26:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/23qlsjvno4-wq.js","/_next/static/chunks/11pkz44bx8x1b.js","/_next/static/chunks/04k_7k5p4krw4.js"],"ReportDetailWrapper"] 157:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 25:T526,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Tool.FleetDeck — Falcon Sandbox Report — Score 84/100 — Sample db56557d0d20…","description":"Malicious verdict for sandbox report 6ab4a03bf03e…. Malware family: Tool.FleetDeck. Threat score 84/100. 1 malicious and 16 suspicious behavioral indicators across 285 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/db56557d0d20550a5b283196f8e4a41a10b931297463dbd3509b90b27408f035/6ab4a03bf03ed6da920b9aab","keywords":["Malicious","Tool.FleetDeck","sandbox report","malware analysis","MITRE ATT\u0026CK","db56557d0d20550a5b283196f8e4a41a10b931297463dbd3509b90b27408f035"],"about":{"@type":"SoftwareApplication","name":"zoom.exe","applicationCategory":"PE32 executable for MS Windows 6.01 (GUI), Intel i386 (stripped to external PDB), 7 sections","identifier":"db56557d0d20550a5b283196f8e4a41a10b931297463dbd3509b90b27408f035","additionalType":"Malicious sample"},"threatScore":84,"malwareFamily":"Tool.FleetDeck","sandboxEnvironment":"Windows 10 64 bit","behavioralIndicators":{"malicious":1,"suspicious":16,"totalSignatures":285},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T755,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000000.228765.6D640000.00000004.mdmp, 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6D6FA000.00000004.mdmp, 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000000.228765.6D640000.00000004.mdmp, 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6D6FA000.00000004.mdmp, 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp") Found string "3,"System.Management.Automation Version=3.0.0.0 Culture=neutral PublicKeyToken=31bf3856ad364e35","C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll",0" (Source: "00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00002636.00000000.228765.6D640000.00000004.mdmp")28:T62a,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "zoom.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "zoom.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "zoom.exe") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "zoom.exe") file/memory contains long string with (Indicator: "NtWaitForSingleObject"; File: "zoom.exe") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "zoom.exe") Found reference to API "eCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "zoom.exe") Found reference to API "GetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard TimePacific SA Standard TimeQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "zoom.exe") file/memory contains long string with (Indicator: "QueryPerformanceFrequency"; File: "zoom.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "zoom.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "zoom.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp")29:T93a,Found string - chaLycianLydianMondayRejangSCHED StringSundaySyriacTai_LeTangutTeluguThaanaUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11WanchoYezidi[]byte\ufffd chan<-efencelistenminutenumberobjectpopcntrdtscpremovesecondselectsilentsocketstringstructsweep sysmontimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type AvestanBengaliBrailleChanDirConvertCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboSwapperTagalogTibetanTirhutaTuesdayUNKNOWNUsage:WSARecvWSASend\\.\UNCtypes value=allocmRallocmWconnectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= msi.dllnumber pacer: panic: runningsyscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBu; Source: "zoom.exe") Found string - chaLycianLydianMondayRejangSCHED StringSundaySyriacTai_LeTangutTeluguThaanaUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11WanchoYezidi[]byte\ufffd chan<-efencelistenminutenumberobjectpopcntrdtscpremovesecondselectsilentsocketstringstructsweep sysmontimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type AvestanBengaliBrailleChanDirConvertCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboSwapperTagalogTibetanTirhutaTuesdayUNKNOWNUsage:WSARecvWSASend\\.\UNCtypes value=allocmRallocmWconnectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= msi.dllnumber pacer: panic: runningsyscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoB; Source: "zoom.exe") Found string - \\.\ROOT\standardcimv2:MSFT_NetFirewallRule.CreationClassName="MSFT|FW|FirewallRule|FleetDeck Agent Service" PolicyRuleName="" SystemCreationClassName="" SystemName=""; Source: "00000000-00002636.00000001.229385.6DD14000.00000004.mdmp")2a:T41e,Found string - chaLycianLydianMondayRejangSCHED StringSundaySyriacTai_LeTangutTeluguThaanaUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11WanchoYezidi[]byte\ufffd chan<-efencelistenminutenumberobjectpopcntrdtscpremovesecondselectsilentsocketstringstructsweep sysmontimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type AvestanBengaliBrailleChanDirConvertCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboSwapperTagalogTibetanTirhutaTuesdayUNKNOWNUsage:WSARecvWSASend\\.\UNCtypes value=allocmRallocmWconnectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= msi.dllnumber pacer: panic: runningsyscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBu; Source: "zoom.exe")2b:T41d,Found string - chaLycianLydianMondayRejangSCHED StringSundaySyriacTai_LeTangutTeluguThaanaUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11WanchoYezidi[]byte\ufffd chan<-efencelistenminutenumberobjectpopcntrdtscpremovesecondselectsilentsocketstringstructsweep sysmontimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type AvestanBengaliBrailleChanDirConvertCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboSwapperTagalogTibetanTirhutaTuesdayUNKNOWNUsage:WSARecvWSASend\\.\UNCtypes value=allocmRallocmWconnectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= msi.dllnumber pacer: panic: runningsyscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoB; Source: "zoom.exe")2c:T41e,Found string - chaLycianLydianMondayRejangSCHED StringSundaySyriacTai_LeTangutTeluguThaanaUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11WanchoYezidi[]byte\ufffd chan<-efencelistenminutenumberobjectpopcntrdtscpremovesecondselectsilentsocketstringstructsweep sysmontimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type AvestanBengaliBrailleChanDirConvertCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboSwapperTagalogTibetanTirhutaTuesdayUNKNOWNUsage:WSARecvWSASend\\.\UNCtypes value=allocmRallocmWconnectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= msi.dllnumber pacer: panic: runningsyscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBu; Source: "zoom.exe")2d:T41d,Found string - chaLycianLydianMondayRejangSCHED StringSundaySyriacTai_LeTangutTeluguThaanaUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11WanchoYezidi[]byte\ufffd chan<-efencelistenminutenumberobjectpopcntrdtscpremovesecondselectsilentsocketstringstructsweep sysmontimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type AvestanBengaliBrailleChanDirConvertCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboSwapperTagalogTibetanTirhutaTuesdayUNKNOWNUsage:WSARecvWSASend\\.\UNCtypes value=allocmRallocmWconnectconsolecpuproffloat32float64forcegcgctracehead = invalidminpc= msi.dllnumber pacer: panic: runningsyscalluintptrunknownwaiting bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoB; Source: "zoom.exe")2e:T72b,"powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CERTIFICATES\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CRLS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CTLS") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\FLIGHTROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CERTIFICATES") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLS") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLS") "powershell.exe" (Access type: "QUERY"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLS") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\PHYSICALSTORES")2f:Ta1d,"zoom.exe" queried SystemProcessInformation at 00000000-00003924-00000C15-2553767126 [PID: 3924] "zoom.exe" queried SystemProcessInformation at 00000000-00003924-00000C15-2553775778 [PID: 3924] "zoom.exe" queried SystemProcessInformation at 00000000-00003924-00000C15-2553946496 [PID: 3924] "zoom.exe" queried SystemProcessInformation at 00000000-00003924-00000C15-2553955036 [PID: 3924] "zoom.exe" queried SystemProcessInformation at 00000000-00003924-00000C15-2554062520 [PID: 3924] "zoom.exe" queried SystemProcessInformation at 00000000-00003924-00000C15-2554071476 [PID: 3924] "zoom.exe" queried SystemProcessInformation at 00000000-00003924-00000C15-2554240930 [PID: 3924] "zoom.exe" queried SystemProcessInformation at 00000000-00003924-00000C15-2554249664 [PID: 3924] "zoom.exe" queried SystemProcessInformation at 00000000-00003924-00000C15-2554473407 [PID: 3924] "zoom.exe" queried SystemProcessInformation at 00000000-00003924-00000C15-2554482037 [PID: 3924] "zoom.exe" queried SystemProcessInformation at 00000000-00003924-00000C15-2554660067 [PID: 3924] "zoom.exe" queried SystemProcessInformation at 00000000-00003924-00000C15-2554669149 [PID: 3924] "zoom.exe" queried SystemProcessInformation at 00000000-00003924-00000C15-2555080808 [PID: 3924] "zoom.exe" queried SystemProcessInformation at 00000000-00003924-00000C15-2555089523 [PID: 3924] "msiexec.exe" queried SystemProcessInformation at 00000000-00003340-00000C15-2557590410 [PID: 3340] "msiexec.exe" queried SystemProcessInformation at 00000000-00003340-00000C15-2557599223 [PID: 3340] "fleetdeck_agent_svc.exe" queried SystemProcessInformation at 00000000-00002548-00000C15-2558843393 [PID: 2548] "fleetdeck_agent_svc.exe" queried SystemProcessInformation at 00000000-00002548-00000C15-2558852504 [PID: 2548] "fleetdeck_agent_svc.exe" queried SystemProcessInformation at 00000000-00002548-00000C15-2559008943 [PID: 2548] "fleetdeck_agent_svc.exe" queried SystemProcessInformation at 00000000-00002548-00000C15-2559018533 [PID: 2548] "fleetdeck_agent_svc.exe" queried SystemProcessInformation at 00000000-00002548-00000C15-2559274424 [PID: 2548] "fleetdeck_agent_svc.exe" queried SystemProcessInformation at 00000000-00002548-00000C15-2559284776 [PID: 2548] "fleetdeck_agent_svc.exe" queried SystemProcessInformation at 00000000-00002548-00000C15-2559496217 [PID: 2548] "fleetdeck_agent_svc.exe" queried SystemProcessInformation at 00000000-00002548-00000C15-2559505154 [PID: 2548] "fleetdeck_agent_svc.exe" queried SystemProcessInformation at 00000000-00002548-00000C15-2574383358 [PID: 2548]30:T52ce,Found api reference "n (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWMsiViewModifyOld_HungarianRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWUsage of %s:VirtualUnlockWriteConsoleWadvapi32.dll" (Indicator: "CertOpenStore"; File: "zoom.exe") Found api reference "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabunimplementedvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625: extra text: CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIsWow64ProcessMB; allocated Module32FirstWMsiCloseHandleMsiViewExecuteNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waitt" (Indicator: "CertCloseStore"; File: "zoom.exe") Found api reference "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabunimplementedvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625: extra text: CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIsWow64ProcessMB; allocated Module32FirstWMsiCloseHandleMsiViewExecuteNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waitt" (Indicator: "CryptGenRandom"; File: "zoom.exe") Found api reference "Time.MarshalJSON: Time.MarshalText: Variation_Selectoradaptivestackstartbad manualFreeListconnection refusedelem align too bigexceeded max depthfile name too longflag %q contains =flag redefined: %sforEachP: not donegarbage collectionidentifier removedin numeric literalindex out of rangeinput/output errorinvalid character multihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintreflect: Zero(nil)runtime.semacreateruntime.semawakeupruntime: gp: gp=runtime: getg: g=runtime: npages = runtime: range = {runtime: textAddr stopping the worldstreams pipe errorsync.RWMutex.RLocksystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessId" (Indicator: "CryptReleaseContext"; File: "zoom.exe") Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryI" (Indicator: "CertOpenSystemStoreW"; File: "zoom.exe") Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryI" (Indicator: "CryptAcquireContextW"; File: "zoom.exe") Found api reference "5386962890625Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeLogical_Order_ExceptionLord Howe Standard TimeMB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointQyzylorda Standard TimeRtlGetNtVersionNumbers" (Indicator: "CertGetCertificateChain"; File: "zoom.exe") Found api reference "lock: lock countslice bounds out of rangesocket type not supportedstartm: p has runnable gsstoplockedm: not runnableunexpected fault address unexpected key value type using unaddressable value1455191522836685180664062572759576141834259033203125: day-of-year out of rangeBougainville Standard TimeCentral Asia Standard TimeCertFreeCertificateContextE. Australia Standard TimeEkaterinburg Standard TimeError creating tmpFile: %vGetFileInformationByHandleLine Islands Standard TimeNewfoundland Standard TimePostQueuedCompletionStatusQueryPerformanceFrequency" (Indicator: "CertFreeCertificateContext"; File: "zoom.exe") Found api reference "CertEnumCertificatesInStoreEaster Island Standard TimeG waiting list is corruptedaddress not a stack addressafter object key:value pairchannel number out of rangecommunication error on sendcould not find QPC syscallsfailed to set sweep barrierflag needs an argument: -%sgcstopm: not waiting for gcgrowslice: len out of rangeinternal lockOSThread errorinvalid boolean flag %s: %vinvalid profile bucket typekey was rejected by servicemakechan: size out of rangemakeslice: cap out of rangemakeslice: len out of rangemspan.sweep: bad span statenot a XENIX named type fileprogToPointerMask: overflowreflect.Value.UnsafePointerrunlock of unlocked rwmutexruntime: asyncPreemptStack=runtime: checkdead: find g runtime: checkdead: nmidle=runtime: corrupted polldescruntime: netpollinit failedruntime: thread ID overflowruntime" (Indicator: "CertEnumCertificatesInStore"; File: "zoom.exe") Found api reference "unlock: lock countsigsend: inconsistent statestack size not a power of 2stopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionswork.nwait was > work.nproc args stack map entries for !#$%&()*+-./:;<=>?@[]^_{|}~ 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextEnglish name for time zone "FixedStack is not power-of-2GetFileInformationByHandleExPrepended_Concatenation_Mark[originating from goroutine comparing uncomparable type destination address requiredfatal: morestack on gsignalfile descriptor in bad statefindrunnable: netpoll with pfound pointer to free objectgcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid runtime symbol tablejson: Unmarshal(non-pointer mheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockedneed padding in bucket (key)newproc1: new g is not Gdeadnewpr" (Indicator: "CertCreateCertificateContext"; File: "zoom.exe"), Found api reference "ica Standard Timebad write barrier buffer boundscannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happenin literal null (expecting 'l')in literal null (expecting 'u')in literal true (expecting 'e')in literal true (expecting 'r')in literal true (expecting 'u')internal error - misuse of itabjson: invalid number literal %qmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorreflect.MakeSlice: negative capreflect.MakeSlice: negative lenreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125: day-of-year does not match dayCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyError call" (Indicator: "CertAddCertificateContextToStore"; File: "zoom.exe"), Found api reference "ica Standard Timebad write barrier buffer boundscannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happenin literal null (expecting 'l')in literal null (expecting 'u')in literal true (expecting 'e')in literal true (expecting 'r')in literal true (expecting 'u')internal error - misuse of itabjson: invalid number literal %qmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorreflect.MakeSlice: negative capreflect.MakeSlice: negative lenreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125: day-of-year does not match dayCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyError call" (Indicator: "CertVerifyCertificateChainPolicy"; File: "zoom.exe"), Found api reference "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabunimplementedvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625: extra text: CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIsWow64ProcessMB; allocated Module32FirstWMsiCloseHandleMsiViewExecuteNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Wait" (Indicator: "CertCloseStore"; File: "zoom.exe"), Found api reference "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabunimplementedvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625: extra text: CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIsWow64ProcessMB; allocated Module32FirstWMsiCloseHandleMsiViewExecuteNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Wait" (Indicator: "CryptGenRandom"; File: "zoom.exe"), Found api reference "Time.MarshalJSON: Time.MarshalText: Variation_Selectoradaptivestackstartbad manualFreeListconnection refusedelem align too bigexceeded max depthfile name too longflag %q contains =flag redefined: %sforEachP: not donegarbage collectionidentifier removedin numeric literalindex out of rangeinput/output errorinvalid character multihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintreflect: Zero(nil)runtime.semacreateruntime.semawakeupruntime: gp: gp=runtime: getg: g=runtime: npages = runtime: range = {runtime: textAddr stopping the worldstreams pipe errorsync.RWMutex.RLocksystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessI" (Indicator: "CryptReleaseContext"; File: "zoom.exe") Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemory" (Indicator: "CertOpenSystemStoreW"; File: "zoom.exe") Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemory" (Indicator: "CryptAcquireContextW"; File: "zoom.exe") Found api reference "unlock: lock countsigsend: inconsistent statestack size not a power of 2stopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionswork.nwait was > work.nproc args stack map entries for !#$%&()*+-./:;<=>?@[]^_{|}~ 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextEnglish name for time zone "FixedStack is not power-of-2GetFileInformationByHandleExPrepended_Concatenation_Mark[originating from goroutine comparing uncomparable type destination address requiredfatal: morestack on gsignalfile descriptor in bad statefindrunnable: netpoll with pfound pointer to free objectgcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid runtime symbol tablejson: Unmarshal(non-pointer mheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockedneed padding in bucket (key)newproc1: new g is not Gdeadnewp" (Indicator: "CertCreateCertificateContext"; File: "zoom.exe"), Found api reference "ica Standard Timebad write barrier buffer boundscannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happenin literal null (expecting 'l')in literal null (expecting 'u')in literal true (expecting 'e')in literal true (expecting 'r')in literal true (expecting 'u')internal error - misuse of itabjson: invalid number literal %qmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorreflect.MakeSlice: negative capreflect.MakeSlice: negative lenreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125: day-of-year does not match dayCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyError cal" (Indicator: "CertAddCertificateContextToStore"; File: "zoom.exe"), Found api reference "ica Standard Timebad write barrier buffer boundscannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happenin literal null (expecting 'l')in literal null (expecting 'u')in literal true (expecting 'e')in literal true (expecting 'r')in literal true (expecting 'u')internal error - misuse of itabjson: invalid number literal %qmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorreflect.MakeSlice: negative capreflect.MakeSlice: negative lenreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125: day-of-year does not match dayCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyError cal" (Indicator: "CertVerifyCertificateChainPolicy"; File: "zoom.exe"), Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00002548.00000000.228697.035E0000.00000004.mdmp 00000000-00002548.00000001.230295.035E0000.00000004.mdmp"), Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00002548.00000000.228697.035E0000.00000004.mdmp"), Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp"), Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp"), Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp"), Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp")31:T443,Found api reference "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabunimplementedvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625: extra text: CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIsWow64ProcessMB; allocated Module32FirstWMsiCloseHandleMsiViewExecuteNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waitt" (Indicator: "CertCloseStore"; File: "zoom.exe")32:T443,Found api reference "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabunimplementedvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625: extra text: CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIsWow64ProcessMB; allocated Module32FirstWMsiCloseHandleMsiViewExecuteNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waitt" (Indicator: "CryptGenRandom"; File: "zoom.exe")33:T44b,Found api reference "Time.MarshalJSON: Time.MarshalText: Variation_Selectoradaptivestackstartbad manualFreeListconnection refusedelem align too bigexceeded max depthfile name too longflag %q contains =flag redefined: %sforEachP: not donegarbage collectionidentifier removedin numeric literalindex out of rangeinput/output errorinvalid character multihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintreflect: Zero(nil)runtime.semacreateruntime.semawakeupruntime: gp: gp=runtime: getg: g=runtime: npages = runtime: range = {runtime: textAddr stopping the worldstreams pipe errorsync.RWMutex.RLocksystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessId" (Indicator: "CryptReleaseContext"; File: "zoom.exe")34:T44a,Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryI" (Indicator: "CertOpenSystemStoreW"; File: "zoom.exe")35:T44a,Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryI" (Indicator: "CryptAcquireContextW"; File: "zoom.exe")36:T19db,Found api reference "unlock: lock countsigsend: inconsistent statestack size not a power of 2stopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionswork.nwait was > work.nproc args stack map entries for !