","process_flags":[{"name":"Extracted Streams","data":null},{"name":"Multiscan Match","data":"46/66"}]},{"uid":"00050960-00003680","parentuid":"00047647-00003048","name":"9afb2870-sample.exe","normalized_path":"C:\\9afb2870-sample.exe","command_line":null,"sha256":"737edb7dd8ba6a9a2c54eed0a4e806c8d344e17e13427afed0b24a724af51939","av_label":"Trojan.Generic","av_matched":46,"av_total":66,"pid":"3680","icon":null,"process_flags":[{"name":"Extracted Streams","data":null},{"name":"Multiscan Match","data":"46/66"}]},{"uid":"00051554-00003360","parentuid":"00050960-00003680","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"cmd /c \"\"%TEMP%\\gtbvjyxphi.bat\" \"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3360","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00051562-00002132","parentuid":"00050960-00003680","name":"winmgr.exe","normalized_path":"%WINDIR%\\M-505059720970246082475082628448545\\winmgr.exe","command_line":null,"sha256":"737edb7dd8ba6a9a2c54eed0a4e806c8d344e17e13427afed0b24a724af51939","av_label":"Trojan.Generic","av_matched":46,"av_total":66,"pid":"2132","icon":null,"process_flags":[{"name":"Extracted Streams","data":null},{"name":"Multiscan Match","data":"46/66"}]},{"uid":"00055537-00003484","parentuid":"00051562-00002132","name":"winmgr.exe","normalized_path":"%WINDIR%\\M-505059720970246082475082628448545\\winmgr.exe","command_line":null,"sha256":"737edb7dd8ba6a9a2c54eed0a4e806c8d344e17e13427afed0b24a724af51939","av_label":"Trojan.Generic","av_matched":46,"av_total":66,"pid":"3484","icon":null,"process_flags":[{"name":"Extracted Streams","data":null},{"name":"Network Activity","data":null},{"name":"Multiscan Match","data":"46/66"}]}],"mitre_attcks":[],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"stream-4","type":1,"relevance":1,"name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 53154-2786-030018FC\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00047647-00003048-65481-13-03001BC3\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00047647-00003048-65481-77-03016AAD\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00047647-00003048-65481-132-030017AE\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00047647-00003048-65481-2583-030018FC\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00051562-00002132-17936-13-03001BC3\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00051562-00002132-17936-77-03016AAD\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00051562-00002132-17936-132-030017AE\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00051562-00002132-17936-2583-030018FC","description_v2":["SetUnhandledExceptionFilter@KERNEL32.dll at 53154-2786-030018FC","SetUnhandledExceptionFilter@KERNEL32.DLL at 00047647-00003048-65481-13-03001BC3","SetUnhandledExceptionFilter@KERNEL32.DLL at 00047647-00003048-65481-77-03016AAD","SetUnhandledExceptionFilter@KERNEL32.DLL at 00047647-00003048-65481-132-030017AE","SetUnhandledExceptionFilter@KERNEL32.DLL at 00047647-00003048-65481-2583-030018FC","SetUnhandledExceptionFilter@KERNEL32.DLL at 00051562-00002132-17936-13-03001BC3","SetUnhandledExceptionFilter@KERNEL32.DLL at 00051562-00002132-17936-77-03016AAD","SetUnhandledExceptionFilter@KERNEL32.DLL at 00051562-00002132-17936-132-030017AE","SetUnhandledExceptionFilter@KERNEL32.DLL at 00051562-00002132-17936-2583-030018FC"],"description_v3":[{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.dll"},{"type":"stream","stream_uid":"53154-2786-030018FC","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/53154-2786-030018FC","process":null},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-13-03001BC3","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-13-03001BC3","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-77-03016AAD","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-77-03016AAD","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-132-030017AE","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-132-030017AE","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-2583-030018FC","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-2583-030018FC","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00051562-00002132-17936-13-03001BC3","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00051562-00002132-17936-13-03001BC3?childUid=00051562-00002132","process":{"name":"winmgr.exe","process_uid":"00051562-00002132","pid":"2132"}},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00051562-00002132-17936-77-03016AAD","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00051562-00002132-17936-77-03016AAD?childUid=00051562-00002132","process":{"name":"winmgr.exe","process_uid":"00051562-00002132","pid":"2132"}},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00051562-00002132-17936-132-030017AE","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00051562-00002132-17936-132-030017AE?childUid=00051562-00002132","process":{"name":"winmgr.exe","process_uid":"00051562-00002132","pid":"2132"}},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00051562-00002132-17936-2583-030018FC","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00051562-00002132-17936-2583-030018FC?childUid=00051562-00002132","process":{"name":"winmgr.exe","process_uid":"00051562-00002132","pid":"2132"}}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":{"modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/53154-2786-030018FC","name":"9afb2870-sample.exe","pid":3048}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-2","type":1,"relevance":1,"name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 53154-1517-03019E50\n GetSystemTimes@KERNEL32.DLL at 00047647-00003048-65481-65-03030227\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00047647-00003048-65481-144-03001692\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00047647-00003048-65481-1364-03019E50\n GetSystemTimes@KERNEL32.DLL at 00051562-00002132-17936-65-03030227\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00051562-00002132-17936-144-03001692\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00051562-00002132-17936-1364-03019E50","description_v2":["GetSystemTimeAsFileTime@KERNEL32.dll at 53154-1517-03019E50","GetSystemTimes@KERNEL32.DLL at 00047647-00003048-65481-65-03030227","GetSystemTimeAsFileTime@KERNEL32.DLL at 00047647-00003048-65481-144-03001692","GetSystemTimeAsFileTime@KERNEL32.DLL at 00047647-00003048-65481-1364-03019E50","GetSystemTimes@KERNEL32.DLL at 00051562-00002132-17936-65-03030227","GetSystemTimeAsFileTime@KERNEL32.DLL at 00051562-00002132-17936-144-03001692","GetSystemTimeAsFileTime@KERNEL32.DLL at 00051562-00002132-17936-1364-03019E50"],"description_v3":[{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.dll"},{"type":"stream","stream_uid":"53154-1517-03019E50","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/53154-1517-03019E50","process":null},{"type":"linebreak"},{"type":"text","value":"GetSystemTimes@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-65-03030227","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-65-03030227","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-144-03001692","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-144-03001692","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-1364-03019E50","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-1364-03019E50","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"GetSystemTimes@KERNEL32.DLL"},{"type":"stream","stream_uid":"00051562-00002132-17936-65-03030227","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00051562-00002132-17936-65-03030227?childUid=00051562-00002132","process":{"name":"winmgr.exe","process_uid":"00051562-00002132","pid":"2132"}},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"stream","stream_uid":"00051562-00002132-17936-144-03001692","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00051562-00002132-17936-144-03001692?childUid=00051562-00002132","process":{"name":"winmgr.exe","process_uid":"00051562-00002132","pid":"2132"}},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"stream","stream_uid":"00051562-00002132-17936-1364-03019E50","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00051562-00002132-17936-1364-03019E50?childUid=00051562-00002132","process":{"name":"winmgr.exe","process_uid":"00051562-00002132","pid":"2132"}}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":{"modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/53154-1517-03019E50","name":"9afb2870-sample.exe","pid":3048}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-49","type":1,"relevance":1,"name":"Contains ability to query the system locale","description":"$26","description_v2":["EnumSystemLocalesW@KERNEL32.dll at 53154-1508-03019502","GetUserDefaultLCID@KERNEL32.dll at 53154-1055-03019F14","EnumSystemLocalesW@KERNEL32.dll at 53154-1087-0301D6F8","GetUserDefaultLCID@KERNEL32.dll at 53154-1082-0301DD6D","EnumSystemLocalesW@KERNEL32.dll at 53154-1084-0301D793","EnumSystemLocalesW@KERNEL32.dll at 53154-1083-0301D68F","EnumSystemLocalesW@KERNEL32.dll at 53154-1061-03019413","GetUserDefaultLCID@KERNEL32.dll at 53154-1576-0301D6DC","EnumSystemLocalesW@KERNEL32.DLL at 00047647-00003048-65481-931-0301D793","EnumSystemLocalesW@KERNEL32.DLL at 00047647-00003048-65481-930-0301D68F","EnumSystemLocalesW@KERNEL32.DLL at 00047647-00003048-65481-1355-03019502","GetUserDefaultLCID@KERNEL32.DLL at 00047647-00003048-65481-902-03019F14","EnumSystemLocalesW@KERNEL32.DLL at 00047647-00003048-65481-934-0301D6F8","EnumSystemLocalesW@KERNEL32.DLL at 00047647-00003048-65481-908-03019413","GetUserDefaultLCID@KERNEL32.DLL at 00047647-00003048-65481-929-0301DD6D","GetUserDefaultLCID@KERNEL32.DLL at 00047647-00003048-65481-1423-0301D6DC","EnumSystemLocalesW@KERNEL32.DLL at 00051562-00002132-17936-931-0301D793","GetUserDefaultLCID@KERNEL32.DLL at 00051562-00002132-17936-902-03019F14","EnumSystemLocalesW@KERNEL32.DLL at 00051562-00002132-17936-930-0301D68F","EnumSystemLocalesW@KERNEL32.DLL at 00051562-00002132-17936-908-03019413"],"description_v3":[{"type":"text","value":"EnumSystemLocalesW@KERNEL32.dll"},{"type":"stream","stream_uid":"53154-1508-03019502","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/53154-1508-03019502","process":null},{"type":"linebreak"},{"type":"text","value":"GetUserDefaultLCID@KERNEL32.dll"},{"type":"stream","stream_uid":"53154-1055-03019F14","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/53154-1055-03019F14","process":null},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.dll"},{"type":"stream","stream_uid":"53154-1087-0301D6F8","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/53154-1087-0301D6F8","process":null},{"type":"linebreak"},{"type":"text","value":"GetUserDefaultLCID@KERNEL32.dll"},{"type":"stream","stream_uid":"53154-1082-0301DD6D","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/53154-1082-0301DD6D","process":null},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.dll"},{"type":"stream","stream_uid":"53154-1084-0301D793","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/53154-1084-0301D793","process":null},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.dll"},{"type":"stream","stream_uid":"53154-1083-0301D68F","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/53154-1083-0301D68F","process":null},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.dll"},{"type":"stream","stream_uid":"53154-1061-03019413","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/53154-1061-03019413","process":null},{"type":"linebreak"},{"type":"text","value":"GetUserDefaultLCID@KERNEL32.dll"},{"type":"stream","stream_uid":"53154-1576-0301D6DC","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/53154-1576-0301D6DC","process":null},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-931-0301D793","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-931-0301D793","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-930-0301D68F","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-930-0301D68F","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-1355-03019502","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-1355-03019502","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"GetUserDefaultLCID@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-902-03019F14","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-902-03019F14","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-934-0301D6F8","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-934-0301D6F8","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-908-03019413","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-908-03019413","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"GetUserDefaultLCID@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-929-0301DD6D","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-929-0301DD6D","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"GetUserDefaultLCID@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-1423-0301D6DC","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-1423-0301D6DC","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00051562-00002132-17936-931-0301D793","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00051562-00002132-17936-931-0301D793?childUid=00051562-00002132","process":{"name":"winmgr.exe","process_uid":"00051562-00002132","pid":"2132"}},{"type":"linebreak"},{"type":"text","value":"GetUserDefaultLCID@KERNEL32.DLL"},{"type":"stream","stream_uid":"00051562-00002132-17936-902-03019F14","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00051562-00002132-17936-902-03019F14?childUid=00051562-00002132","process":{"name":"winmgr.exe","process_uid":"00051562-00002132","pid":"2132"}},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00051562-00002132-17936-930-0301D68F","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00051562-00002132-17936-930-0301D68F?childUid=00051562-00002132","process":{"name":"winmgr.exe","process_uid":"00051562-00002132","pid":"2132"}},{"type":"linebreak"},{"type":"text","value":"EnumSystemLocalesW@KERNEL32.DLL"},{"type":"stream","stream_uid":"00051562-00002132-17936-908-03019413","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00051562-00002132-17936-908-03019413?childUid=00051562-00002132","process":{"name":"winmgr.exe","process_uid":"00051562-00002132","pid":"2132"}}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":{"modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/53154-1508-03019502","name":"9afb2870-sample.exe","pid":3048}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-31","type":1,"relevance":1,"name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 53154-2864-0301E016\n GetProcessHeap@KERNEL32.DLL at 00047647-00003048-65481-2622-0301E016\n GetProcessHeap@KERNEL32.DLL at 00051562-00002132-17936-2622-0301E016","description_v2":["GetProcessHeap@KERNEL32.dll at 53154-2864-0301E016","GetProcessHeap@KERNEL32.DLL at 00047647-00003048-65481-2622-0301E016","GetProcessHeap@KERNEL32.DLL at 00051562-00002132-17936-2622-0301E016"],"description_v3":[{"type":"text","value":"GetProcessHeap@KERNEL32.dll"},{"type":"stream","stream_uid":"53154-2864-0301E016","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/53154-2864-0301E016","process":null},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"stream","stream_uid":"00047647-00003048-65481-2622-0301E016","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-2622-0301E016","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.DLL"},{"type":"stream","stream_uid":"00051562-00002132-17936-2622-0301E016","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00051562-00002132-17936-2622-0301E016?childUid=00051562-00002132","process":{"name":"winmgr.exe","process_uid":"00051562-00002132","pid":"2132"}}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":{"modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/53154-2864-0301E016","name":"9afb2870-sample.exe","pid":3048}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-11","type":6,"relevance":2,"name":"Queries volume information","description":"$27","description_v2":["\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926376","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926425","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926469","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926515","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926558","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926601","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926643","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926686","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926728","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926771","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926815","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926857","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926900","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926942","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926985","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108927027","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108927070","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108927112","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108927155","\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108927199"],"description_v3":[{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926376"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926425"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926469"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926515"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926558"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926601"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926643"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926686"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926728"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926771"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926815"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926857"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926900"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926942"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108926985"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108927027"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108927070"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108927112"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108927155"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of unknown location at 00047647-00003048-0000010C-108927199"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-55","type":3,"relevance":10,"name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\GTBVJYXPHI.BAT\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\GTBVJYXPHI.BAT\")","description_v2":["\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\GTBVJYXPHI.BAT\")","\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\GTBVJYXPHI.BAT\")"],"description_v3":[{"type":"text","value":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\GTBVJYXPHI.BAT\")"},{"type":"linebreak"},{"type":"text","value":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\GTBVJYXPHI.BAT\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-0","type":7,"relevance":1,"name":"Contacts domains","description":"\"siiifibiiegiiciib.ws\"\n \"siiifibiiegiiciib.su\"\n \"siiifibiiegiiciib.ru\"\n \"siiifibiiegiiciib.nl\"\n \"siiifibiiegiiciib.kz\"\n \"siiifibiiegiiciib.in\"\n \"rohgoruhgsorhugih.ws\"\n \"rohgoruhgsorhugih.su\"\n \"rohgoruhgsorhugih.ru\"\n \"rohgoruhgsorhugih.nl\"\n \"rohgoruhgsorhugih.kz\"\n \"rohgoruhgsorhugih.in\"\n \"oeihefoeaboeubfuo.ws\"\n \"oeihefoeaboeubfuo.su\"\n \"oeihefoeaboeubfuo.ru\"\n \"oeihefoeaboeubfuo.nl\"\n \"oeihefoeaboeubfuo.kz\"\n \"oeihefoeaboeubfuo.in\"\n \"oeabocbeogoaehgoi.ws\"\n \"oeabocbeogoaehgoi.su\"","description_v2":["\"siiifibiiegiiciib.ws\"","\"siiifibiiegiiciib.su\"","\"siiifibiiegiiciib.ru\"","\"siiifibiiegiiciib.nl\"","\"siiifibiiegiiciib.kz\"","\"siiifibiiegiiciib.in\"","\"rohgoruhgsorhugih.ws\"","\"rohgoruhgsorhugih.su\"","\"rohgoruhgsorhugih.ru\"","\"rohgoruhgsorhugih.nl\"","\"rohgoruhgsorhugih.kz\"","\"rohgoruhgsorhugih.in\"","\"oeihefoeaboeubfuo.ws\"","\"oeihefoeaboeubfuo.su\"","\"oeihefoeaboeubfuo.ru\"","\"oeihefoeaboeubfuo.nl\"","\"oeihefoeaboeubfuo.kz\"","\"oeihefoeaboeubfuo.in\"","\"oeabocbeogoaehgoi.ws\"","\"oeabocbeogoaehgoi.su\""],"description_v3":[{"type":"text","value":"\"siiifibiiegiiciib.ws\""},{"type":"linebreak"},{"type":"text","value":"\"siiifibiiegiiciib.su\""},{"type":"linebreak"},{"type":"text","value":"\"siiifibiiegiiciib.ru\""},{"type":"linebreak"},{"type":"text","value":"\"siiifibiiegiiciib.nl\""},{"type":"linebreak"},{"type":"text","value":"\"siiifibiiegiiciib.kz\""},{"type":"linebreak"},{"type":"text","value":"\"siiifibiiegiiciib.in\""},{"type":"linebreak"},{"type":"text","value":"\"rohgoruhgsorhugih.ws\""},{"type":"linebreak"},{"type":"text","value":"\"rohgoruhgsorhugih.su\""},{"type":"linebreak"},{"type":"text","value":"\"rohgoruhgsorhugih.ru\""},{"type":"linebreak"},{"type":"text","value":"\"rohgoruhgsorhugih.nl\""},{"type":"linebreak"},{"type":"text","value":"\"rohgoruhgsorhugih.kz\""},{"type":"linebreak"},{"type":"text","value":"\"rohgoruhgsorhugih.in\""},{"type":"linebreak"},{"type":"text","value":"\"oeihefoeaboeubfuo.ws\""},{"type":"linebreak"},{"type":"text","value":"\"oeihefoeaboeubfuo.su\""},{"type":"linebreak"},{"type":"text","value":"\"oeihefoeaboeubfuo.ru\""},{"type":"linebreak"},{"type":"text","value":"\"oeihefoeaboeubfuo.nl\""},{"type":"linebreak"},{"type":"text","value":"\"oeihefoeaboeubfuo.kz\""},{"type":"linebreak"},{"type":"text","value":"\"oeihefoeaboeubfuo.in\""},{"type":"linebreak"},{"type":"text","value":"\"oeabocbeogoaehgoi.ws\""},{"type":"linebreak"},{"type":"text","value":"\"oeabocbeogoaehgoi.su\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-1","type":7,"relevance":1,"name":"Contacts server","description":"\"220.181.87.80:5050\"\n \"173.230.130.175:5050\"","description_v2":["\"220.181.87.80:5050\"","\"173.230.130.175:5050\""],"description_v3":[{"type":"text","value":"\"220.181.87.80:5050\""},{"type":"linebreak"},{"type":"text","value":"\"173.230.130.175:5050\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-4","type":6,"relevance":1,"name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\gtbvjyxphi.bat\"","description_v2":["\"\" created file \"%TEMP%\\gtbvjyxphi.bat\""],"description_v3":[{"type":"text","value":"\"\" created file \"%TEMP%\\gtbvjyxphi.bat\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\b32\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"\n \"b32\"","description_v2":["\"\\Sessions\\1\\BaseNamedObjects\\b32\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","\"Local\\ZonesLockedCacheCounterMutex\"","\"Local\\ZonesCacheCounterMutex\"","\"Local\\ZoneAttributeCacheCounterMutex\"","\"Local\\ZonesCounterMutex\"","\"b32\""],"description_v3":[{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\b32\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZoneAttributeCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"b32\""}],"origin":"Created Mutant","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-3","type":9,"relevance":5,"name":"Runs shell commands","description":"\"cmd /c \"\"%TEMP%\\gtbvjyxphi.bat\" \"\" on 2018-4-21.04:55:39.343","description_v2":["\"cmd /c \"\"%TEMP%\\gtbvjyxphi.bat\" \"\" on 2018-4-21.04:55:39.343"],"description_v3":[{"type":"text","value":"\"cmd /c \"\"%TEMP%\\gtbvjyxphi.bat\" \"\" on 2018-4-21.04:55:39.343"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-25","type":9,"relevance":3,"name":"Spawns new processes","description":"Spawned process \"\" (UID: 00050960-00003680)\n Spawned process \"cmd.exe\" with commandline \"cmd /c \"\"%TEMP%\\gtbvjyxphi.bat\" \"\" (UID: 00051554-00003360)\n Spawned process \"winmgr.exe\" (UID: 00051562-00002132)\n Spawned process \"winmgr.exe\" (UID: 00055537-00003484)","description_v2":["Spawned process \"\" (UID: 00050960-00003680)","Spawned process \"cmd.exe\" with commandline \"cmd /c \"\"%TEMP%\\gtbvjyxphi.bat\" \"\" (UID: 00051554-00003360)","Spawned process \"winmgr.exe\" (UID: 00051562-00002132)","Spawned process \"winmgr.exe\" (UID: 00055537-00003484)"],"description_v3":[{"type":"text","value":"Spawned process \"\""},{"type":"process","process_uid":"00050960-00003680","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"cmd /c \"\"%TEMP%\\gtbvjyxphi.bat\" \"\""},{"type":"process","process_uid":"00051554-00003360","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"winmgr.exe\""},{"type":"process","process_uid":"00051562-00002132","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"winmgr.exe\""},{"type":"process","process_uid":"00055537-00003484","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"api-16","type":6,"relevance":1,"name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"winmgr.exe\" connecting to \"\\ThemeApiPort\"","description_v2":["\"\" connecting to \"\\ThemeApiPort\"","\"winmgr.exe\" connecting to \"\\ThemeApiPort\""],"description_v3":[{"type":"text","value":"\"\" connecting to \"\\ThemeApiPort\""},{"type":"linebreak"},{"type":"text","value":"\"winmgr.exe\" connecting to \"\\ThemeApiPort\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"\"gtbvjyxphi.bat\" has type \"ASCII text with CRLF line terminators\"\n \"desktop.ini\" has type \"empty \"\n \"gwhroqkhwu\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"edakubnfgu\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"phqghumeay\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"rgjqmvnkyr\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","description_v2":["\"gtbvjyxphi.bat\" has type \"ASCII text with CRLF line terminators\"","\"desktop.ini\" has type \"empty \"","\"gwhroqkhwu\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"edakubnfgu\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"phqghumeay\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"rgjqmvnkyr\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""],"description_v3":[{"type":"text","value":"\"gtbvjyxphi.bat\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"desktop.ini\" has type \"empty \""},{"type":"linebreak"},{"type":"text","value":"\"gwhroqkhwu\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"edakubnfgu\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"phqghumeay\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"rgjqmvnkyr\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"api-55","type":6,"relevance":7,"name":"Touches files in the Windows directory","description":"$28","description_v2":["\"\" touched file \"C:\\Windows\\M-505059720970246082475082628448545\"","\"\" touched file \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\"","\"\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\"","\"\" touched file \"C:\\Users\\62ccv3C\\AppData\\Local\\Microsoft\\Windows\\Caches\"","\"\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\"","\"\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"","\"\" touched file \"C:\\Windows\\System32\\en-US\\propsys.dll.mui\"","\"\" touched file \"C:\\Windows\\System32\\en-US\\setupapi.dll.mui\"","\"\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"","\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"","\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"","\"cmd.exe\" touched file \"C:\\Windows\\System32\\en-US\\cmd.exe.mui\"","\"cmd.exe\" touched file \"C:\\Windows\\System32\\en-US\\KernelBase.dll.mui\"","\"winmgr.exe\" touched file \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\""],"description_v3":[{"type":"text","value":"\"\" touched file \"C:\\Windows\\M-505059720970246082475082628448545\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\System32\\en-US\\propsys.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\System32\\en-US\\setupapi.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\""},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" touched file \"C:\\Windows\\System32\\en-US\\cmd.exe.mui\""},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" touched file \"C:\\Windows\\System32\\en-US\\KernelBase.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"winmgr.exe\" touched file \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":10,"name":"Found potential URL in binary/memory","description":"$29","description_v2":["Heuristic match: \"siiifibiiegiiciib.ws\"","Heuristic match: \"siiifibiiegiiciib.su\"","Heuristic match: \"siiifibiiegiiciib.ru\"","Heuristic match: \"siiifibiiegiiciib.nl\"","Heuristic match: \"siiifibiiegiiciib.kz\"","Heuristic match: \"siiifibiiegiiciib.in\"","Heuristic match: \"rohgoruhgsorhugih.ws\"","Heuristic match: \"rohgoruhgsorhugih.su\"","Heuristic match: \"rohgoruhgsorhugih.ru\"","Heuristic match: \"rohgoruhgsorhugih.nl\"","Heuristic match: \"rohgoruhgsorhugih.kz\"","Heuristic match: \"rohgoruhgsorhugih.in\"","Heuristic match: \"oeihefoeaboeubfuo.ws\"","Heuristic match: \"oeihefoeaboeubfuo.su\"","Heuristic match: \"oeihefoeaboeubfuo.ru\"","Heuristic match: \"oeihefoeaboeubfuo.nl\"","Heuristic match: \"oeihefoeaboeubfuo.kz\"","Heuristic match: \"oeihefoeaboeubfuo.in\"","Heuristic match: \"oeabocbeogoaehgoi.ws\"","Heuristic match: \"oeabocbeogoaehgoi.su\"","Heuristic match: \"oeabocbeogoaehgoi.ru\"","Heuristic match: \"oeabocbeogoaehgoi.nl\"","Heuristic match: \"oeabocbeogoaehgoi.kz\"","Heuristic match: \"oeabocbeogoaehgoi.in\"","Heuristic match: \"iapghahpnpnapcipa.ws\"","Heuristic match: \"iapghahpnpnapcipa.su\"","Heuristic match: \"iapghahpnpnapcipa.ru\"","Heuristic match: \"iapghahpnpnapcipa.nl\"","Heuristic match: \"iapghahpnpnapcipa.kz\"","Heuristic match: \"iapghahpnpnapcipa.in\"","Heuristic match: \"goiaegodbuebieibg.ws\"","Heuristic match: \"goiaegodbuebieibg.su\"","Heuristic match: \"goiaegodbuebieibg.ru\"","Heuristic match: \"goiaegodbuebieibg.kz\"","Heuristic match: \"goiaegodbuebieibg.in\"","Heuristic match: \"eghoabeogbuaeofua.ws\"","Heuristic match: \"eghoabeogbuaeofua.su\"","Heuristic match: \"eghoabeogbuaeofua.ru\"","Heuristic match: \"eghoabeogbuaeofua.nl\"","Heuristic match: \"eghoabeogbuaeofua.kz\"","Heuristic match: \"eghoabeogbuaeofua.in\"","Heuristic match: \"ageihehaioeoaiegj.ws\"","Heuristic match: \"ageihehaioeoaiegj.su\"","Heuristic match: \"ageihehaioeoaiegj.ru\"","Heuristic match: \"ageihehaioeoaiegj.nl\"","Heuristic match: \"ageihehaioeoaiegj.kz\"","Heuristic match: \"ageihehaioeoaiegj.in\"","Heuristic match: \"aefobfboabobfaoua.ws\"","Heuristic match: \"aefobfboabobfaoua.su\"","Heuristic match: \"aefobfboabobfaoua.ru\"","Heuristic match: \"aefobfboabobfaoua.kz\"","Heuristic match: \"aefobfboabobfaoua.in\"","Heuristic match: \"abvainvienvaiebai.ws\"","Heuristic match: \"abvainvienvaiebai.su\"","Heuristic match: \"abvainvienvaiebai.ru\"","Heuristic match: \"abvainvienvaiebai.kz\"","Heuristic match: \"abvainvienvaiebai.in\""],"description_v3":[{"type":"text","value":"Heuristic match: \"siiifibiiegiiciib.ws\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"siiifibiiegiiciib.su\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"siiifibiiegiiciib.ru\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"siiifibiiegiiciib.nl\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"siiifibiiegiiciib.kz\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"siiifibiiegiiciib.in\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"rohgoruhgsorhugih.ws\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"rohgoruhgsorhugih.su\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"rohgoruhgsorhugih.ru\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"rohgoruhgsorhugih.nl\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"rohgoruhgsorhugih.kz\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"rohgoruhgsorhugih.in\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"oeihefoeaboeubfuo.ws\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"oeihefoeaboeubfuo.su\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"oeihefoeaboeubfuo.ru\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"oeihefoeaboeubfuo.nl\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"oeihefoeaboeubfuo.kz\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"oeihefoeaboeubfuo.in\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"oeabocbeogoaehgoi.ws\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"oeabocbeogoaehgoi.su\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"oeabocbeogoaehgoi.ru\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"oeabocbeogoaehgoi.nl\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"oeabocbeogoaehgoi.kz\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"oeabocbeogoaehgoi.in\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"iapghahpnpnapcipa.ws\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"iapghahpnpnapcipa.su\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"iapghahpnpnapcipa.ru\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"iapghahpnpnapcipa.nl\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"iapghahpnpnapcipa.kz\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"iapghahpnpnapcipa.in\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"goiaegodbuebieibg.ws\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"goiaegodbuebieibg.su\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"goiaegodbuebieibg.ru\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"goiaegodbuebieibg.kz\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"goiaegodbuebieibg.in\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"eghoabeogbuaeofua.ws\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"eghoabeogbuaeofua.su\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"eghoabeogbuaeofua.ru\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"eghoabeogbuaeofua.nl\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"eghoabeogbuaeofua.kz\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"eghoabeogbuaeofua.in\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ageihehaioeoaiegj.ws\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ageihehaioeoaiegj.su\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ageihehaioeoaiegj.ru\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ageihehaioeoaiegj.nl\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ageihehaioeoaiegj.kz\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ageihehaioeoaiegj.in\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"aefobfboabobfaoua.ws\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"aefobfboabobfaoua.su\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"aefobfboabobfaoua.ru\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"aefobfboabobfaoua.kz\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"aefobfboabobfaoua.in\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"abvainvienvaiebai.ws\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"abvainvienvaiebai.su\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"abvainvienvaiebai.ru\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"abvainvienvaiebai.kz\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"abvainvienvaiebai.in\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-67","type":3,"relevance":10,"name":"Creates or modifies windows services","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINDEFEND\"; Key: \"START\"; Value: \"04000000\")","description_v2":["\"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINDEFEND\"; Key: \"START\"; Value: \"04000000\")"],"description_v3":[{"type":"text","value":"\"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINDEFEND\"; Key: \"START\"; Value: \"04000000\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"api-37","type":6,"relevance":10,"name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","description_v2":["\"\" opened \"\\Device\\KsecDD\""],"description_v3":[{"type":"text","value":"\"\" opened \"\\Device\\KsecDD\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"static-18","type":0,"relevance":10,"name":"Matched Compiler/Packer signature","description":"\"9afb2870-sample.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"gwhroqkhwu\" was detected as \"VC8 -> Microsoft Corporation\"\n \"edakubnfgu\" was detected as \"VC8 -> Microsoft Corporation\"\n \"phqghumeay\" was detected as \"VC8 -> Microsoft Corporation\"\n \"rgjqmvnkyr\" was detected as \"VC8 -> Microsoft Corporation\"","description_v2":["\"9afb2870-sample.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","\"gwhroqkhwu\" was detected as \"VC8 -> Microsoft Corporation\"","\"edakubnfgu\" was detected as \"VC8 -> Microsoft Corporation\"","\"phqghumeay\" was detected as \"VC8 -> Microsoft Corporation\"","\"rgjqmvnkyr\" was detected as \"VC8 -> Microsoft Corporation\""],"description_v3":[{"type":"text","value":"\"9afb2870-sample.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\""},{"type":"linebreak"},{"type":"text","value":"\"gwhroqkhwu\" was detected as \"VC8 -> Microsoft Corporation\""},{"type":"linebreak"},{"type":"text","value":"\"edakubnfgu\" was detected as \"VC8 -> Microsoft Corporation\""},{"type":"linebreak"},{"type":"text","value":"\"phqghumeay\" was detected as \"VC8 -> Microsoft Corporation\""},{"type":"linebreak"},{"type":"text","value":"\"rgjqmvnkyr\" was detected as \"VC8 -> Microsoft Corporation\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Cryptographic Related","identifier":"string-57","type":2,"relevance":10,"name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"9afb2870-sample.exe.bin\")","description_v2":["\"DES\" (Indicator: \"des\"; File: \"9afb2870-sample.exe.bin\")"],"description_v3":[{"type":"text","value":"\"DES\" (Indicator: \"des\"; File: \"9afb2870-sample.exe.bin\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"stream-13","type":1,"relevance":10,"name":"Contains ability to query CPU information","description":"cpuid at 00047647-00003048-65481-29-030019F6\n cpuid at 00050960-00003680-9527-29-030019F6\n cpuid at 00051562-00002132-17936-29-030019F6\n cpuid at 00055537-00003484-33482-29-030019F6\n cpuid at 56867-30-030019F6","description_v2":["cpuid at 00047647-00003048-65481-29-030019F6","cpuid at 00050960-00003680-9527-29-030019F6","cpuid at 00051562-00002132-17936-29-030019F6","cpuid at 00055537-00003484-33482-29-030019F6","cpuid at 56867-30-030019F6"],"description_v3":[{"type":"text","value":"cpuid"},{"type":"stream","stream_uid":"00047647-00003048-65481-29-030019F6","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-29-030019F6","process":{"name":"9afb2870-sample.exe","process_uid":"00047647-00003048","pid":"3048"}},{"type":"linebreak"},{"type":"text","value":"cpuid"},{"type":"stream","stream_uid":"00050960-00003680-9527-29-030019F6","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00050960-00003680-9527-29-030019F6?childUid=00050960-00003680","process":{"name":"9afb2870-sample.exe","process_uid":"00050960-00003680","pid":"3680"}},{"type":"linebreak"},{"type":"text","value":"cpuid"},{"type":"stream","stream_uid":"00051562-00002132-17936-29-030019F6","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00051562-00002132-17936-29-030019F6?childUid=00051562-00002132","process":{"name":"winmgr.exe","process_uid":"00051562-00002132","pid":"2132"}},{"type":"linebreak"},{"type":"text","value":"cpuid"},{"type":"stream","stream_uid":"00055537-00003484-33482-29-030019F6","modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00055537-00003484-33482-29-030019F6?childUid=00055537-00003484","process":{"name":"winmgr.exe","process_uid":"00055537-00003484","pid":"3484"}},{"type":"linebreak"},{"type":"text","value":"cpuid at 56867-30-030019F6"}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":{"modal_link":"/bff/report/5adb25aa7ca3e128295cf997/processes/00047647-00003048/streams/0/00047647-00003048-65481-29-030019F6","name":"9afb2870-sample.exe","pid":3048}},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"External Systems","identifier":"suricata-1","type":18,"relevance":10,"name":"Detected Suricata Alert","description":"Detected alert \"ET DNS Query for .su TLD (Soviet Union) Often Malware Related\" (SID: 2014169, Rev: 1, Severity: 2) categorized as \"Potentially Bad Traffic\"","description_v2":["Detected alert \"ET DNS Query for .su TLD (Soviet Union) Often Malware Related\" (SID: 2014169, Rev: 1, Severity: 2) categorized as \"Potentially Bad Traffic\""],"description_v3":[{"type":"text","value":"Detected alert \"ET DNS Query for .su TLD (Soviet Union) Often Malware Related\" (SID: 2014169, Rev: 1, Severity: 2) categorized as \"Potentially Bad Traffic\""}],"origin":"Suricata Alerts","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"External Systems","identifier":"avtest-6","type":12,"relevance":10,"name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"http://rohgoruhgsorhugih.su\" as malicious (1% detection rate)\n 1/66 reputation engines marked \"http://siiifibiiegiiciib.ru\" as malicious (1% detection rate)\n 1/66 reputation engines marked \"http://rohgoruhgsorhugih.ws\" as malicious (1% detection rate)\n 1/66 reputation engines marked \"http://siiifibiiegiiciib.ws\" as malicious (1% detection rate)\n 4/67 reputation engines marked \"http://rohgoruhgsorhugih.ru\" as malicious (5% detection rate)","description_v2":["1/67 reputation engines marked \"http://rohgoruhgsorhugih.su\" as malicious (1% detection rate)","1/66 reputation engines marked \"http://siiifibiiegiiciib.ru\" as malicious (1% detection rate)","1/66 reputation engines marked \"http://rohgoruhgsorhugih.ws\" as malicious (1% detection rate)","1/66 reputation engines marked \"http://siiifibiiegiiciib.ws\" as malicious (1% detection rate)","4/67 reputation engines marked \"http://rohgoruhgsorhugih.ru\" as malicious (5% detection rate)"],"description_v3":[{"type":"text","value":"1/67 reputation engines marked \"http://rohgoruhgsorhugih.su\" as malicious (1% detection rate)"},{"type":"linebreak"},{"type":"text","value":"1/66 reputation engines marked \"http://siiifibiiegiiciib.ru\" as malicious (1% detection rate)"},{"type":"linebreak"},{"type":"text","value":"1/66 reputation engines marked \"http://rohgoruhgsorhugih.ws\" as malicious (1% detection rate)"},{"type":"linebreak"},{"type":"text","value":"1/66 reputation engines marked \"http://siiifibiiegiiciib.ws\" as malicious (1% detection rate)"},{"type":"linebreak"},{"type":"text","value":"4/67 reputation engines marked \"http://rohgoruhgsorhugih.ru\" as malicious (5% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"api-6","type":6,"relevance":4,"name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","description_v2":["\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\""],"description_v3":[{"type":"text","value":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistance","identifier":"binary-1","type":8,"relevance":10,"name":"Drops executable files","description":"\"gwhroqkhwu\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"edakubnfgu\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"phqghumeay\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"rgjqmvnkyr\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","description_v2":["\"gwhroqkhwu\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"edakubnfgu\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"phqghumeay\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","\"rgjqmvnkyr\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""],"description_v3":[{"type":"text","value":"\"gwhroqkhwu\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"edakubnfgu\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"phqghumeay\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""},{"type":"linebreak"},{"type":"text","value":"\"rgjqmvnkyr\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\""}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistance","identifier":"registry-0","type":3,"relevance":8,"name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"MICROSOFT WINDOWS MANAGER\"; Value: \"%WINDIR%\\M-505059720970246082475082628448545\\winmgr.exe\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"MICROSOFT WINDOWS MANAGER\"; Value: \"%WINDIR%\\M-505059720970246082475082628448545\\winmgr.exe\")","description_v2":["\"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"MICROSOFT WINDOWS MANAGER\"; Value: \"%WINDIR%\\M-505059720970246082475082628448545\\winmgr.exe\")","\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"MICROSOFT WINDOWS MANAGER\"; Value: \"%WINDIR%\\M-505059720970246082475082628448545\\winmgr.exe\")"],"description_v3":[{"type":"text","value":"\"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"MICROSOFT WINDOWS MANAGER\"; Value: \"%WINDIR%\\M-505059720970246082475082628448545\\winmgr.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"MICROSOFT WINDOWS MANAGER\"; Value: \"%WINDIR%\\M-505059720970246082475082628448545\\winmgr.exe\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"network-34","type":7,"relevance":10,"name":"Detected very many DNS queries for domains that cannot be resolved","description":"\"siiifibiiegiiciib.su\"\n \"siiifibiiegiiciib.ru\"\n \"siiifibiiegiiciib.nl\"\n \"siiifibiiegiiciib.kz\"\n \"siiifibiiegiiciib.in\"\n \"rohgoruhgsorhugih.su\"\n \"rohgoruhgsorhugih.ru\"\n \"rohgoruhgsorhugih.nl\"\n \"rohgoruhgsorhugih.kz\"\n \"rohgoruhgsorhugih.in\"\n \"oeihefoeaboeubfuo.su\"\n \"oeihefoeaboeubfuo.ru\"\n \"oeihefoeaboeubfuo.nl\"\n \"oeihefoeaboeubfuo.kz\"\n \"oeihefoeaboeubfuo.in\"\n \"oeabocbeogoaehgoi.su\"\n \"oeabocbeogoaehgoi.ru\"\n \"oeabocbeogoaehgoi.nl\"\n \"oeabocbeogoaehgoi.kz\"\n \"oeabocbeogoaehgoi.in\"\n \"iapghahpnpnapcipa.su\"\n \"iapghahpnpnapcipa.ru\"\n \"iapghahpnpnapcipa.nl\"\n \"iapghahpnpnapcipa.kz\"\n \"iapghahpnpnapcipa.in\"\n \"goiaegodbuebieibg.su\"\n \"goiaegodbuebieibg.ru\"\n \"goiaegodbuebieibg.kz\"\n \"goiaegodbuebieibg.in\"\n \"eghoabeogbuaeofua.su\"","description_v2":["\"siiifibiiegiiciib.su\"","\"siiifibiiegiiciib.ru\"","\"siiifibiiegiiciib.nl\"","\"siiifibiiegiiciib.kz\"","\"siiifibiiegiiciib.in\"","\"rohgoruhgsorhugih.su\"","\"rohgoruhgsorhugih.ru\"","\"rohgoruhgsorhugih.nl\"","\"rohgoruhgsorhugih.kz\"","\"rohgoruhgsorhugih.in\"","\"oeihefoeaboeubfuo.su\"","\"oeihefoeaboeubfuo.ru\"","\"oeihefoeaboeubfuo.nl\"","\"oeihefoeaboeubfuo.kz\"","\"oeihefoeaboeubfuo.in\"","\"oeabocbeogoaehgoi.su\"","\"oeabocbeogoaehgoi.ru\"","\"oeabocbeogoaehgoi.nl\"","\"oeabocbeogoaehgoi.kz\"","\"oeabocbeogoaehgoi.in\"","\"iapghahpnpnapcipa.su\"","\"iapghahpnpnapcipa.ru\"","\"iapghahpnpnapcipa.nl\"","\"iapghahpnpnapcipa.kz\"","\"iapghahpnpnapcipa.in\"","\"goiaegodbuebieibg.su\"","\"goiaegodbuebieibg.ru\"","\"goiaegodbuebieibg.kz\"","\"goiaegodbuebieibg.in\"","\"eghoabeogbuaeofua.su\""],"description_v3":[{"type":"text","value":"\"siiifibiiegiiciib.su\""},{"type":"linebreak"},{"type":"text","value":"\"siiifibiiegiiciib.ru\""},{"type":"linebreak"},{"type":"text","value":"\"siiifibiiegiiciib.nl\""},{"type":"linebreak"},{"type":"text","value":"\"siiifibiiegiiciib.kz\""},{"type":"linebreak"},{"type":"text","value":"\"siiifibiiegiiciib.in\""},{"type":"linebreak"},{"type":"text","value":"\"rohgoruhgsorhugih.su\""},{"type":"linebreak"},{"type":"text","value":"\"rohgoruhgsorhugih.ru\""},{"type":"linebreak"},{"type":"text","value":"\"rohgoruhgsorhugih.nl\""},{"type":"linebreak"},{"type":"text","value":"\"rohgoruhgsorhugih.kz\""},{"type":"linebreak"},{"type":"text","value":"\"rohgoruhgsorhugih.in\""},{"type":"linebreak"},{"type":"text","value":"\"oeihefoeaboeubfuo.su\""},{"type":"linebreak"},{"type":"text","value":"\"oeihefoeaboeubfuo.ru\""},{"type":"linebreak"},{"type":"text","value":"\"oeihefoeaboeubfuo.nl\""},{"type":"linebreak"},{"type":"text","value":"\"oeihefoeaboeubfuo.kz\""},{"type":"linebreak"},{"type":"text","value":"\"oeihefoeaboeubfuo.in\""},{"type":"linebreak"},{"type":"text","value":"\"oeabocbeogoaehgoi.su\""},{"type":"linebreak"},{"type":"text","value":"\"oeabocbeogoaehgoi.ru\""},{"type":"linebreak"},{"type":"text","value":"\"oeabocbeogoaehgoi.nl\""},{"type":"linebreak"},{"type":"text","value":"\"oeabocbeogoaehgoi.kz\""},{"type":"linebreak"},{"type":"text","value":"\"oeabocbeogoaehgoi.in\""},{"type":"linebreak"},{"type":"text","value":"\"iapghahpnpnapcipa.su\""},{"type":"linebreak"},{"type":"text","value":"\"iapghahpnpnapcipa.ru\""},{"type":"linebreak"},{"type":"text","value":"\"iapghahpnpnapcipa.nl\""},{"type":"linebreak"},{"type":"text","value":"\"iapghahpnpnapcipa.kz\""},{"type":"linebreak"},{"type":"text","value":"\"iapghahpnpnapcipa.in\""},{"type":"linebreak"},{"type":"text","value":"\"goiaegodbuebieibg.su\""},{"type":"linebreak"},{"type":"text","value":"\"goiaegodbuebieibg.ru\""},{"type":"linebreak"},{"type":"text","value":"\"goiaegodbuebieibg.kz\""},{"type":"linebreak"},{"type":"text","value":"\"goiaegodbuebieibg.in\""},{"type":"linebreak"},{"type":"text","value":"\"eghoabeogbuaeofua.su\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Destruction","identifier":"api-26","type":6,"relevance":10,"name":"Marks file for deletion","description":"\"C:\\9afb2870-sample.exe\" marked \"C:\\9afb2870-sample.exe:Zone.Identifier\" for deletion","description_v2":["\"C:\\9afb2870-sample.exe\" marked \"C:\\9afb2870-sample.exe:Zone.Identifier\" for deletion"],"description_v3":[{"type":"text","value":"\"C:\\9afb2870-sample.exe\" marked \"C:\\9afb2870-sample.exe:Zone.Identifier\" for deletion"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Destruction","identifier":"api-25","type":6,"relevance":7,"name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\9afb2870-sample.exe:Zone.Identifier\" with delete access\n \"winmgr.exe\" opened \"%WINDIR%\\M-505059720970246082475082628448545\\winmgr.exe:Zone.Identifier\" with delete access","description_v2":["\"\" opened \"C:\\9afb2870-sample.exe:Zone.Identifier\" with delete access","\"winmgr.exe\" opened \"%WINDIR%\\M-505059720970246082475082628448545\\winmgr.exe:Zone.Identifier\" with delete access"],"description_v3":[{"type":"text","value":"\"\" opened \"C:\\9afb2870-sample.exe:Zone.Identifier\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"winmgr.exe\" opened \"%WINDIR%\\M-505059720970246082475082628448545\\winmgr.exe:Zone.Identifier\" with delete access"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-27","type":3,"relevance":10,"name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","description_v2":["\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"],"description_v3":[{"type":"text","value":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-36","type":3,"relevance":8,"name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","description_v2":["\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"],"description_v3":[{"type":"text","value":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-0","type":0,"relevance":10,"name":"CRC value set in PE header does not match actual value","description":"\"gwhroqkhwu\" claimed CRC 399289 while the actual is CRC 358265\n \"edakubnfgu\" claimed CRC 399289 while the actual is CRC 383223\n \"phqghumeay\" claimed CRC 399289 while the actual is CRC 359159\n \"rgjqmvnkyr\" claimed CRC 399289 while the actual is CRC 341927","description_v2":["\"gwhroqkhwu\" claimed CRC 399289 while the actual is CRC 358265","\"edakubnfgu\" claimed CRC 399289 while the actual is CRC 383223","\"phqghumeay\" claimed CRC 399289 while the actual is CRC 359159","\"rgjqmvnkyr\" claimed CRC 399289 while the actual is CRC 341927"],"description_v3":[{"type":"text","value":"\"gwhroqkhwu\" claimed CRC 399289 while the actual is CRC 358265"},{"type":"linebreak"},{"type":"text","value":"\"edakubnfgu\" claimed CRC 399289 while the actual is CRC 383223"},{"type":"linebreak"},{"type":"text","value":"\"phqghumeay\" claimed CRC 399289 while the actual is CRC 359159"},{"type":"linebreak"},{"type":"text","value":"\"rgjqmvnkyr\" claimed CRC 399289 while the actual is CRC 341927"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-1","type":0,"relevance":1,"name":"Imports suspicious APIs","description":"UnhandledExceptionFilter\n WriteFile\n OutputDebugStringW\n OutputDebugStringA\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryExW\n CreateThread\n TerminateProcess\n GetModuleHandleExW\n GetStartupInfoW\n FindFirstFileExA\n FindNextFileW\n FindNextFileA\n FindFirstFileExW\n GetProcAddress\n CreateFileW\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleW","description_v2":["UnhandledExceptionFilter","WriteFile","OutputDebugStringW","OutputDebugStringA","GetModuleFileNameW","IsDebuggerPresent","GetModuleFileNameA","LoadLibraryExW","CreateThread","TerminateProcess","GetModuleHandleExW","GetStartupInfoW","FindFirstFileExA","FindNextFileW","FindNextFileA","FindFirstFileExW","GetProcAddress","CreateFileW","GetCommandLineW","GetCommandLineA","GetModuleHandleW"],"description_v3":[{"type":"text","value":"UnhandledExceptionFilter"},{"type":"linebreak"},{"type":"text","value":"WriteFile"},{"type":"linebreak"},{"type":"text","value":"OutputDebugStringW"},{"type":"linebreak"},{"type":"text","value":"OutputDebugStringA"},{"type":"linebreak"},{"type":"text","value":"GetModuleFileNameW"},{"type":"linebreak"},{"type":"text","value":"IsDebuggerPresent"},{"type":"linebreak"},{"type":"text","value":"GetModuleFileNameA"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryExW"},{"type":"linebreak"},{"type":"text","value":"CreateThread"},{"type":"linebreak"},{"type":"text","value":"TerminateProcess"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleExW"},{"type":"linebreak"},{"type":"text","value":"GetStartupInfoW"},{"type":"linebreak"},{"type":"text","value":"FindFirstFileExA"},{"type":"linebreak"},{"type":"text","value":"FindNextFileW"},{"type":"linebreak"},{"type":"text","value":"FindNextFileA"},{"type":"linebreak"},{"type":"text","value":"FindFirstFileExW"},{"type":"linebreak"},{"type":"text","value":"GetProcAddress"},{"type":"linebreak"},{"type":"text","value":"CreateFileW"},{"type":"linebreak"},{"type":"text","value":"GetCommandLineW"},{"type":"linebreak"},{"type":"text","value":"GetCommandLineA"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleW"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"hooks-8","type":11,"relevance":10,"name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053157758581677186a1677653c17770000000000bfb7750000000056ccb775000000007ccab7750000000037683b756a2c1777d62d17770000000020693b750000000029a6b77500000000a48d3b7500000000f70eb77500000000\" to virtual address \"0x75AE1000\" (part of module \"NSI.DLL\")","description_v2":["\"\" wrote bytes \"4053157758581677186a1677653c17770000000000bfb7750000000056ccb775000000007ccab7750000000037683b756a2c1777d62d17770000000020693b750000000029a6b77500000000a48d3b7500000000f70eb77500000000\" to virtual address \"0x75AE1000\" (part of module \"NSI.DLL\")"],"description_v3":[{"type":"text","value":"\"\" wrote bytes \"4053157758581677186a1677653c17770000000000bfb7750000000056ccb775000000007ccab7750000000037683b756a2c1777d62d17770000000020693b750000000029a6b77500000000a48d3b7500000000f70eb77500000000\" to virtual address \"0x75AE1000\" (part of module \"NSI.DLL\")"}],"origin":"Hook Detection","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Anti-Detection/Stealthyness","identifier":"api-42","type":6,"relevance":7,"name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"\" opened \"C:\\9afb2870-sample.exe:Zone.Identifier\" with delete access\n \"winmgr.exe\" opened \"%WINDIR%\\M-505059720970246082475082628448545\\winmgr.exe:Zone.Identifier\" with delete access","description_v2":["\"\" opened \"C:\\9afb2870-sample.exe:Zone.Identifier\" with delete access","\"winmgr.exe\" opened \"%WINDIR%\\M-505059720970246082475082628448545\\winmgr.exe:Zone.Identifier\" with delete access"],"description_v3":[{"type":"text","value":"\"\" opened \"C:\\9afb2870-sample.exe:Zone.Identifier\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"winmgr.exe\" opened \"%WINDIR%\\M-505059720970246082475082628448545\\winmgr.exe:Zone.Identifier\" with delete access"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"suricata-2","type":18,"relevance":10,"name":"Detected Suricata Alert","description":"Detected alert \"ET TROJAN Zeus GameOver Possible DGA NXDOMAIN Responses\" (SID: 2018316, Rev: 4, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","description_v2":["Detected alert \"ET TROJAN Zeus GameOver Possible DGA NXDOMAIN Responses\" (SID: 2018316, Rev: 4, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)"],"description_v3":[{"type":"text","value":"Detected alert \"ET TROJAN Zeus GameOver Possible DGA NXDOMAIN Responses\" (SID: 2018316, Rev: 4, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)"}],"origin":"Suricata Alerts","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"avtest-7","type":12,"relevance":10,"name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"4/67 reputation engines marked \"http://rohgoruhgsorhugih.ru\" as malicious (5% detection rate)","description_v2":["4/67 reputation engines marked \"http://rohgoruhgsorhugih.ru\" as malicious (5% detection rate)"],"description_v3":[{"type":"text","value":"4/67 reputation engines marked \"http://rohgoruhgsorhugih.ru\" as malicious (5% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"avtest-3","type":12,"relevance":10,"name":"Sample was identified as malicious by a large number of Antivirus engines","description":"46/66 Antivirus vendors marked sample as malicious (69% detection rate)","description_v2":["46/66 Antivirus vendors marked sample as malicious (69% detection rate)"],"description_v3":[{"type":"text","value":"46/66 Antivirus vendors marked sample as malicious (69% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"avtest-0","type":12,"relevance":8,"name":"Sample was identified as malicious by at least one Antivirus engine","description":"46/66 Antivirus vendors marked sample as malicious (69% detection rate)","description_v2":["46/66 Antivirus vendors marked sample as malicious (69% detection rate)"],"description_v3":[{"type":"text","value":"46/66 Antivirus vendors marked sample as malicious (69% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"General","identifier":"binary-11","type":8,"relevance":10,"name":"The analysis extracted a file that was identified as malicious","description":"58/68 Antivirus vendors marked dropped file \"gwhroqkhwu\" as malicious (classified as \"Trojan.Generic\" with 85% detection rate)\n 