#$%&()*+-./:;<=>?@[]^_{|}~ 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextEnglish name for time zone "FixedStack is not power-of-2GetFileInformationByHandleExPrepended_Concatenation_Mark[originating from goroutine comparing uncomparable type destination address requiredfatal: morestack on gsignalfile descriptor in bad statefindrunnable: netpoll with pfound pointer to free objectgcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid runtime symbol tablejson: Unmarshal(non-pointer mheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockedneed padding in bucket (key)newproc1: new g is not Gdeadnewpr" (Indicator: "CertCreateCertificateContext"; File: "zoom.exe"), Found api reference "ica Standard Timebad write barrier buffer boundscannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happenin literal null (expecting 'l')in literal null (expecting 'u')in literal true (expecting 'e')in literal true (expecting 'r')in literal true (expecting 'u')internal error - misuse of itabjson: invalid number literal %qmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorreflect.MakeSlice: negative capreflect.MakeSlice: negative lenreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125: day-of-year does not match dayCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyError call" (Indicator: "CertAddCertificateContextToStore"; File: "zoom.exe"), Found api reference "ica Standard Timebad write barrier buffer boundscannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happenin literal null (expecting 'l')in literal null (expecting 'u')in literal true (expecting 'e')in literal true (expecting 'r')in literal true (expecting 'u')internal error - misuse of itabjson: invalid number literal %qmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorreflect.MakeSlice: negative capreflect.MakeSlice: negative lenreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125: day-of-year does not match dayCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyError call" (Indicator: "CertVerifyCertificateChainPolicy"; File: "zoom.exe"), Found api reference "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabunimplementedvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625: extra text: CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIsWow64ProcessMB; allocated Module32FirstWMsiCloseHandleMsiViewExecuteNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Wait" (Indicator: "CertCloseStore"; File: "zoom.exe"), Found api reference "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabunimplementedvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625: extra text: CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIsWow64ProcessMB; allocated Module32FirstWMsiCloseHandleMsiViewExecuteNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Wait" (Indicator: "CryptGenRandom"; File: "zoom.exe"), Found api reference "Time.MarshalJSON: Time.MarshalText: Variation_Selectoradaptivestackstartbad manualFreeListconnection refusedelem align too bigexceeded max depthfile name too longflag %q contains =flag redefined: %sforEachP: not donegarbage collectionidentifier removedin numeric literalindex out of rangeinput/output errorinvalid character multihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintreflect: Zero(nil)runtime.semacreateruntime.semawakeupruntime: gp: gp=runtime: getg: g=runtime: npages = runtime: range = {runtime: textAddr stopping the worldstreams pipe errorsync.RWMutex.RLocksystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessI" (Indicator: "CryptReleaseContext"; File: "zoom.exe")37:T449,Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemory" (Indicator: "CertOpenSystemStoreW"; File: "zoom.exe")38:T449,Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemory" (Indicator: "CryptAcquireContextW"; File: "zoom.exe")39:Td86,Found api reference "unlock: lock countsigsend: inconsistent statestack size not a power of 2stopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionswork.nwait was > work.nproc args stack map entries for !#$%&()*+-./:;<=>?@[]^_{|}~ 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextEnglish name for time zone "FixedStack is not power-of-2GetFileInformationByHandleExPrepended_Concatenation_Mark[originating from goroutine comparing uncomparable type destination address requiredfatal: morestack on gsignalfile descriptor in bad statefindrunnable: netpoll with pfound pointer to free objectgcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid runtime symbol tablejson: Unmarshal(non-pointer mheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockedneed padding in bucket (key)newproc1: new g is not Gdeadnewp" (Indicator: "CertCreateCertificateContext"; File: "zoom.exe"), Found api reference "ica Standard Timebad write barrier buffer boundscannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happenin literal null (expecting 'l')in literal null (expecting 'u')in literal true (expecting 'e')in literal true (expecting 'r')in literal true (expecting 'u')internal error - misuse of itabjson: invalid number literal %qmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorreflect.MakeSlice: negative capreflect.MakeSlice: negative lenreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125: day-of-year does not match dayCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyError cal" (Indicator: "CertAddCertificateContextToStore"; File: "zoom.exe"), Found api reference "ica Standard Timebad write barrier buffer boundscannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happenin literal null (expecting 'l')in literal null (expecting 'u')in literal true (expecting 'e')in literal true (expecting 'r')in literal true (expecting 'u')internal error - misuse of itabjson: invalid number literal %qmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorreflect.MakeSlice: negative capreflect.MakeSlice: negative lenreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125: day-of-year does not match dayCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyError cal" (Indicator: "CertVerifyCertificateChainPolicy"; File: "zoom.exe"), Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00002548.00000000.228697.035E0000.00000004.mdmp3a:T443,Found api reference "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabunimplementedvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625: extra text: CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIsWow64ProcessMB; allocated Module32FirstWMsiCloseHandleMsiViewExecuteNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waitt" (Indicator: "CertCloseStore"; File: "zoom.exe")3b:T443,Found api reference "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabunimplementedvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625: extra text: CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIsWow64ProcessMB; allocated Module32FirstWMsiCloseHandleMsiViewExecuteNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waitt" (Indicator: "CryptGenRandom"; File: "zoom.exe")3c:T44b,Found api reference "Time.MarshalJSON: Time.MarshalText: Variation_Selectoradaptivestackstartbad manualFreeListconnection refusedelem align too bigexceeded max depthfile name too longflag %q contains =flag redefined: %sforEachP: not donegarbage collectionidentifier removedin numeric literalindex out of rangeinput/output errorinvalid character multihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintreflect: Zero(nil)runtime.semacreateruntime.semawakeupruntime: gp: gp=runtime: getg: g=runtime: npages = runtime: range = {runtime: textAddr stopping the worldstreams pipe errorsync.RWMutex.RLocksystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessId" (Indicator: "CryptReleaseContext"; File: "zoom.exe")3d:T44a,Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryI" (Indicator: "CertOpenSystemStoreW"; File: "zoom.exe")3e:T44a,Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryI" (Indicator: "CryptAcquireContextW"; File: "zoom.exe")3f:T19db,Found api reference "unlock: lock countsigsend: inconsistent statestack size not a power of 2stopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionswork.nwait was > work.nproc args stack map entries for !#$%&()*+-./:;<=>?@[]^_{|}~ 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextEnglish name for time zone "FixedStack is not power-of-2GetFileInformationByHandleExPrepended_Concatenation_Mark[originating from goroutine comparing uncomparable type destination address requiredfatal: morestack on gsignalfile descriptor in bad statefindrunnable: netpoll with pfound pointer to free objectgcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid runtime symbol tablejson: Unmarshal(non-pointer mheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockedneed padding in bucket (key)newproc1: new g is not Gdeadnewpr" (Indicator: "CertCreateCertificateContext"; File: "zoom.exe"), Found api reference "ica Standard Timebad write barrier buffer boundscannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happenin literal null (expecting 'l')in literal null (expecting 'u')in literal true (expecting 'e')in literal true (expecting 'r')in literal true (expecting 'u')internal error - misuse of itabjson: invalid number literal %qmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorreflect.MakeSlice: negative capreflect.MakeSlice: negative lenreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125: day-of-year does not match dayCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyError call" (Indicator: "CertAddCertificateContextToStore"; File: "zoom.exe"), Found api reference "ica Standard Timebad write barrier buffer boundscannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happenin literal null (expecting 'l')in literal null (expecting 'u')in literal true (expecting 'e')in literal true (expecting 'r')in literal true (expecting 'u')internal error - misuse of itabjson: invalid number literal %qmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorreflect.MakeSlice: negative capreflect.MakeSlice: negative lenreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125: day-of-year does not match dayCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyError call" (Indicator: "CertVerifyCertificateChainPolicy"; File: "zoom.exe"), Found api reference "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabunimplementedvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625: extra text: CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIsWow64ProcessMB; allocated Module32FirstWMsiCloseHandleMsiViewExecuteNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Wait" (Indicator: "CertCloseStore"; File: "zoom.exe"), Found api reference "profMemActiveprofMemFutureruntime: seq=runtime: val=srmount errortestRInternaltimer expiredtraceStackTabunimplementedvalue method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit1907348632812595367431640625: extra text: CertCloseStoreCreateProcessWCryptGenRandomFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserNameExWIsWow64ProcessMB; allocated Module32FirstWMsiCloseHandleMsiViewExecuteNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRegSetValueExWSetFilePointerTranslateNameWallocfreetracebad allocCountbad restart PCbad span statefile too largefinalizer waitgcstoptheworldgetprotobynameinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratenil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Wait" (Indicator: "CryptGenRandom"; File: "zoom.exe"), Found api reference "Time.MarshalJSON: Time.MarshalText: Variation_Selectoradaptivestackstartbad manualFreeListconnection refusedelem align too bigexceeded max depthfile name too longflag %q contains =flag redefined: %sforEachP: not donegarbage collectionidentifier removedin numeric literalindex out of rangeinput/output errorinvalid character multihop attemptedno child processesno locks availableoperation canceledreflect.Value.Elemreflect.Value.Typereflect.Value.Uintreflect: Zero(nil)runtime.semacreateruntime.semawakeupruntime: gp: gp=runtime: getg: g=runtime: npages = runtime: range = {runtime: textAddr stopping the worldstreams pipe errorsync.RWMutex.RLocksystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessI" (Indicator: "CryptReleaseContext"; File: "zoom.exe")40:T449,Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemory" (Indicator: "CertOpenSystemStoreW"; File: "zoom.exe")41:T449,Found api reference "mstartbad sequence numberbad value for fielddevice not a streamdirectory not emptydisk quota exceededdodeltimer: wrong Pfile already closedfile already existsfile does not existm not found in allmmarking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not found markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemory" (Indicator: "CryptAcquireContextW"; File: "zoom.exe")42:Td86,Found api reference "unlock: lock countsigsend: inconsistent statestack size not a power of 2stopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionswork.nwait was > work.nproc args stack map entries for !#$%&()*+-./:;<=>?@[]^_{|}~ 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextEnglish name for time zone "FixedStack is not power-of-2GetFileInformationByHandleExPrepended_Concatenation_Mark[originating from goroutine comparing uncomparable type destination address requiredfatal: morestack on gsignalfile descriptor in bad statefindrunnable: netpoll with pfound pointer to free objectgcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid runtime symbol tablejson: Unmarshal(non-pointer mheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockedneed padding in bucket (key)newproc1: new g is not Gdeadnewp" (Indicator: "CertCreateCertificateContext"; File: "zoom.exe"), Found api reference "ica Standard Timebad write barrier buffer boundscannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happenin literal null (expecting 'l')in literal null (expecting 'u')in literal true (expecting 'e')in literal true (expecting 'r')in literal true (expecting 'u')internal error - misuse of itabjson: invalid number literal %qmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorreflect.MakeSlice: negative capreflect.MakeSlice: negative lenreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125: day-of-year does not match dayCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyError cal" (Indicator: "CertAddCertificateContextToStore"; File: "zoom.exe"), Found api reference "ica Standard Timebad write barrier buffer boundscannot assign requested addresscasgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happenin literal null (expecting 'l')in literal null (expecting 'u')in literal true (expecting 'e')in literal true (expecting 'r')in literal true (expecting 'u')internal error - misuse of itabjson: invalid number literal %qmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorreflect.MakeSlice: negative capreflect.MakeSlice: negative lenreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125: day-of-year does not match dayCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyError cal" (Indicator: "CertVerifyCertificateChainPolicy"; File: "zoom.exe"), Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00002548.00000000.228697.035E0000.00000004.mdmp43:T936,"powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}44:T80e,"pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f"45:T80e,"pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f"46:T9b9,Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "2FN9" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "Keep" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "User" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "ocsp" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com"47:T622,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to use Cryptographic classes Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption48:T2cca,Found XOR loop in file "sample.bin" at offset 1041180; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1475597; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1483653; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1504618; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1968392; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2016831; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2150144; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2223049; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2352544; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2444329; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2468879; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2844772; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2878601; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2909783; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2913627; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2924295; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2945589; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3061135; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3119563; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3361682; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3376379; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3381006; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3542369; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3576313; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3699323; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3755372; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3766914; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4148071; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4148903; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4171803; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4204830; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4274105; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4278711; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4286477; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4299851; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4300181; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4300573; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4301935; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4303405; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4303917; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4304563; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4304925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4305535; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4307033; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4308243; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4312705; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4313139; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4313753; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4329205; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4362238; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 446769; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1933227; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1934208; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2226302; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2297766; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2324646; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2335517; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2370195; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2396655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2402496; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2546648; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2595791; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2696982; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2801449; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2822928; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2833014; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2847727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2878283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2892388; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2936223; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3001766; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3075175; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3090064; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3155758; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3166032; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3186813; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3282026; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3448043; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3463417; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3518322; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3597636; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3615194; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3680178; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3758174; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3821218; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3824098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3917007; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4006775; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4158642; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4275217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4296583; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4298475; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4320140; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1381503; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 