22/67 Antivirus vendors marked dropped file \"edakubnfgu\" as malicious (classified as \"Trojan.Generic\" with 32% detection rate)\n 22/67 Antivirus vendors marked dropped file \"phqghumeay\" as malicious (classified as \"Trojan.Generic\" with 32% detection rate)\n 22/67 Antivirus vendors marked dropped file \"rgjqmvnkyr\" as malicious (classified as \"Trojan.Generic\" with 32% detection rate)","description_v2":["58/68 Antivirus vendors marked dropped file \"gwhroqkhwu\" as malicious (classified as \"Trojan.Generic\" with 85% detection rate)","22/67 Antivirus vendors marked dropped file \"edakubnfgu\" as malicious (classified as \"Trojan.Generic\" with 32% detection rate)","22/67 Antivirus vendors marked dropped file \"phqghumeay\" as malicious (classified as \"Trojan.Generic\" with 32% detection rate)","22/67 Antivirus vendors marked dropped file \"rgjqmvnkyr\" as malicious (classified as \"Trojan.Generic\" with 32% detection rate)"],"description_v3":[{"type":"text","value":"58/68 Antivirus vendors marked dropped file \"gwhroqkhwu\" as malicious (classified as \"Trojan.Generic\" with 85% detection rate)"},{"type":"linebreak"},{"type":"text","value":"22/67 Antivirus vendors marked dropped file \"edakubnfgu\" as malicious (classified as \"Trojan.Generic\" with 32% detection rate)"},{"type":"linebreak"},{"type":"text","value":"22/67 Antivirus vendors marked dropped file \"phqghumeay\" as malicious (classified as \"Trojan.Generic\" with 32% detection rate)"},{"type":"linebreak"},{"type":"text","value":"22/67 Antivirus vendors marked dropped file \"rgjqmvnkyr\" as malicious (classified as \"Trojan.Generic\" with 32% detection rate)"}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"General","identifier":"target-58","type":9,"relevance":10,"name":"The analysis spawned a process that was identified as malicious","description":"46/66 Antivirus vendors marked spawned process \"\" (PID: 3680) as malicious (classified as \"Trojan.Generic\" with 69% detection rate)\n 46/66 Antivirus vendors marked spawned process \"winmgr.exe\" (PID: 2132) as malicious (classified as \"Trojan.Generic\" with 69% detection rate)\n 46/66 Antivirus vendors marked spawned process \"winmgr.exe\" (PID: 3484) as malicious (classified as \"Trojan.Generic\" with 69% detection rate)","description_v2":["46/66 Antivirus vendors marked spawned process \"\" (PID: 3680) as malicious (classified as \"Trojan.Generic\" with 69% detection rate)","46/66 Antivirus vendors marked spawned process \"winmgr.exe\" (PID: 2132) as malicious (classified as \"Trojan.Generic\" with 69% detection rate)","46/66 Antivirus vendors marked spawned process \"winmgr.exe\" (PID: 3484) as malicious (classified as \"Trojan.Generic\" with 69% detection rate)"],"description_v3":[{"type":"text","value":"46/66 Antivirus vendors marked spawned process \"\" (PID: 3680) as malicious (classified as \"Trojan.Generic\" with 69% detection rate)"},{"type":"linebreak"},{"type":"text","value":"46/66 Antivirus vendors marked spawned process \"winmgr.exe\" (PID: 2132) as malicious (classified as \"Trojan.Generic\" with 69% detection rate)"},{"type":"linebreak"},{"type":"text","value":"46/66 Antivirus vendors marked spawned process \"winmgr.exe\" (PID: 3484) as malicious (classified as \"Trojan.Generic\" with 69% detection rate)"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Installation/Persistance","identifier":"api-0","type":6,"relevance":6,"name":"Writes data to a remote process","description":"$2a","description_v2":["\"\" wrote 32 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)","\"\" wrote 52 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)","\"\" wrote 4 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)","\"\" wrote 1024 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)","\"\" wrote 22016 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)","\"\" wrote 12800 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)","\"\" wrote 2560 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)","\"\" wrote 2048 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)","\"\" wrote 32 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 192)","\"\" wrote 52 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 192)","\"\" wrote 4 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 192)","\"winmgr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)","\"winmgr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)","\"winmgr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)","\"winmgr.exe\" wrote 1024 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)","\"winmgr.exe\" wrote 22016 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)","\"winmgr.exe\" wrote 12800 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)","\"winmgr.exe\" wrote 2560 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)","\"winmgr.exe\" wrote 2048 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)"],"description_v3":[{"type":"text","value":"\"\" wrote 32 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 52 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 4 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 1024 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 22016 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 12800 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 2560 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 2048 bytes to a remote process \"C:\\9afb2870-sample.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 32 bytes to a remote process \"%WINDIR%\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 192)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 52 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 192)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 4 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 192)"},{"type":"linebreak"},{"type":"text","value":"\"winmgr.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"winmgr.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"winmgr.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"winmgr.exe\" wrote 1024 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"winmgr.exe\" wrote 22016 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"winmgr.exe\" wrote 12800 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"winmgr.exe\" wrote 2560 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"winmgr.exe\" wrote 2048 bytes to a remote process \"C:\\Windows\\M-505059720970246082475082628448545\\winmgr.exe\" (Handle: 76)"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Network Related","identifier":"network-21","type":7,"relevance":10,"name":"Malicious artifacts seen in the context of a contacted host","description":"$2b","description_v2":["Found malicious artifacts related to \"220.181.87.80\": ...","URL: http://220.181.87.80/ (AV positives: 9/67 scanned on 04/13/2018 19:52:06)","URL: http://photobeat.su/ (AV positives: 4/67 scanned on 04/05/2018 20:19:47)","URL: http://220.181.87.80/k.exe (AV positives: 10/67 scanned on 03/31/2018 19:33:14)","URL: http://auoegfiaefuageudn.ru/ (AV positives: 2/67 scanned on 03/13/2018 13:36:26)","URL: http://xjpakmdcfuqe.ru/ (AV positives: 5/66 scanned on 12/01/2017 20:16:51)","File SHA256: 5b1cb6acbd68c911e15adc8f4bbacf1ec4efc16e (Date: 04/11/2018 05:15:22)","File SHA256: 21f2b8f84c566749bf7076598cde0492 (Date: 04/11/2018 05:15:22)","File SHA256: f00a375ef54f6b0223b6f9a5dc00f0df941dd54ab6e353a982c9c18fe8891129 (Date: 04/11/2018 05:15:22)","File SHA256: 340f86c78f56fb71ca0a111b10ccd40baa0ab8c85cac241af27194b6f7b4be3c (Date: 04/11/2018 05:15:22)","File SHA256: b982d79da5f8a8e5667d643ffad767bd (Date: 04/11/2018 05:15:22)","File SHA256: adbf62843d57df8558d35addb08ca052cd9e27dd7ac5f565fd90b05119b53011 (AV positives: 58/66 scanned on 04/03/2018 05:40:35)","File SHA256: fa422a185168193606f71ed2ba5355f5f1aed45333c6b0c1e6c323a101030c0b (AV positives: 15/66 scanned on 04/03/2018 05:27:04)","File SHA256: fe9c5bb24122d6a81239be3719b1c6583f534d5b7fe6d2a199835a64cc7951f9 (AV positives: 60/67 scanned on 04/02/2018 19:02:42)","File SHA256: f7cea8b9d6d8a19974a95dbb996bb022561298458d0db39a183def82aee6334d (AV positives: 59/65 scanned on 04/02/2018 19:01:49)","File SHA256: f1a3684c5d31dac6f6bf9186bbb165c41cd0e81613db838b5080a2831c7b9a3d (AV positives: 60/67 scanned on 04/02/2018 19:00:06)","File SHA256: e82c52f279163b1f01fa50732438724e313e67053b24c0f712cefe923c563c9e (Date: 03/29/2018 23:03:57)","File SHA256: 5ff1a8a5464bafbae155f3ab63d07b903c3d0a90ef467905013c415724c2feb7 (Date: 03/29/2018 21:49:36)","File SHA256: 04023ff653ecbc08e55d51d31adf110627fb36245d330cbcaffa9d7076a7de37 (Date: 03/29/2018 21:49:26)","File SHA256: 6e5de2363825ea1f2d921dd6b76aca80b52327bfb0e80e9de2ecbce7abc0989d (Date: 03/29/2018 21:49:01)","File SHA256: ecd49bc92640d9f74eb1d7a73bdcce05bc3fe71ad2948a385d1e1efd04d586c6 (Date: 03/14/2018 18:01:58)","Found malicious artifacts related to \"173.230.130.175\": ...","URL: http://download.recover-files.ws/setup-cure-files.exe (AV positives: 2/67 scanned on 04/21/2018 11:55:25)","URL: http://mostwatched.ws/crafts/fabric-embellishments.html (AV positives: 4/67 scanned on 04/21/2018 11:34:44)","URL: http://www.img502.imageshack.us.img502.ws/cb/w.php?f=c6300&e=4 (AV positives: 3/67 scanned on 04/21/2018 11:25:27)","URL: http://www.img502.imageshack.us.img502.ws/cb/w.php?f=c6300&e=0 (AV positives: 3/67 scanned on 04/21/2018 11:24:01)","URL: http://www.img502.imageshack.us.img502.ws/cb/w.php?f=435d4&e=0 (AV positives: 3/67 scanned on 04/21/2018 10:24:18)","File SHA256: 6549b3d719627cb128a558de2c5693c17de4a2a42700f9368a971a51f4aa2204 (AV positives: 54/68 scanned on 04/20/2018 11:05:01)","File SHA256: 75f74c0360077cbbbc3dab8d8ec43fea614a9a38abe558f3da218bb755c9ec1b (Date: 04/17/2018 04:43:58)","File SHA256: 5015393447a4a317ce8c5748bd0e57231080e270ce7da11b2ee5ad31d2389d69 (Date: 04/17/2018 02:01:36)","File SHA256: db28ad609a7a14e858534fea95df56625a917e68a2a158202b3c28fb40bd2dda (Date: 04/17/2018 00:42:13)","File SHA256: 344e5af768fd87406f6a1358b1ecabc5e206a518e151244cef425c8b696feab2 (Date: 04/16/2018 22:00:30)","File SHA256: a8705be2b826a79cccc905655bea046c4f7e0af0483e9ae8b02adec17e55b09a (Date: 04/16/2018 21:56:13)","File SHA256: 21575d42eace3e9b42d6a46479932a78849f6816384a9e300200ec4c8c216b55 (AV positives: 11/67 scanned on 04/11/2018 05:16:24)","File SHA256: e77f2676d4fe116dd582e733e2d2d1603c8905dc3529696e65775409952f95d5 (AV positives: 50/66 scanned on 04/11/2018 04:45:22)","File SHA256: 693c5627f624067ef7db1387327da807eae279778c9a7120320e6202369eb9ed (AV positives: 58/67 scanned on 04/10/2018 09:51:30)","File SHA256: c7e42cbe9b6c7b3e20edcc0f555b93efcc507d5af6cd84ca84675c45012364e7 (AV positives: 44/67 scanned on 04/09/2018 21:56:17)"],"description_v3":[{"type":"text","value":"Found malicious artifacts related to \"220.181.87.80\": ..."},{"type":"linebreak"},{"type":"text","value":"URL: http://220.181.87.80/ (AV positives: 9/67 scanned on 04/13/2018 19:52:06)"},{"type":"linebreak"},{"type":"text","value":"URL: http://photobeat.su/ (AV positives: 4/67 scanned on 04/05/2018 20:19:47)"},{"type":"linebreak"},{"type":"text","value":"URL: http://220.181.87.80/k.exe (AV positives: 10/67 scanned on 03/31/2018 19:33:14)"},{"type":"linebreak"},{"type":"text","value":"URL: http://auoegfiaefuageudn.ru/ (AV positives: 2/67 scanned on 03/13/2018 13:36:26)"},{"type":"linebreak"},{"type":"text","value":"URL: http://xjpakmdcfuqe.ru/ (AV positives: 5/66 scanned on 12/01/2017 20:16:51)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 5b1cb6acbd68c911e15adc8f4bbacf1ec4efc16e (Date: 04/11/2018 05:15:22)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 21f2b8f84c566749bf7076598cde0492 (Date: 04/11/2018 05:15:22)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: f00a375ef54f6b0223b6f9a5dc00f0df941dd54ab6e353a982c9c18fe8891129 (Date: 04/11/2018 05:15:22)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 340f86c78f56fb71ca0a111b10ccd40baa0ab8c85cac241af27194b6f7b4be3c (Date: 04/11/2018 05:15:22)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: b982d79da5f8a8e5667d643ffad767bd (Date: 04/11/2018 05:15:22)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: adbf62843d57df8558d35addb08ca052cd9e27dd7ac5f565fd90b05119b53011 (AV positives: 58/66 scanned on 04/03/2018 05:40:35)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: fa422a185168193606f71ed2ba5355f5f1aed45333c6b0c1e6c323a101030c0b (AV positives: 15/66 scanned on 04/03/2018 05:27:04)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: fe9c5bb24122d6a81239be3719b1c6583f534d5b7fe6d2a199835a64cc7951f9 (AV positives: 60/67 scanned on 04/02/2018 19:02:42)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: f7cea8b9d6d8a19974a95dbb996bb022561298458d0db39a183def82aee6334d (AV positives: 59/65 scanned on 04/02/2018 19:01:49)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: f1a3684c5d31dac6f6bf9186bbb165c41cd0e81613db838b5080a2831c7b9a3d (AV positives: 60/67 scanned on 04/02/2018 19:00:06)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: e82c52f279163b1f01fa50732438724e313e67053b24c0f712cefe923c563c9e (Date: 03/29/2018 23:03:57)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 5ff1a8a5464bafbae155f3ab63d07b903c3d0a90ef467905013c415724c2feb7 (Date: 03/29/2018 21:49:36)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 04023ff653ecbc08e55d51d31adf110627fb36245d330cbcaffa9d7076a7de37 (Date: 03/29/2018 21:49:26)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 6e5de2363825ea1f2d921dd6b76aca80b52327bfb0e80e9de2ecbce7abc0989d (Date: 03/29/2018 21:49:01)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: ecd49bc92640d9f74eb1d7a73bdcce05bc3fe71ad2948a385d1e1efd04d586c6 (Date: 03/14/2018 18:01:58)"},{"type":"linebreak"},{"type":"text","value":"Found malicious artifacts related to \"173.230.130.175\": ..."},{"type":"linebreak"},{"type":"text","value":"URL: http://download.recover-files.ws/setup-cure-files.exe (AV positives: 2/67 scanned on 04/21/2018 11:55:25)"},{"type":"linebreak"},{"type":"text","value":"URL: http://mostwatched.ws/crafts/fabric-embellishments.html (AV positives: 4/67 scanned on 04/21/2018 11:34:44)"},{"type":"linebreak"},{"type":"text","value":"URL: http://www.img502.imageshack.us.img502.ws/cb/w.php?f=c6300&e=4 (AV positives: 3/67 scanned on 04/21/2018 11:25:27)"},{"type":"linebreak"},{"type":"text","value":"URL: http://www.img502.imageshack.us.img502.ws/cb/w.php?f=c6300&e=0 (AV positives: 3/67 scanned on 04/21/2018 11:24:01)"},{"type":"linebreak"},{"type":"text","value":"URL: http://www.img502.imageshack.us.img502.ws/cb/w.php?f=435d4&e=0 (AV positives: 3/67 scanned on 04/21/2018 10:24:18)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 6549b3d719627cb128a558de2c5693c17de4a2a42700f9368a971a51f4aa2204 (AV positives: 54/68 scanned on 04/20/2018 11:05:01)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 75f74c0360077cbbbc3dab8d8ec43fea614a9a38abe558f3da218bb755c9ec1b (Date: 04/17/2018 04:43:58)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 5015393447a4a317ce8c5748bd0e57231080e270ce7da11b2ee5ad31d2389d69 (Date: 04/17/2018 02:01:36)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: db28ad609a7a14e858534fea95df56625a917e68a2a158202b3c28fb40bd2dda (Date: 04/17/2018 00:42:13)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 344e5af768fd87406f6a1358b1ecabc5e206a518e151244cef425c8b696feab2 (Date: 04/16/2018 22:00:30)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: a8705be2b826a79cccc905655bea046c4f7e0af0483e9ae8b02adec17e55b09a (Date: 04/16/2018 21:56:13)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 21575d42eace3e9b42d6a46479932a78849f6816384a9e300200ec4c8c216b55 (AV positives: 11/67 scanned on 04/11/2018 05:16:24)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: e77f2676d4fe116dd582e733e2d2d1603c8905dc3529696e65775409952f95d5 (AV positives: 50/66 scanned on 04/11/2018 04:45:22)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: 693c5627f624067ef7db1387327da807eae279778c9a7120320e6202369eb9ed (AV positives: 58/67 scanned on 04/10/2018 09:51:30)"},{"type":"linebreak"},{"type":"text","value":"File SHA256: c7e42cbe9b6c7b3e20edcc0f555b93efcc507d5af6cd84ca84675c45012364e7 (AV positives: 44/67 scanned on 04/09/2018 21:56:17)"}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"System Destruction","identifier":"api-59","type":6,"relevance":5,"name":"Interacts with the primary disk partition (DR0)","description":"\"\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400\n \"winmgr.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400","description_v2":["\"\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400","\"winmgr.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400"],"description_v3":[{"type":"text","value":"\"\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400"},{"type":"linebreak"},{"type":"text","value":"\"winmgr.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Unusual Characteristics","identifier":"target-14","type":9,"relevance":8,"name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00047647-00003048)\n Spawned process \"\" (UID: 00050960-00003680)\n Spawned process \"cmd.exe\" with commandline \"cmd /c \"\"%TEMP%\\gtbvjyxphi.bat\" \"\" (UID: 00051554-00003360)\n Spawned process \"winmgr.exe\" (UID: 00051562-00002132)\n Spawned process \"winmgr.exe\" (UID: 00055537-00003484)","description_v2":["Spawned process \"\" (UID: 00047647-00003048)","Spawned process \"\" (UID: 00050960-00003680)","Spawned process \"cmd.exe\" with commandline \"cmd /c \"\"%TEMP%\\gtbvjyxphi.bat\" \"\" (UID: 00051554-00003360)","Spawned process \"winmgr.exe\" (UID: 00051562-00002132)","Spawned process \"winmgr.exe\" (UID: 00055537-00003484)"],"description_v3":[{"type":"text","value":"Spawned process \"\""},{"type":"process","process_uid":"00047647-00003048","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"\""},{"type":"process","process_uid":"00050960-00003680","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"cmd /c \"\"%TEMP%\\gtbvjyxphi.bat\" \"\""},{"type":"process","process_uid":"00051554-00003360","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"winmgr.exe\""},{"type":"process","process_uid":"00051562-00002132","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"winmgr.exe\""},{"type":"process","process_uid":"00055537-00003484","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":false,"allow_sample_tampering":false,"network_mode":"default","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":240,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 7","windows_version_edition":"Home Premium","windows_version_service_pack":"Service Pack 1","windows_version_version":"6.1 (build 7601)","windows_version_bitness":"32","custom_date_time":null,"sandbox_version":"8.00","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[{"name":"Remote Access","details":["Uses network protocols on unusual ports"]},{"name":"Persistence","details":["Writes data to a remote process","Interacts with the primary disk partition (DR0)","Modifies auto-execute functionality by setting/creating a value in the registry","Spawns a lot of processes"]},{"name":"Fingerprint","details":["Reads the active computer name"]},{"name":"Spreading","details":["Opens the MountPointManager (often used to detect additional infection locations)"]},{"name":"Network Behavior","details":["Contacts 57 domains and 57 hosts"]}],"icon":"$2c","visualization":"$2d","classification":["67.4% (.EXE) Win32 Executable MS Visual C++ (generic)","14.2% (.DLL) Win32 Dynamic Link Library (generic)","9.7% (.EXE) Win32 Executable (generic)","4.3% (.EXE) Generic Win/DOS Executable","4.3% (.EXE) DOS Executable Generic"],"dns_requests":[{"compromised":true,"domain":"siiifibiiegiiciib.ws","address":"173.230.130.175","ttl":299,"country":"United States","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"b3894ca4354619d2828088ec1cab6e6f4ee92de1e8a1291ac42e515ce1b4b9c7","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:50+00:00","reference":null},{"sha256":"704abe9a1f735dd4c4a4346cf9288edd181dc537","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:50+00:00","reference":null},{"sha256":"6bfada57a115a52af2ee7a82e2d26732","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:50+00:00","reference":null},{"sha256":"f4c9e7adcea8ec043b4b9f7f9ff28706","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:50+00:00","reference":null},{"sha256":"09d0bb7c849a16b52dee1a693acaf08ce12d760a","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:50+00:00","reference":null}]},{"compromised":false,"domain":"siiifibiiegiiciib.su","address":null,"ttl":1799,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"307db75e09baf54a18146ca8a46f92f77afbd9613ab3171315df3accfa7cbe91","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-02-12T19:22:26+00:00","reference":null}]},{"compromised":true,"domain":"siiifibiiegiiciib.ru","address":null,"ttl":737,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"6bfada57a115a52af2ee7a82e2d26732","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:15+00:00","reference":null},{"sha256":"9332e4fdc16fb71e340a47450dc2a12a","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:16+00:00","reference":null},{"sha256":"b3894ca4354619d2828088ec1cab6e6f4ee92de1e8a1291ac42e515ce1b4b9c7","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:16+00:00","reference":null},{"sha256":"3c3fbe0d23d47438b79a590e0182e79d7cddeb2d5db9090942a970094ed29fdd","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:15+00:00","reference":null},{"sha256":"ab4e475e5e3b3ac12fe15aa96ce00749586787b5","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:15+00:00","reference":null},{"sha256":"6bf47e92cf57b24ca64756b22dd2675f05fb1b8470a466632ec7cf8fe1b8ad30","verdict":"no verdict","positives":null,"total":null,"scan_date":"2018-03-13T08:02:58+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/6bf47e92cf57b24ca64756b22dd2675f05fb1b8470a466632ec7cf8fe1b8ad30/"}},{"sha256":"f5810df5663f1f49ab43a14494de2ced264aaa4a117648fb4050875dacdc43f9","verdict":"no verdict","positives":null,"total":null,"scan_date":"2017-11-15T17:58:30+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/f5810df5663f1f49ab43a14494de2ced264aaa4a117648fb4050875dacdc43f9/"}},{"sha256":"e75184cf891e4cb8cc2a1cefd9ff5946c28fdd0e996dc571eb9dacbc76c6cb5b","verdict":"no verdict","positives":null,"total":null,"scan_date":"2017-10-28T10:56:57+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/e75184cf891e4cb8cc2a1cefd9ff5946c28fdd0e996dc571eb9dacbc76c6cb5b/"}}]},{"compromised":true,"domain":"siiifibiiegiiciib.nl","address":null,"ttl":599,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"704abe9a1f735dd4c4a4346cf9288edd181dc537","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:47:36+00:00","reference":null},{"sha256":"6bfada57a115a52af2ee7a82e2d26732","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:47:35+00:00","reference":null},{"sha256":"09d0bb7c849a16b52dee1a693acaf08ce12d760a","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:47:36+00:00","reference":null},{"sha256":"357b4c72c9c22271c3d96ed2896066dc55acc941cccf341b7845dd9aef7b7943","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:47:36+00:00","reference":null},{"sha256":"ab4e475e5e3b3ac12fe15aa96ce00749586787b5","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:47:36+00:00","reference":null}]},{"compromised":true,"domain":"siiifibiiegiiciib.kz","address":null,"ttl":1799,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"09d0bb7c849a16b52dee1a693acaf08ce12d760a","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:59+00:00","reference":null},{"sha256":"9332e4fdc16fb71e340a47450dc2a12a","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:59+00:00","reference":null},{"sha256":"357b4c72c9c22271c3d96ed2896066dc55acc941cccf341b7845dd9aef7b7943","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:59+00:00","reference":null},{"sha256":"ab4e475e5e3b3ac12fe15aa96ce00749586787b5","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:59+00:00","reference":null},{"sha256":"3c3fbe0d23d47438b79a590e0182e79d7cddeb2d5db9090942a970094ed29fdd","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:59+00:00","reference":null}]},{"compromised":true,"domain":"siiifibiiegiiciib.in","address":null,"ttl":834,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"f4c9e7adcea8ec043b4b9f7f9ff28706","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:26+00:00","reference":null},{"sha256":"3c3fbe0d23d47438b79a590e0182e79d7cddeb2d5db9090942a970094ed29fdd","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:26+00:00","reference":null},{"sha256":"09d0bb7c849a16b52dee1a693acaf08ce12d760a","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:26+00:00","reference":null},{"sha256":"704abe9a1f735dd4c4a4346cf9288edd181dc537","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:26+00:00","reference":null},{"sha256":"357b4c72c9c22271c3d96ed2896066dc55acc941cccf341b7845dd9aef7b7943","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:26+00:00","reference":null}]},{"compromised":true,"domain":"rohgoruhgsorhugih.ws","address":"173.230.130.175","ttl":299,"country":"United States","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"f4c9e7adcea8ec043b4b9f7f9ff28706","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:29+00:00","reference":null},{"sha256":"b3894ca4354619d2828088ec1cab6e6f4ee92de1e8a1291ac42e515ce1b4b9c7","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:30+00:00","reference":null},{"sha256":"704abe9a1f735dd4c4a4346cf9288edd181dc537","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:30+00:00","reference":null},{"sha256":"357b4c72c9c22271c3d96ed2896066dc55acc941cccf341b7845dd9aef7b7943","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:29+00:00","reference":null},{"sha256":"3c3fbe0d23d47438b79a590e0182e79d7cddeb2d5db9090942a970094ed29fdd","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:29+00:00","reference":null},{"sha256":"6754a1bfc91e617a8aa7d56ed8c4de91d1718064459b91aff2862bac00578c3d","verdict":"no verdict","positives":null,"total":null,"scan_date":"2017-10-29T01:24:47+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/6754a1bfc91e617a8aa7d56ed8c4de91d1718064459b91aff2862bac00578c3d/"}}]},{"compromised":false,"domain":"rohgoruhgsorhugih.su","address":null,"ttl":193,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"6bf47e92cf57b24ca64756b22dd2675f05fb1b8470a466632ec7cf8fe1b8ad30","verdict":"no verdict","positives":null,"total":null,"scan_date":"2018-03-13T08:02:58+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/6bf47e92cf57b24ca64756b22dd2675f05fb1b8470a466632ec7cf8fe1b8ad30/"}},{"sha256":"199f6bc4e427a37be82b0337a4458866b050f7e4f008d930466508eb6877a990","verdict":"no verdict","positives":null,"total":null,"scan_date":"2018-03-03T18:02:13+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/199f6bc4e427a37be82b0337a4458866b050f7e4f008d930466508eb6877a990/"}},{"sha256":"307db75e09baf54a18146ca8a46f92f77afbd9613ab3171315df3accfa7cbe91","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-02-12T19:22:25+00:00","reference":null}]},{"compromised":true,"domain":"rohgoruhgsorhugih.ru","address":null,"ttl":1541,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"340f86c78f56fb71ca0a111b10ccd40baa0ab8c85cac241af27194b6f7b4be3c","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-11T05:01:28+00:00","reference":null},{"sha256":"f00a375ef54f6b0223b6f9a5dc00f0df941dd54ab6e353a982c9c18fe8891129","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-11T05:01:34+00:00","reference":null},{"sha256":"5b1cb6acbd68c911e15adc8f4bbacf1ec4efc16e","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-11T05:01:28+00:00","reference":null},{"sha256":"21f2b8f84c566749bf7076598cde0492","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-11T05:01:34+00:00","reference":null},{"sha256":"87b4adc0d8d7776362e8c715e788c887436e3179","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-11T05:01:34+00:00","reference":null},{"sha256":"6bf47e92cf57b24ca64756b22dd2675f05fb1b8470a466632ec7cf8fe1b8ad30","verdict":"no verdict","positives":null,"total":null,"scan_date":"2018-03-13T08:02:58+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/6bf47e92cf57b24ca64756b22dd2675f05fb1b8470a466632ec7cf8fe1b8ad30/"}},{"sha256":"e58eaa4f75cb68da035aab9e95eb7fb55b1b12dd687459be0f1f47087f681faf","verdict":"no verdict","positives":null,"total":null,"scan_date":"2017-11-15T18:01:50+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/e58eaa4f75cb68da035aab9e95eb7fb55b1b12dd687459be0f1f47087f681faf/"}},{"sha256":"e75184cf891e4cb8cc2a1cefd9ff5946c28fdd0e996dc571eb9dacbc76c6cb5b","verdict":"no verdict","positives":null,"total":null,"scan_date":"2017-10-28T10:56:57+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/e75184cf891e4cb8cc2a1cefd9ff5946c28fdd0e996dc571eb9dacbc76c6cb5b/"}}]},{"compromised":true,"domain":"rohgoruhgsorhugih.nl","address":null,"ttl":599,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"deee8c27325616439b9c05b66d5ea5e4800cc14e","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-20T01:48:22+00:00","reference":null},{"sha256":"cec491b1d405ca88eaa7e2beeb28915425350d77b5b3ffb7ef3542a031003e46","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-20T01:48:21+00:00","reference":null},{"sha256":"035d1403e6378a74e1c904b89c0ad578efce2f8455d44ba24dee6abf027cb360","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-20T16:52:20+00:00","reference":null},{"sha256":"007b4820233b63d354864ad72312af6e","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-20T01:48:21+00:00","reference":null},{"sha256":"6d2d3a75d2339ee45745358c40c7a2dec7752739","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-20T16:52:20+00:00","reference":null}]},{"compromised":true,"domain":"rohgoruhgsorhugih.kz","address":null,"ttl":884,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"e392fd94a7f576825d7fc3b34675e459","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-20T16:51:36+00:00","reference":null},{"sha256":"deee8c27325616439b9c05b66d5ea5e4800cc14e","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-20T01:47:40+00:00","reference":null},{"sha256":"007b4820233b63d354864ad72312af6e","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-20T01:47:40+00:00","reference":null},{"sha256":"b531852fba799529d6f7b5da134ce19172f0d2e9d58d91244da08f8d97c9cf13","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-20T01:47:40+00:00","reference":null},{"sha256":"96391e658bd63c5ebecae515248aa971","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-20T16:51:35+00:00","reference":null}]},{"compromised":true,"domain":"rohgoruhgsorhugih.in","address":null,"ttl":899,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"b531852fba799529d6f7b5da134ce19172f0d2e9d58d91244da08f8d97c9cf13","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-20T01:46:57+00:00","reference":null},{"sha256":"5059d20013f821eebd0feb6116cfdd6fef9ea48f","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-20T16:50:42+00:00","reference":null},{"sha256":"cec491b1d405ca88eaa7e2beeb28915425350d77b5b3ffb7ef3542a031003e46","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-20T01:46:57+00:00","reference":null},{"sha256":"96391e658bd63c5ebecae515248aa971","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-20T16:50:41+00:00","reference":null},{"sha256":"80eab3193514be5ad0979db8c8ad264f","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-20T01:46:57+00:00","reference":null}]},{"compromised":true,"domain":"oeihefoeaboeubfuo.ws","address":"173.230.130.175","ttl":146,"country":"United States","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"f4c9e7adcea8ec043b4b9f7f9ff28706","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:33+00:00","reference":null},{"sha256":"3c3fbe0d23d47438b79a590e0182e79d7cddeb2d5db9090942a970094ed29fdd","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:33+00:00","reference":null},{"sha256":"6bfada57a115a52af2ee7a82e2d26732","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:32+00:00","reference":null},{"sha256":"09d0bb7c849a16b52dee1a693acaf08ce12d760a","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:33+00:00","reference":null},{"sha256":"ab4e475e5e3b3ac12fe15aa96ce00749586787b5","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:33+00:00","reference":null}]},{"compromised":false,"domain":"oeihefoeaboeubfuo.su","address":null,"ttl":1799,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"307db75e09baf54a18146ca8a46f92f77afbd9613ab3171315df3accfa7cbe91","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-02-12T19:22:26+00:00","reference":null}]},{"compromised":true,"domain":"oeihefoeaboeubfuo.ru","address":null,"ttl":1799,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"b982d79da5f8a8e5667d643ffad767bd","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-11T05:01:32+00:00","reference":null},{"sha256":"f00a375ef54f6b0223b6f9a5dc00f0df941dd54ab6e353a982c9c18fe8891129","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-11T05:01:36+00:00","reference":null},{"sha256":"21f2b8f84c566749bf7076598cde0492","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-11T05:01:36+00:00","reference":null},{"sha256":"340f86c78f56fb71ca0a111b10ccd40baa0ab8c85cac241af27194b6f7b4be3c","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-11T05:01:32+00:00","reference":null},{"sha256":"5b1cb6acbd68c911e15adc8f4bbacf1ec4efc16e","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-11T05:01:33+00:00","reference":null}]},{"compromised":true,"domain":"oeihefoeaboeubfuo.nl","address":null,"ttl":499,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"ab4e475e5e3b3ac12fe15aa96ce00749586787b5","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:47:18+00:00","reference":null},{"sha256":"9332e4fdc16fb71e340a47450dc2a12a","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:47:18+00:00","reference":null},{"sha256":"b3894ca4354619d2828088ec1cab6e6f4ee92de1e8a1291ac42e515ce1b4b9c7","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:47:18+00:00","reference":null},{"sha256":"f4c9e7adcea8ec043b4b9f7f9ff28706","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:47:18+00:00","reference":null},{"sha256":"357b4c72c9c22271c3d96ed2896066dc55acc941cccf341b7845dd9aef7b7943","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:47:18+00:00","reference":null}]},{"compromised":true,"domain":"oeihefoeaboeubfuo.kz","address":null,"ttl":586,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"ab4e475e5e3b3ac12fe15aa96ce00749586787b5","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:43+00:00","reference":null},{"sha256":"704abe9a1f735dd4c4a4346cf9288edd181dc537","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:43+00:00","reference":null},{"sha256":"f4c9e7adcea8ec043b4b9f7f9ff28706","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:43+00:00","reference":null},{"sha256":"6bfada57a115a52af2ee7a82e2d26732","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:43+00:00","reference":null},{"sha256":"357b4c72c9c22271c3d96ed2896066dc55acc941cccf341b7845dd9aef7b7943","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:43+00:00","reference":null}]},{"compromised":true,"domain":"oeihefoeaboeubfuo.in","address":null,"ttl":705,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"6bfada57a115a52af2ee7a82e2d26732","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:07+00:00","reference":null},{"sha256":"3c3fbe0d23d47438b79a590e0182e79d7cddeb2d5db9090942a970094ed29fdd","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:07+00:00","reference":null},{"sha256":"9332e4fdc16fb71e340a47450dc2a12a","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:07+00:00","reference":null},{"sha256":"09d0bb7c849a16b52dee1a693acaf08ce12d760a","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:07+00:00","reference":null},{"sha256":"b3894ca4354619d2828088ec1cab6e6f4ee92de1e8a1291ac42e515ce1b4b9c7","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:46:07+00:00","reference":null}]},{"compromised":true,"domain":"oeabocbeogoaehgoi.ws","address":"173.230.130.175","ttl":240,"country":"United States","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[{"sha256":"3c3fbe0d23d47438b79a590e0182e79d7cddeb2d5db9090942a970094ed29fdd","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:40+00:00","reference":null},{"sha256":"09d0bb7c849a16b52dee1a693acaf08ce12d760a","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:40+00:00","reference":null},{"sha256":"b3894ca4354619d2828088ec1cab6e6f4ee92de1e8a1291ac42e515ce1b4b9c7","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:40+00:00","reference":null},{"sha256":"9332e4fdc16fb71e340a47450dc2a12a","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:40+00:00","reference":null},{"sha256":"357b4c72c9c22271c3d96ed2896066dc55acc941cccf341b7845dd9aef7b7943","verdict":"suspicious","positives":null,"total":null,"scan_date":"2018-04-16T23:45:40+00:00","reference":null}]},{"compromised":false,"domain":"oeabocbeogoaehgoi.su","address":null,"ttl":1799,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"oeabocbeogoaehgoi.ru","address":null,"ttl":1799,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"oeabocbeogoaehgoi.nl","address":null,"ttl":599,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"oeabocbeogoaehgoi.kz","address":null,"ttl":1799,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"oeabocbeogoaehgoi.in","address":null,"ttl":271,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":true,"domain":"iapghahpnpnapcipa.ws","address":"173.230.130.175","ttl":299,"country":"United States","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"iapghahpnpnapcipa.su","address":null,"ttl":205,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"iapghahpnpnapcipa.ru","address":null,"ttl":1267,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"iapghahpnpnapcipa.nl","address":null,"ttl":599,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"iapghahpnpnapcipa.kz","address":null,"ttl":1799,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"iapghahpnpnapcipa.in","address":null,"ttl":637,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":true,"domain":"goiaegodbuebieibg.ws","address":"173.230.130.175","ttl":1,"country":"United States","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"goiaegodbuebieibg.su","address":null,"ttl":316,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"goiaegodbuebieibg.ru","address":null,"ttl":1799,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"goiaegodbuebieibg.kz","address":null,"ttl":1799,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"goiaegodbuebieibg.in","address":null,"ttl":573,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":true,"domain":"eghoabeogbuaeofua.ws","address":"173.230.130.175","ttl":299,"country":"United States","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"eghoabeogbuaeofua.su","address":null,"ttl":1799,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"eghoabeogbuaeofua.ru","address":null,"ttl":1799,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"eghoabeogbuaeofua.nl","address":null,"ttl":599,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"eghoabeogbuaeofua.kz","address":null,"ttl":1334,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"eghoabeogbuaeofua.in","address":null,"ttl":705,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":true,"domain":"ageihehaioeoaiegj.ws","address":"173.230.130.175","ttl":299,"country":"United States","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"ageihehaioeoaiegj.su","address":null,"ttl":1272,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"ageihehaioeoaiegj.ru","address":null,"ttl":23,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"ageihehaioeoaiegj.nl","address":null,"ttl":578,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"ageihehaioeoaiegj.kz","address":null,"ttl":1592,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"ageihehaioeoaiegj.in","address":null,"ttl":899,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":true,"domain":"aefobfboabobfaoua.ws","address":"173.230.130.175","ttl":299,"country":"United States","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"aefobfboabobfaoua.su","address":null,"ttl":888,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"aefobfboabobfaoua.ru","address":null,"ttl":1050,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"aefobfboabobfaoua.kz","address":null,"ttl":1799,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"aefobfboabobfaoua.in","address":null,"ttl":852,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":true,"domain":"abvainvienvaiebai.ws","address":"173.230.130.175","ttl":299,"country":"United States","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"abvainvienvaiebai.su","address":null,"ttl":1799,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"abvainvienvaiebai.ru","address":null,"ttl":179,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"abvainvienvaiebai.kz","address":null,"ttl":1013,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]},{"compromised":false,"domain":"abvainvienvaiebai.in","address":null,"ttl":899,"country":"-","registrar_name":null,"registrar_organization":null,"registrar_name_servers":null,"registrar_creation_date":null,"who_is":[],"associated_sha256s":[]}],"contacted_hosts":[{"compromised":true,"address":"220.181.87.80","port":5050,"protocol":"TCP","associated_runtime":[{"name":"winmgr.exe","pid":"3484"}],"country":"China","associated_sha256s":[]},{"compromised":true,"address":"173.230.130.175","port":5050,"protocol":"TCP","associated_runtime":[{"name":"winmgr.exe","pid":"3484"}],"country":"United States","associated_sha256s":[]}],"contacted_countries":{"countries":["CHN","USA"],"coordinates":[{"origin":{"latitude":"51.65","longitude":"6.1833"},"destination":{"latitude":"39.9289","longitude":"116.388"}},{"origin":{"latitude":"51.65","longitude":"6.1833"},"destination":{"latitude":"33.749","longitude":"-84.388"}}]},"port_infos":[{"port":5050,"description":"Yahoo! Messenger"}],"extracted_strings":{"all":[{"value":"ISEhISEhMiEhJA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISEhIW5ubm4hIVJSISFSUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISEhSkohSkoyaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5eltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlae3x9fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ITAmMDIwODBAMEcwUDBZMF4wZjBsMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ITJTU1NTU1NTU1NTU1NTU1N4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IWxsIWwhISEhISEhIQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IW4hUiEhUlIh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KCgoKCggICAgICAgICAgICAgICAgICBI","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KkdCV1BcLCYx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LCwsLCwsLCwsLCwsLCw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LCwsLCwsLCwsLCw5Vg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LDAwMDgwWDBcMGwwcDB4MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LDxlbGxpcHNpcz4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LWJyYXppbGlhbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LWVuZ2xpc2g=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LWtlcm5lbDMyLXBhY2thZ2UtY3VycmVudC1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LWx1eGVtYm91cmc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Memory/File Scan","process":"9afb2870-sample.exe","filename":"00047647-00003048.00000000.48150.03031000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LXdpbi1ydGNvcmUtbnR1c2VyLXdpbmRvdy1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNoYXJOb2RlQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkROYW1lTm9kZUBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkROYW1lU3RhdHVzTm9kZUBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnBhaXJOb2RlQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnBjaGFyTm9kZUBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnBETmFtZU5vZGVAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnR5cGVfaW5mb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYQ0FB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSVo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUFhB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LmdmaWRzJHg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LmdmaWRzJHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHN4ZGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHp6emRiZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LlhTU1NTU1NTU1NTU1NTU1NT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MCAwJjAsMDIwODA+MEQwSjBQMFYwXDBiMGgwbjB0MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MCAwUjBcMGYwbDB1MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MCExKjFjMW4x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MCkwMjA+MGIw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MDAwRTAxM2M0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MDIxdDFWMnsy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MDMwPzBLMF4wfTA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MDkxZzF4MX0x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MDswRjBLMFAwazA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MEAyXjJpMnIyfTI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MFAxVDFYMVwxYDFkMWgxbDE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MSMxTzFdMW4x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MSYyODJKMlwybjI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MSgxODE8MUwxUDFUMVwxdDE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MTAyODJAMkQySDJMMlAyVDJYMlwyZDJoMmwycDJ0MngyfDI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MTE3MVwxZzE8Mlwy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MTJWMnUyeTJ9Mg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MTcxVjFsMXYx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MUYyXTIgMzkzZjNtM3gz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MXAydDJ4Mnwy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MVAzVDNYM1wzYDNkM2gzbDNwM3QzeDN8Mw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MiAyMDI0MjwyVDJsNXA1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MiAzMzN5NX04IjlJOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MjEyQzJLMmkydDI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MjIhISEhISEhNWc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MyEzJjMrM0MzXzNqM28zdDM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MyQzNzNEM1YzXDNxM3wz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Myg0MzRCNGc0cjQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MzIzNzNCM1YzYTN4Mw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Mzk0RDRJNE40ZzR0NHk0fjQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"M0Y0UzRgNG00","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NCA0JDQoNCw0MDQ0NDg0PDRANEQ0SDRMNFA0VDRYNFw0YDRkNGg0bDRwNHQ0eDR8NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NCQ0MzRMNGo0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NCg0NDRANEw0WDRkNHA0fDQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NCo0QDRNNFs0aTR0NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NDE2aDZvNnQ2eDZ8Ng==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NDV1Zzhocm9ibm9ib2k4cjhydGJpcm5iaXNuNWk2ajBzMHJ0OGJoc3J0YmlubWRycDZvb2RwNWpuMGRyOWIwOGRyNmhib254cnRibWRyNnBoamQ2amgwOXJzaGJvbmRvaXJtaHBvZDZocGQ2cGhqZG9yNm5ibzhyb2JkbnI2YmQ2aGRtNnBibWRwbW5kbmRp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NEA0RzRNNFQ0ZjRrNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NSI1NDU6NUE1RjVLNVs1YDVlNXU1ejU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NSQ1MDU8NUg1VDVgNWw1eDU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NUU1WjVhNWc1eTU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NUg1TDVQNVQ1WDVcNWA1ZDVoNWw1cDV0NXg1fDU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NVQ2XzZuNnw2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NVQ2WDZcNmA2ZDZoNmw2cDY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NiA2LDY4Nkg2VDZgNmw2eDY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NiA2MDZINlQ2WDZcNng2fDY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NiI2PTZlNnk2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NiM3UDdcN3E3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NiU3SjdPN1s3Yjc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Nik3MTc5N0E3STdnN283","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Nio3ODdWN2s3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Nis2MDY1NkU2SjZPNl82ZDZpNnk2fjY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ni03ODdCN1E3WTdhNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ni83PjdMN2k3cTc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NjY2UDZYNnA2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NnA3dDd4N3w3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NyA3JDcoNyw3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NyA3LDc4N0Q3UDc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NyA3LjcrOFE5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NyA3PDdAN2A3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NyQ3NTc7N0E3bjd0Nw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Nyc3OTdLN103","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ny04MjhKOGA4dzg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ny83NDc5N0k3TjdTN2M3aDdtN303","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NzA3NzdAN043VTdbN3Q3ezc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Nzg3PzdyN3c3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"N145ZTltOXU5fTk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCA4JjgrODA4Njg7OEE4SzhbOGI4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCI5UTljOXI5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCM4KDgtOD04QjhHOFc4XDhhOHE4djh7OA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCM4Mzg4OD04TThSOFc4ZzhsOHE4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCQ4LDg0ODw4RDhMOFQ4XDhkOGw4dDh8OA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ODNEM1AzXDNoM3Qz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OSA5JDkoOSw5MDk0OTg5PDlAOUQ5SDlMOVA5VDlYOVw5YDlkOWg5bDlwOXQ5eDl8OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OSA5KDkwOTg5QDlIOVA5WDlgOWg5cDl4OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OSQ5LDk0OTw5RDlMOVQ5XDlkOWw5dDl8OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OSU5TDllOXQ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OSk5MTlbOXc5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OSwsLCwsLCwsLDk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OTQ5WDljOXA5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OTs5QzlJOU85VTl+OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OUE5UjltOXk5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OWFmYjI4NzAtc2FtcGxlLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OUNgdTk5Q1x0NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OiA6KDowOjg6QDpIOlA6WDpgOmg6cDp4Og==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OiQ6LDo0Ojw6RDpMOlQ6XDpkOmw6dDp8Og==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OiQ7Mzs6O3A7eTs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Oio6OTo+OkM6eTp+Og==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Oi06ODo9OkI6Wjp7Og==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OjU6RjpQOlY6YDpzOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OnJlcGVhdGRlbCAiQzpcOWFmYjI4NzAtc2FtcGxlLmV4ZSJpZiBleGlzdCAiQzpcOWFmYjI4NzAtc2FtcGxlLmV4ZSIgZ290byByZXBlYXRkZWwgIiVURU1QJVxndGJ2anl4cGhpLmJhdCI=","type":"Ansi","source":"Dropped File","process":null,"filename":"gtbvjyxphi.bat","compromised":null,"detection_total":null,"total":null},{"value":"OyA7JDsoOyw7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OyA7KDswOzg7QDtIO1A7WDtgO2g7cDt4Ow==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OyA7LDtoO3o7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OyQ7LDs0Ozw7RDtMO1Q7XDtkO2w7dDt8Ow==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Oyk7XDtnO2w7cTs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OzxNPFg8ZTx2PA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Oz87RDtJO3A7eTt+Ow==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"O0A8RDxIPEw8UDxUPFg8XDw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCA8KDwwPDg8QDxIPFA8WDxgPGg8cDx4PA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCE8JTwpPC08MTw1PDk8PTxBPEU8STxNPFE8VTxZPF08YTxlPGk8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCE9OD1VPWY9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCI8KDwuPDQ8OzxCPEk8UDxXPF48ZTxtPHU8fTw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCI8LDw+PEw8VjxyPHc8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCQ8LDw0PDw8RDxMPFQ8XDxkPGw8dDx8PA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCo8Lzw0PGQ8bDxxPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCw8RjxbPHU8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PC88OTxDPE08Vzw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PDg8QjxePGk8bjxzPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PDk9Vj1mPXo9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PGVsbGlwc2lzPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PEk8TTxRPFU8WTxdPGE8ZTxxPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PHByb2dyYW0gbmFtZSB1bmtub3duPg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PHVua25vd24+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PSA9KD0wPTg9QD1IPVA9WD1gPWg9cD14PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PSA9LT0zPTk9Rz1XPQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PSA+JT4yPj4+VD5nPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PSM9KT0vPTU9Oz1CPUk9UD1XPV49ZT1sPXQ9fD0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PSQ9Kj0wPTY9PD1CPUg9Tj1UPVo9YD1mPWw9cj14PX49","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PSQ9LD00PTw9RD1MPVQ9XD1kPWw9dD18PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PTc9ST1TPXI9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PTk9RD1JPU49Zj0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PiA+Jj4sPjI+OD4+PkQ+Sj5QPlY+XD5iPmg+bj50Pno+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PiA+Jz4uPjU+PD5EPkw+VD5fPmQ+aj50Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PiA+KD4wPjg+QD5IPlA+WD5gPmg+cD54Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PiQ+LD40Pjw+RD5MPlQ+XD5kPmw+dD58Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PiQ+OT5VPmA+ZT5qPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PiY/Kz89P1s/bz91Pw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pjk+PT5BPkU+ST5NPnY+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pl4+aT50Pn0+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PyA/KD8wPzg/QD9IP1A/WD9gP2g/cD94Pw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PyY/Kz8wP04/YD8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PzA/Nz9AP1U/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PzI/UD9aP2s/cD8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QCJAdyZrazw8PEk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QE1+fn5+fn5+fn5+fn5+fn50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"W3RodW5rXTo=","type":"Ansi","source":"Hybrid Analysis","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XkR+fn5+fn5+fn5+fn5+fn5+fn5+dHw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XnR+fn5+fn5+fn5+fn5+fn4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Xz9fP18/TV9MXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X18/bUpfX19fcV8/LCw/LD8/bT8/Xz9fdl9fLCwsXyws","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fLF8sXywsXyws","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X19jbHJjYWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19mYXN0Y2FsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19yZXN0cmljdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zdGRjYWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X190aGlzY2FsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X191bmFsaWduZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X192ZWN0b3JjYWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X01PTkVUQVJZ","type":"Unicode","source":"Memory/File Scan","process":"9afb2870-sample.exe","filename":"00047647-00003048.00000000.48150.03031000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X25leHRhZnRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTQtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTUtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YGFkanVzdG9yew==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGFub255bW91cyBuYW1lc3BhY2Un","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGNvcHkgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGRlZmF1bHQgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGR5bmFtaWMgYXRleGl0IGRlc3RydWN0b3IgZm9yICc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGR5bmFtaWMgaW5pdGlhbGl6ZXIgZm9yICc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGdlbmVyaWMtY2xhc3MtcGFyYW1ldGVyLQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGdlbmVyaWMtbWV0aG9kLXBhcmFtZXRlci0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyBkZXN0cnVjdG9yIGhlbHBlcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyBndWFyZCc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyB0aHJlYWQgZ3VhcmQn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YG5vbi10eXBlLXRlbXBsYXRlLXBhcmFtZXRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YG9tbmkgY2FsbHNpZyc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHBsYWNlbWVudCBkZWxldGUgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHBsYWNlbWVudCBkZWxldGVbXSBjbG9zdXJlJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHNjYWxhciBkZWxldGluZyBkZXN0cnVjdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHN0cmluZyc=","type":"Ansi","source":"Hybrid Analysis","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHRlbXBsYXRlIHN0YXRpYyBkYXRhIG1lbWJlciBjb25zdHJ1Y3RvciBoZWxwZXIn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHRlbXBsYXRlIHN0YXRpYyBkYXRhIG1lbWJlciBkZXN0cnVjdG9yIGhlbHBlcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHRlbXBsYXRlLXBhcmFtZXRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHRlbXBsYXRlLXR5cGUtcGFyYW1ldGVyLQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHR5cGVvZic=","type":"Ansi","source":"Memory/File