3534857; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 686850; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 686878; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 687007; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 687120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 926432; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1128566; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1128584; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1164872; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1877008; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1946392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1975005; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1993625; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2177564; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2223468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2229603; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2263672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2290320; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2362419; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2463139; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2483286; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2532307; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2534768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2617917; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2628497; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2716181; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2716778; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2818307; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2879860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2907845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2985286; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3058315; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3061134; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3103633; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3174236; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3236237; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3305120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3328620; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3448978; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3604019; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3706452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3750477; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3919737; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3927718; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4143528; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4145850; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4148884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4152901; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4154955; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4248698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4251444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4289550; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4299812; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4300920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4303404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4304548; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4306018; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4308218; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4313736; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4390407; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4393173; code bytes = 803049:T279e,"zoom.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120000009e290a7738d9cc020000000028000000240000000000cb02f8f0b3000000000000000000000000000000000000000000d007b5023000000000000000120000000000b50200000000dcdb00000000000000000000b0d5cc02f0b0cb021200000000000000200000000000b502d001b5023c0cb50200000000380cb50200000000f0f0b30050f5097738d9cc0258f1b300a4f1b300 (UID: 00000000-00003924) "zoom.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003924) "zoom.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003924) "zoom.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02cdd7544f4b300226e3f750000f104000000002d6e3f75d94951e02d000000ecb7d375c8f4b300b1ce9800c801cd02c820cc020d0000008000000008f4b3000000b5028cf4b30070c8407565cca795feffffff2d000000d0cce275270000005cf4b300856a41751c2346759cf4b300f85f417508000000bb694075b2694075014951e02d000000ecb7d37527000000d0cce27570f4b3002d000000d0cce27527000000a0f4b300856a41751c234675e8f4b3007e8ae175ee8ce175738ae175e870b8ea2d000000ecb7d37527000000d0cce275b413f1044813f104e870b8eab0f4b300fc521f769cf5b300e084e1753875169cfeffffff738ae175 (UID: 00000000-00003924) "zoom.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000001777000000000000000050dbcd025cdbcd02e0f4b3003ec70a7750dbcd02000000001c030d778a020b771e00000080f4b3000000000018f5b300c2020b7774dbcd025cf5b30000000000e9020b770000000000000000bd054073c802000000000000bd054073000000002e00cd02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004cf5b300c2a26d2228f5b300cd010b7750dbcd02 (UID: 00000000-00003924) "zoom.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000100000000000ff07000000000000702cce02ff0700000000000000000100feffffff00000000888acb02000000000000000600000000115c000000000000888acb027f0700007f070000115c00007f07000000000000000000007cf4b300506a0d77eea2cb55feffffff18f4b300b7160a77e8020000f00200000c04cb0204f4b3008020d40d0000cb0200000000f002000000000000000000005e000000030000000000cb02e802000008001000000000003cf4b300ee130a7740000000ee130a7708001000000000000000000008000000000000008cf4b300a40c9e740000cb0208001000b50c9e748e84c6e08020d40d0a0000000100000000000000 (UID: 00000000-00003924) "fleetdeck_agent_svc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000005e030900000068a95f030f00000088025e03800000000000000000000000000000000000000000000000b8025e03010000002200000001000000000000000000000000000000000000000000000006000000000000000f0000009e290a7722005f03000000000f000000f8eb5e030000010106000000f8eb5e030000000070a95f0322000022e03c5e03000075000000000020a95f030000000098925f030f0000000f000000000000010f00000060025e0360025e03040000010000000020000000f8f1af00506a0d77dcb3e0d6feffffff50f0af000dfa09770000000070a95f03d8ba5f03b0f0af00fcf0af00 (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002548) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002636) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002636) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acca43fb7f0000000000000000000051edf345fb7f000000000000ce0200000000000000000000aec814ad9a6e00002a00000000000000d0dc646dce0200008fecf345fb7f0000e0acca43fb7f0000e0acca43fb7f0000000000000000000000000000fb7f0000ffffff7fd0d9000000000000000000000000000000000000d8cebe43fb7f00002a0000000000000069c37743fb7f00003100000000000000d003000000000000d403000000000000110001100000000090d21f96d100000003a36443fb7f000090d21f96d100000000000000000000002b00000000000000000000000000000020b07d43fb7f0000b43f7c43fb7f0000e0cebe43 (UID: 00000000-00002636) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000696bce0200000b8ef145fb7f00000000696bce0200000200000000000000380000000000000040000000000000003003696bce02000088e0ec96d100000001000000000000000300000000000000010000000000000016000000000000004011276bce02000000000000000000000000276bce020000382ac46dce020000000000000000000078000000010000000000000000000000800000000000000004000000000000000000000000000000a849c46dce02000004000000000000003800000000000000f0986343fb7f00003800000000000000380000000000000000e2ec96d1000000c00c6b0efb7f000000000000 (UID: 00000000-00002636) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0fd2dfb7f0000070000000000000000000000000000000100000000000000f0df696bce0200000000000000000000d079b46dce0200004c986343fb7f0000e0b0b46dce020000b3ce610efb7f00005080b46dce020000004ffd2dfb7f0000d0b0fd2dfb7f0000000000000000000000000000000000005080b46dce020000f0df696bce0200006095b46dce02000058e2ec96d10000004c986343fb7f0000010000000000000058e2ec96d10000006095b46dce0200005080b46dce020000010000000000000002bc610efb7f00004081b46dce02000080c0b26dce020000feffffff040000007df0fc2dfb7f0000e092b46d (UID: 00000000-00002636) "powershell.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000f0df696bce0200000000000000000000d079b46dce0200004c986343fb7f000060adb46dce020000b3ce610efb7f0000f07fb46dce020000384ffd2dfb7f0000d0b0fd2dfb7f000000000000000000000000000000000000f07fb46dce020000f0df696bce0200006095b46dce02000050e2ec96d10000004c986343fb7f0000010000000000000050e2ec96d10000006095b46dce020000f07fb46dce020000010000000000000002bc610efb7f0000000000000000000080c0b26dce0200004081b46d04000000fefffffffffffffff0df696bce0200007df0fc2dfb7f000000000000 (UID: 00000000-00002636)4a:T5e6,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00002636) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000f8c04142fb7f000000002d2afb7f00000000000000000000000000000000000008062e2afb7f00000001000000000000f0986343fb7f000000010000000000000001000000000000000000000000000000062e2afb7f000001000000000000000f182d2afb7f0000000000000000000000062e2afb7f000009000000 (UID: 00000000-00002636) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000e9010000d0c60f36e901000010c70f36e9010000020000027e77000030070d36 (UID: 00000000-00004540) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000f8c04142fb7f000000002d2afb7f00000000000000000000000000000000000008062e2afb7f00000001000000000000f0986343fb7f000000010000000000000001000000000000000000000000000000062e2afb7f000001000000000000000f182d2afb7f0000000000000000000000062e2afb7f000009000000 (UID: 00000000-00004540)4b:T15bd,"zoom.exe" queries volume information of "C:\zoom.exe" at 00000000-00003924-00000C17-2554575771 "msiexec.exe" queries volume information of an entire harddrive"C:\" at 00000000-00003340-00000C17-2556058932 "msiexec.exe" queries volume information of "C:\share" at 00000000-00003340-00000C17-2557554555 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002636-00000C17-2561563118 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002636-00000C17-2561627369 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002636-00000C17-2562145431 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002636-00000C17-2562809474 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002636-00000C17-2563000044 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002636-00000C17-2563098922 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002636-00000C17-2563702261 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_734_for_KB4074588~31bf3856ad364e35~amd64~~10.0.1.17.cat" at 00000000-00002636-00000C17-2563768398 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll" at 00000000-00002636-00000C17-2563804913 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00002636-00000C17-2563838580 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll" at 00000000-00002636-00000C17-2563838929 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002636-00000C17-2563926831 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.16299.15.cat" at 00000000-00002636-00000C17-2563966074 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002636-00000C17-2564052435 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002636-00000C17-2564174864 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002636-00000C17-2564231797 "powershell.exe" queries volume information of "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll" at 00000000-00002636-00000C17-2564312496 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002636-00000C17-2564454418 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002636-00000C17-2564496678 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002636-00000C17-2564780835 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002636-00000C17-2564821333 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-IIS-WebServer-AddOn-2-ServerCommon-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002636-00000C17-25648802604c:T5e1,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\90E98BB05040666936B20E23F209B10C3CBC4D96"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\97EFF3028677894BDD4F9AC53F789BEE5DF4AD86"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\83DA05A9886F7658BE73ACF0A4930C0F99B92F01"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB")4d:T8195,"zoom.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter msi.dll (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter srpapi.dll (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\TSAPPCMP.DLL (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter Ntdll.dll (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\SHLWAPI.DLL (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\OLE32.DLL (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\KERNEL32.DLL (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter MsiMsg.dll (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\SHELL32.DLL (UID: 00000000-00003924) "zoom.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\NETAPI32.DLL (UID: 00000000-00003924) "fleetdeck_agent_svc.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00002548) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Ibaae5ed9#\e86f7f836a07f673cdef4c9a4d4b4d80\Microsoft.IIS.Powershell.Comm (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Kd58820a5#\00f9e9ff321d8a141f3d71163c70c906\Microsoft.KeyDistributionServ (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDis (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00002636) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\5f64880c86c98e7ddecdf28e61917307\Microsoft.Management.Infrastr (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Ibaae5ed9#\e86f7f836a07f673cdef4c9a4d4b4d80\Microsoft.IIS.Powershell.Comm (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Kd58820a5#\00f9e9ff321d8a141f3d71163c70c906\Microsoft.KeyDistributionServ (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDis (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00004540) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00004540)4e:T17e88,"zoom.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter MsiSetInternalUI (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter MsiLocateComponentA (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter MsiInstallProductA (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter SrpOpenTrackInstall (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter SrpCloseTrackInstall (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter WinSqmIsOptedIn (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter SHGetPropertyStoreForWindow (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter NetGetJoinInformation (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter CoQueryProxyBlanket (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter SHChangeNotify (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003924) "zoom.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00003924) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter EnumProcesses (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter SetTokenInformation (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter CreateEnvironmentBlock (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter DestroyEnvironmentBlock (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter CreateProcessAsUserW (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00002548) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectory (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00002636) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountName (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FormatMessage (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter _create_locale (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter _free_locale (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter _wcstod_l (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObject (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnum (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateAssemblyEnumW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MI_Application_InitializeV1 (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetComputerName (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetComputerNameW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfo (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter TranslateCharsetInfoW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutput (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter ReadConsoleOutputW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutput (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleOutputW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WriteConsole (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess_RetAddr (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter CorExitProcess (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00004540) "powershell.exe" called "GetProcAddress" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00004540)4f:T1124,"SELECT `WixCloseApplication`, `Target`, `Description`, `Condition`, `Attributes`, `Property`, `TerminateExitCode`, `Timeout` FROM `WixCloseApplication` ORDER BY `Sequence`" (Source: zoom.exe, Indicator: "select `wixcloseapplication`, `target`, `description`, `condition`, `attributes`, `property`, `terminateexitcode`, `timeout` from `wixcloseapplication` order by `sequence`") "SELECT `WixRemoveFolderEx`, `Component_`, `Property`, `InstallMode` FROM `WixRemoveFolderEx`" (Source: zoom.exe, Indicator: "select `wixremovefolderex`, `component_`, `property`, `installmode` from `wixremovefolderex`") "SELECT `SecureObjects`.`SecureObject`, `SecureObjects`.`Table`, `SecureObjects`.`Domain`, `SecureObjects`.`User`, `SecureObjects`.`Permission`, `SecureObjects`.`Component_`, `Component`.`Attributes` FROM `SecureObjects`,`Component` WHERE `SecureObjects`.`Component_`=`Component`.`Component`" (Source: zoom.exe, Indicator: "select `secureobjects`.`secureobject`, `secureobjects`.`table`, `secureobjects`.`domain`, `secureobjects`.`user`, `secureobjects`.`permission`, `secureobjects`.`component_`, `component`.`attributes` from `secureobjects`,`component` where `secureobjects`.`component_`=`component`.`component`") "SELECT `Registry`.`Registry`, `Registry`.`Root`, `Registry`.`Key` FROM `Registry` WHERE `Registry`.`Registry`=?" (Source: zoom.exe, Indicator: "select `registry`.`registry`, `registry`.`root`, `registry`.`key` from `registry` where `registry`.`registry`=?") "SELECT `ServiceInstall`.`Name` FROM `ServiceInstall` WHERE `ServiceInstall`.`ServiceInstall`=?" (Source: zoom.exe, Indicator: "select `serviceinstall`.`name` from `serviceinstall` where `serviceinstall`.`serviceinstall`=?") "SELECT `ServiceName`, `Component_`, `NewService`, `FirstFailureActionType`, `SecondFailureActionType`, `ThirdFailureActionType`, `ResetPeriodInDays`, `RestartServiceDelayInSeconds`, `ProgramCommandLine`, `RebootMessage` FROM `ServiceConfig`" (Source: zoom.exe, Indicator: "select `servicename`, `component_`, `newservice`, `firstfailureactiontype`, `secondfailureactiontype`, `thirdfailureactiontype`, `resetperiodindays`, `restartservicedelayinseconds`, `programcommandline`, `rebootmessage` from `serviceconfig`") "SELECT `Data` FROM `Binary` WHERE `Name`='%s'" (Source: zoom.exe, Indicator: "select `data` from `binary` where `name`='%s'") "SELECT `XmlFile`.`XmlFile`, `XmlFile`.`File`, `XmlFile`.`ElementPath`, `XmlFile`.`Name`, `XmlFile`.`Value`, `XmlFile`.`Flags`, `XmlFile`.`Component_`, `Component`.`Attributes` FROM `XmlFile`,`Component` WHERE `XmlFile`.`Component_`=`Component`.`Component` ORDER BY `File`, `Sequence`" (Source: zoom.exe, Indicator: "select `xmlfile`.`xmlfile`, `xmlfile`.`file`, `xmlfile`.`elementpath`, `xmlfile`.`name`, `xmlfile`.`value`, `xmlfile`.`flags`, `xmlfile`.`component_`, `component`.`attributes` from `xmlfile`,`component` where `xmlfile`.`component_`=`component`.`component` order by `file`, `sequence`") "SELECT `XmlConfig`.`XmlConfig`, `XmlConfig`.`File`, `XmlConfig`.`ElementPath`, `XmlConfig`.`VerifyPath`, `XmlConfig`.`Name`, `XmlConfig`.`Value`, `XmlConfig`.`Flags`, `XmlConfig`.`Component_`, `Component`.`Attributes` FROM `XmlConfig`,`Component` WHERE `XmlConfig`.`Component_`=`Component`.`Component` ORDER BY `File`, `Sequence`" (Source: zoom.exe, Indicator: "select `xmlconfig`.`xmlconfig`, `xmlconfig`.`file`, `xmlconfig`.`elementpath`, `xmlconfig`.`verifypath`, `xmlconfig`.`name`, `xmlconfig`.`value`, `xmlconfig`.`flags`, `xmlconfig`.`component_`, `component`.`attributes` from `xmlconfig`,`component` where `xmlconfig`.`component_`=`component`.`component` order by `file`, `sequence`") "SELECT * FROM `%s`" (Source: zoom.exe, Indicator: "select * from `%s`") "SELECT `Component_`, `Directory_`, `Name`, `Target`, `Attributes`, `IconFile`, `IconIndex` FROM `WixInternetShortcut`" (Source: zoom.exe, Indicator: "select `component_`, `directory_`, `name`, `target`, `attributes`, `iconfile`, `iconindex` from `wixinternetshortcut`") "SELECT `WixRestartResource`.