Scan","process":"9afb2870-sample.exe","filename":"00047647-00003048.00000000.48150.03031000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHVkdCByZXR1cm5pbmcn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHVua25vd24gZWNzdSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZiYXNlIGRlc3RydWN0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZidGFibGUn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBkZWxldGluZyBkZXN0cnVjdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZmdGFibGUn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZpcnR1YWwgZGlzcGxhY2VtZW50IG1hcCc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZ0b3JkaXNwZXh7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZ0b3JkaXNwew==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YWJ2YWludmllbnZhaWViYWk=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"YWJ2YWludmllbnZhaWViYWkuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWJ2YWludmllbnZhaWViYWkua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWJ2YWludmllbnZhaWViYWkucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWJ2YWludmllbnZhaWViYWkuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWJ2YWludmllbnZhaWViYWkud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWRpdGlvbmFs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWE=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWEuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWEua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWEucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWEuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWEud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWZpbGlhcy1uc3Q=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2ouaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2oua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2oubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2oucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2ouc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2oud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzU2hvd0V4dA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YW1lcmljYW4gZW5nbGlzaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YW1lcmljYW4tZW5nbGlzaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YW4gZW5nbGlzaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YW4tbHV4ZW1ib3VyZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1hcHBtb2RlbC1ydW50aW1lLWwxLTEtMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWRhdGV0aW1lLWwxLTEtMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpbGUtbDItMS0x","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1vYnNvbGV0ZS1sMS0yLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXByb2Nlc3N0aHJlYWRzLWwxLTEtMg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN0cmluZy1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5c2luZm8tbDEtMi0x","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LWwxLTEtMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXhzdGF0ZS1sMi0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1ydGNvcmUtbnR1c2VyLXdpbmRvdy1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1zZWN1cml0eS1zeXN0ZW1mdW5jdGlvbnMtbDEtMS0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXJlRmlsZUFwaXNBTlNJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXJnZW50aW5h","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXVzdHJhbGlhbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljb2RlRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0NoZWNrU2VsZWN0","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0RldGVjdA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXotQVotQ3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXotYXotY3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXotQVotTGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXotYXotbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZSBDbGFzcyBBcnJheSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZSBDbGFzcyBEZXNjcmlwdG9yIGF0ICg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QnJvd3NlSW5QbGFjZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YnMtQkEtTGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YnMtYmEtbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QzpcOWFmYjI4NzAtc2FtcGxlLmV4ZQ==","type":"Ansi","source":"Hybrid Analysis","process":"9afb2870-sample.exe","filename":"00047647-00003048.00000000.48150.03001000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTS01MDUwNTk3MjA5NzAyNDYwODI0NzUwODI2Mjg0NDg1NDVcd2lubWdyLmV4ZQ==","type":"Ansi","source":"Hybrid Analysis","process":"winmgr.exe","filename":"00051562-00002132.00000001.55060.03001000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZvckF0dHJpYnV0ZXM=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0VJUEVuYWJsZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2gtYmVsZ2lhbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2hhcjE2X3Q=","type":"Ansi","source":"Hybrid Analysis","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2hhcjMyX3Q=","type":"Ansi","source":"Hybrid Analysis","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2hpbmVzZS1ob25na29uZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2hpbmVzZS1zaW1wbGlmaWVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2hpbmVzZS1zaW5nYXBvcmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2hpbmVzZS10cmFkaXRpb25hbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3MgSGllcmFyY2h5IERlc2NyaXB0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2xpOjphcnJheTw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2xpOjpwaW5fcHRyPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y21kIC9jICIiJVRFTVAlXGd0YnZqeXhwaGkuYmF0IiAi","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y29pbnRlcmZhY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGxldGUgT2JqZWN0IExvY2F0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJOYW1l","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udGVudCBUeXBl","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVCdWZmZXJlZFN5bmNocm9ub3VzSW8=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVDaHVua1NpemU=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVPdmVybGFwcGVkQ291bnQ=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29yRXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y29zdGEgcmljYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVXJpQ2FjaGVTaXpl","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1dESWxsZWdhbEluRExMU2VhcmNo","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGRkZCwgTU1NTSBkZCwgeXl5eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdIZWFwRmxhZ3M=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVjb2RlUG9pbnRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZGVsICJDOlw5YWZiMjg3MC1zYW1wbGUuZXhlIg==","type":"Ansi","source":"Dropped File","process":null,"filename":"gtbvjyxphi.bat","compromised":null,"detection_total":null,"total":null},{"value":"ZGVsICIlVEVNUCVcZ3Ridmp5eHBoaS5iYXQi","type":"Ansi","source":"Dropped File","process":null,"filename":"gtbvjyxphi.bat","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZWdhdGVFeGVjdXRl","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQ3JpdGljYWxTZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGV2aWNlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGZlImRlZkFmZGVwZmVkfmVlZkJlZmYw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUVuZ2luZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUltcHJvdmVkWm9uZUNoZWNr","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUxvY2FsT3ZlcnJpZGU=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVNlY3VyaXR5U2V0dGluZ3NDaGVjaw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVzZXJNb2RlQ2FsbGJhY2tGaWx0ZXI=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVN0cmluZw==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9jT2JqZWN0","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZG9tYWluLXJlZ2lzdHJ5","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"ZG9taW5pY2FuIHJlcHVibGlj","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RG9udFByZXR0eVBhdGg=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVNYXNr","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZHV0Y2gtYmVsZ2lhbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZH5+fn5+fn5+fn5LU1UqKip4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RH5+fn5+fn5+fn5+fn5+ZFw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RH5+fn5+fn5+fn5+fn5+fn5+dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZS1zaW5nYXBvcmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWE=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUHVueWNvZGU=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5jb2RlUG9pbnRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1hbWVyaWNhbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1hdXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1iZWxpemU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1jYW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1jYXJpYmJlYW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1pcmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1qYW1haWNh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1ueg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1zb3V0aCBhZnJpY2E=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC10cmluaWRhZCB5IHRvYmFnbw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC11aw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC11cw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC11c2E=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVN5c3RlbUxvY2FsZXNFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVN5c3RlbUxvY2FsZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXNlLWhvbmdrb25n","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRSZWdpc3Rlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRTZXRJbmZvcm1hdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRVbnJlZ2lzdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRXcml0ZVRyYW5zZmVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXh0LW1zLXdpbi1rZXJuZWwzMi1wYWNrYWdlLWN1cnJlbnQtbDEtMS0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXh0LW1zLXdpbi1udHVzZXItZGlhbG9nYm94LWwxLTEtMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXh0LW1zLXdpbi1udHVzZXItd2luZG93c3RhdGlvbi1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXh0ZXJuICJDIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZidZNVBAXVdw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RkROVUtJS0pMSk9CTEpPTExVRUxQVUVGU00=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmluZENsb3Nl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZUV4QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmxzU2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hGaWxlQnVmZmVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVHlwZUlE","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUVudmlyb25tZW50U3RyaW5nc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlbmNoLWJlbGdpYW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlbmNoLWNhbmFkaWFu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlbmNoLWx1eGVtYm91cmc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlbmNoLXN3aXNz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZnNkbztpaGZ2b3VoYnVld3k1ODczOXR1Z2lhZWhiODk1ZXl1dDk4d3U0NTh3NWpnb3NuZXJ1dmg5cDV1OTBpdC0wNHdqZ29pYWVvcnV2aDg5c3k0dDgzNTh5LXc0aWJvZXM1eTQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Zn5+fn5+fn5+fn5+fn4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Zn5+fn5+fn5+fn5+fn5+fn5+aw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Zn5+fn5+fn5+fn5+fn5+fn5+fn4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZzIyKiohISEhIQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGlvbg==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2VuZXJpYy10eXBlLQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2VybWFuLWF1c3RyaWFu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2VybWFuLWxpY2h0ZW5zdGVpbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2VybWFuLWx1eGVtYm91cmc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2VybWFuLXN3aXNz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWN0aXZlV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QXRvbU5hbWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZUNQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q1BJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGF0ZUZvcm1hdEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGF0ZUZvcm1hdFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5hYmxlZFhTdGF0ZUZlYXR1cmVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRTdHJpbmdzVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVQcm9jZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEFjdGl2ZVBvcHVw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0T0VNQ1A=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0FmZmluaXR5TWFzaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0hlYXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1RpbWVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1dpbmRvd1N0YXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RhcnR1cEluZm9X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5nVHlwZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkVGltZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZUZvcm1hdEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZUZvcm1hdFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMQ0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMb2NhbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck9iamVjdEluZm9ybWF0aW9uVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0WFN0YXRlRmVhdHVyZXNNYXNr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmc=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmcuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmcua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmcucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmcuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmcud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z3JlYXQgYnJpdGFpbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z3Ridmp5eHBoaS5iYXQ=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z3tuUm5SUm5SUiEhUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aC1jb2xvbWJpYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aDhsOHA4dDh4OHw4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SGFzTmF2aWdhdGlvbkVudW0=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEFsbG9j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFJlQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SGVscGVyRGxsTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUZpbGVFeHQ=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUZvbGRlclZlcmJz","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUljb25z","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUluV2ViVmlldw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZU9uRGVza3RvcFBlclVzZXI=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aG9uZy1rb25n","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aG9zdG1hc3Rlcg==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"SSg3SSg3SSg3SSg3PiE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aWFuLW55bm9yc2s=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGE=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"SWNvbnNPbmx5","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aWYgZXhpc3QgIkM6XDlhZmIyODcwLXNhbXBsZS5leGUiIGdvdG8gcmVwZWF0","type":"Ansi","source":"Dropped File","process":null,"filename":"gtbvjyxphi.bat","compromised":null,"detection_total":null,"total":null},{"value":"aWkmJmtrPDw8ew==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aWlpJiZrazw8VQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aW4tY29yZS1sb2NhbGl6YXRpb24tb2Jzb2xldGUtbDEtMi0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aW5pZGFkICYgdG9iYWdv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEZvbGRlckhhbmRsZXI=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkFuZFNwaW5Db3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNMaXN0SGVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRGbHVzaFNMaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRQdXNoRW50cnlTTGlzdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW50cmFuZXROYW1l","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aXJpc2gtZW5nbGlzaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNEZWJ1Z2dlclByZXNlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNoLWFtZXJpY2Fu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNoLWphbWFpY2E=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNoLXBhbmFtYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNoLXB1ZXJ0byByaWNv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNQcm9jZXNzb3JGZWF0dXJlUHJlc2VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNTaG9ydGN1dA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZENvZGVQYWdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZExvY2FsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZExvY2FsZU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXRhbGlhbi1zd2lzcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aiJeZjkxalxedTg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SkohISEhISFKUjJo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"amohamghaGho","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bCEhYCFSUlIhISEhUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bC4hbCFSUlJSISFSIVIhISEhIUpKSioy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TENfQ09MTEFURQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TENfTU9ORVRBUlk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TENfTlVNRVJJQw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TENJRFRvTG9jYWxlTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGRhcENsaWVudEludGVncml0eQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVhdmVDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGlicmFyeVBhdGg=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxlTmFtZVRvTENJRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYXRlWFN0YXRlRmVhdHVyZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"THR+fn5+fn5+fn5+fn4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bV9fX19KXyws","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmV0RHJpdmVWZXJicw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmV0RHJ2QnRu","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFydGFFeHRlbnNpb24=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW1pemVBcHBz","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U29ja2FkZHJMZW5ndGg=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWVzc2FnZUJveEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWVzc2FnZUJveFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IFZpc3VhbCBDKysgUnVudGltZSBMaWJyYXJ5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IFdpbmRvd3MgTWFuYWdlcg==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWluU29ja2FkZHJMZW5ndGg=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TU1NTSBkZCwgeXl5eQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bXMtd2luLWNvcmUtc3RyaW5nLWwxLTEtMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bXMtd2luLWNvcmUtd2lucnQtbDEtMS0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bVNqQVtqWl4r","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bXN2Y3J0LmRsbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGlCeXRlVG9XaWRlQ2hhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bi1ib2ttYWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZVNwYWNlX0NhbGxvdXQ=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmFuKHNuYW4p","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TkFOKFNOQU4p","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TmV2ZXJTaG93RXh0","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmV3LXplYWxhbmQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TmV4dF9DYXRhbG9nX0VudHJ5X0lE","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9GaWxlRm9sZGVySnVuY3Rpb24=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9OZXRDcmF3bGluZw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bm9yd2VnaWFu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bm9yd2VnaWFuLWJva21hbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bm9yd2VnaWFuLW55bm9yc2s=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Tm9Xb3JraW5nRGlyZWN0b3J5","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnVtX0NhdGFsb2dfRW50cmllcw==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bn5+fn5+fn5+fn5+fn54Zmt+fktT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2k=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8uaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8ua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8ubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8ucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8uc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8ud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b24tbDEtMi0x","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T09CRUluUHJvZ3Jlc3M=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b3BlcmF0b3IgIiI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3V0cHV0RGVidWdTdHJpbmdB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3V0cHV0RGVidWdTdHJpbmdX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b3xPZHxPZHxPZHxPZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b3xPZHxPZHxPZHxPZHxPZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UGFja2VkQ2F0YWxvZ0l0ZW0=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50Rm9sZGVy","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWU=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluVG9OYW1lU3BhY2VUcmVl","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cG9ydHVndWVzZS1icmF6aWxpYW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UFA5RSB1OlBQVldQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cHIgY2hpbmE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ3JlYXRl","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cHJpdmF0ZTo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZmlsZUltYWdlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cHJvdGVjdGVkOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJZA==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlCeXBhc3M=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UFNQVUJXUy1QQw==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"UFNTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UFNTU1NTU1NTU1NTU1NTU1NTU1NTU1NYcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaEV4cGFuZGVkUGF0aA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cHVlcnRvLXJpY28=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGb3JJbmZvVGlw","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGb3JPdmVybGF5","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VFeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVsYXRpdmVQYXRo","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cmVzdHJpY3Qo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdHJpY3RlZEF0dHJpYnV0ZXM=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cm9oZ29ydWhnc29yaHVnaWg=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"cm9oZ29ydWhnc29yaHVnaWguaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"cm9oZ29ydWhnc29yaHVnaWgua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"cm9oZ29ydWhnc29yaHVnaWgubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":67},{"value":"cm9oZ29ydWhnc29yaHVnaWgucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":4,"total":67},{"value":"cm9oZ29ydWhnc29yaHVnaWguc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":1,"total":67},{"value":"cm9oZ29ydWhnc29yaHVnaWgud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":1,"total":66},{"value":"Um9Jbml0aWFsaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Um9VbmluaXRpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnRsVW53aW5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZSBFcnJvciFQcm9ncmFtOg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHlfSEtMTV9vbmx5","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VwYXJhdGVQcm9jZXNz","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VwdGVtYmVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2VyaWFsX0FjY2Vzc19OdW0=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN0cmxIYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW52aXJvbm1lbnRWYXJpYWJsZUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXJFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UHJvY2Vzc1NodXRkb3duUGFyYW1ldGVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkU3RhY2tHdWFyYW50ZWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V29ya2luZ0RpcmVjdG9yeUZyb21UYXJnZXQ=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxTdGF0ZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0NvbXBDb2xvcg==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0luZm9UaXA=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1N1cGVySGlkZGVu","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1R5cGVPdmVybGF5","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2lpaWZpYmlpZWdpaWNpaWI=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"c2lpaWZpYmlpZWdpaWNpaWIuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":67},{"value":"c2lpaWZpYmlpZWdpaWNpaWIua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":67},{"value":"c2lpaWZpYmlpZWdpaWNpaWIubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":67},{"value":"c2lpaWZpYmlpZWdpaWNpaWIucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":1,"total":66},{"value":"c2lpaWZpYmlpZWdpaWNpaWIuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":67},{"value":"c2lpaWZpYmlpZWdpaWNpaWIud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":1,"total":66},{"value":"U0t+fn5+fn5+fn5+fn5+fn5+fn4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U291cmNlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c291dGggYWZyaWNh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c291dGgga29yZWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c291dGgtYWZyaWNh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c291dGgta29yZWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1hcmdlbnRpbmE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1ib2xpdmlh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1jaGlsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1jb2xvbWJpYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1jb3N0YSByaWNh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1kb21pbmljYW4gcmVwdWJsaWM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1lY3VhZG9y","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1lbCBzYWx2YWRvcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1ndWF0ZW1hbGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1ob25kdXJhcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1tZXhpY2Fu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1tb2Rlcm4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1uaWNhcmFndWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1wYW5hbWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1wYXJhZ3VheQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1wZXJ1","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1wdWVydG8gcmljbw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC11cnVndWF5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC12ZW5lenVlbGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3BlY2lhbEZvbGRlcnNDYWNoZVNpemU=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3ItQkEtQ3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3ItYmEtY3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3ItYmEtbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3ItQkEtTGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3Itc3AtY3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3ItU1AtQ3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3Itc3AtbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3ItU1AtTGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1My","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1NTMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1NTU1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU3h4eA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1gh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1N4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1N4Sg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU3g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTeCcn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTeENi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpudWxscHRyX3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2U=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2VUeXBl","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1ZqQVtqWl4r","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c1ZWViwsViwsViw5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1ZXakFfalor","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3dlZGlzaC1maW5sYW5k","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtRnVuY3Rpb24wMzY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU2V0dXBJblByb2dyZXNz","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dCBicml0YWlu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dC1tcy13aW4tbnR1c2VyLXdpbmRvd3N0YXRpb24tbDEtMS0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dGVtcGxhdGUtcGFyYW1ldGVyLQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGhlbWVBcGlDb25uZWN0aW9uUmVxdWVzdA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGh1cnNkYXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dGlvbnMtbDEtMS0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dEs8X3Q8PCR0ODw8dDQ8PnQwPC10LDxhfA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGxzR2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGxzU2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwb3J0cw==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dHJpbmlkYWQgJiB0b2JhZ28=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VHlwZSBEZXNjcmlwdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dH5+fn5+fn5+fn5+fn5+fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VU5DQXNJbnRyYW5ldA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dW5pdGVkLWtpbmdkb20=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dW5pdGVkLXN0YXRlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dW5rbm93biBlY3N1Jw==","type":"Ansi","source":"Hybrid