`WixRestartResource`, `WixRestartResource`.`Component_`, `WixRestartResource`.`Resource`, `WixRestartResource`.`Attributes` FROM `WixRestartResource`" (Source: zoom.exe, Indicator: "select `wixrestartresource`.`wixrestartresource`, `wixrestartresource`.`component_`, `wixrestartresource`.`resource`, `wixrestartresource`.`attributes` from `wixrestartresource`")50:T5bdb,Found reference to API (Indicator: "WaitForMultipleObjects"; File: "zoom.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "zoom.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "zoom.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "zoom.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "zoom.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "zoom.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "zoom.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "zoom.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "zoom.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "zoom.exe") Found reference to API (Indicator: "CreateFileA"; File: "zoom.exe") Found reference to API (Indicator: "GetProcAddress"; File: "zoom.exe") Found reference to API (Indicator: "CreateThread"; File: "zoom.exe") Found reference to API (Indicator: "SetErrorMode"; File: "zoom.exe") Found reference to API (Indicator: "WriteFile"; File: "zoom.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "zoom.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "zoom.exe") Found reference to API (Indicator: "SetThreadContext"; File: "zoom.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "zoom.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "zoom.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "zoom.exe") Found reference to API (Indicator: "SetEvent"; File: "zoom.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "zoom.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "zoom.exe") Found reference to API (Indicator: "ExitProcess"; File: "zoom.exe") Found reference to API (Indicator: "CreateEventA"; File: "zoom.exe") Found reference to API (Indicator: "CloseHandle"; File: "zoom.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "zoom.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "zoom.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "zoom.exe") Found reference to API (Indicator: "VirtualFree"; File: "zoom.exe") Found reference to API (Indicator: "GetThreadContext"; File: "zoom.exe") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "zoom.exe") Found reference to API (Indicator: "GetStdHandle"; File: "zoom.exe") Found reference to API (Indicator: "ResumeThread"; File: "zoom.exe") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "zoom.exe") Found reference to API (Indicator: "VirtualQuery"; File: "zoom.exe") Found reference to API (Indicator: "SwitchToThread"; File: "zoom.exe") Found reference to API (Indicator: "SuspendThread"; File: "zoom.exe") Found reference to API (Indicator: "WSAIoctl"; File: "zoom.exe") Found reference to API (Indicator: "GetFileType"; File: "zoom.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "zoom.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "zoom.exe") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "zoom.exe") Found reference to API (Indicator: "SeDebugPrivilege"; File: "zoom.exe") Found reference to API (Indicator: "IsWow64Process"; File: "zoom.exe") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "zoom.exe") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; File: "zoom.exe") Found reference to API (Indicator: "FlsAlloc"; File: "zoom.exe") Found reference to API (Indicator: "FlsFree"; File: "zoom.exe") Found reference to API (Indicator: "FlsGetValue"; File: "zoom.exe") Found reference to API (Indicator: "FlsSetValue"; File: "zoom.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "zoom.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "zoom.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "zoom.exe") Found reference to API (Indicator: "LookupAccountSidW"; File: "zoom.exe") Found reference to API (Indicator: "GetSecurityDescriptorControl"; File: "zoom.exe") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; File: "zoom.exe") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "zoom.exe") Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptorW"; File: "zoom.exe") Found reference to API (Indicator: "SetEntriesInAclW"; File: "zoom.exe") Found reference to API (Indicator: "GetNamedSecurityInfoW"; File: "zoom.exe") Found reference to API (Indicator: "SetNamedSecurityInfoW"; File: "zoom.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "zoom.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "zoom.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "zoom.exe") Found reference to API (Indicator: "CloseServiceHandle"; File: "zoom.exe") Found reference to API (Indicator: "OpenSCManagerW"; File: "zoom.exe") Found reference to API (Indicator: "OpenServiceW"; File: "zoom.exe") Found reference to API (Indicator: "RegCloseKey"; File: "zoom.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "zoom.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "zoom.exe") Found reference to API (Indicator: "CreateWellKnownSid"; File: "zoom.exe") Found reference to API (Indicator: "LookupAccountNameW"; File: "zoom.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "zoom.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "zoom.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "zoom.exe") Found reference to API (Indicator: "RegEnumKeyExW"; File: "zoom.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "zoom.exe") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "zoom.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "zoom.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "zoom.exe") Found reference to API (Indicator: "EnumWindows"; File: "zoom.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "zoom.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "zoom.exe") Found reference to API (Indicator: "TranslateMessage"; File: "zoom.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "zoom.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "zoom.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "zoom.exe") Found reference to API (Indicator: "RegisterClassW"; File: "zoom.exe") Found reference to API (Indicator: "UnregisterClassW"; File: "zoom.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "zoom.exe") Found reference to API (Indicator: "IsWindow"; File: "zoom.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "zoom.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "zoom.exe") Found reference to API (Indicator: "CoInitialize"; File: "zoom.exe") Found reference to API (Indicator: "CoUninitialize"; File: "zoom.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "zoom.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "zoom.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "zoom.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "zoom.exe") Found reference to API (Indicator: "OpenProcess"; File: "zoom.exe") Found reference to API (Indicator: "TerminateProcess"; File: "zoom.exe") Found reference to API (Indicator: "GetLastError"; File: "zoom.exe") Found reference to API (Indicator: "SetLastError"; File: "zoom.exe") Found reference to API (Indicator: "FreeLibrary"; File: "zoom.exe") Found reference to API (Indicator: "LocalFree"; File: "zoom.exe") Found reference to API (Indicator: "GetVersionExW"; File: "zoom.exe") Found reference to API (Indicator: "FindClose"; File: "zoom.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "zoom.exe") Found reference to API (Indicator: "FindNextFileW"; File: "zoom.exe") Found reference to API (Indicator: "lstrcmpW"; File: "zoom.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "zoom.exe") Found reference to API (Indicator: "FormatMessageW"; File: "zoom.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "zoom.exe") Found reference to API (Indicator: "GetTempPathW"; File: "zoom.exe") Found reference to API (Indicator: "CreateFileW"; File: "zoom.exe") Found reference to API (Indicator: "CreateEventW"; File: "zoom.exe") Found reference to API (Indicator: "Sleep"; File: "zoom.exe") Found reference to API (Indicator: "lstrlenW"; File: "zoom.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "zoom.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "zoom.exe") Found reference to API (Indicator: "LCMapStringW"; File: "zoom.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "zoom.exe") Found reference to API (Indicator: "SetFilePointer"; File: "zoom.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "zoom.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "zoom.exe") Found reference to API (Indicator: "HeapAlloc"; File: "zoom.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "zoom.exe") Found reference to API (Indicator: "HeapFree"; File: "zoom.exe") Found reference to API (Indicator: "HeapSize"; File: "zoom.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "zoom.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "zoom.exe") Found reference to API (Indicator: "CreatePipe"; File: "zoom.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "zoom.exe") Found reference to API (Indicator: "CreateProcessW"; File: "zoom.exe") Found reference to API (Indicator: "GetPriorityClass"; File: "zoom.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "zoom.exe") Found reference to API (Indicator: "Process32FirstW"; File: "zoom.exe") Found reference to API (Indicator: "Process32NextW"; File: "zoom.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "zoom.exe") Found reference to API (Indicator: "GlobalFree"; File: "zoom.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "zoom.exe") Found reference to API (Indicator: "ReadFile"; File: "zoom.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "zoom.exe") Found reference to API (Indicator: "GetFileTime"; File: "zoom.exe") Found reference to API (Indicator: "SetFileTime"; File: "zoom.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "zoom.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "zoom.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "zoom.exe") Found reference to API (Indicator: "DeleteFileW"; File: "zoom.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "zoom.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "zoom.exe") Found reference to API (Indicator: "GetProcessTimes"; File: "zoom.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "zoom.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "zoom.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "zoom.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "zoom.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "zoom.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "zoom.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "zoom.exe") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "zoom.exe") Found reference to API (Indicator: "GlobalAddAtomW"; File: "zoom.exe") Found reference to API (Indicator: "GlobalFindAtomW"; File: "zoom.exe") Found reference to API (Indicator: "GetTickCount"; File: "zoom.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "zoom.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "zoom.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "zoom.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "zoom.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "zoom.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "zoom.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "zoom.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "zoom.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "zoom.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "zoom.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "zoom.exe") Found reference to API (Indicator: "RtlUnwind"; File: "zoom.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "zoom.exe") Found reference to API (Indicator: "TlsAlloc"; File: "zoom.exe") Found reference to API (Indicator: "TlsGetValue"; File: "zoom.exe") Found reference to API (Indicator: "TlsSetValue"; File: "zoom.exe") Found reference to API (Indicator: "TlsFree"; File: "zoom.exe") Found reference to API (Indicator: "RaiseException"; File: "zoom.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "zoom.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "zoom.exe") Found reference to API (Indicator: "GetACP"; File: "zoom.exe") Found reference to API (Indicator: "FindFirstFileExA"; File: "zoom.exe") Found reference to API (Indicator: "FindNextFileA"; File: "zoom.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "zoom.exe") Found reference to API (Indicator: "GetOEMCP"; File: "zoom.exe") Found reference to API (Indicator: "GetCPInfo"; File: "zoom.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "zoom.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "zoom.exe") Found reference to API (Indicator: "SetStdHandle"; File: "zoom.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "zoom.exe") Found reference to API (Indicator: "DecodePointer"; File: "zoom.exe") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00002548.00000000.228697.035E0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp")51:Tbb9,"uSoftware\Policies\Microsoft\Windows\Installer" in Source: zoom.exe "Software\Policies\Microsoft\Windows\Installer" in Source: zoom.exe "STRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002548.00000001.230295.035E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp "1\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{000C101C-0000-0000-C000-000000000046}" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\AppID\powershell.exe" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002636.00000000.228765.6D640000.00000004.mdmp 00000000-00002636.00000001.229385.6D640000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp "REGISTRY\MACHINE\Software\WOW6432NodeP" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp "REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp "REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000," in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp52:T8c4,Process zoom.exe created mutex with name "\BaseNamedObjects\_MSIExecute" Process zoom.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3924:168:WilStaging_02" Process zoom.exe created mutex with name "Local\SM0:3924:168:WilStaging_02" Process zoom.exe created mutex with name "SM0:3924:168:WilStaging_02" Process zoom.exe created mutex with name "SM0:3924:64:WilError_01" Process zoom.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3924:168:WilStaging_02" Process zoom.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3924:64:WilError_01" Process msiexec.exe created mutex with name "\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process msiexec.exe created mutex with name "\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process msiexec.exe created mutex with name "\BaseNamedObjects\Local\SM0:3340:304:WilStaging_02" Process msiexec.exe created mutex with name "\BaseNamedObjects\SM0:3340:120:WilError_01" Process msiexec.exe created mutex with name "\BaseNamedObjects\SM0:3340:304:WilStaging_02" Process MsiExec.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2128:168:WilStaging_02" Process MsiExec.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2128:168:WilStaging_02" Process MsiExec.exe created mutex with name "Local\SM0:2128:168:WilStaging_02" Process MsiExec.exe created mutex with name "SM0:2128:168:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "SM0:2636:304:WilStaging_02" Process powershell.exe created mutex with name "Local\ZonesCacheCounterMutex" Process powershell.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2636:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4540:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:4540:304:WilStaging_02"53:T1271,"zoom.exe" failed to load missing module "%WINDIR%\SysWOW64\TSAPPCMP.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\urlmon.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:c0000135]54:T30c6,"STRY\USER\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002548.00000001.230295.035E0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp "1\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{000C101C-0000-0000-C000-000000000046}" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\AppID\powershell.exe" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002636.00000000.228765.6D640000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp "REGISTRY\MACHINE\Software\WOW6432NodeP" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp "Y\MACHINE\SOFTWARE\Classes\AppID\powershell.exe" in Source: 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002636.00000001.229385.6D640000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp "REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000046}" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp "REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000," in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp "REGISTRY\MACHINE\Software\WOW6432NodeP" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003924.00000000.228373.02CB0000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\zoom.exe" in Source: 00000000-00003924.00000000.228373.02CB0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{752073A1-23F2-4396" in Source: 00000000-00003924.00000000.228373.02CB0000.00000004.mdmp " is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time ZonesUnexpected return value from MsiLocateComponent: %v. %vcasfrom_Gscanstatus:top gp->status is not in scan stategentraceback callback cannot be used with non-zero skipmheap.freeSpanLocked - invalid free of user arena chunkos: invalid use of WriteAt on file opened with O_APPENDreflect: internal error: invalid use of makeMethodValuefailed to allocate aligned heap memory; too many retriesin gcMark expecting to see gcphase as _GCmarkterminationnon-empty pointer map passed for non-pointer-size valuesprofilealloc called without a P or outside bootstrappingptrEncoder.encode should have emptied ptrSeen via defersstrings: illegal use of non-zero Builder copied by valuegentraceback cannot trace user goroutine on its own stackruntime: checkmarks found unexpected unmarked object obj=sync: WaitGroup misuse: Add called concurrently with Waitjson: cannot set embedded pointer to unexported struct: %vError when querying for previously installed deployment: %vreflect: reflect.Value.Elem on an invalid notinheap pointersync: WaitGroup is reused before previous Wait has returnedaddr range base and limit are not in the same memory segmentmanual span allocation called with non-manually-managed typereflect: call of reflect.Value.Len on ptr to non-array Valueruntime: GetQueuedCompletionStatusEx returned invalid mode= runtime: netpoll: PostQueuedCompletionStatus failed (errno= abiRegArgsType needs GC Prog, update methodValueCallFrameObjsfound bad pointer in Go heap (incorrect use of unsafe or cgo?)limiterEvent.stop: found wrong event in p's limiter event slotreflect: reflect.Value.Pointer on an invalid notinheap pointerruntime: internal error: misuse of lockOSThread/unlockOSThreadmalformed GOMEMLIMIT; see `go doc runtime/debug.SetMemoryLimit`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_Duplicate deployment ID found with ID: %v, skipping installationcompileCallback: expected function with one uintptr-sized resultjson: invalid number literal, trying to unmarshal %q into Numberruntime.SetFinalizer: first argument was allocated into an arenaruntime.SetFinalizer: pointer not at beginning of allocated blockuser arena chunk size is not a mutliple of the physical page sizereflect: reflect.Value.UnsafePointer on an invalid notinheap pointerbytes.Buffer: UnreadByte: previous operation was not a successful readjson: invalid use of ,string struct tag, trying to unmarshal %q into %vtoo many concurrent operations on a single file or socket (max 1048575)MapIter.Next called on an iterator that does not have an associated map Valuecannot convert slice with length %y to array or pointer to array with length %xQueryPerformanceFrequency syscall returned zero, running on unsupported hardwarejson: invalid use of ,string struct tag, trying to unmarshal unquoted value into %vreflect.Value.Interface: cannot return value obtained from unexported field or methodQueryPerformanceFrequency overflow 32 bit divider, check nosplit discussion to proceedreflect: New of type that may not be allocated in heap (possibly undefined cgo C type)An Agent is already installed from a different Deployment" in Source: 00000000-00003924.00000001.230292.003F7000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003924.00000001.230292.02CB0000.00000004.mdmp "Registry\Machine\Software\Classes\AppID\zoom.exe" in Source: 00000000-00003924.00000001.230292.02CB0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{752073A1-23F2-4396" in Source: 00000000-00003924.00000001.230292.02CB0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003924.00000002.230420.02CB0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00004540.00000000.229712.0E668000.00000002.mdmp "HKLM\" in Source: 00000000-00004540.00000000.229712.0E668000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00004540.00000000.229712.0E668000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004540.00000000.229712.0E668000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00004540.00000000.229712.0E668000.00000002.mdmp "E\Software\M" in Source: 00000000-00004540.00000000.229712.360D0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004540.00000000.229712.360D0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000C101C-0000-0000-C000-000000000046}" in Source: 