Analysis","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VXNlRGVsYXllZEFjY2VwdGFuY2U=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRHJvcEhhbmRsZXI=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlSG9zdG5hbWVBc0FsaWFz","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlT2xkSG9zdFJlc29sdXRpb25PcmRlcg==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dXRoIGFmcmljYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dXRoLWFmcmljYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dXotdXotY3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dXotVVotQ3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dXotVVotTGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dXotdXotbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ViwsLFYsLCwsViwsLCwsVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VjksLFYsLFYsVixW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbFByb3RlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VlYsLCwsLCwsVlYsLA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VlYsLCxWVlZWUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VlYsViwsLFZW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VlZWVlZWLCwsLFYsLCwsViwsLFZWLCwsLCxWLFYsLFYsLCwsLCwsVixWLCwsVixWVlYsVlZWVlYsLCwsLA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Ao","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2AoJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2AoP1Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Aod2Ao","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Aod2Aod2Ao","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Aod2Aod2Aod2Aod2Ao","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Aod2Aod2Aod2Aod2AoOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Aod2Aod2Aod2Aod2AobCo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2AofE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2AofE9kfE9kfE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNBbGlhc2VkTm90aWZpY2F0aW9ucw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNGT1JESVNQTEFZ","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNGT1JQQVJTSU5H","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNQYXJzZURpc3BsYXlOYW1l","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNVbml2ZXJzYWxEZWxlZ2F0ZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2VkbmVzZGF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2lkZUNoYXJUb011bHRpQnl0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V0lOSFRUUC5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2luSHR0cENsb3NlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2luSHR0cE9wZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2lubWdyLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29jayAyLjAgUHJvdmlkZXIgSUQ=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVDb25zb2xlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyTnVtSGFuZGxlQnVja2V0cw==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyU3BpbkNvdW50","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"eGl0UHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":"9afb2870-sample.exe","filename":"00047647-00003048.00000000.48150.03031000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"WFNTU1NTU1NTU1NTU1NT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WjJeUzA5PnlQIw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezIwRDA0RkUwLTNBRUEtMTA2OS1BMkQ4LTA4MDAyQjMwMzA5RH0=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezksLCwsLCws","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"e3BXfi0lJH4y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fGl+fn5+fn5+fn5+fn5+fn4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9kfE9kJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9kfE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9kfE9kfE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9kfE9kfE9kfE9kUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9kfE9kfE9kfE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9kfE9kfE9kfE9kfE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fn5+fn5+fn5+fmY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fn5+fn5+fn5+fn5ueFcqKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fn5+fn5+fn5+fn5+flMmZmtL","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fn5+fn5+fn5+fn5+fn5+fn5+aw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5EdH5+fn5+fn5+fn5+fn5+fn5+fn5+fmk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9X8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$2e","type":"Ansi","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null}],"interesting":[{"value":"ISEhISEhMiEhJA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISEhIW5ubm4hIVJSISFSUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISEhSkohSkoyaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IWxsIWwhISEhISEhIQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IW4hUiEhUlIh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KCgoKCggICAgICAgICAgICAgICAgICBI","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LWtlcm5lbDMyLXBhY2thZ2UtY3VycmVudC1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Memory/File Scan","process":"9afb2870-sample.exe","filename":"00047647-00003048.00000000.48150.03031000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LXdpbi1ydGNvcmUtbnR1c2VyLXdpbmRvdy1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnR5cGVfaW5mb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MjIhISEhISEhNWc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NDV1Zzhocm9ibm9ib2k4cjhydGJpcm5iaXNuNWk2ajBzMHJ0OGJoc3J0YmlubWRycDZvb2RwNWpuMGRyOWIwOGRyNmhib254cnRibWRyNnBoamQ2amgwOXJzaGJvbmRvaXJtaHBvZDZocGQ2cGhqZG9yNm5ibzhyb2JkbnI2YmQ2aGRtNnBibWRwbW5kbmRp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCM4KDgtOD04QjhHOFc4XDhhOHE4djh7OA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OWFmYjI4NzAtc2FtcGxlLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OiA6KDowOjg6QDpIOlA6WDpgOmg6cDp4Og==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OiQ6LDo0Ojw6RDpMOlQ6XDpkOmw6dDp8Og==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Oio6OTo+OkM6eTp+Og==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Oi06ODo9OkI6Wjp7Og==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OjU6RjpQOlY6YDpzOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OnJlcGVhdGRlbCAiQzpcOWFmYjI4NzAtc2FtcGxlLmV4ZSJpZiBleGlzdCAiQzpcOWFmYjI4NzAtc2FtcGxlLmV4ZSIgZ290byByZXBlYXRkZWwgIiVURU1QJVxndGJ2anl4cGhpLmJhdCI=","type":"Ansi","source":"Dropped File","process":null,"filename":"gtbvjyxphi.bat","compromised":null,"detection_total":null,"total":null},{"value":"PCE8JTwpPC08MTw1PDk8PTxBPEU8STxNPFE8VTxZPF08YTxlPGk8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTQtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTUtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyBkZXN0cnVjdG9yIGhlbHBlcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyBndWFyZCc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyB0aHJlYWQgZ3VhcmQn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YWJ2YWludmllbnZhaWViYWkuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWJ2YWludmllbnZhaWViYWkua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWJ2YWludmllbnZhaWViYWkucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWJ2YWludmllbnZhaWViYWkuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWJ2YWludmllbnZhaWViYWkud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWEuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWEua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWEucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWEuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWEud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2ouaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2oua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2oubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2oucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2ouc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2oud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1hcHBtb2RlbC1ydW50aW1lLWwxLTEtMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWRhdGV0aW1lLWwxLTEtMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpbGUtbDItMS0x","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1vYnNvbGV0ZS1sMS0yLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXByb2Nlc3N0aHJlYWRzLWwxLTEtMg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN0cmluZy1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5c2luZm8tbDEtMi0x","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LWwxLTEtMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXhzdGF0ZS1sMi0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1ydGNvcmUtbnR1c2VyLXdpbmRvdy1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1zZWN1cml0eS1zeXN0ZW1mdW5jdGlvbnMtbDEtMS0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXJlRmlsZUFwaXNBTlNJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZSBDbGFzcyBEZXNjcmlwdG9yIGF0ICg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QzpcOWFmYjI4NzAtc2FtcGxlLmV4ZQ==","type":"Ansi","source":"Hybrid Analysis","process":"9afb2870-sample.exe","filename":"00047647-00003048.00000000.48150.03001000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcTS01MDUwNTk3MjA5NzAyNDYwODI0NzUwODI2Mjg0NDg1NDVcd2lubWdyLmV4ZQ==","type":"Ansi","source":"Hybrid Analysis","process":"winmgr.exe","filename":"00051562-00002132.00000001.55060.03001000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3MgSGllcmFyY2h5IERlc2NyaXB0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y21kIC9jICIiJVRFTVAlXGd0YnZqeXhwaGkuYmF0IiAi","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGxldGUgT2JqZWN0IExvY2F0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJOYW1l","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29yRXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZGVsICJDOlw5YWZiMjg3MC1zYW1wbGUuZXhlIg==","type":"Ansi","source":"Dropped File","process":null,"filename":"gtbvjyxphi.bat","compromised":null,"detection_total":null,"total":null},{"value":"ZGVsICIlVEVNUCVcZ3Ridmp5eHBoaS5iYXQi","type":"Ansi","source":"Dropped File","process":null,"filename":"gtbvjyxphi.bat","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZWdhdGVFeGVjdXRl","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUxvY2FsT3ZlcnJpZGU=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZG9tYWluLXJlZ2lzdHJ5","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVN5c3RlbUxvY2FsZXNFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVN5c3RlbUxvY2FsZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRSZWdpc3Rlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRTZXRJbmZvcm1hdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRVbnJlZ2lzdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXh0LW1zLXdpbi1rZXJuZWwzMi1wYWNrYWdlLWN1cnJlbnQtbDEtMS0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXh0LW1zLXdpbi1udHVzZXItZGlhbG9nYm94LWwxLTEtMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXh0LW1zLXdpbi1udHVzZXItd2luZG93c3RhdGlvbi1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RkROVUtJS0pMSk9CTEpPTExVRUxQVUVGU00=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmxzU2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZzIyKiohISEhIQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWN0aXZlV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QXRvbU5hbWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZUNQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q1BJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGF0ZUZvcm1hdEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGF0ZUZvcm1hdFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5hYmxlZFhTdGF0ZUZlYXR1cmVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRTdHJpbmdzVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVQcm9jZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEFjdGl2ZVBvcHVw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0T0VNQ1A=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0FmZmluaXR5TWFzaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0hlYXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1RpbWVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1dpbmRvd1N0YXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RhcnR1cEluZm9X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5nVHlwZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkVGltZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZUZvcm1hdEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZUZvcm1hdFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMQ0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMb2NhbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck9iamVjdEluZm9ybWF0aW9uVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0WFN0YXRlRmVhdHVyZXNNYXNr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmcuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmcua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmcucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmcuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmcud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z3Ridmp5eHBoaS5iYXQ=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SSg3SSg3SSg3SSg3PiE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWYgZXhpc3QgIkM6XDlhZmIyODcwLXNhbXBsZS5leGUiIGdvdG8gcmVwZWF0","type":"Ansi","source":"Dropped File","process":null,"filename":"gtbvjyxphi.bat","compromised":null,"detection_total":null,"total":null},{"value":"aW4tY29yZS1sb2NhbGl6YXRpb24tb2Jzb2xldGUtbDEtMi0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRGbHVzaFNMaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNQcm9jZXNzb3JGZWF0dXJlUHJlc2VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZExvY2FsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZExvY2FsZU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SkohISEhISFKUjJo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bCEhYCFSUlIhISEhUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bC4hbCFSUlJSISFSIVIhISEhIUpKSioy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TENJRFRvTG9jYWxlTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxlTmFtZVRvTENJRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IFZpc3VhbCBDKysgUnVudGltZSBMaWJyYXJ5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWluU29ja2FkZHJMZW5ndGg=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bXMtd2luLWNvcmUtc3RyaW5nLWwxLTEtMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bXMtd2luLWNvcmUtd2lucnQtbDEtMS0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8uaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8ua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8ubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8ucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8uc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8ud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"cG9ydHVndWVzZS1icmF6aWxpYW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGb3JJbmZvVGlw","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cm9oZ29ydWhnc29yaHVnaWguaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"cm9oZ29ydWhnc29yaHVnaWgua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"cm9oZ29ydWhnc29yaHVnaWgubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":67},{"value":"cm9oZ29ydWhnc29yaHVnaWgucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":4,"total":67},{"value":"cm9oZ29ydWhnc29yaHVnaWguc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":1,"total":67},{"value":"cm9oZ29ydWhnc29yaHVnaWgud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":1,"total":66},{"value":"UnVudGltZSBFcnJvciFQcm9ncmFtOg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2VwYXJhdGVQcm9jZXNz","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UHJvY2Vzc1NodXRkb3duUGFyYW1ldGVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V29ya2luZ0RpcmVjdG9yeUZyb21UYXJnZXQ=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0NvbXBDb2xvcg==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0luZm9UaXA=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2lpaWZpYmlpZWdpaWNpaWIuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":67},{"value":"c2lpaWZpYmlpZWdpaWNpaWIua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":67},{"value":"c2lpaWZpYmlpZWdpaWNpaWIubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":67},{"value":"c2lpaWZpYmlpZWdpaWNpaWIucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":1,"total":66},{"value":"c2lpaWZpYmlpZWdpaWNpaWIuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":67},{"value":"c2lpaWZpYmlpZWdpaWNpaWIud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":1,"total":66},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dC1tcy13aW4tbnR1c2VyLXdpbmRvd3N0YXRpb24tbDEtMS0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGhlbWVBcGlDb25uZWN0aW9uUmVxdWVzdA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGxzR2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwb3J0cw==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHlwZSBEZXNjcmlwdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Aod2Ao","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Aod2Aod2Ao","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Aod2Aod2Aod2Aod2Ao","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Aod2Aod2Aod2Aod2AoOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Aod2Aod2Aod2Aod2AobCo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V0lOSFRUUC5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2luSHR0cENsb3NlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2luSHR0cE9wZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2lubWdyLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29jayAyLjAgUHJvdmlkZXIgSUQ=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"eGl0UHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":"9afb2870-sample.exe","filename":"00047647-00003048.00000000.48150.03031000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezIwRDA0RkUwLTNBRUEtMTA2OS1BMkQ4LTA4MDAyQjMwMzA5RH0=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$2f","type":"Ansi","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null}],"targets":[{"name":"9afb2870-sample.exe.bin","strings":[{"value":"ISEhISEhMiEhJA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISEhIW5ubm4hIVJSISFSUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISEhSkohSkoyaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5eltcXV5fYGFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6e3x9fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISIjJCUmJygpKissLS4vMDEyMzQ1Njc4OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlae3x9fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ITAmMDIwODBAMEcwUDBZMF4wZjBsMA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ITJTU1NTU1NTU1NTU1NTU1N4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IWxsIWwhISEhISEhIQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IW4hUiEhUlIh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KCgoKCggICAgICAgICAgICAgICAgICBI","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KkdCV1BcLCYx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LCwsLCwsLCwsLCwsLCw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCwsLCw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LCwsLCwsLCwsLCw5Vg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LDAwMDgwWDBcMGwwcDB4MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LDxlbGxpcHNpcz4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LWJyYXppbGlhbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LWVuZ2xpc2g=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LWtlcm5lbDMyLXBhY2thZ2UtY3VycmVudC1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LWx1eGVtYm91cmc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LXdpbi1ydGNvcmUtbnR1c2VyLXdpbmRvdy1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmNoYXJOb2RlQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkROYW1lTm9kZUBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkROYW1lU3RhdHVzTm9kZUBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnBhaXJOb2RlQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnBjaGFyTm9kZUBA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnBETmFtZU5vZGVAQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVnR5cGVfaW5mb0BA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYQ0FB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSUFD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYSVo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUFhB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LkNSVCRYUFo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LmdmaWRzJHg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LmdmaWRzJHk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHN4ZGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LnJkYXRhJHp6emRiZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LlhTU1NTU1NTU1NTU1NTU1NT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MCAwJjAsMDIwODA+MEQwSjBQMFYwXDBiMGgwbjB0MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MCAwUjBcMGYwbDB1MA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MCExKjFjMW4x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MCkwMjA+MGIw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MDAwRTAxM2M0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MDIxdDFWMnsy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MDMwPzBLMF4wfTA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MDkxZzF4MX0x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MDswRjBLMFAwazA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MEAyXjJpMnIyfTI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MFAxVDFYMVwxYDFkMWgxbDE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MSMxTzFdMW4x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MSYyODJKMlwybjI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MSgxODE8MUwxUDFUMVwxdDE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MTAyODJAMkQySDJMMlAyVDJYMlwyZDJoMmwycDJ0MngyfDI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MTE3MVwxZzE8Mlwy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MTJWMnUyeTJ9Mg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MTcxVjFsMXYx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MUYyXTIgMzkzZjNtM3gz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MXAydDJ4Mnwy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MVAzVDNYM1wzYDNkM2gzbDNwM3QzeDN8Mw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MiAyMDI0MjwyVDJsNXA1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MiAzMzN5NX04IjlJOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MjEyQzJLMmkydDI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MjIhISEhISEhNWc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MyEzJjMrM0MzXzNqM28zdDM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MyQzNzNEM1YzXDNxM3wz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Myg0MzRCNGc0cjQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MzIzNzNCM1YzYTN4Mw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Mzk0RDRJNE40ZzR0NHk0fjQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"M0Y0UzRgNG00","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NCA0JDQoNCw0MDQ0NDg0PDRANEQ0SDRMNFA0VDRYNFw0YDRkNGg0bDRwNHQ0eDR8NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NCQ0MzRMNGo0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NCg0NDRANEw0WDRkNHA0fDQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NCo0QDRNNFs0aTR0NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NDE2aDZvNnQ2eDZ8Ng==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NDV1Zzhocm9ibm9ib2k4cjhydGJpcm5iaXNuNWk2ajBzMHJ0OGJoc3J0YmlubWRycDZvb2RwNWpuMGRyOWIwOGRyNmhib254cnRibWRyNnBoamQ2amgwOXJzaGJvbmRvaXJtaHBvZDZocGQ2cGhqZG9yNm5ibzhyb2JkbnI2YmQ2aGRtNnBibWRwbW5kbmRp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NEA0RzRNNFQ0ZjRrNA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NSI1NDU6NUE1RjVLNVs1YDVlNXU1ejU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NSQ1MDU8NUg1VDVgNWw1eDU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NUU1WjVhNWc1eTU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NUg1TDVQNVQ1WDVcNWA1ZDVoNWw1cDV0NXg1fDU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NVQ2XzZuNnw2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NVQ2WDZcNmA2ZDZoNmw2cDY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NiA2LDY4Nkg2VDZgNmw2eDY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NiA2MDZINlQ2WDZcNng2fDY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NiI2PTZlNnk2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NiM3UDdcN3E3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NiU3SjdPN1s3Yjc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Nik3MTc5N0E3STdnN283","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Nio3ODdWN2s3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Nis2MDY1NkU2SjZPNl82ZDZpNnk2fjY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ni03ODdCN1E3WTdhNw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ni83PjdMN2k3cTc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NjY2UDZYNnA2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NnA3dDd4N3w3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NyA3JDcoNyw3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NyA3LDc4N0Q3UDc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NyA3LjcrOFE5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NyA3PDdAN2A3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NyQ3NTc7N0E3bjd0Nw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Nyc3OTdLN103","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ny04MjhKOGA4dzg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ny83NDc5N0k3TjdTN2M3aDdtN303","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NzA3NzdAN043VTdbN3Q3ezc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Nzg3PzdyN3c3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"N145ZTltOXU5fTk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCA4JjgrODA4Njg7OEE4SzhbOGI4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCI5UTljOXI5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCM4KDgtOD04QjhHOFc4XDhhOHE4djh7OA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCM4Mzg4OD04TThSOFc4ZzhsOHE4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCQ4LDg0ODw4RDhMOFQ4XDhkOGw4dDh8OA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ODNEM1AzXDNoM3Qz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OSA5JDkoOSw5MDk0OTg5PDlAOUQ5SDlMOVA5VDlYOVw5YDlkOWg5bDlwOXQ5eDl8OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OSA5KDkwOTg5QDlIOVA5WDlgOWg5cDl4OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OSQ5LDk0OTw5RDlMOVQ5XDlkOWw5dDl8OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OSU5TDllOXQ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OSk5MTlbOXc5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OSwsLCwsLCwsLDk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OTQ5WDljOXA5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OTs5QzlJOU85VTl+OQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OUE5UjltOXk5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OUNgdTk5Q1x0NA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OiA6KDowOjg6QDpIOlA6WDpgOmg6cDp4Og==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OiQ6LDo0Ojw6RDpMOlQ6XDpkOmw6dDp8Og==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OiQ7Mzs6O3A7eTs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Oio6OTo+OkM6eTp+Og==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Oi06ODo9OkI6Wjp7Og==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OjU6RjpQOlY6YDpzOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OyA7JDsoOyw7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OyA7KDswOzg7QDtIO1A7WDtgO2g7cDt4Ow==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OyA7LDtoO3o7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OyQ7LDs0Ozw7RDtMO1Q7XDtkO2w7dDt8Ow==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Oyk7XDtnO2w7cTs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OzxNPFg8ZTx2PA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Oz87RDtJO3A7eTt+Ow==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"O0A8RDxIPEw8UDxUPFg8XDw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCA8KDwwPDg8QDxIPFA8WDxgPGg8cDx4PA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCE8JTwpPC08MTw1PDk8PTxBPEU8STxNPFE8VTxZPF08YTxlPGk8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCE9OD1VPWY9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCI8KDwuPDQ8OzxCPEk8UDxXPF48ZTxtPHU8fTw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCI8LDw+PEw8VjxyPHc8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCQ8LDw0PDw8RDxMPFQ8XDxkPGw8dDx8PA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCo8Lzw0PGQ8bDxxPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PCw8RjxbPHU8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PC88OTxDPE08Vzw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PDg8QjxePGk8bjxzPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PDk9Vj1mPXo9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PGVsbGlwc2lzPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PEk8TTxRPFU8WTxdPGE8ZTxxPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PHByb2dyYW0gbmFtZSB1bmtub3duPg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PHVua25vd24+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PSA9KD0wPTg9QD1IPVA9WD1gPWg9cD14PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PSA9LT0zPTk9Rz1XPQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PSA+JT4yPj4+VD5nPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PSM9KT0vPTU9Oz1CPUk9UD1XPV49ZT1sPXQ9fD0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PSQ9Kj0wPTY9PD1CPUg9Tj1UPVo9YD1mPWw9cj14PX49","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PSQ9LD00PTw9RD1MPVQ9XD1kPWw9dD18PQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PTc9ST1TPXI9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PTk9RD1JPU49Zj0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PiA+Jj4sPjI+OD4+PkQ+Sj5QPlY+XD5iPmg+bj50Pno+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PiA+Jz4uPjU+PD5EPkw+VD5fPmQ+aj50Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PiA+KD4wPjg+QD5IPlA+WD5gPmg+cD54Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PiQ+LD40Pjw+RD5MPlQ+XD5kPmw+dD58Pg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PiQ+OT5VPmA+ZT5qPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PiY/Kz89P1s/bz91Pw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pjk+PT5BPkU+ST5NPnY+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pl4+aT50Pn0+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PyA/KD8wPzg/QD9IP1A/WD9gP2g/cD94Pw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PyY/Kz8wP04/YD8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PzA/Nz9AP1U/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PzI/UD9aP2s/cD8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QCJAdyZrazw8PEk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QE1+fn5+fn5+fn5+fn5+fn50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"W3RodW5rXTo=","type":"Ansi","source":"Hybrid Analysis","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XkR+fn5+fn5+fn5+fn5+fn5+fn5+dHw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XnR+fn5+fn5+fn5+fn5+fn4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19jbHJjYWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19mYXN0Y2FsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19yZXN0cmljdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X19zdGRjYWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X190aGlzY2FsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X191bmFsaWduZWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X192ZWN0b3JjYWxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X25leHRhZnRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGFkanVzdG9yew==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGFub255bW91cyBuYW1lc3BhY2Un","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGNvcHkgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGRlZmF1bHQgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGR5bmFtaWMgYXRleGl0IGRlc3RydWN0b3IgZm9yICc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGR5bmFtaWMgaW5pdGlhbGl6ZXIgZm9yICc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGVoIHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGdlbmVyaWMtY2xhc3MtcGFyYW1ldGVyLQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGdlbmVyaWMtbWV0aG9kLXBhcmFtZXRlci0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyBkZXN0cnVjdG9yIGhlbHBlcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyBndWFyZCc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHN0YXRpYyB0aHJlYWQgZ3VhcmQn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUgY29uc3RydWN0b3IgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGxvY2FsIHZmdGFibGUn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGNvcHkgY29uc3RydWN0b3IgaXRlcmF0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YG1hbmFnZWQgdmVjdG9yIGRlc3RydWN0b3IgaXRlcmF0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YG5vbi10eXBlLXRlbXBsYXRlLXBhcmFtZXRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YG9tbmkgY2FsbHNpZyc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHBsYWNlbWVudCBkZWxldGUgY2xvc3VyZSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHBsYWNlbWVudCBkZWxldGVbXSBjbG9zdXJlJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHNjYWxhciBkZWxldGluZyBkZXN0cnVjdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHN0cmluZyc=","type":"Ansi","source":"Hybrid Analysis","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHRlbXBsYXRlIHN0YXRpYyBkYXRhIG1lbWJlciBjb25zdHJ1Y3RvciBoZWxwZXIn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHRlbXBsYXRlIHN0YXRpYyBkYXRhIG1lbWJlciBkZXN0cnVjdG9yIGhlbHBlcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHRlbXBsYXRlLXBhcmFtZXRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHRlbXBsYXRlLXR5cGUtcGFyYW1ldGVyLQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHVkdCByZXR1cm5pbmcn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHVua25vd24gZWNzdSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZiYXNlIGRlc3RydWN0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZidGFibGUn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBkZWxldGluZyBkZXN0cnVjdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciBkZXN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciB2YmFzZSBjb25zdHJ1Y3RvciBpdGVyYXRvcic=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZlY3RvciB2YmFzZSBjb3B5IGNvbnN0cnVjdG9yIGl0ZXJhdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZmdGFibGUn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZpcnR1YWwgZGlzcGxhY2VtZW50IG1hcCc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZ0b3JkaXNwZXh7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YHZ0b3JkaXNwew==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QUJDREVGR0hJSktMTU5PUFFSU1RVVldYWVo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YWRpdGlvbmFs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YW1lcmljYW4gZW5nbGlzaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YW1lcmljYW4tZW5nbGlzaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YW4gZW5nbGlzaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YW4tbHV4ZW1ib3VyZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1hcHBtb2RlbC1ydW50aW1lLWwxLTEtMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWRhdGV0aW1lLWwxLTEtMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpbGUtbDItMS0x","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1vYnNvbGV0ZS1sMS0yLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXByb2Nlc3N0aHJlYWRzLWwxLTEtMg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN0cmluZy1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5c2luZm8tbDEtMi0x","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LWwxLTEtMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXhzdGF0ZS1sMi0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1ydGNvcmUtbnR1c2VyLXdpbmRvdy1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1zZWN1cml0eS1zeXN0ZW1mdW5jdGlvbnMtbDEtMS0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXJlRmlsZUFwaXNBTlNJ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXJnZW50aW5h","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXVzdHJhbGlhbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXotQVotQ3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXotYXotY3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXotQVotTGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXotYXotbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZSBDbGFzcyBBcnJheSc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QmFzZSBDbGFzcyBEZXNjcmlwdG9yIGF0ICg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YnMtQkEtTGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YnMtYmEtbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2gtYmVsZ2lhbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2hhcjE2X3Q=","type":"Ansi","source":"Hybrid Analysis","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2hhcjMyX3Q=","type":"Ansi","source":"Hybrid Analysis","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2hpbmVzZS1ob25na29uZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2hpbmVzZS1zaW1wbGlmaWVk","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2hpbmVzZS1zaW5nYXBvcmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2hpbmVzZS10cmFkaXRpb25hbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2xhc3MgSGllcmFyY2h5IERlc2NyaXB0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2xpOjphcnJheTw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y2xpOjpwaW5fcHRyPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y29pbnRlcmZhY2U=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGxldGUgT2JqZWN0IExvY2F0b3In","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29yRXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y29zdGEgcmljYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZGRkZCwgTU1NTSBkZCwgeXl5eQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGVjb2RlUG9pbnRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQ3JpdGljYWxTZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZGZlImRlZkFmZGVwZmVkfmVlZkJlZmYw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZG9taW5pY2FuIHJlcHVibGlj","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZHV0Y2gtYmVsZ2lhbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZH5+fn5+fn5+fn5LU1UqKip4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RH5+fn5+fn5+fn5+fn5+ZFw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RH5+fn5+fn5+fn5+fn5+fn5+dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZS1zaW5nYXBvcmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW5jb2RlUG9pbnRlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1hbWVyaWNhbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1hdXM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1iZWxpemU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1jYW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1jYXJpYmJlYW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1pcmU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1qYW1haWNh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1ueg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC1zb3V0aCBhZnJpY2E=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC10cmluaWRhZCB5IHRvYmFnbw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC11aw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC11cw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZW5nbGlzaC11c2E=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVN5c3RlbUxvY2FsZXNFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW51bVN5c3RlbUxvY2FsZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXNlLWhvbmdrb25n","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRSZWdpc3Rlcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRTZXRJbmZvcm1hdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRVbnJlZ2lzdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXZlbnRXcml0ZVRyYW5zZmVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXh0LW1zLXdpbi1rZXJuZWwzMi1wYWNrYWdlLWN1cnJlbnQtbDEtMS0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXh0LW1zLXdpbi1udHVzZXItZGlhbG9nYm94LWwxLTEtMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXh0LW1zLXdpbi1udHVzZXItd2luZG93c3RhdGlvbi1sMS0xLTA=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXh0ZXJuICJDIg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZidZNVBAXVdw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RkROVUtJS0pMSk9CTEpPTExVRUxQVUVGU00=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmluZENsb3Nl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZUV4QQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmxzU2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hGaWxlQnVmZmVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUVudmlyb25tZW50U3RyaW5nc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlbmNoLWJlbGdpYW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlbmNoLWNhbmFkaWFu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlbmNoLWx1eGVtYm91cmc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlbmNoLXN3aXNz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZnNkbztpaGZ2b3VoYnVld3k1ODczOXR1Z2lhZWhiODk1ZXl1dDk4d3U0NTh3NWpnb3NuZXJ1dmg5cDV1OTBpdC0wNHdqZ29pYWVvcnV2aDg5c3k0dDgzNTh5LXc0aWJvZXM1eTQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Zn5+fn5+fn5+fn5+fn4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Zn5+fn5+fn5+fn5+fn5+fn5+aw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Zn5+fn5+fn5+fn5+fn5+fn5+fn4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZzIyKiohISEhIQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2VuZXJpYy10eXBlLQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2VybWFuLWF1c3RyaWFu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2VybWFuLWxpY2h0ZW5zdGVpbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2VybWFuLWx1eGVtYm91cmc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z2VybWFuLXN3aXNz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWN0aXZlV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QXRvbU5hbWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZUNQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q1BJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGF0ZUZvcm1hdEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGF0ZUZvcm1hdFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW5hYmxlZFhTdGF0ZUZlYXR1cmVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRTdHJpbmdzVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVQcm9jZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEFjdGl2ZVBvcHVw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0T0VNQ1A=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0FmZmluaXR5TWFzaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0hlYXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1RpbWVz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc1dpbmRvd1N0YXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RhcnR1cEluZm9X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RyaW5nVHlwZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGhyZWFkVGltZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZUZvcm1hdEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZUZvcm1hdFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMQ0lE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlckRlZmF1bHRMb2NhbGVOYW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck9iamVjdEluZm9ybWF0aW9uVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0WFN0YXRlRmVhdHVyZXNNYXNr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z3JlYXQgYnJpdGFpbg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Z3tuUm5SUm5SUiEhUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aC1jb2xvbWJpYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aDhsOHA4dDh4OHw4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEFsbG9j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFJlQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aG9uZy1rb25n","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SSg3SSg3SSg3SSg3PiE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aWFuLW55bm9yc2s=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aWkmJmtrPDw8ew==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aWlpJiZrazw8VQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aW4tY29yZS1sb2NhbGl6YXRpb24tb2Jzb2xldGUtbDEtMi0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aW5pZGFkICYgdG9iYWdv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkFuZFNwaW5Db3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNMaXN0SGVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRGbHVzaFNMaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRQdXNoRW50cnlTTGlzdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXJpc2gtZW5nbGlzaA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNEZWJ1Z2dlclByZXNlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNoLWFtZXJpY2Fu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNoLWphbWFpY2E=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNoLXBhbmFtYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXNoLXB1ZXJ0byByaWNv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNQcm9jZXNzb3JGZWF0dXJlUHJlc2VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZENvZGVQYWdl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZExvY2FsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXNWYWxpZExvY2FsZU5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXRhbGlhbi1zd2lzcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aiJeZjkxalxedTg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SkohISEhISFKUjJo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"amohamghaGho","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bCEhYCFSUlIhISEhUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bC4hbCFSUlJSISFSIVIhISEhIUpKSioy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TENfQ09MTEFURQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TENfTU9ORVRBUlk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TENfTlVNRVJJQw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TENJRFRvTG9jYWxlTmFtZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGVhdmVDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxlTmFtZVRvTENJRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYXRlWFN0YXRlRmVhdHVyZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"THR+fn5+fn5+fn5+fn4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWVzc2FnZUJveEE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWVzc2FnZUJveFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IFZpc3VhbCBDKysgUnVudGltZSBMaWJyYXJ5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TU1NTSBkZCwgeXl5eQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bXMtd2luLWNvcmUtc3RyaW5nLWwxLTEtMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bXMtd2luLWNvcmUtd2lucnQtbDEtMS0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bXNjb3JlZS5kbGw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bVNqQVtqWl4r","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bXN2Y3J0LmRsbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGlCeXRlVG9XaWRlQ2hhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bi1ib2ttYWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bmFuKHNuYW4p","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TkFOKFNOQU4p","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bmV3LXplYWxhbmQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bm9yd2VnaWFu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bm9yd2VnaWFuLWJva21hbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bm9yd2VnaWFuLW55bm9yc2s=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bn5+fn5+fn5+fn5+fn54Zmt+fktT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b24tbDEtMi0x","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b3BlcmF0b3IgIiI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3V0cHV0RGVidWdTdHJpbmdB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3V0cHV0RGVidWdTdHJpbmdX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b3xPZHxPZHxPZHxPZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b3xPZHxPZHxPZHxPZHxPZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cG9ydHVndWVzZS1icmF6aWxpYW4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UFA5RSB1OlBQVldQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cHIgY2hpbmE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cHJpdmF0ZTo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cHJvdGVjdGVkOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UFNTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UFNTU1NTU1NTU1NTU1NTU1NTU1NTU1NYcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cHVlcnRvLXJpY28=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VFeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cmVzdHJpY3Qo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Um9Jbml0aWFsaXpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Um9VbmluaXRpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnRsVW53aW5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnVudGltZSBFcnJvciFQcm9ncmFtOg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2VwdGVtYmVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN0cmxIYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW52aXJvbm1lbnRWYXJpYWJsZUE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXJFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UHJvY2Vzc1NodXRkb3duUGFyYW1ldGVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkU3RhY2tHdWFyYW50ZWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U0t+fn5+fn5+fn5+fn5+fn5+fn4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c291dGggYWZyaWNh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c291dGgga29yZWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c291dGgtYWZyaWNh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c291dGgta29yZWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1hcmdlbnRpbmE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1ib2xpdmlh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1jaGlsZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1jb2xvbWJpYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1jb3N0YSByaWNh","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1kb21pbmljYW4gcmVwdWJsaWM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1lY3VhZG9y","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1lbCBzYWx2YWRvcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1ndWF0ZW1hbGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1ob25kdXJhcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1tZXhpY2Fu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1tb2Rlcm4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1uaWNhcmFndWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1wYW5hbWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1wYXJhZ3VheQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1wZXJ1","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC1wdWVydG8gcmljbw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC11cnVndWF5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3BhbmlzaC12ZW5lenVlbGE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3ItQkEtQ3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3ItYmEtY3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3ItYmEtbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3ItQkEtTGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3Itc3AtY3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3ItU1AtQ3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3Itc3AtbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3ItU1AtTGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1My","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1NTMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1NTU1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1NTU1NTU3h4eA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1NTU1gh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1N4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU1N4Sg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTU3g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTU1NTU1NTU1NTeCcn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1NTU1NTeENi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3RkOjpudWxscHRyX3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1ZqQVtqWl4r","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c1ZWViwsViwsViw5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1ZXakFfalor","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3dlZGlzaC1maW5sYW5k","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtRnVuY3Rpb24wMzY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dCBicml0YWlu","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dC1tcy13aW4tbnR1c2VyLXdpbmRvd3N0YXRpb24tbDEtMS0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dGVtcGxhdGUtcGFyYW1ldGVyLQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGh1cnNkYXk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dGlvbnMtbDEtMS0w","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dEs8X3Q8PCR0ODw8dDQ8PnQwPC10LDxhfA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGxzR2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGxzU2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dHJpbmlkYWQgJiB0b2JhZ28=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VHlwZSBEZXNjcmlwdG9yJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dH5+fn5+fn5+fn5+fn5+fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dW5pdGVkLWtpbmdkb20=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dW5pdGVkLXN0YXRlcw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dW5rbm93biBlY3N1Jw==","type":"Ansi","source":"Hybrid Analysis","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dXRoIGFmcmljYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dXRoLWFmcmljYQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dXotdXotY3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dXotVVotQ3lybA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dXotVVotTGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dXotdXotbGF0bg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ViwsLFYsLCwsViwsLCwsVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VjksLFYsLFYsVixW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbFByb3RlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VlYsLCwsLCwsVlYsLA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VlYsLCxWVlZWUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VlYsViwsLFZW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VlZWVlZWLCwsLFYsLCwsViwsLFZWLCwsLCxWLFYsLFYsLCwsLCwsVixWLCwsVixWVlYsVlZWVlYsLCwsLA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Ao","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2AoJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2AoP1Y=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Aod2Ao","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Aod2Aod2Ao","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Aod2Aod2Aod2Aod2Ao","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Aod2Aod2Aod2Aod2AoOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2Aod2Aod2Aod2Aod2Aod2Aod2AobCo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2AofE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d2AofE9kfE9kfE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2VkbmVzZGF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2lkZUNoYXJUb011bHRpQnl0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V0lOSFRUUC5kbGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2luSHR0cENsb3NlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2luSHR0cE9wZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVDb25zb2xlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WFNTU1NTU1NTU1NTU1NT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WjJeUzA5PnlQIw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ezksLCwsLCws","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"e3BXfi0lJH4y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fGl+fn5+fn5+fn5+fn5+fn4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9kfE9kJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9kfE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9kfE9kfE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9kfE9kfE9kfE9kUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9kfE9kfE9kfE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fE9kfE9kfE9kfE9kfE9kfE9kfE9kfE9k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fn5+fn5+fn5+fmY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fn5+fn5+fn5+fn5ueFcqKg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fn5+fn5+fn5+fn5+flMmZmtL","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fn5+fn5+fn5+fn5+fn5+fn5+aw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5EdH5+fn5+fn5+fn5+fn5+fn5+fn5+fmk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"9afb2870-sample.exe.bin","compromised":null,"detection_total":null,"total":null}]},{"name":"9afb2870-sample.exe:3048","strings":[{"value":"LXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Memory/File Scan","process":"9afb2870-sample.exe","filename":"00047647-00003048.00000000.48150.03031000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X01PTkVUQVJZ","type":"Unicode","source":"Memory/File Scan","process":"9afb2870-sample.exe","filename":"00047647-00003048.00000000.48150.03031000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YHR5cGVvZic=","type":"Ansi","source":"Memory/File Scan","process":"9afb2870-sample.exe","filename":"00047647-00003048.00000000.48150.03031000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljb2RlRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcOWFmYjI4NzAtc2FtcGxlLmV4ZQ==","type":"Ansi","source":"Hybrid