00000000-00004540.00000000.229712.360D0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004540.00000000.229712.360D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004540.00000000.229712.505E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004540.00000000.229712.50C29000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00004540.00000000.229712.50C29000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004540.00000000.229712.50C29000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00004540.00000000.229712.50C29000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432NodeP" in Source: 00000000-00004540.00000000.229712.50C29000.00000004.mdmp "E\Software\M" in Source: 00000000-00004540.00000001.230288.360D0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00004540.00000001.230288.360D0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\W\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{000C101C-0000-0000-C000-000000000046}" in Source: 00000000-00004540.00000001.230288.360D0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00004540.00000001.230288.360D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00004540.00000001.230288.505E0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00004540.00000001.230288.50C29000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00004540.00000001.230288.50C72000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432Node" in Source: 00000000-00004540.00000001.230288.50C72000.00000004.mdmp "\REGISTRY\MACHINE\Software\WOW6432NodeP" in Source: 00000000-00004540.00000001.230288.50C72000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004540.00000001.230288.50CD3000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}" in Source: 00000000-00004540.00000001.230288.50DBA000.00000004.mdmp "REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}" in Source: 00000000-00004540.00000001.230288.50DBA000.00000004.mdmp55:Td17," is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time ZonesUnexpected return value from MsiLocateComponent: %v. %vcasfrom_Gscanstatus:top gp->status is not in scan stategentraceback callback cannot be used with non-zero skipmheap.freeSpanLocked - invalid free of user arena chunkos: invalid use of WriteAt on file opened with O_APPENDreflect: internal error: invalid use of makeMethodValuefailed to allocate aligned heap memory; too many retriesin gcMark expecting to see gcphase as _GCmarkterminationnon-empty pointer map passed for non-pointer-size valuesprofilealloc called without a P or outside bootstrappingptrEncoder.encode should have emptied ptrSeen via defersstrings: illegal use of non-zero Builder copied by valuegentraceback cannot trace user goroutine on its own stackruntime: checkmarks found unexpected unmarked object obj=sync: WaitGroup misuse: Add called concurrently with Waitjson: cannot set embedded pointer to unexported struct: %vError when querying for previously installed deployment: %vreflect: reflect.Value.Elem on an invalid notinheap pointersync: WaitGroup is reused before previous Wait has returnedaddr range base and limit are not in the same memory segmentmanual span allocation called with non-manually-managed typereflect: call of reflect.Value.Len on ptr to non-array Valueruntime: GetQueuedCompletionStatusEx returned invalid mode= runtime: netpoll: PostQueuedCompletionStatus failed (errno= abiRegArgsType needs GC Prog, update methodValueCallFrameObjsfound bad pointer in Go heap (incorrect use of unsafe or cgo?)limiterEvent.stop: found wrong event in p's limiter event slotreflect: reflect.Value.Pointer on an invalid notinheap pointerruntime: internal error: misuse of lockOSThread/unlockOSThreadmalformed GOMEMLIMIT; see `go doc runtime/debug.SetMemoryLimit`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_Duplicate deployment ID found with ID: %v, skipping installationcompileCallback: expected function with one uintptr-sized resultjson: invalid number literal, trying to unmarshal %q into Numberruntime.SetFinalizer: first argument was allocated into an arenaruntime.SetFinalizer: pointer not at beginning of allocated blockuser arena chunk size is not a mutliple of the physical page sizereflect: reflect.Value.UnsafePointer on an invalid notinheap pointerbytes.Buffer: UnreadByte: previous operation was not a successful readjson: invalid use of ,string struct tag, trying to unmarshal %q into %vtoo many concurrent operations on a single file or socket (max 1048575)MapIter.Next called on an iterator that does not have an associated map Valuecannot convert slice with length %y to array or pointer to array with length %xQueryPerformanceFrequency syscall returned zero, running on unsupported hardwarejson: invalid use of ,string struct tag, trying to unmarshal unquoted value into %vreflect.Value.Interface: cannot return value obtained from unexported field or methodQueryPerformanceFrequency overflow 32 bit divider, check nosplit discussion to proceedreflect: New of type that may not be allocated in heap (possibly undefined cgo C type)An Agent is already installed from a different Deployment" in Source: 00000000-00003924.00000001.230292.003F7000.00000002.mdmp56:Td17," is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time ZonesUnexpected return value from MsiLocateComponent: %v. %vcasfrom_Gscanstatus:top gp->status is not in scan stategentraceback callback cannot be used with non-zero skipmheap.freeSpanLocked - invalid free of user arena chunkos: invalid use of WriteAt on file opened with O_APPENDreflect: internal error: invalid use of makeMethodValuefailed to allocate aligned heap memory; too many retriesin gcMark expecting to see gcphase as _GCmarkterminationnon-empty pointer map passed for non-pointer-size valuesprofilealloc called without a P or outside bootstrappingptrEncoder.encode should have emptied ptrSeen via defersstrings: illegal use of non-zero Builder copied by valuegentraceback cannot trace user goroutine on its own stackruntime: checkmarks found unexpected unmarked object obj=sync: WaitGroup misuse: Add called concurrently with Waitjson: cannot set embedded pointer to unexported struct: %vError when querying for previously installed deployment: %vreflect: reflect.Value.Elem on an invalid notinheap pointersync: WaitGroup is reused before previous Wait has returnedaddr range base and limit are not in the same memory segmentmanual span allocation called with non-manually-managed typereflect: call of reflect.Value.Len on ptr to non-array Valueruntime: GetQueuedCompletionStatusEx returned invalid mode= runtime: netpoll: PostQueuedCompletionStatus failed (errno= abiRegArgsType needs GC Prog, update methodValueCallFrameObjsfound bad pointer in Go heap (incorrect use of unsafe or cgo?)limiterEvent.stop: found wrong event in p's limiter event slotreflect: reflect.Value.Pointer on an invalid notinheap pointerruntime: internal error: misuse of lockOSThread/unlockOSThreadmalformed GOMEMLIMIT; see `go doc runtime/debug.SetMemoryLimit`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_Duplicate deployment ID found with ID: %v, skipping installationcompileCallback: expected function with one uintptr-sized resultjson: invalid number literal, trying to unmarshal %q into Numberruntime.SetFinalizer: first argument was allocated into an arenaruntime.SetFinalizer: pointer not at beginning of allocated blockuser arena chunk size is not a mutliple of the physical page sizereflect: reflect.Value.UnsafePointer on an invalid notinheap pointerbytes.Buffer: UnreadByte: previous operation was not a successful readjson: invalid use of ,string struct tag, trying to unmarshal %q into %vtoo many concurrent operations on a single file or socket (max 1048575)MapIter.Next called on an iterator that does not have an associated map Valuecannot convert slice with length %y to array or pointer to array with length %xQueryPerformanceFrequency syscall returned zero, running on unsupported hardwarejson: invalid use of ,string struct tag, trying to unmarshal unquoted value into %vreflect.Value.Interface: cannot return value obtained from unexported field or methodQueryPerformanceFrequency overflow 32 bit divider, check nosplit discussion to proceedreflect: New of type that may not be allocated in heap (possibly undefined cgo C type)An Agent is already installed from a different Deployment" in Source: 00000000-00003924.00000001.230292.003F7000.00000002.mdmp57:T96b,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsp.sectigo.com" Response ==> HTTP/1.1 200 OK Date: Thu 24 Sep 2026 04:00:33 GMT Content-Type: application/ocsp-response Content-Length: 765 Connection: keep-alive CF-Ray: a3fee1fec937405d-SJC CF-Cache-Status: HIT Accept-Ranges: bytes Age: 1066 Cache-Control: max-age=445392 s-maxage=1800 public no-transform must-revalidate ETag: "b99d5bb5088549867eecadc8ae7707db3a8878db" Expires: Tue 29 Sep 2026 06:56:27 GMT Last-Modified: Tue 22 Sep 2026 06:56:28 GMT Server: cloudflare X-CCACDN-Proxy-ID: scdpinlb6 X-Frame-Options: SAMEORIGIN set-cookie: __cf_bm=OX8akekXItYav31iOkQydObTIBqvAgXk0oWclNhEcvA-1790222433.081204-1.0.1.1-tAPRuM_kBgqEth0IyK1hXwHDOsRWfEVODXLO0zAoNLIgWFO.KKdQThs6BCCiP8GWK.h.HtkJibHANi10aemKMinGNonzPb6zFT2NbDvNEOxQGxOduaLymxkzy6Iwgh3I; HttpOnly; Path=/; Domain=ocsp.sectigo.com; Expires=Thu 24 Sep 2026 04:30:33 GMT with response body ==>30C28202C3B90A0100C2A0C28202C3B230C28202C3AE06092B060105050730010104C28202C39F30C28202C39B30C281C384C2A216041432C3ABC292C29AC3BF....... "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsp.sectigo.com" Response ==> HTTP/1.1 200 OK Date: Thu 24 Sep 2026 04:00:33 GMT Content-Type: application/ocsp-response Content-Length: 638 Connection: keep-alive CF-Ray: a3fee1ff5a34405d-SJC CF-Cache-Status: HIT Accept-Ranges: bytes Age: 1096 Cache-Control: max-age=526778 s-maxage=1800 public no-transform must-revalidate ETag: "b8daeafeadf6ce149692bc239ce5f1f64cc391b5" Expires: Wed 30 Sep 2026 05:53:33 GMT Last-Modified: Wed 23 Sep 2026 05:53:34 GMT Server: cloudflare X-CCACDN-Proxy-ID: scdpinlb6 X-Frame-Options: SAMEORIGIN set-cookie: __cf_bm=yilWTiY2TcnDfpxWYUHNDGdkoD8b7RfQLZ3Bnpt65j4-1790222433.1794693-1.0.1.1-.smLFo0m7z_h11S459QUAG_mHbNjEIYYO4BVi1zLPbsyj9Uc9a3RijSWVO2ld0mH3uh25uBq6UH_xode3mI8TlONJ5nWKk5nQjdfvyog51q3zGuRq.igPCO5YlmalVVt; HttpOnly; Path=/; Domain=ocsp.sectigo.com; Expires=Thu 24 Sep 2026 04:30:33 GMT with response body ==>30C282027A0A0100C2A0C282027330C282026F06092B060105050730010104C282026030C282025C30C281C385C2A2160414C28132C292412B28C38D46C388C3.......58:T334f,"zoom.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73860000 "zoom.exe" loaded module "KERNEL32.DLL" at base 73b40000 "zoom.exe" loaded module "ADVAPI32.DLL" at base 73c40000 "zoom.exe" loaded module "NTDLL.DLL" at base 77060000 "zoom.exe" loaded module "WINMM.DLL" at base 73810000 "zoom.exe" loaded module "WS2_32.DLL" at base 75750000 "zoom.exe" loaded module "POWRPROF.DLL" at base 75670000 "zoom.exe" loaded module "MSI.DLL" at base 733f0000 "zoom.exe" loaded module "COMCTL32.DLL" at base 731b0000 "zoom.exe" loaded module "SRPAPI.DLL" at base 73180000 "zoom.exe" loaded module "%WINDIR%\SYSWOW64\SHLWAPI.DLL" at base 752a0000 "zoom.exe" loaded module "%WINDIR%\SYSWOW64\OLE32.DLL" at base 74600000 "zoom.exe" loaded module "COMCTL32" at base 731b0000 "zoom.exe" loaded module "%WINDIR%\SYSWOW64\KERNEL32.DLL" at base 73b40000 "zoom.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73100000 "zoom.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75120000 "zoom.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75d10000 "zoom.exe" loaded module "SHELL32.DLL" at base 75d10000 "zoom.exe" loaded module "%WINDIR%\SYSWOW64\NETAPI32.DLL" at base 72f30000 "zoom.exe" loaded module "RPCRT4.DLL" at base 752f0000 "zoom.exe" loaded module "%WINDIR%\SYSWOW64\MSI.DLL" at base 733f0000 "fleetdeck_agent_svc.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73860000 "fleetdeck_agent_svc.exe" loaded module "KERNEL32.DLL" at base 73b40000 "fleetdeck_agent_svc.exe" loaded module "ADVAPI32.DLL" at base 73c40000 "fleetdeck_agent_svc.exe" loaded module "NTDLL.DLL" at base 77060000 "fleetdeck_agent_svc.exe" loaded module "WINMM.DLL" at base 73810000 "fleetdeck_agent_svc.exe" loaded module "WS2_32.DLL" at base 75750000 "fleetdeck_agent_svc.exe" loaded module "POWRPROF.DLL" at base 75670000 "fleetdeck_agent_svc.exe" loaded module "PSAPI.DLL" at base 77050000 "fleetdeck_agent_svc.exe" loaded module "USERENV.DLL" at base 72b50000 "fleetdeck_agent_svc.exe" loaded module "RPCRT4.DLL" at base 752f0000 "fleetdeck_agent_svc.exe" loaded module "SSPICLI.DLL" at base 73a80000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffb22e00000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffb458e0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffb455a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffb424c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffb424c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffb424c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffb20e60000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffb45650000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffb42260000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffb3a860000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffb14bd0000 "powershell.exe" loaded module "USER32.DLL" at base 7ffb433c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffb424c0000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffb29170000 "powershell.exe" loaded module "NTDLL" at base 7ffb45ef0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffb459a0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffb457c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffb135d0000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffb45cb0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffb459a0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffb43550000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffb12960000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffb11ee0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffb1eb70000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffb416e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffb42a40000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffb0fe70000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffb459a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffb459a0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffb45ef0000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffb44ed0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffb436c0000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffb42ac0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffb42ac0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffb422f0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffb2ec30000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffb3a860000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffb2dfc0000 "powershell.exe" loaded module "KERNEL32" at base 7ffb458e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\H7TQ1KDF.DLL" at base 7ffb266d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffb1ead0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffb1c980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffb1c810000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffb0f5c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffb238f0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffb0ec50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffb0e8e0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffb422f0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffb424c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffb1e980000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffb1c7a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffb0e7a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffb0e6c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffb1c750000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffb39360000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffb42140000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffb412a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffb40880000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffb0e5e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffb458e0000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffb42170000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffb455a0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffb459a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7ffb33ad0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7ffb2a2d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\APPXSIP.DLL" at base 7ffb290b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 7ffb2e8a0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7ffb337a0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 7ffb337a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.M870D558A#\5F64880C86C98E7DDECDF28E61917307\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL" at base 7ffb0e2e0000 "powershell.exe" loaded module "URLMON.DLL" at base 7ffb38530000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffb424c0000 "powershell.exe" loaded module "MSISO.DLL" at base 7ffb290f0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 7ffb0e220000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffb0d510000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffb29760000 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffb41da0000 "powershell.exe" loaded module "OLEAUT32" at base 7ffb43550000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffb0d2d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.IBAAE5ED9#\E86F7F836A07F673CDEF4C9A4D4B4D80\MICROSOFT.IIS.POWERSHELL.COMMANDS.NI.DLL" at base 7ffb0d260000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.KD58820A5#\00F9E9FF321D8A141F3D71163C70C906\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.NI.DLL" at base 7ffb225a0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.DLL" at base 7ffb2a180000 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 7ffb424c0000 "powershell.exe" loaded module "MSVCRT.DLL" at base 7ffb43620000 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 7ffb2e5a0000 "powershell.exe" loaded module "MI.DLL" at base 7ffb38d20000 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 7ffb424c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WMIDCOM.DLL" at base 7ffb38c50000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffb45080000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffb424c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffb37b60000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffb374d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffb424c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffb424c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffb36cd0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffb36e30000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 7ffb458e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 7ffb424c0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffb0f500000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffb0f190000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffb0e8e000059:T6dd,"zoom.exe" touched "Msi install server" (Path: "HKCU\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}") "zoom.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{000C103E-0000-0000-C000-000000000046}\TREATAS") "zoom.exe" touched "Window Property Store" (Path: "HKCU\WOW6432NODE\CLSID\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\INSTANCE") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\PROGID") "powershell.exe" touched "WBEM Locator" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "powershell.exe" touched "WbemDefaultPathParser" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")5a:T646,Process "msiexec.exe" (UID: 00000000-00003340) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "msiexec.exe" (UID: 00000000-00003340) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE" Process "MsiExec.exe" (UID: 00000000-00002128) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LOGONSERVER="\\DESKTOP-FVVF82A", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\K0dlOnu", HOMEDRIVE="C:"" Process "MsiExec.exe" (UID: 00000000-00002128) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP" Process "powershell.exe" (UID: 00000000-00002636) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles" Process "powershell.exe" (UID: 00000000-00002636) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE" Process "MsiExec.exe" (UID: 00000000-00001128) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LOGONSERVER="\\DESKTOP-FVVF82A", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\K0dlOnu", HOMEDRIVE="C:"" Process "MsiExec.exe" (UID: 00000000-00001128) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles"5b:T59b,"zoom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "zoom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "zoom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "zoom.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "fleetdeck_agent_svc.