Analysis","process":"9afb2870-sample.exe","filename":"00047647-00003048.00000000.48150.03001000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q1dESWxsZWdhbEluRExMU2VhcmNo","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUVuZ2luZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUxvY2FsT3ZlcnJpZGU=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVzZXJNb2RlQ2FsbGJhY2tGaWx0ZXI=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhlbWVBcGlDb25uZWN0aW9uUmVxdWVzdA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"eGl0UHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":"9afb2870-sample.exe","filename":"00047647-00003048.00000000.48150.03031000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9X8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"9afb2870-sample.exe:3680","strings":[{"value":"OWFmYjI4NzAtc2FtcGxlLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTQtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTUtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzU2hvd0V4dA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0NoZWNrU2VsZWN0","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0RldGVjdA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnJvd3NlSW5QbGFjZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZvckF0dHJpYnV0ZXM=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0VJUEVuYWJsZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJOYW1l","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udGVudCBUeXBl","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVCdWZmZXJlZFN5bmNocm9ub3VzSW8=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVDaHVua1NpemU=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVPdmVybGFwcGVkQ291bnQ=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVXJpQ2FjaGVTaXpl","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdIZWFwRmxhZ3M=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZWdhdGVFeGVjdXRl","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGV2aWNlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUltcHJvdmVkWm9uZUNoZWNr","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVNlY3VyaXR5U2V0dGluZ3NDaGVjaw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9jT2JqZWN0","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udFByZXR0eVBhdGg=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVNYXNr","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUHVueWNvZGU=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVHlwZUlE","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGlvbg==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z3Ridmp5eHBoaS5iYXQ=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGFzTmF2aWdhdGlvbkVudW0=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUZpbGVFeHQ=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUZvbGRlclZlcmJz","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUljb25z","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUluV2ViVmlldw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZU9uRGVza3RvcFBlclVzZXI=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWNvbnNPbmx5","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEZvbGRlckhhbmRsZXI=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50cmFuZXROYW1l","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNTaG9ydGN1dA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGRhcENsaWVudEludGVncml0eQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmV0RHJpdmVWZXJicw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmV0RHJ2QnRu","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFydGFFeHRlbnNpb24=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW1pemVBcHBz","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IFdpbmRvd3MgTWFuYWdlcg==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV2ZXJTaG93RXh0","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9GaWxlRm9sZGVySnVuY3Rpb24=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9OZXRDcmF3bGluZw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Xb3JraW5nRGlyZWN0b3J5","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T09CRUluUHJvZ3Jlc3M=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50Rm9sZGVy","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWU=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluVG9OYW1lU3BhY2VUcmVl","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ3JlYXRl","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZmlsZUltYWdlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlCeXBhc3M=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaEV4cGFuZGVkUGF0aA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGb3JJbmZvVGlw","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGb3JPdmVybGF5","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsYXRpdmVQYXRo","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzdHJpY3RlZEF0dHJpYnV0ZXM=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHlfSEtMTV9vbmx5","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VwYXJhdGVQcm9jZXNz","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0V29ya2luZ0RpcmVjdG9yeUZyb21UYXJnZXQ=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxTdGF0ZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0NvbXBDb2xvcg==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0luZm9UaXA=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1N1cGVySGlkZGVu","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1R5cGVPdmVybGF5","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U291cmNlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3BlY2lhbEZvbGRlcnNDYWNoZVNpemU=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2U=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2VUeXBl","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU2V0dXBJblByb2dyZXNz","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VU5DQXNJbnRyYW5ldA==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRHJvcEhhbmRsZXI=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlSG9zdG5hbWVBc0FsaWFz","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlT2xkSG9zdFJlc29sdXRpb25PcmRlcg==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNBbGlhc2VkTm90aWZpY2F0aW9ucw==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNGT1JESVNQTEFZ","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNGT1JQQVJTSU5H","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNQYXJzZURpc3BsYXlOYW1l","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNVbml2ZXJzYWxEZWxlZ2F0ZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d2lubWdyLmV4ZQ==","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezIwRDA0RkUwLTNBRUEtMTA2OS1BMkQ4LTA4MDAyQjMwMzA5RH0=","type":"Unicode","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"9afb2870-sample.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"gtbvjyxphi.bat","strings":[{"value":"OnJlcGVhdGRlbCAiQzpcOWFmYjI4NzAtc2FtcGxlLmV4ZSJpZiBleGlzdCAiQzpcOWFmYjI4NzAtc2FtcGxlLmV4ZSIgZ290byByZXBlYXRkZWwgIiVURU1QJVxndGJ2anl4cGhpLmJhdCI=","type":"Ansi","source":"Dropped File","process":null,"filename":"gtbvjyxphi.bat","compromised":null,"detection_total":null,"total":null},{"value":"ZGVsICJDOlw5YWZiMjg3MC1zYW1wbGUuZXhlIg==","type":"Ansi","source":"Dropped File","process":null,"filename":"gtbvjyxphi.bat","compromised":null,"detection_total":null,"total":null},{"value":"ZGVsICIlVEVNUCVcZ3Ridmp5eHBoaS5iYXQi","type":"Ansi","source":"Dropped File","process":null,"filename":"gtbvjyxphi.bat","compromised":null,"detection_total":null,"total":null},{"value":"aWYgZXhpc3QgIkM6XDlhZmIyODcwLXNhbXBsZS5leGUiIGdvdG8gcmVwZWF0","type":"Ansi","source":"Dropped File","process":null,"filename":"gtbvjyxphi.bat","compromised":null,"detection_total":null,"total":null}]},{"name":"screen_0.png","strings":[{"value":"Xz9fP18/TV9MXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X18/bUpfX19fcV8/LCw/LD8/bT8/Xz9fdl9fLCwsXyws","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fLF8sXywsXyws","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"bV9fX19KXyws","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null}]},{"name":"network.pcap","strings":[{"value":"YWJ2YWludmllbnZhaWViYWk=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWE=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"YWZpbGlhcy1uc3Q=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"ZG9tYWluLXJlZ2lzdHJ5","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWE=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmc=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"aG9zdG1hc3Rlcg==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGE=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2k=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"UFNQVUJXUy1QQw==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"cm9oZ29ydWhnc29yaHVnaWg=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"c2lpaWZpYmlpZWdpaWNpaWI=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null}]},{"name":"PCAP","strings":[{"value":"YWJ2YWludmllbnZhaWViYWkuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWJ2YWludmllbnZhaWViYWkua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWJ2YWludmllbnZhaWViYWkucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWJ2YWludmllbnZhaWViYWkuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWJ2YWludmllbnZhaWViYWkud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWEuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWEua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWEucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWEuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWVmb2JmYm9hYm9iZmFvdWEud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2ouaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2oua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2oubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2oucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2ouc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YWdlaWhlaGFpb2VvYWllZ2oud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"ZWdob2FiZW9nYnVhZW9mdWEud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmcuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmcua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmcucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmcuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"Z29pYWVnb2RidWViaWVpYmcud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"aWFwZ2hhaHBucG5hcGNpcGEud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VhYm9jYmVvZ29hZWhnb2kud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8uaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8ua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8ubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8ucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8uc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"b2VpaGVmb2VhYm9ldWJmdW8ud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"cm9oZ29ydWhnc29yaHVnaWguaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"cm9oZ29ydWhnc29yaHVnaWgua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"cm9oZ29ydWhnc29yaHVnaWgubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":67},{"value":"cm9oZ29ydWhnc29yaHVnaWgucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":4,"total":67},{"value":"cm9oZ29ydWhnc29yaHVnaWguc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":1,"total":67},{"value":"cm9oZ29ydWhnc29yaHVnaWgud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":1,"total":66},{"value":"c2lpaWZpYmlpZWdpaWNpaWIuaW4=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":67},{"value":"c2lpaWZpYmlpZWdpaWNpaWIua3o=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":67},{"value":"c2lpaWZpYmlpZWdpaWNpaWIubmw=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":67},{"value":"c2lpaWZpYmlpZWdpaWNpaWIucnU=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":1,"total":66},{"value":"c2lpaWZpYmlpZWdpaWNpaWIuc3U=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":0,"total":67},{"value":"c2lpaWZpYmlpZWdpaWNpaWIud3M=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":1,"total":66}]},{"name":"winmgr.exe:3484","strings":[{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVN0cmluZw==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVscGVyRGxsTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGlicmFyeVBhdGg=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U29ja2FkZHJMZW5ndGg=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWluU29ja2FkZHJMZW5ndGg=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmFtZVNwYWNlX0NhbGxvdXQ=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV4dF9DYXRhbG9nX0VudHJ5X0lE","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnVtX0NhdGFsb2dfRW50cmllcw==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFja2VkQ2F0YWxvZ0l0ZW0=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJZA==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VyaWFsX0FjY2Vzc19OdW0=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwb3J0cw==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRGVsYXllZEFjY2VwdGFuY2U=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29jayAyLjAgUHJvdmlkZXIgSUQ=","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyTnVtSGFuZGxlQnVja2V0cw==","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyU3BpbkNvdW50","type":"Unicode","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"winmgr.exe:2132","strings":[{"value":"JVdJTkRJUiVcTS01MDUwNTk3MjA5NzAyNDYwODI0NzUwODI2Mjg0NDg1NDVcd2lubWdyLmV4ZQ==","type":"Ansi","source":"Hybrid Analysis","process":"winmgr.exe","filename":"00051562-00002132.00000001.55060.03001000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9w6/Cv8K9","type":"Ansi","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$30","type":"Ansi","source":"Runtime Data","process":"winmgr.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"cmd.exe","strings":[{"value":"Y21kIC9jICIiJVRFTVAlXGd0YnZqeXhwaGkuYmF0IiAi","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null}]}],"image":[]},"http_requests":[],"ftp_requests":[],"irc_requests":[],"strings_resources":[],"tags_details":[],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"suricata_alerts":[{"destination_ip":"8.8.8.8","destination_port":53,"protocol":"UDP","category":"Potentially Bad Traffic","description":"ET DNS Query for .su TLD (Soviet Union) Often Malware Related","sid":"2014169"},{"destination_ip":"8.8.8.8","destination_port":53,"protocol":"UDP","category":"Potentially Bad Traffic","description":"ET DNS Query for .su TLD (Soviet Union) Often Malware Related","sid":"2014169"},{"destination_ip":"8.8.8.8","destination_port":53,"protocol":"UDP","category":"Potentially Bad Traffic","description":"ET DNS Query for .su TLD (Soviet Union) Often Malware Related","sid":"2014169"},{"destination_ip":"8.8.8.8","destination_port":53,"protocol":"UDP","category":"Potentially Bad Traffic","description":"ET DNS Query for .su TLD (Soviet Union) Often Malware Related","sid":"2014169"},{"destination_ip":"8.8.8.8","destination_port":53,"protocol":"UDP","category":"Potentially Bad Traffic","description":"ET DNS Query for .su TLD (Soviet Union) Often Malware Related","sid":"2014169"},{"destination_ip":"8.8.8.8","destination_port":53,"protocol":"UDP","category":"Potentially Bad Traffic","description":"ET DNS Query for .su TLD (Soviet Union) Often Malware Related","sid":"2014169"},{"destination_ip":"8.8.8.8","destination_port":53,"protocol":"UDP","category":"Potentially Bad Traffic","description":"ET DNS Query for .su TLD (Soviet Union) Often Malware Related","sid":"2014169"},{"destination_ip":"192.168.56.12","destination_port":57585,"protocol":"UDP","category":"A Network Trojan was detected","description":"ET TROJAN Zeus GameOver Possible DGA NXDOMAIN Responses","sid":"2018316"},{"destination_ip":"8.8.8.8","destination_port":53,"protocol":"UDP","category":"Potentially Bad Traffic","description":"ET DNS Query for .su TLD (Soviet Union) Often Malware Related","sid":"2014169"},{"destination_ip":"8.8.8.8","destination_port":53,"protocol":"UDP","category":"Potentially Bad Traffic","description":"ET DNS Query for .su TLD (Soviet Union) Often Malware Related","sid":"2014169"},{"destination_ip":"8.8.8.8","destination_port":53,"protocol":"UDP","category":"Potentially Bad Traffic","description":"ET DNS Query for .su TLD (Soviet Union) Often Malware Related","sid":"2014169"}],"version_info":[],"apk_info":null,"apps_info":[{"name":"Access","product":null,"version":null},{"name":"Acrobat Reader","product":"Adobe Reader","version":"11.0.9.29"},{"name":"Chrome","product":"Google Chrome","version":"56.0.2924.87"},{"name":"Excel","product":"Microsoft Office 2010","version":"14.0.4756.1000"},{"name":"Firefox","product":"Firefox","version":"35.0.1"},{"name":"Flash","product":null,"version":null},{"name":"Hancom Office Hancell","product":null,"version":null},{"name":"Internet Explorer","product":"Windows Internet Explorer","version":"8.00.7600.16385"},{"name":"Java","product":"Java(TM) Platform SE 8","version":"8.0.25.18"},{"name":"OneNote","product":"Microsoft OneNote","version":"14.0.4763.1000"},{"name":"PowerPoint","product":"Microsoft Office 2010","version":"14.0.4754.1000"},{"name":"Word","product":"Microsoft Office 2010","version":"14.0.4762.1000"}],"architecture":"32 Bit","document":{"author":null,"creator":null,"producer":null,"title":null,"subject":null,"pages":0},"packer":"VC8 -> Microsoft Corporation","file_imports":[{"module":"KERNEL32.dll","functions":["CloseHandle","CompareStringW","CreateFileW","CreateThread","DecodePointer","DeleteCriticalSection","EncodePointer","EnterCriticalSection","EnumSystemLocalesW","ExitProcess","FindClose","FindFirstFileExA","FindFirstFileExW","FindNextFileA","FindNextFileW","FlushFileBuffers","FreeEnvironmentStringsW","FreeLibrary","GetACP","GetAtomNameW","GetCommandLineA","GetCommandLineW","GetConsoleCP","GetConsoleMode","GetCPInfo","GetCurrentProcess","GetCurrentProcessId","GetCurrentThread","GetCurrentThreadId","GetDateFormatW","GetEnvironmentStringsW","GetExitCodeProcess","GetFileInformationByHandle","GetFileType","GetLastError","GetLocaleInfoW","GetModuleFileNameA","GetModuleFileNameW","GetModuleHandleExW","GetModuleHandleW","GetOEMCP","GetProcAddress","GetProcessAffinityMask","GetProcessHeap","GetProcessId","GetProcessTimes","GetStartupInfoW","GetStdHandle","GetStringTypeW","GetSystemTimeAsFileTime","GetSystemTimes","GetThreadTimes","GetTimeFormatW","GetUserDefaultLCID","HeapAlloc","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSectionAndSpinCount","InitializeSListHead","InterlockedFlushSList","InterlockedPushEntrySList","IsDebuggerPresent","IsProcessorFeaturePresent","IsValidCodePage","IsValidLocale","LCMapStringW","LeaveCriticalSection","LoadLibraryExW","LocalAlloc","MultiByteToWideChar","OutputDebugStringA","OutputDebugStringW","QueryPerformanceCounter","RaiseException","RtlUnwind","SetConsoleCtrlHandler","SetEnvironmentVariableA","SetEnvironmentVariableW","SetFilePointerEx","SetLastError","SetProcessShutdownParameters","SetStdHandle","SetUnhandledExceptionFilter","TerminateProcess","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnhandledExceptionFilter","WaitForSingleObjectEx","WideCharToMultiByte","WriteConsoleW","WriteFile"]},{"module":"WINHTTP.dll","functions":["WinHttpCloseHandle","WinHttpOpen"]}],"osint_tags":[],"osint_references":[],"memory_forensics":[],"language":"LITHUANIAN,NEUTRAL","authentihash":"3cb425de8badc12e125691f2279bfa1e2e0a0dedb900ef4369f2de1946ae972e","entrypoint_bytes":null,"pdb_timestamp":null,"pdb_pathway":null,"pdb_guid":null,"file_sections":[{"name":".text","entropy":6.61920310576,"virtual_address":"0x1000","virtual_size":"0x2f85e","raw_size":"0x2fa00","md5":"e1766fca6b92eafd3533cbfcaa2a666e","characteristics":[]},{"name":".rdata","entropy":5.1949466563,"virtual_address":"0x31000","virtual_size":"0x853e","raw_size":"0x8600","md5":"b3eeb639a30298cabaf62a2980d64513","characteristics":[]},{"name":".data","entropy":2.25734133237,"virtual_address":"0x3a000","virtual_size":"0x4338","raw_size":"0xa00","md5":"716b9fcdf6b82f6e5f891871efb7f967","characteristics":[]},{"name":".gfids","entropy":3.28178660328,"virtual_address":"0x3f000","virtual_size":"0x16c","raw_size":"0x200","md5":"78022499e82f94e71cb3af90d2681d3e","characteristics":[]},{"name":".rsrc","entropy":6.93719496057,"virtual_address":"0x40000","virtual_size":"0x17fc2","raw_size":"0x18000","md5":"8548983c0a242dd761062ba25c6852dd","characteristics":[]},{"name":".reloc","entropy":6.59458944084,"virtual_address":"0x58000","virtual_size":"0x1ed4","raw_size":"0x2000","md5":"0211e32e44ca24064d732092b4302f20","characteristics":[]}],"file_exports":[],"error":null,"yara_hits":[],"intelligence_mitre_mappings":[],"entrypoint_preview_count":0,"entrypoint_preview_instructions":[],"file_resources":[{"name":"FDNUKIKJLJOBLJOL","rva":"0x40450","size":"0x100","type":"Non-ISO extended-ASCII text, with NEL line terminators","language":"lithuanian"},{"name":"LUELPUEFSM","rva":"0x40550","size":"0xb5c8","type":"data","language":"neutral"},{"name":"RT_BITMAP","rva":"0x4bb18","size":"0xda8","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x4c8c0","size":"0xea8","type":"dBase IV DBT of `.DBF, blocks size 48, next free block index 40, 1st item \"\\316\\310\\315\"","language":"neutral"},{"name":"RT_ICON","rva":"0x4d768","size":"0x6c8","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x4de30","size":"0x568","type":"GLS_BINARY_LSB_FIRST","language":"neutral"},{"name":"RT_ICON","rva":"0x4e398","size":"0x25a8","type":"FoxPro FPT, blocks size 0, next free block index 671088640","language":"neutral"},{"name":"RT_ICON","rva":"0x50940","size":"0x988","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x512c8","size":"0x468","type":"GLS_BINARY_LSB_FIRST","language":"neutral"},{"name":"RT_ICON","rva":"0x51730","size":"0xea8","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x525d8","size":"0x8a8","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x52e80","size":"0x6c8","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x53548","size":"0x568","type":"GLS_BINARY_LSB_FIRST","language":"neutral"},{"name":"RT_ICON","rva":"0x53ab0","size":"0x25a8","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x56058","size":"0x10a8","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x57100","size":"0x988","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x57a88","size":"0x468","type":"GLS_BINARY_LSB_FIRST","language":"neutral"},{"name":"RT_GROUP_ICON","rva":"0x57ef0","size":"0x5a","type":"MS Windows icon resource - 6 icons, 48x48, 256-colors","language":"neutral"},{"name":"RT_GROUP_ICON","rva":"0x57f4c","size":"0x76","type":"MS Windows icon resource - 8 icons, 48x48, 256-colors","language":"neutral"}],"file_permissions":[],"file_activities":[],"file_receivers":[],"file_data_directories":[],"elf_headers":[],"elf_static_symbols":null,"vba_macros":[],"verdict_source":null,"user_comments":[],"email_headers":null,"classification_tags":["banker","zbot"],"tags":["banker","zbot"],"submissions":[{"submission_id":"5adb25aa7ca3e128295cf996","filename":"9afb2870-sample","url":null,"created_at":"2018-04-21T06:51:06-05:00"}],"crowdstrike_ai":{"executable_process_memory_analysis":[],"analysis_related_urls":[]},"warnings":["Added comment to Virus Total report","Enforcing malicious verdict, as a reliable source indicates high confidence","Extracted file \"gtbvjyxphi.bat\" was unknown to VirusTotal, submitted file for scanning (Permalink: \"https://www.virustotal.com/file/269f9a744a32e17b4ca11b9d793f4fad8f881894502882e1c674e3b4831bd22e/analysis/1524312112/\")","Not all IP/URL string resources were checked online","Not all sources for indicator ID \"api-11\" are available in the report","Not all sources for indicator ID \"api-55\" are available in the report","Not all sources for indicator ID \"mutant-0\" are available in the report","Not all sources for indicator ID \"network-0\" are available in the report","Not all sources for indicator ID \"network-34\" are available in the report","Not all sources for indicator ID \"stream-49\" are available in the report","Not all sources for indicator ID \"string-64\" are available in the report"],"report_related_files":{"report_json":{"file_name":"report.json","download_url":"/bff/report/5adb25aa7ca3e128295cf997/download/files/report_json","file_size":973646},"memory_strings":{"file_name":"mstrings.zip","download_url":"/bff/report/5adb25aa7ca3e128295cf997/download/files/memory_strings","file_size":24935},"certificate":null,"network_pcap":{"file_name":"network.pcap","download_url":"/bff/report/5adb25aa7ca3e128295cf997/download/files/network_pcap","file_size":6122},"memory_dumps":null},"system_resource_monitor":{"cpu_usage":[{"x":0,"y":100},{"x":1,"y":100},{"x":2,"y":99.9},{"x":3,"y":89.5105},{"x":4,"y":100},{"x":5,"y":100},{"x":6,"y":100},{"x":7,"y":98.6},{"x":8,"y":13.8138},{"x":9,"y":5.30531},{"x":10,"y":9.30931},{"x":11,"y":6.20621},{"x":12,"y":8.30831},{"x":13,"y":8.30831},{"x":14,"y":8.20821},{"x":15,"y":5.00501},{"x":16,"y":11.8118},{"x":17,"y":5.30531},{"x":18,"y":16.016},{"x":19,"y":30.1},{"x":20,"y":56.3},{"x":21,"y":72.1722}],"memory_usage":[{"x":0,"y":13.7733},{"x":1,"y":13.77},{"x":2,"y":13.7957},{"x":3,"y":13.7648},{"x":4,"y":13.7674},{"x":5,"y":13.7776},{"x":6,"y":13.8665},{"x":7,"y":13.9058},{"x":8,"y":13.9509},{"x":9,"y":13.9525},{"x":10,"y":13.5978},{"x":11,"y":13.6019},{"x":12,"y":13.6033},{"x":13,"y":13.6402},{"x":14,"y":13.5473},{"x":15,"y":13.5474},{"x":16,"y":13.5714},{"x":17,"y":13.5401},{"x":18,"y":13.5388},{"x":19,"y":13.5794},{"x":20,"y":13.6452},{"x":21,"y":13.7724}],"disk_read":[{"x":0,"y":13070.9},{"x":1,"y":0},{"x":2,"y":36389.4},{"x":3,"y":209044},{"x":4,"y":2045},{"x":5,"y":818.008},{"x":6,"y":28221.3},{"x":7,"y":3680.86},{"x":8,"y":9416.73},{"x":9,"y":0},{"x":10,"y":1637.67},{"x":11,"y":4094.25},{"x":12,"y":554769},{"x":13,"y":0},{"x":14,"y":2865.71},{"x":15,"y":0},{"x":16,"y":0},{"x":17,"y":0},{"x":18,"y":0},{"x":19,"y":0},{"x":20,"y":83435.9},{"x":21,"y":418010}],"disk_write":[{"x":0,"y":144852},{"x":1,"y":93511.6},{"x":2,"y":1065310},{"x":3,"y":777290},{"x":4,"y":615699},{"x":5,"y":192027},{"x":6,"y":176485},{"x":7,"y":250349},{"x":8,"y":538187},{"x":9,"y":226133},{"x":10,"y":67861},{"x":11,"y":299034},{"x":12,"y":333833},{"x":13,"y":161414},{"x":14,"y":420901},{"x":15,"y":109417},{"x":16,"y":211668},{"x":17,"y":84802.6},{"x":18,"y":81525.5},{"x":19,"y":80728.6},{"x":20,"y":117690},{"x":21,"y":227275}],"network_packets":[{"x":0,"y":0},{"x":1,"y":0},{"x":2,"y":0.0998217},{"x":3,"y":0},{"x":4,"y":0},{"x":5,"y":12.382},{"x":6,"y":0.998546},{"x":7,"y":0.0998496},{"x":8,"y":0.499784},{"x":9,"y":0.499736},{"x":10,"y":1.09951},{"x":11,"y":1.3994},{"x":12,"y":1.19948},{"x":13,"y":4.69795},{"x":14,"y":1.69912},{"x":15,"y":2.39893},{"x":16,"y":2.59884},{"x":17,"y":2.5989},{"x":18,"y":1.19947},{"x":19,"y":1.19828},{"x":20,"y":2.19678},{"x":21,"y":3.19853}],"page_file":[{"x":0,"y":259727000},{"x":1,"y":259621000},{"x":2,"y":260653000},{"x":3,"y":259322000},{"x":4,"y":259322000},{"x":5,"y":260092000},{"x":6,"y":263594000},{"x":7,"y":263987000},{"x":8,"y":264212000},{"x":9,"y":264258000},{"x":10,"y":249135000},{"x":11,"y":249348000},{"x":12,"y":249369000},{"x":13,"y":250327000},{"x":14,"y":246977000},{"x":15,"y":246874000},{"x":16,"y":247706000},{"x":17,"y":246751000},{"x":18,"y":246804000},{"x":19,"y":247718000},{"x":20,"y":247165000},{"x":21,"y":246952000}]},"external_reports":null,"available_buttons":{"report_false_positive":true},"hashes_to_context_check":["737edb7dd8ba6a9a2c54eed0a4e806c8d344e17e13427afed0b24a724af51939","3053ae22aec4e737cebee0967b0bb48352673a9ba02c7329256ed252860ff87a","81b22a2f5c51c30555b608ebe59f49ca9b929232f75f69375036e994300e54b9","2424b198dea9396a6a654f638d83e5e646093667060ea3146810e259f78051dd","e5251977e94b8c1d708f0a271d1f00525193c69006dd35086ac60d00f9c925f9","269f9a744a32e17b4ca11b9d793f4fad8f881894502882e1c674e3b4831bd22e","17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae"]}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic — Falcon Sandbox Report — Score 100/100 — Sample 737edb7dd8ba… | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sandbox report 5adb25aa7ca3…. Malware family: Trojan.Generic. Threat score 100/100. 11 malicious and 16 suspicious behavioral indicators across 58 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/737edb7dd8ba6a9a2c54eed0a4e806c8d344e17e13427afed0b24a724af51939/5adb25aa7ca3e128295cf997"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic — Falcon Sandbox Report — Score 100/100 — Sample 737edb7dd8ba… | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sandbox report 5adb25aa7ca3…. Malware family: Trojan.Generic. Threat score 100/100. 11 malicious and 16 suspicious behavioral indicators across 58 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/737edb7dd8ba6a9a2c54eed0a4e806c8d344e17e13427afed0b24a724af51939/5adb25aa7ca3e128295cf997"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic — Falcon Sandbox Report — Score 100/100 — Sample 737edb7dd8ba… | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sandbox report 5adb25aa7ca3…. Malware family: Trojan.Generic. Threat score 100/100. 11 malicious and 16 suspicious behavioral indicators across 58 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]