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\🌎🌏🌍"; Key: "CURRENCIES") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\🌎🌏🌍"; Key: "NLS CURRENCY DATA") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\🌎🌏🌍"; Key: "CLOCK") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SCURRENCYOVERRIDE") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")5c:Teca,Observed system executable string:"%WINDIR%\SysWOW64\TSAPPCMP.DLL" [Source: 00000000-00003924-00000C2B-2554772498] Observed system executable string:"%WINDIR%\SysWOW64\SHLWAPI.DLL" [Source: 00000000-00003924-00000C2B-2554810288] Observed system executable string:"%WINDIR%\SysWOW64\OLE32.DLL" [Source: 00000000-00003924-00000C2B-2554834474] Observed system executable string:"%WINDIR%\SysWOW64\KERNEL32.DLL" [Source: 00000000-00003924-00000C2B-2554891604] Observed system executable string:"%WINDIR%\SysWOW64\SHELL32.DLL" [Source: 00000000-00003924-00000C2B-2554977223] Observed system executable string:"%WINDIR%\SysWOW64\NETAPI32.DLL" [Source: 00000000-00003924-00000C2B-2555059974] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00002636-00000C2E-148157806] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00002636-00000C2B-2560147357] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00002636-00000C2B-2560192197] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002636-00000C2B-2560230270] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00002636-00000C2B-2560345713] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00002636-00000C2B-2560360812] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00002636-00000C2B-2560383228] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00002636-00000C2B-2560406561] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00002636-00000C2B-2560449582] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00002636-00000C2B-2560476167] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00002636-00000C2B-2560521831] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00002636-00000C2B-2560604824] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00002636-00000C2B-2560657575] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002636-00000C2B-2560760019] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002636-00000C2B-2560760925] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00002636-00000C2B-2560926002] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00002636-00000C2B-2560990739] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00002636-00000C2B-2561228266] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00002636-00000C2B-2561239361]5d:T40a,"zoom.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\4041571202.msi" "zoom.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\FleetDeck\FleetDeck Agent Installer.log" "fleetdeck_agent_svc.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\FleetDeck\FleetDeck Agent Service.log" "powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_iphrlbb4.qj1.ps1" "powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_32nsukb0.yfm.psm1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_iphrlbb4.qj1.ps1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_32nsukb0.yfm.psm1" "powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_iscuh4ak.jwc.ps1" "powershell.exe" writes to a file "C:\Windows\Temp\__PSScriptPolicyTest_2ahizkk2.qnc.psm1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_iscuh4ak.jwc.ps1" "powershell.exe" writes to a file "%WINDIR%\Temp\__PSScriptPolicyTest_2ahizkk2.qnc.psm1"5e:T4fa,file/memory contains long string with (Indicator: "New-NetFirewallRule"; File: "powershell.exe") file/memory contains long string with (Indicator: "New-NetFirewallRule"; Source: "00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp") Found string "New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\Program Files (x86)\FleetDeck Agent\fleetdeck_agent_svc.exe' -Action Allow" (Indicator: "New-NetFirewallRule"; Source: "00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000000.228765.6B690000.00000004.mdmp, 00000000-00002636.00000000.228765.6CD30000.00000004.mdmp, 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B690000.00000004.mdmp, 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6DD14000.00000004.mdmp") Found string "New-NetFirewallRule" (Indicator: "New-NetFirewallRule"; Source: "00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp, 00000000-00002636.00000001.229385.6DF90000.00000004.mdmp")5f:T535,"4041571202.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 MSI Installer Code page: 1252 Title: Installation Database Subject: FleetDeck Agent Author: FleetDeck Inc Keywords: Installer Comments: This installer database contains the logic and data required to install FleetDeck Agent. Template: Intel;1033 Revision Number: {A81C6934-4041-46E1-A95E-99E3002E9BF2} Create Time/Date: Mon Feb 23 00:39:28 2026 Last Saved Time/Date: Mon Feb 23 00:39:28 2026 Number of Pages: 500 Number of Words: 2 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 2"- Location: [%TEMP%\4041571202.msi]- [targetUID: 00000000-00003924] "StartupProfileData-NonInteractive" has type "data"- Location: [%WINDIR%\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002636] "FleetDeck Agent Service.log" has type "ASCII text"- Location: [%TEMP%\FleetDeck\FleetDeck Agent Service.log]- [targetUID: 00000000-00002548] "FleetDeck Agent Installer.log" has type "ASCII text"- Location: [%TEMP%\FleetDeck\FleetDeck Agent Installer.log]- [targetUID: 00000000-00003924] "deployment.json" has type "JSON text data"- Location: [%PROGRAMFILES%\(x86)\FleetDeck Agent\deployment.json]- [targetUID: 00000000-00002548]60:T6c4,"zoom.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "zoom.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "zoom.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "zoom.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ZOOM.EXE"; Key: ""; Value: "") "zoom.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "zoom.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "zoom.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: ""; Value: "") "zoom.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}"; Key: ""; Value: "") "zoom.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}"; Key: ""; Value: "") "zoom.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}\TREATAS"; Key: ""; Value: "") "zoom.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}\TREATAS"; Key: ""; Value: "") "zoom.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}\INPROCSERVER32"; Key: ""; Value: "") "zoom.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}\INPROCSERVER32"; Key: ""; Value: "") "zoom.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}\INPROCHANDLER32"; Key: ""; Value: "")61:Tb98,"zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXIMUMALLOWEDALLOCATIONSIZE"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3"; Key: "COM+ENABLED"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}"; Key: ""; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXSXSHASHCOUNT"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODELUNLOCK"; Key: "ALLOWDEVELOPMENTWITHOUTDEVLICENSE"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\APPCOMPAT"; Key: "RAISEDEFAULTAUTHNLEVEL"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "DEFAULTACCESSPERMISSION"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "ANONYMOUSAPPCONTAINERIMPERSONATIONLEVELCHECK"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "EVERYONEINCLUDESANONYMOUS"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{00000134-0000-0000-C000-000000000046}\PROXYSTUBCLSID32"; Key: ""; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC\EXTENSIONS"; Key: "NDROLEEXTDLL"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}\PROGID"; Key: ""; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{000C101C-0000-0000-C000-000000000046}\PROXYSTUBCLSID32"; Key: ""; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{000C103E-0000-0000-C000-000000000046}"; Key: ""; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{000C103E-0000-0000-C000-000000000046}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{000C103E-0000-0000-C000-000000000046}\INPROCSERVER32"; Key: ""; Value: "")62:T424,"zoom.exe" reads file "c:\zoom.exe" "zoom.exe" reads file "c:\windows\fonts\staticcache.dat" "powershell.exe" reads file "c:\windows\system32\windowspowershell\v1.0\powershell.exe.config" "powershell.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\microsoft.pb378ec07#\b5ba37e1558ced178a99011a1d659b52\microsoft.powershell.consolehost.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "powershell.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\system.management.automation.ni.dll.aux"63:T620,"zoom.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "zoom.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "zoom.exe" trying to access non-existent file "C:\FLTLIB.DLL" "zoom.exe" trying to access non-existent file "C:\MSVCP140.DLL" "zoom.exe" trying to access non-existent file "C:\MSVCP140.dll" "zoom.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "zoom.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "zoom.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "zoom.exe" trying to access non-existent file "C:\MSI.DLL" "zoom.exe" trying to access non-existent file "C:\msi.dll" "zoom.exe" trying to access non-existent file "C:\BCRYPT.DLL" "zoom.exe" trying to access non-existent file "C:\bcrypt.dll" "zoom.exe" trying to access non-existent file "C:\SRPAPI.DLL" "zoom.exe" trying to access non-existent file "C:\srpapi.dll" "zoom.exe" trying to access non-existent file "C:\Windows\SysWOW64\TSAPPCMP.DLL" "zoom.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\TSAPPCMP.DLL" "zoom.exe" trying to access non-existent file "C:\MSIMSG.DLL" "zoom.exe" trying to access non-existent file "C:\MsiMsg.dll" "zoom.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "zoom.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "zoom.exe" trying to access non-existent file "C:\PROPSYS.DLL" "zoom.exe" trying to access non-existent file "C:\PROPSYS.dll" "zoom.exe" trying to access non-existent file "C:\SAMCLI.DLL"64:T42a,"zoom.exe" writes file "c:\users\%osuser%\appdata\local\temp\4041571202.msi" "zoom.exe" writes file "\device\namedpipe\wkssvc" "zoom.exe" writes file "c:\users\%osuser%\appdata\local\temp\fleetdeck\fleetdeck agent installer.log" "zoom.exe" writes file "%temp%\4041571202.msi" "zoom.exe" writes file "%temp%\fleetdeck\fleetdeck agent installer.log" "fleetdeck_agent_svc.exe" writes file "c:\users\%osuser%\appdata\local\temp\fleetdeck\fleetdeck agent service.log" "fleetdeck_agent_svc.exe" writes file "c:\program files (x86)\fleetdeck agent\deployment.json" "fleetdeck_agent_svc.exe" writes file "%programfiles%\(x86)\fleetdeck agent\deployment.json" "fleetdeck_agent_svc.exe" writes file "%temp%\fleetdeck\fleetdeck agent service.log" "powershell.exe" writes file "c:\windows\temp\__psscriptpolicytest_iphrlbb4.qj1.ps1" "powershell.exe" writes file "c:\windows\temp\__psscriptpolicytest_32nsukb0.yfm.psm1" "powershell.exe" writes file "c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive"65:T68a,file/memory contains long string with (Indicator: "wsastartup"; File: "zoom.exe") file/memory contains long string with (Indicator: "wsacleanup"; File: "zoom.exe") Found reference to API "bad flushGen bad map statedalTLDpSugct?double unlockexchange fullexecRInternalfatal error: gethostbynamegetservbynameinvalid base kernel32.dll" (Indicator: "gethostbyname"; File: "zoom.exe") file/memory contains long string with (Indicator: " send "; File: "zoom.exe") file/memory contains long string with (Indicator: " socket "; File: "zoom.exe") Found reference to API "syscall.WSAStartup" (Indicator: "wsastartup"; File: "zoom.exe") Found reference to API "App: %ls found running, %d processes, attempting to send message." (Indicator: " send "; File: "zoom.exe") Found reference to API "failed to send progress message" (Indicator: " send "; File: "zoom.exe") Found reference to API "failed to get message to send to users when server reboots due to service failure." (Indicator: " send "; File: "zoom.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00003924-00000C2C-2554356412") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp")66:T77e,"2.5.29.37" "2.5.29.35" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" "192.168.0.2" Potential IP "4.0.0.0" found in string "4.0.0.0," Potential IP "1.0.0.0" found in string "anagement.Infrastructure,1.0.0.0,,31bf3856ad364e35" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.31" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.14" "2.5.29.15" "2.5.29.19" "2.5.29.32" "2.5.4.3" "2.5.29.1" "2.5.29.10" "2.5.29.17" Potential IP "2.5.4.11" found in string "2.5.4.11`" "2.5.4.8" "2.5.4.10" "2.5.4.6" "2.5.4.11" "2.5.4.7" "2.5.4.5" "2.5.29.16" "1.10.3.6" Potential IP "4.0.0.0" found in string "#n=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Potential IP "10.0.0.0" found in string "ppV.AppvClientComConsumer,10.0.0.0,,31bf3856ad364e35" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" Potential IP "1.0.0.0" found in string "1.0.0.0)" Potential IP "10.0.0.0" found in string "icrosoft.Windows.Firewall.Commands,10.0.0.0,,31bf3856ad364e35" Potential IP "1.0.0.0" found in string ":\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0" Potential IP "1.0.0.0" found in string "C:/WINDOWS/system32/WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/Microsoft.Powershell.LocalAccounts.dll" Potential IP "1.0.0.0" found in string "ile:///C:/WINDOWS/system32/WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/Microsoft.Powershell.LocalAccounts.dll" Potential IP "1.0.0.0" found in string "C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.Powershell.LocalAccounts.dll" "1.0.0.0"67:T28b8,Heuristic match: "*runtime.name" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil" Pattern match: "pathfleetdeck.io/prototype3/agent_installermodfleetdeck.io/prototype3/agent_installer(devel)depfleetdeck.io/prototype3/go-libs/fsutilv0.0.0-00010101000000-000000000000=" Heuristic match: "__x86.get_pc_thunk.ax" Heuristic match: "__x86.get_pc_thunk.cx" Heuristic match: "__x86.get_pc_thunk.si" Heuristic match: "runtime.(*functype).in" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*polldesc).info" Heuristic match: "runtime.name.name" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "internal/reflectlite.name.name" Heuristic match: "internal/reflectlite.(*rtype).name" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer" Heuristic match: "unicode.to" Heuristic match: "reflect.(*functype).in" Heuristic match: "reflect.name.name" Heuristic match: "reflect.(*rtype).name" Heuristic match: "reflect.(*rtype).in" Heuristic match: "reflect.flag.ro" Heuristic match: "reflect.value.int" Heuristic match: "reflect.(*functype).name" Heuristic match: "reflect.(*ptrtype).name" Pattern match: "eq.io/fs.patherror" Heuristic match: "syscall.errno.is" Heuristic match: "os.(*file).name" Heuristic match: "os.(*filestat).name" Pattern match: "fleetdeck.io/prototype3/go-libs/fsutil.createdirifnonexistant" Pattern match: "fleetdeck.io/prototype3/go-libs/logutil.logfile" Pattern match: "fleetdeck.io/prototype3/go-libs/logutil.initlogging" Pattern match: "fleetdeck.io/prototype3/go-libs/logutil.paniclogger" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.msiopendatabase" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.msidatabasegeneratetransform" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.msicreatetransformsummaryinfo" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.msiviewclose" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.modifyrecord" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.modifyrecord.func2" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.modifyrecord.func1" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.msiclosehandle" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.msisetinternalui" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.msiinstallproduct" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.msigetproductcode" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.msilocatecomponent" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.msiconfigureproduct" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.asktouninstall" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.uninstall" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil.init" Pattern match: "fleetdeck.io/prototype3/go-libs/logutil.logfilewriter" Heuristic match: "ocsp.sectigo.com" Heuristic match: "get /mfewtzbnmeswstajbgurdgmcgguabbsde3gf41waic8uh9lf92%2bijqh5qwqumuusmv81lkgvkebccca2kvwxheycedpxckirqfmz4qw70zm5rw4%3d http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/10.0host: ocsp.sectigo.com" Heuristic match: "get /mfiwudbomewwsjajbgurdgmcgguabbrd0jozuyxmqqw4y4zjtrlcmcrskaqugtksqssozubixklgkjks7eippxqceqc94xtxfo2ez6abd%2fn9%2bl69 http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/10.0host: ocsp.sectigo.com" Pattern match: "fleetdeck.io/prototype3/go-libs/fsutil@v0.0.0-00010101000000-000000000000/fsutils.go" Pattern match: "fleetdeck.io/prototype3/go-libs/logutil@v0.0.0-00010101000000-000000000000/logdir_windows.go" Pattern match: "fleetdeck.io/prototype3/go-libs/logutil@v0.0.0-00010101000000-000000000000/logutil.go" Pattern match: "fleetdeck.io/prototype3/go-libs/msiutil@v0.0.0-00010101000000-000000000000/msiutil.go" Pattern match: "fleetdeck.io/prototype3/agent_installer/agent_installer.go" Pattern match: "fleetdeck.io/prototype3/agent_installer/w32.go" Pattern match: "fleetdeck.io/prototype3/agent_installer/msidata_gen.go" Pattern match: "fleetdeck.io/prototype3/agent_svc" Pattern match: "fleetdeck.io/prototype3/go-libs/agentcommon" Pattern match: "fleetdeck.io/prototype3/go-libs/fsutil" Pattern match: "fleetdeck.io/prototype3/go-libs/logutil" Pattern match: "fleetdeck.io/prototype3/go-libs/retryutil" Pattern match: "fleetdeck.io/prototype3/go-libs/robustdns" Pattern match: "fleetdeck.io/prototype3/go-libs/svcutil" Pattern match: "fleetdeck.io/prototype3/go-libs/updater" Pattern match: "fleetdeck.io/prototype3/go-libs/updaterversion" Pattern match: "github.com/miekg/dns" Pattern match: "golang.org/x/sys" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1" Pattern match: "www.microsoft" Heuristic match: "\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Heuristic match: "stem.management.automation.re" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "www.digicert.com1$0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "http://ocsp.omniroot.com/baltimoreroot0" Pattern match: "cdp1.public-trust.com/crl/omniroot2025.crl0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Pattern match: "go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "http://www.microsoft.com/windows" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Heuristic match: "ystem.windows.fo" Heuristic match: "ft.net" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Heuristic match: "tupes.ps" Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x" Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0" Heuristic match: "icrolist.com" Heuristic match: "micrlistt.co" Pattern match: "www.micr" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "cim_system.name" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "dows.firewall.co" Heuristic match: "bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ".0.16299.15.ca" Pattern match: "http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Heuristic match: "tomation.re" Pattern match: "https://go.microsoft.com/fwlink/?linkid=285219" Heuristic match: "5.cat" Heuristic match: "23.ck" Pattern match: "oft.com/9tf_p" Pattern match: "www.microsoft.com/p" Heuristic match: "icrosoft.management.in" Pattern match: "crl.microsoft.com/pki/crl/pr" Pattern match: "http://www.microsoft.com/pki/cer\" Pattern match: "http://www.microxa3\.i" Pattern match: "www.microsoft.com/"68:Ta8d5,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002548.00000000.228697.035E0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002548.00000001.230295.035E0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00002636.00000000.228765.6D640000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00002636.00000000.228765.6D640000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002636.00000000.228765.6D640000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl00vemkidmroot" - Source: "00000000-00002636.00000000.228765.6D640000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002636.00000000.228765.6D640000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002636.00000000.228765.6D640000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002636.00000000.228765.6D640000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002636.00000000.228765.6D640000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002636.00000000.228765.6D640000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002636.00000000.228765.6D640000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002636.00000000.228765.6D640000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lcrosoft" - Source: "00000000-00002636.00000000.228765.6D640000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l;" - Source: "00000000-00002636.00000000.228765.6D640000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002636.00000000.228765.6D640000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreport:\programdata\microsoft\windows" - Source: "00000000-00002636.00000000.228765.6DB20000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002636.00000000.228765.6DB20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002636.00000000.228765.6DB20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002636.00000000.228765.6DB20000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1" - Source: "00000000-00002636.00000000.228765.6DB20000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!09;kp^-kwashington1redmond1microsoft" - Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>" - Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00002636.00000001.229385.6D640000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00002636.00000001.229385.6D640000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002636.00000001.229385.6D640000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl00vemkidmroot" - Source: "00000000-00002636.00000001.229385.6D640000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002636.00000001.229385.6D640000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002636.00000001.229385.6D640000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00002636.00000001.229385.6D640000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002636.00000001.229385.6D640000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002636.00000001.229385.6D640000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002636.00000001.229385.6D640000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002636.00000001.229385.6D6AB000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lcrosoft" - Source: "00000000-00002636.00000001.229385.6D6AB000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l:" - Source: "00000000-00002636.00000001.229385.6D6AB000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002636.00000001.229385.6D6FA000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0^" - Source: "00000000-00002636.00000001.229385.6DC20000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0," - Source: "00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\l!8.ek@26vtlp0xr!s4zs9_>$vkt7" - Source: "00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0@;'k.com/pkiops/certs/micwinprop11_2011-10-19.crt0cj1+ppqqm" - Source: "00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0abq]\dqc\i11202335q" - Source: "00000000-00002636.00000001.229385.6DD14000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0," - Source: "00000000-00002636.00000001.229385.6DD14000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fmicrosoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenumenabledmicrosoft.powershell.cmdletization.generatedtypes.netsecurityvalue__truefalseprofileflagsattribute.ctorpublicprivatedomainnotapplicabledirectioninboundoutboundactionnotconfiguredallowblockedgetraversaldefertouserdefertoappprimarystatusunknowninactiveerrorpolicystoretypenonelocalgrouppolicydynamicgeneratedhardcodeddynamictransportproximityappsproximitysharingwifidirectprintingwifidirectdisplaywifidirectdevicesinterfacetypewiredwirelessremoteaccessauthenticationnotrequiredrequirednoencapencryptionipsecmodetransporttunnelsecuritypolicyrequestrequirekeymoduleikev1ikev2authipdefaultendpointtypeendpoint1endpoint2addressversionipv4ipv6changeactiondeletegpobooleandospkeymodulesikev1ikev2dospflagsdisabledefaultblockfilterblockfilterexemptimpersonationtypeimpersonatedeffectiveauthenticationmethoddtypes.netsecuritymicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00002636.00000001.229385.6DD14000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/prictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/cer\" - Source: "00000000-00002636.00000001.229385.6DD66000.00000004.mdmp") Found URL "http://www.microxa3\.ilambda_methodtimstapca_2010-07-01.crt0" - Source: "00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0," - Source: "00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp") Found URL "http://www.microsoft.com/rl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0kh!y," - Source: "00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt03d71bkp$kmtboundconnectionsforwardpathinitiatorenableoptionalasymmetricidleusingdictatedkeyslocallydictatedkeystrafficexemptionneighbordiscoveryicmprouterdiscoverydhcpcrlcheckattemptcrlcheckrequirecrlcheckipsecthroughnatserverbothkeyencodingutf16utf8microsoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenumenabledmicrosoft.powershell.cmdletization.generatedtypes.netsecurityvalue__truefalseprofileflagsattribute.ctorpublicprivatedomainnotapplicabledirectioninboundoutboundactionnotconfiguredallowblockedgetraversaldefertouserdefertoappprimarystatusunknowninactiveerrorpolicystoretypenonelocalgrouppolicydynamicgeneratedhardcodeddynamictransportproximityappsproximitysharingwifidirectprintingwifidirectdisplaywifidirectdevicesinterfacetypewiredwirelessremoteaccessauthenticationnotrequiredrequirednoencapencryptionipsecmodetransporttunnelsecuritypolicyrequestrequirekeymoduleikev1ikev2authipdefaultendpointtypeendpoint1endpoint2addressversionipv4ipv6changeactiondeletegpobooleandospkeymodulesikev1ikev2dospflagsdisabledefaultblockfilterblockfilterexemptimpersonationtypeimpersonatedeffectiveauthenticationmethodpresharedkeycertificatekerberosanonymousntlmv2certificateecdsa256certificateecdsa384sslecdsa256sslecdsa384idflagshealthcertificateeffectivekeymoduleqmsatransformtypeespauthespcipherespauthandcipherespauthfirewallqmbundleflagsndsecurendboundaryndpeernatboundaryguaranteeencryptionnomachineluidverifynoimpersonationluidverifynoexplicitcredmatchunknown256allownulltargetnamematchcleardfontunnelassumeudpcontextoutboundndpeerboundarysuppressduplicatedeletionpeersupportsguaranteeencryptionforceinboundconnectionsforceoummetricidleusingdictatedkeyslocallydictatedkeystrafficexemptionneighbordiscoveryicmprouterdiscoverydhcpcrlcheckattemptcrlcheckrequirecrlcheckipsecthroughnatserverbothmicrosoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenumenabledmicrosoft.powershell.cmdletization.generatedtypes.netsecurityvalue__truefalseprofileflagsattribute.ctorpublicprivatedomainnotapplicabledirectioninboundoutboundactionnotconfiguredallowblockedgetraversaldefertouserdefertoappprimarystatusunknowninactiveerrorpolicystoretypenonelocalgrouppolicydynamicgeneratedhardcodeddynamictransportproximityappsproximitysharingwifidirectprintingwifidirectdisplaywifidirectdevicesinterfacetypewiredwirelessremoteaccessauthenticationnotrequiredrequirednoencapencryptionipsecmodetransporttunnelsecuritypolicyrequestrequirekeymoduleikev1ikev2authipdefaultendpointtypeendpoint1endpoint2addressversionipv4ipv6changeactiondeletegpobooleandospkeymodulesikev1ikev2dospflagsdisabledefaultblockfilterblockfilterexemptimpersonationtypeimpersonatedeffectiveauthenticationmethodpresharedkeycertificatekerberosanonymousntlmv2certificateecdsa256certificateecdsa384sslecdsa256sslecdsa384idflagshealthcertificateeffectivekeymoduleqmsatransformtypeespauthespcipherespauthandcipherespauthfirewallqmbundleflagsndsecurendboundaryndpeernatboundaryguaranteeencryptionnomachineluidverifynoimpersonationluidverifynoexplicitcredmatchunknown256allownulltargetnamematchcleardfontunnelassumeudpcontextoutboundndpeerboundarysuppressduplicatedeletionpeersupportsguaranteeencryptionforceinboundconnectionsforceoutboundconnectionsforwardpathinitiatorenableoptionalasybsjbv4.0.30319" - Source: "00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>bldrr1-40500root\standardcimv2__parametersabstractreturnvalueuint32uint32bldrr1-40500root\standardcimv2__parametersabstractreturnvalueuint32uint32__parametersabstractreturnvalueuint32uint32p7rml$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hh" - Source: "00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003924.00000000.228373.02CB0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003924.00000001.230292.02CB0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003924.00000002.230420.02CB0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00004540.00000000.229712.0E668000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00004540.00000000.229712.0E668000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00004540.00000000.229712.0E668000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0u" - Source: "00000000-00004540.00000000.229712.360D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004540.00000000.229712.505E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0qi&>@'uh?iwashington1redmond1microsoft" - Source: "00000000-00004540.00000000.229712.505E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00004540.00000000.229712.505E0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00004540.00000000.229712.505E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004540.00000000.229712.505E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004540.00000000.229712.505E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00004540.00000000.229712.505E0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00004540.00000000.229712.505E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00004540.00000000.229712.505E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00004540.00000000.229712.505E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004540.00000000.229712.505E0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00004540.00000000.229712.505E0000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsx>gpp>gpxdgppdgpxggppggp0>gpx>gph5t[u8?gp']qqx?gpf89b8@gpx@gpessmlhistoryencodeexpigpencoderecipientid8agp3k*jpagpwvtasn1spcsiginfoencode8bgpxbgpgz;" - Source: "00000000-00004540.00000000.229712.505E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004540.00000000.229712.50AD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00004540.00000000.229712.50AD0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=528806'redmond1microsoft" - Source: "00000000-00004540.00000000.229712.50AD0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1" - Source: "00000000-00004540.00000000.229712.50AD0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004540.00000000.229712.50CD3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>pvapd6@" - Source: "00000000-00004540.00000000.229712.50CD3000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00004540.00000000.229712.50CD3000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsv\n?+q^p;v^pkv^p+q^p;v^pkv^p+q^p;v^pkv^pudm?" - Source: "00000000-00004540.00000000.229712.50CD3000.00000004.mdmp") Found URL "https://github.com/lzybkr/psreadline/issues/new-----------------------------------------------------------------------last" - Source: "00000000-00004540.00000000.229712.50F02000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=528808-microsoft.powershell.psconsolereadlineoptionspsreadlineoptionhelpuri-http://go.microsoft.com/fwlink/?linkid=528811" - Source: "00000000-00004540.00000000.229712.50F02000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=528810position" - Source: "00000000-00004540.00000000.229712.50F02000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=528807(microsoft.powershell.keyhandlerremovepsreadlinekeyhandlerhelpuri-http://go.microsoft.com/fwlink/?linkid=528809count" - Source: "00000000-00004540.00000000.229712.50F02000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0u" - Source: "00000000-00004540.00000001.230288.360D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004540.00000001.230288.505E0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0qi&>@'uh?iwashington1redmond1microsoft" - Source: "00000000-00004540.00000001.230288.505E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^" - Source: "00000000-00004540.00000001.230288.505E0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e" - Source: "00000000-00004540.00000001.230288.505E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00004540.00000001.230288.505E0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004540.00000001.230288.505E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00004540.00000001.230288.505E0000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00004540.00000001.230288.505E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00004540.00000001.230288.505E0000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00004540.00000001.230288.505E0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004540.00000001.230288.50626000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsmicrosoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenumenabledmicrosoft.powershell.cmdletization.generatedtypes.netsecurityvalue__truefalseprofileflagsattribute.ctorpublicprivatedomainnotapplicabledirectioninboundoutboundactionnotconfiguredallowblockedgetraversaldefertouserdefertoappprimarystatusunknowninactiveerrorpolicystoretypenonelocalgrouppolicydynamicgeneratedhardcodeddynamictransportproximityappsproximitysharingwifidirectprintingwifidirectdisplaywifidirectdevicesinterfacetypewiredwirelessremoteaccessauthenticationnotrequiredrequirednoencapencryptionipsecmodetransporttunnelsecuritypolicyrequestrequirekeymoduleikev1ikev2authipdefaultendpointtypeendpoint1endpoint2addressversionipv4ipv6changeactiondeletegpobooleandospkeymodulesikev1ikev2dospflagsdisabledefaultblockfilterblockfilterexemptimpersonationtypeimpersonatedeffectiveauthenticationmethoddtypes.netsecurity03gp@7gp" - Source: "00000000-00004540.00000001.230288.50664000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt008ipar')xxxxxxxxi\o\\30" - Source: "00000000-00004540.00000001.230288.50664000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=528806'redmond1microsoft" - Source: "00000000-00004540.00000001.230288.50B1D000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1;n/" - Source: "00000000-00004540.00000001.230288.50B1D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00004540.00000001.230288.50B1D000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0," - Source: "00000000-00004540.00000001.230288.50B1D000.00000004.mdmp") Found URL "http://www.microsoft.com/windows&of?washington1redmond1microsoft" - Source: "00000000-00004540.00000001.230288.50C29000.00000004.mdmp") Found URL "http://www.microsoft.com/windows3.6.1." - Source: "00000000-00004540.00000001.230288.50C29000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0_>n?t9s>;9j>" - Source: "00000000-00004540.00000001.230288.50C29000.00000004.mdmp") Found URL "http://www.microsoft.com/windowspk]\ffobg88v-movnen%v" - Source: "00000000-00004540.00000001.230288.50CD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?" - Source: "00000000-00004540.00000001.230288.50CD3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06" - Source: "00000000-00004540.00000001.230288.50CD3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0," - Source: "00000000-00004540.00000001.230288.50CD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.comfhttp://www.microsoft.com/pki/cerp(9iheappca_nu,3p6washington1redmond1microsoft" - Source: "00000000-00004540.00000001.230288.50CD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00004540.00000001.230288.50CD3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4z" - Source: "00000000-00004540.00000001.230288.50CD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00004540.00000001.230288.50CD3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00004540.00000001.230288.50CD3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>1l0j" - Source: "00000000-00004540.00000001.230288.50CD3000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00004540.00000001.230288.50CD3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1microsoft" - Source: "00000000-00004540.00000001.230288.50CD3000.00000004.mdmp") Found URL "http://www.microsoft.com/windowsroot\standardcimv2cim_policysetcim_policycim_managedelementcim_policyruleumlpackagepathcim::policylocalecaptionstringmaxlencommonnamestringconditionlisttypeuint16valuemapcreationclassnamestringmaxlendescriptionstringelementnamestringenableduint16valuemapexecutionstrategyuint16valuemapinstanceidstringmandatorybooleandeprecatedno" - Source: "00000000-00004540.00000001.230288.50CD3000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0," - Source: "00000000-00004540.00000001.230288.50D97000.00000004.mdmp") Found URL "http://www.microsoft.com/windowswashington1redmond1microsoft" - Source: "00000000-00004540.00000001.230288.50D97000.00000004.mdmp")69:T53a,Found URL "http://www.microsoft.com/windowscx]^microsoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenumenabledmicrosoft.powershell.cmdletization.generatedtypes.netsecurityvalue__truefalseprofileflagsattribute.ctorpublicprivatedomainnotapplicabledirectioninboundoutboundactionnotconfiguredallowblockedgetraversaldefertouserdefertoappprimarystatusunknowninactiveerrorpolicystoretypenonelocalgrouppolicydynamicgeneratedhardcodeddynamictransportproximityappsproximitysharingwifidirectprintingwifidirectdisplaywifidirectdevicesinterfacetypewiredwirelessremoteaccessauthenticationnotrequiredrequirednoencapencryptionipsecmodetransporttunnelsecuritypolicyrequestrequirekeymoduleikev1ikev2authipdefaultendpointtypeendpoint1endpoint2addressversionipv4ipv6changeactiondeletegpobooleandospkeymodulesikev1ikev2dospflagsdisabledefaultblockfilterblockfilterexemptimpersonationtypeimpersonatedeffectiveauthenticationmethoddtypes.netsecuritymicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00002636.00000001.229385.6DD14000.00000004.mdmp")6a:Tde2,Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt03d71bkp$kmtboundconnectionsforwardpathinitiatorenableoptionalasymmetricidleusingdictatedkeyslocallydictatedkeystrafficexemptionneighbordiscoveryicmprouterdiscoverydhcpcrlcheckattemptcrlcheckrequirecrlcheckipsecthroughnatserverbothkeyencodingutf16utf8microsoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenumenabledmicrosoft.powershell.cmdletization.generatedtypes.netsecurityvalue__truefalseprofileflagsattribute.ctorpublicprivatedomainnotapplicabledirectioninboundoutboundactionnotconfiguredallowblockedgetraversaldefertouserdefertoappprimarystatusunknowninactiveerrorpolicystoretypenonelocalgrouppolicydynamicgeneratedhardcodeddynamictransportproximityappsproximitysharingwifidirectprintingwifidirectdisplaywifidirectdevicesinterfacetypewiredwirelessremoteaccessauthenticationnotrequiredrequirednoencapencryptionipsecmodetransporttunnelsecuritypolicyrequestrequirekeymoduleikev1ikev2authipdefaultendpointtypeendpoint1endpoint2addressversionipv4ipv6changeactiondeletegpobooleandospkeymodulesikev1ikev2dospflagsdisabledefaultblockfilterblockfilterexemptimpersonationtypeimpersonatedeffectiveauthenticationmethodpresharedkeycertificatekerberosanonymousntlmv2certificateecdsa256certificateecdsa384sslecdsa256sslecdsa384idflagshealthcertificateeffectivekeymoduleqmsatransformtypeespauthespcipherespauthandcipherespauthfirewallqmbundleflagsndsecurendboundaryndpeernatboundaryguaranteeencryptionnomachineluidverifynoimpersonationluidverifynoexplicitcredmatchunknown256allownulltargetnamematchcleardfontunnelassumeudpcontextoutboundndpeerboundarysuppressduplicatedeletionpeersupportsguaranteeencryptionforceinboundconnectionsforceoummetricidleusingdictatedkeyslocallydictatedkeystrafficexemptionneighbordiscoveryicmprouterdiscoverydhcpcrlcheckattemptcrlcheckrequirecrlcheckipsecthroughnatserverbothmicrosoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenumenabledmicrosoft.powershell.cmdletization.generatedtypes.netsecurityvalue__truefalseprofileflagsattribute.ctorpublicprivatedomainnotapplicabledirectioninboundoutboundactionnotconfiguredallowblockedgetraversaldefertouserdefertoappprimarystatusunknowninactiveerrorpolicystoretypenonelocalgrouppolicydynamicgeneratedhardcodeddynamictransportproximityappsproximitysharingwifidirectprintingwifidirectdisplaywifidirectdevicesinterfacetypewiredwirelessremoteaccessauthenticationnotrequiredrequirednoencapencryptionipsecmodetransporttunnelsecuritypolicyrequestrequirekeymoduleikev1ikev2authipdefaultendpointtypeendpoint1endpoint2addressversionipv4ipv6changeactiondeletegpobooleandospkeymodulesikev1ikev2dospflagsdisabledefaultblockfilterblockfilterexemptimpersonationtypeimpersonatedeffectiveauthenticationmethodpresharedkeycertificatekerberosanonymousntlmv2certificateecdsa256certificateecdsa384sslecdsa256sslecdsa384idflagshealthcertificateeffectivekeymoduleqmsatransformtypeespauthespcipherespauthandcipherespauthfirewallqmbundleflagsndsecurendboundaryndpeernatboundaryguaranteeencryptionnomachineluidverifynoimpersonationluidverifynoexplicitcredmatchunknown256allownulltargetnamematchcleardfontunnelassumeudpcontextoutboundndpeerboundarysuppressduplicatedeletionpeersupportsguaranteeencryptionforceinboundconnectionsforceoutboundconnectionsforwardpathinitiatorenableoptionalasybsjbv4.0.30319" - Source: "00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp")6b:T4b9,Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00004540.00000000.229712.0E668000.00000002.mdmp")6c:T419,Found URL "http://www.microsoft.com/windowsmicrosoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenumenabledmicrosoft.powershell.cmdletization.generatedtypes.netsecurityvalue__truefalseprofileflagsattribute.ctorpublicprivatedomainnotapplicabledirectioninboundoutboundactionnotconfiguredallowblockedgetraversaldefertouserdefertoappprimarystatusunknowninactiveerrorpolicystoretypenonelocalgrouppolicydynamicgeneratedhardcodeddynamictransportproximityappsproximitysharingwifidirectprintingwifidirectdisplaywifidirectdevicesinterfacetypewiredwirelessremoteaccessauthenticationnotrequiredrequirednoencapencryptionipsecmodetransporttunnelsecuritypolicyrequestrequirekeymoduleikev1ikev2authipdefaultendpointtypeendpoint1endpoint2addressversionipv4ipv6changeactiondeletegpobooleandospkeymodulesikev1ikev2dospflagsdisabledefaultblockfilterblockfilterexemptimpersonationtypeimpersonatedeffectiveauthenticationmethoddtypes.netsecurity03gp@7gp" - Source: "00000000-00004540.00000001.230288.50664000.00000004.mdmp")6d:T53a,Found URL "http://www.microsoft.com/windowscx]^microsoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenumenabledmicrosoft.powershell.cmdletization.generatedtypes.netsecurityvalue__truefalseprofileflagsattribute.ctorpublicprivatedomainnotapplicabledirectioninboundoutboundactionnotconfiguredallowblockedgetraversaldefertouserdefertoappprimarystatusunknowninactiveerrorpolicystoretypenonelocalgrouppolicydynamicgeneratedhardcodeddynamictransportproximityappsproximitysharingwifidirectprintingwifidirectdisplaywifidirectdevicesinterfacetypewiredwirelessremoteaccessauthenticationnotrequiredrequirednoencapencryptionipsecmodetransporttunnelsecuritypolicyrequestrequirekeymoduleikev1ikev2authipdefaultendpointtypeendpoint1endpoint2addressversionipv4ipv6changeactiondeletegpobooleandospkeymodulesikev1ikev2dospflagsdisabledefaultblockfilterblockfilterexemptimpersonationtypeimpersonatedeffectiveauthenticationmethoddtypes.netsecuritymicrosoft.management.infrastructure.userfilteredexceptionhandlingrefemit_inmemorymanifestmodulemscorlibsystem.diagnosticsdebuggableattributedebuggingmodes.ctorsystem.runtime.compilerservicesruntimecompatibilityattributesystemobjectuserfilteredexceptionhandlingexceptionactioninvokefunc" - Source: "00000000-00002636.00000001.229385.6DD14000.00000004.mdmp")6e:Tde2,Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt03d71bkp$kmtboundconnectionsforwardpathinitiatorenableoptionalasymmetricidleusingdictatedkeyslocallydictatedkeystrafficexemptionneighbordiscoveryicmprouterdiscoverydhcpcrlcheckattemptcrlcheckrequirecrlcheckipsecthroughnatserverbothkeyencodingutf16utf8microsoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenumenabledmicrosoft.powershell.cmdletization.generatedtypes.netsecurityvalue__truefalseprofileflagsattribute.ctorpublicprivatedomainnotapplicabledirectioninboundoutboundactionnotconfiguredallowblockedgetraversaldefertouserdefertoappprimarystatusunknowninactiveerrorpolicystoretypenonelocalgrouppolicydynamicgeneratedhardcodeddynamictransportproximityappsproximitysharingwifidirectprintingwifidirectdisplaywifidirectdevicesinterfacetypewiredwirelessremoteaccessauthenticationnotrequiredrequirednoencapencryptionipsecmodetransporttunnelsecuritypolicyrequestrequirekeymoduleikev1ikev2authipdefaultendpointtypeendpoint1endpoint2addressversionipv4ipv6changeactiondeletegpobooleandospkeymodulesikev1ikev2dospflagsdisabledefaultblockfilterblockfilterexemptimpersonationtypeimpersonatedeffectiveauthenticationmethodpresharedkeycertificatekerberosanonymousntlmv2certificateecdsa256certificateecdsa384sslecdsa256sslecdsa384idflagshealthcertificateeffectivekeymoduleqmsatransformtypeespauthespcipherespauthandcipherespauthfirewallqmbundleflagsndsecurendboundaryndpeernatboundaryguaranteeencryptionnomachineluidverifynoimpersonationluidverifynoexplicitcredmatchunknown256allownulltargetnamematchcleardfontunnelassumeudpcontextoutboundndpeerboundarysuppressduplicatedeletionpeersupportsguaranteeencryptionforceinboundconnectionsforceoummetricidleusingdictatedkeyslocallydictatedkeystrafficexemptionneighbordiscoveryicmprouterdiscoverydhcpcrlcheckattemptcrlcheckrequirecrlcheckipsecthroughnatserverbothmicrosoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenumenabledmicrosoft.powershell.cmdletization.generatedtypes.netsecurityvalue__truefalseprofileflagsattribute.ctorpublicprivatedomainnotapplicabledirectioninboundoutboundactionnotconfiguredallowblockedgetraversaldefertouserdefertoappprimarystatusunknowninactiveerrorpolicystoretypenonelocalgrouppolicydynamicgeneratedhardcodeddynamictransportproximityappsproximitysharingwifidirectprintingwifidirectdisplaywifidirectdevicesinterfacetypewiredwirelessremoteaccessauthenticationnotrequiredrequirednoencapencryptionipsecmodetransporttunnelsecuritypolicyrequestrequirekeymoduleikev1ikev2authipdefaultendpointtypeendpoint1endpoint2addressversionipv4ipv6changeactiondeletegpobooleandospkeymodulesikev1ikev2dospflagsdisabledefaultblockfilterblockfilterexemptimpersonationtypeimpersonatedeffectiveauthenticationmethodpresharedkeycertificatekerberosanonymousntlmv2certificateecdsa256certificateecdsa384sslecdsa256sslecdsa384idflagshealthcertificateeffectivekeymoduleqmsatransformtypeespauthespcipherespauthandcipherespauthfirewallqmbundleflagsndsecurendboundaryndpeernatboundaryguaranteeencryptionnomachineluidverifynoimpersonationluidverifynoexplicitcredmatchunknown256allownulltargetnamematchcleardfontunnelassumeudpcontextoutboundndpeerboundarysuppressduplicatedeletionpeersupportsguaranteeencryptionforceinboundconnectionsforceoutboundconnectionsforwardpathinitiatorenableoptionalasybsjbv4.0.30319" - Source: "00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp")6f:T4b9,Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00004540.00000000.229712.0E668000.00000002.mdmp")70:T419,Found URL "http://www.microsoft.com/windowsmicrosoft.powershell.cmdletization.generatedtypesrefemit_inmemorymanifestmodulemscorlibsystemenumenabledmicrosoft.powershell.cmdletization.generatedtypes.netsecurityvalue__truefalseprofileflagsattribute.ctorpublicprivatedomainnotapplicabledirectioninboundoutboundactionnotconfiguredallowblockedgetraversaldefertouserdefertoappprimarystatusunknowninactiveerrorpolicystoretypenonelocalgrouppolicydynamicgeneratedhardcodeddynamictransportproximityappsproximitysharingwifidirectprintingwifidirectdisplaywifidirectdevicesinterfacetypewiredwirelessremoteaccessauthenticationnotrequiredrequirednoencapencryptionipsecmodetransporttunnelsecuritypolicyrequestrequirekeymoduleikev1ikev2authipdefaultendpointtypeendpoint1endpoint2addressversionipv4ipv6changeactiondeletegpobooleandospkeymodulesikev1ikev2dospflagsdisabledefaultblockfilterblockfilterexemptimpersonationtypeimpersonatedeffectiveauthenticationmethoddtypes.netsecurity03gp@7gp" - Source: "00000000-00004540.00000001.230288.50664000.00000004.mdmp")71:T5ee,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kV" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQS" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "sozUbIxKLGKjkS7EipPxQCEQC94xtxFO2" in header "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com"72:T723,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp")73:T904,"fleetdeck_agent_svc.exe" called "FindFirstFileW" with parameter %PROGRAMFILES%\(x86)\FleetDeck Agent\* (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "FindNextFileW" with parameter deployment.json (UID: 00000000-00002548) "fleetdeck_agent_svc.exe" called "FindNextFileW" with parameter fleetdeck_agent_svc.exe (UID: 00000000-00002548) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002636) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework64\\* (UID: 00000000-00002636) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002636) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00002636) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002636) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002636) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00002636) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00002636) "powershell.exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00002636) "powershell.exe" called "FindNextFileW" with parameter v3.5 (UID: 00000000-00002636) "powershell.exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00002636) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\* (UID: 00000000-00002636) "powershell.exe" called "FindNextFileW" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00002636) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\* (UID: 00000000-00002636) "powershell.exe" called "FindNextFileW" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00002636) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\* (UID: 00000000-00002636) "powershell.exe" called "FindNextFileW" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00002636)74:T841,Found string "encoding/base64" (Indicator: "base64"; File: "zoom.exe") Found string "*base64.encoder" (Indicator: "base64"; File: "zoom.exe") Found string "*base64.Encoding" (Indicator: "base64"; File: "zoom.exe") Found string "*base64.CorruptInputError" (Indicator: "base64"; File: "zoom.exe") file/memory contains long string with (Indicator: "aes"; File: "zoom.exe") file/memory contains long string with (Indicator: "base64"; File: "zoom.exe") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "zoom.exe") Found string "aeshashbody" (Indicator: "aes"; File: "zoom.exe") Found string "encoding/base64.(*Encoding).Encode" (Indicator: "base64"; File: "zoom.exe") Found string "encoding/base64.(*encoder).Write" (Indicator: "base64"; File: "zoom.exe") Found string "encoding/base64.(*encoder).Close" (Indicator: "base64"; File: "zoom.exe") Found string "encoding/base64.(*Encoding).EncodedLen" (Indicator: "base64"; File: "zoom.exe") Found string "encoding/base64.CorruptInputError.Error" (Indicator: "base64"; File: "zoom.exe") Found string "encoding/base64.(*Encoding).decodeQuantum" (Indicator: "base64"; File: "zoom.exe") Found string "encoding/base64.(*Encoding).Decode" (Indicator: "base64"; File: "zoom.exe") Found string "encoding/base64.assemble32" (Indicator: "base64"; File: "zoom.exe") Found string "encoding/base64.init" (Indicator: "base64"; File: "zoom.exe") Found string "encoding/base64.NewEncoding" (Indicator: "base64"; File: "zoom.exe") Found string "encoding/base64.Encoding.WithPadding" (Indicator: "base64"; File: "zoom.exe") Found string "type:.eq.encoding/base64.Encoding" (Indicator: "base64"; File: "zoom.exe") Found string "type:.eq.encoding/base64.encoder" (Indicator: "base64"; File: "zoom.exe") Found string "encoding/base64.(*CorruptInputError).Error" (Indicator: "base64"; File: "zoom.exe") Found string "encoding/base64.(*Encoding).DecodedLen" (Indicator: "base64"; File: "zoom.exe") Found string "encoding/base64.NewEncoder" (Indicator: "base64"; File: "zoom.exe") Found string "encoding/base64/base64.go" (Indicator: "base64"; File: "zoom.exe")75:T842,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "zoom.exe") file/memory contains long string with (Indicator: "Module32Next"; File: "zoom.exe") file/memory contains long string with (Indicator: "Process32Next"; File: "zoom.exe") file/memory contains long string with (Indicator: "Module32First"; File: "zoom.exe") file/memory contains long string with (Indicator: "Process32First"; File: "zoom.exe") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "zoom.exe") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "zoom.exe") Found reference to API "eCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime" (Indicator: "CreateToolhelp32Snapshot"; File: "zoom.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "zoom.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "zoom.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "zoom.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "zoom.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "zoom.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "zoom.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "zoom.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "zoom.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp")76:Tc62,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "zoom.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "zoom.exe") file/memory contains long string with (Indicator: "GetTempPath"; File: "zoom.exe") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "zoom.exe") file/memory contains long string with (Indicator: "GetSystemDirectory"; File: "zoom.exe") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "zoom.exe") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "zoom.exe") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "zoom.exe") Found reference to API "syscall.GetFileAttributesEx" (Indicator: "GetFileAttributes"; File: "zoom.exe") Found reference to API "syscall.GetFileAttributes" (Indicator: "GetFileAttributes"; File: "zoom.exe") Found reference to API "syscall.GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "zoom.exe") Found reference to API "syscall.GetTempPath" (Indicator: "GetTempPath"; File: "zoom.exe") Found reference to API "internal/syscall/windows.GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "zoom.exe") Found reference to API "os.newFileStatFromGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "zoom.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "zoom.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "zoom.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "zoom.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "zoom.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "zoom.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "zoom.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "zoom.exe") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp")77:T648,file/memory contains long string with (Indicator: "password"; File: "zoom.exe") Found string "master secret" (Indicator: "secret"; Source: "00000000-00002548.00000000.228697.013AF000.00000004.mdmp, 00000000-00002548.00000001.230295.013AF000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp") Found string "passwordauthenticationmechanism" (Indicator: "password"; Source: "00000000-00002636.00000000.228765.B5850000.00000004.mdmp") Found string "passwordencodingmethod" (Indicator: "password"; Source: "00000000-00002636.00000000.228765.B5890000.00000004.mdmp") Found string "dsmakepasswordcredentials" (Indicator: "password"; Source: "00000000-00002636.00000000.228765.B5890000.00000004.mdmp") Found string "dsfreepasswordcredentials" (Indicator: "password"; Source: "00000000-00002636.00000000.228765.B5890000.00000004.mdmp") Found string "passwordderivebytes" (Indicator: "password"; Source: "00000000-00002636.00000001.229385.B57B0000.00000004.mdmp") Found string "sha1fornonsecretpurposes" (Indicator: "secret"; Source: "00000000-00002636.00000001.229385.B57D0000.00000004.mdmp") Found string "passwordpropertytextattribute" (Indicator: "password"; Source: "00000000-00002636.00000001.229385.B57D0000.00000004.mdmp")78:T4bc,file/memory contains long string with (Indicator: "CopySid"; File: "zoom.exe") file/memory contains long string with (Indicator: "GetLengthSid"; File: "zoom.exe") file/memory contains long string with (Indicator: "RevertToSelf"; File: "zoom.exe") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "zoom.exe") file/memory contains long string with (Indicator: "DuplicateToken"; File: "zoom.exe") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "zoom.exe") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "zoom.exe") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "zoom.exe") Found reference to API "GetSecurityDescriptorControl" (Indicator: "GetSecurityDescriptorControl"; File: "zoom.exe") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "zoom.exe") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "zoom.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "zoom.exe") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "zoom.exe")79:T982,"zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") "zoom.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")7a:T544,"zoom.exe" has resource with unusual entropy "RT_ICON:7.888439783040667" "zoom.exe" has resource with unusual entropy "RT_ICON:7.9057689229820545" "zoom.exe" has resource with unusual entropy "RT_ICON:7.935524297231732" "zoom.exe" has resource with unusual entropy "RT_ICON:7.8943216483572805" "zoom.exe" has resource with unusual entropy "RT_ICON:7.912165219310808" "zoom.exe" has resource with unusual entropy "RT_ICON:7.896936156221766" "zoom.exe" has resource with unusual entropy "RT_ICON:7.87797568288344" "zoom.exe" has resource with unusual entropy "RT_ICON:7.890134879283647" "zoom.exe" has resource with unusual entropy "RT_ICON:7.841278772410033" "zoom.exe" has resource with unusual entropy "RT_ICON:7.852372196062222" "zoom.exe" has resource with unusual entropy "RT_ICON:7.794888350604326" "zoom.exe" has resource with unusual entropy "RT_ICON:7.759908858082592" "zoom.exe" has resource with unusual entropy "RT_ICON:7.66667961504241" "zoom.exe" has resource with unusual entropy "RT_ICON:7.643288682936825" "zoom.exe" has resource with unusual entropy "RT_ICON:7.621295918458921" "zoom.exe" has resource with unusual entropy "RT_ICON:7.531843154923791" "zoom.exe" has resource with unusual entropy "RT_ICON:7.382858402311073" "zoom.exe" has resource with unusual entropy "RT_ICON:7.232359772420352"7b:Tb61,"powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "powershell.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")7c:T123b8,iVBORw0KGgoAAAANSUhEUgAABLAAAAJYCAIAAAD9hIhNAACAAElEQVR4Xuy8faxmVZmmv1IhpEIYpkIMIQxhaoghlQrDMDQiTdtYXU0rMsggIqIilgXSJdKIJR9lyUfxTVGgIl8i0ohIIyDNoMMYQxxhaIdhaMcYYgjxR4wxxBBCCCHEEGLqR9Vbtc9zX2vv5333Oaf2qTrnvnL/sd+111577Y9iP9fpdpVS7tQIixdLDj5YUvGWRqiO3agRXntN8k5DzHPPlZiyWfKud0lKeUDzqkY4+2wJwMj77ptlyRJJKcdqcvLOsvfAA0sMeP55SSnHxeD5jkPOe999JeaooyRg//0lpdwRw0d2gAQ3FuDY6kSrJe9cY4zCY9POZYmm3K+R1/vXvy4xe+0lKWvWSI47TvLd70p+8APJNddI7rxT8q1vSa64QnL55ZKNGyXf/77kwQcl99wjuesuyU03Sb73Pckdd0hwou98R3LLLRJc0T/+o+Sb35Tce6/kkUck3/iG5IEHJHffLcF5MSsEF4gneP/9EtxJzOr22yW33iq5/nrJ176WBdO47TYJHtmmTRJ0xs254ALJjTdKcIEXXSTBE8SdxOuNp4DLx22/9loJbqy+KpsfeSTm/zPGDAu/sMaYwbEQTmEhTJHzRhu8z0JoIbQQNrEQWgiNMX3gF9YYMzgWwikshCly3miD91kILYQWwiYWQguhMaYP/MIaYwbHQjiFhTBFzhtt8D4LoYXQQtjEQmghNMb0gV9YY8zgWAinsBCmyHmjDd5nIbQQWgibWAgthMaYPvALa4wZmJNOkpQVEnxhq9L8Gc26mM1KKWs1AkrTUn6qAWImV19dYsoizb4ardSpItBUNZNqVk9q9Njycsyee5aYUk6VqHtUnvaYRi6/lFtj8IyqC9RjdysxeNzsXNbEVM/3LYneumoaN2nAFksMEarzXh5T3efzNRmYJPLGG5LqGem9WiwP9Otfl6BCZpV/880S1OLYCwNEZ5wJdfwNN0jyoc4/X4J3BUPhimAX8EMYIKbxP/6HBMcimDP2wqV//GMJbg5u3Q9/KIGn/ehHEtwc2DI09eGHJegMX8Ik0fmf/klS35+Y/AnioUC9MCt4Go6F8OPyMQ1cIAwfI+MZQenxImGSasssTo0xw8LvsTFmYCyEKiqy10KoWWMhtBBaCC2EnJWF0BgzM/g9NsYMjIVQRUX2Wgg1ayyEFkILoYWQs7IQGmNmBr/HxpiBsRCqqMheC6FmjYXQQmghtBByVhZCY8zM4PfYGDMwFkIVFdlrIdSssRBaCC2EFkLOykJojJkZ/B4bYwYGKyuicq3qeIDCHUZ0ngZ7pYDebbcSA7isKNzjnbo/BGslwj1WrCgxmEYlG1rll6s1QDovWlRicIFYdnK//STQiVJO1DweU5kJllGV216J94saXO+VGgiwnAh1XfXI8Kq8HVMtlCrTeOaZEoNbV835p5JlJabWvOz13lujf+/An05eeEHCBUtV2vm2o7xG4f7tb0uwRiXKay1z+YcWlMgIanGcF7OCemGovOjHXsgG1pnEWpGYFYwInobAS3Gv0lUoqbh5ZwSd8QSxvCf++4ULhFw99JAE//nG5cOmoLi4sblb4hnhNcv34rzwNLwMuO1QehyLZVSvukqCG6vvJItTY8ywxG/v3PLEE0+wqQ9PbKXZjrtaif0jXe27LJvTzAFbi3wTsBDGWAg1FkILoYXQQmghNMbsWOK3t5WRIDVwdyDf29A14NjD8w7THqruXLfsytQS2FsIQ3E+C8zWOPMHC2HMlAtue+dkr4XQQmghtBBaCPmM8Jrley2ExpiK+O1tBXaUyFKyK9I14NjD8w5xb96zjOtct+zK1BLYTwijv82Ky83KIPMKC2GMhVBjIbQQWggthBZCY8yOJX57W4EdjX7WjZHW9tjYbMef6NPQ1RJBY/xZHxhbIs0hoz7x565MLYE9hLCWt1EL2pufWsnL3qYRu9A/7q1/zk8shDHxndj6+GWvhdBCaCG0EFoI+YzwmuV7LYTGmIr47W2l1ZQmbGxasL2th/7s6lx3qMGursNbh8KxI1obd02i/tUZQ+1joxa0N41Ne9d20zluxJ+tjfOc55+XYG3Mk08uMaX8OoaLjqZLVlZFv7JIUkmOwkpdOVJy4YWSl16SwMQgG7UzxIzerQaqyGKRuscek0Bj+BRWaLCaq0oOplFJjpwIxWdlU4jS/MsdRXnkEQnWpIQv7bOP5PXXJbSp7Ve6Laq4uHy+k7iiJSXm7bcl2Ms1ZvUVxYmgLeOsVYN/KqjjsRfqhSofhTs6o2LGpKExDz4oWbdOgsVOoROo41GaozOWCYY+3XefBOfFOpMQhvzm4D5jtc/8KeASoG0QFRyLWaEzbArHQvngh7A4mBg6b9ggySeJ2445427gWLwMeAp46665RgI/xBXhLylQTYyMF0n/KsHi1BgzLKgoakYe1RDbuzbyn9sG2k5rh6YxaY9MeEhre+uwrY27Jqgg04KyYnPlY01LsjFhO6j7d/Wcb1BFLIQWwqko8R9v9a/DQmghnIqF0ELYxEJojBkHKoqasU5VbzQ/QWu3hq4OXe2R5BCADthuaG3cNUEFmRaUFZsrJWtaWjcAOtQ/8/44cN5CFbEQWginoqT/fi2EFsKpWAgthE0shMaYcaCiqIEa1SrValn1z4ax7V3jdB1Yql1jD4ntrX1aG3dNUEGmBWXF5krJmpZkA6C9q3/8OdruGnC+QRWxEFoIp6LEf7zVvw4LoYVwKhZCC2ETC6ExZhyoKGq6XGu0nZhV1150a4gdurZHG63Eva2Ho71uTFp2ZVBBpgVlG5srT4s/sbe1c31U3V4fi6PmM1QRC6GFcCpK+u/XQmghnIqF0ELYxEJojBkHKoqakVM11HvjNvo0LWhstiOTHIiWCHrG7frA1g6te3d9UEGmBWUHTaXX2l63oL3uE7ebzkm3eQ6+sGVfSVVe35RGvOXnPy8xAN5CByC/j2me3Ii1a0tMxYmSpUWyWHOYRqFrqXmWIzTqh9UFPhDD+7yP5NlnJUcdJRkDZqXXiyuCIJTykuYODcRGuPJKScXLGrkb7KsmhqdfTWOl5m4JHA8GqCd66y3JHntIcOv4J4zDNboQLu8zlrvEap+opx94QAJtQ1AEo3DHyJjGDTdI0FnraRoC/AGygT/SXHGFBHOGa8EBIEg4EXwYQ+ESsBfyDH2CekFjbrxRgn8MWO4SJ8LlQ3Kgi+iM9UuxF4qLy8e7gfVLYcu4fAg/lA/vJPZiGhgZf8HC5ePpX3aZBMfiivR6WZwaY4aF3/2e7DzuBKmbNrM1jpkhW+vMhYGF0ELYhKJiIbQQWggthBZCY8wOht/9PliczA5ia5G5YLAQWgibUFQshBZCC6GF0EJojNnB8Ls/Gf4/o5kdxPYKcyFhIbQQNqGoWAgthBZCC6GF0Bizg+F33xgzMBZCC2ETioqF0EJoIbQQWgiNMTsYfveNMTsVqK/KuyUUJAVLOO69t2SMXexXJLtLqE9QPrJRIyeqhoJdKLtJ/vxnSSnnSbRzNbLoYjm0xFSzypELpOEreKCvviop5XSJ3nas9nnmmZLqAnHbT4158skSA1uG8lUrdl4bg70YiupVztIIfJ/3SFOejeE6seXkmDH2OHKMJqhrUcdjrUjoxPr1Enga6mlUzPAHLNIIIcRe5LrrJFgrEroIbYMwwABxCViStJfyQZ+wQilGhnvAW3BzcIEwbbyU+Y3dtEmCzni+ME/cq/xPCXjr8FcJPMFHH5XgPzq4OXiC8H9cEd7J3B5xJ3Ei/NPAE9S/d7A4NcYMCz7HxpidCwuhoI5nIbQQWgjbYyG0EFoIjTETg89xzeh/Ljj6Xwx6e263zULEQiio41kILYQWwvZYCC2EFkJjzMTgc2yM2bmwEArqeBZCC6GFsD0WQguhhdAYMzH4HBtjdi4shII6noXQQmghbI+F0EJoITTGTAw+x8aYoYHVoHJ96SXJOFGBEgh0SyifAiXAyCedVGJ4XhbuJ8XgEqoTYd1UIJLzwgslBl6KRSmJLmd6zz1ZKCpLNDlpZ9gU6ro995QAzkpv+4EHSviMNCjVxiHH8r1arCFPxVTv8zoN5tmLZyS6filXVUVpjjoeGgN96uVaGArBNHKrgTDcdpsEVf53vpMFQ0FyIMCYFWwZ/oBZ5TcHPgy7gB+qTlBjMCvcDdxJ3A2cF9aKmwP1yq8Xa5/ixuaehpVRYa04ESaJ9Uvxrx2dcfmYBjrj5b/4YgmEEH920afP4tQYMyz8hCoo1QB7G2OmgYVQT2QhtBBaCC2EFkILoTFmOPgJVVCqAfZuY8L+sVvTs7XRmPmGhVBPZCG0EFoILYQWQguhMWY4+AlVUKoB9m6j6Zb3b93b2mjMfMNCqCeyEFoILYQWQguhhdAYMxz8hCoo1QB7V6DP6OckjSNaG42Zb1gI9UQWQguhhdBCaCG0EBpjhoOfUAWlGmDvCvRpfiYbkdZGY+YfWXl96KESOAD84c03JSiC99pL8vLLkqo0B1KpU0X68aRGi35q6qkSyBXNU4j/tXoHzLm63itjXnutxNAuygualL0kzz0nwZqcWKQQT/BeXeEPF1gOKBLaFPK25kIJhwKvSNBZ57x6tQTAh3MvxSOrlhUVsDYk7xXuBkrVXK5Q1mPS+FtCbnGQHHTGiVB8Y1YYCqqJY3GBeLEw8sMPS6AEsBq4BxY7vfRSCa43Hxmigs64Ilw+zBP/kYX///M/S6BemDNEFK8dbjsuAUNB6jArWCteM7g0TCxfvhWPG+8z3lhcAvZiVvk0dM1VFqfGmGHhR1TBNxSwdwX6ND9bNyJJozHzD6lNLYQWQguhhXBLLIQWQguhMWYQ+BFV8A0F7F2BPvEnRmgdrbXRmPmH1KYWQguhhdBCuCUWQguhhdAYMwj8iCr4hgL2rkCf5meyEWltNGb+IbWphdBCaCG0EG6JhdBCaCE0xgwCP6IKvqGAvdtousX+dWPraK2Nxsw/pDa1EFoILYQWwi2xEFoILYTGmEHgR1TBNxSwdxt1fxw4+tk6WmujMfOPjTHx38zmSmNYfK+QoM5B1bt+fYlBLY7gWMwKK6Nee60EV0T10kvABfJ6yykaZZnkiCMk5UgNFpZcWiTp+qWokTDJE06QUDbKW5rXY3i9i7MlOh96SJK/OTxY7xXenFJ+KlGpK/to1MMXLZLwFS3PSTByuTxm5coSU/GbGF6v3jr8rQT/NPhOYjfqWq1cWeaicMexGBmSgz8AQHIghPhnBtnAcpeo1LHqJgQJ7zeEAZ0vuUQCX4KYQXKgT5jk1VdLMOdrrpGkdsFLiLL0TiDAuEDsRfAE8fSR/E7CWnE3sF4r3rrceOF4eK9wLEZG8ATxUDAU7hUuH++GhdCYnQl+b40xg5OV9RQGC2EkGo6FUOHBeq/w5lgIJRbCRGMshBZCC6Ex8w5+b40xg5OV9RQGC2EkGo6FUOHBeq/w5lgIJRbCRGMshBZCC6Ex8w5+b40xg5OV9RQGC2EkGo6FUOHBeq/w5lgIJRbCRGMshBZCC6Ex8w5+b40xg5OV9RQGC2EkGo6FUOHBeq/w5lgIJRbCRGMshBZCC6Ex8w5+b40xgzPShiYpWm3vsYeE7Ct56ikJa+JDJahjx/GyRoBq4ryoRcluEs5ZwVC54uZ7q4B7NUI1SdE27EWRj0VH8bhxbHXrboqppnG3Ri7w7bdLDP1QXySo9X77lRiuQUrkvNULfJ4mAwqweLHk1Vcl1cj6xmLtRJT1qKcffFCCeeSOB11EbrhBggd88cWSCy6Q4F8s1AvvGXS511qguFc4Fn4Indi4UYKRoUAQJNxJHAtdxBPEjcUFwqXhLXAtWCvuBi4BJ8Izglzhkf33/y750Y8kUL7cPDHyZz8rOeMMCd463Fg8FNwrLEgLaW+EfBS1Rxanxphh4SfWGDM4uXsoFkKRHAFD5cqX760CLIRTsRBaCC2EFkILoTG7NPzEGmMGJ3cPxUIokiNgqFz58r1VgIVwKhZCC6GF0EJoITRml4afWGPM4OTuoVgIRXIEDJUrX763CrAQTsVCaCG0EFoILYTG7NLwE2uMGZzcPRQLoUiOgKFy5cv3VgEWwqlYCC2EFkILoYXQmF0afmKNMUOzu4Y8pclFpc9erPe4WLOnpqyOqWxKOVICyeHikIcUiXppxRsxWKITJ6p86RmJuhYvv7ymWRtD11Jr5Y0tH4jZbbcSk8MT7S+BAmHp1+qKlBWSyv9F6pYvLzF4gkuWlJgXX5SgM8CLdNhhkl/8QsKDFQx18skSVKo4lvW0lqpczxOBbODYDRskeClxXkgOToRFR6ET3/mO5NvfluTeArvAyJgzJBavzhVXZMG9guJizl/5igQ6AcmBeeIScrfErKB8n/+85NOflpx5pgR3A4/swgslWLAU+oQXCbcdl/CJT0hOO03y8Y9L0PlTn5Jgb6/g5tQdujuzODXGDItUCMaYOcBCaCHsgCeyEHZjIbQQWgi3xUJoFjCbS2nCfaYbqRB2APLNTenq2dVuzHzBQmgh7IAnshB2YyG0EFoIt8VCaBYwFsLpIRXCDmDLp1Y3uujq2dVuzHzBQmgh7IAnshB2YyG0EFoIt8VCaBYwFsLpIRXCbLPlO1v9nLwxaTdmHmEhtBB2wBNZCLuxEFoILYTbYiE0CxgL4fSQCmG22fKdbfuZbEzYbsz8Yaos3QrqWpQQqNzIvmkghNi7RLOHBO5BuVKef14y5rzYC5Zp2Dk9VvdCF7GQJp4CLgGLMpZyokaAmMFaS7lU86rmLQkeioa6qI8Ml//kkyUGlSr1WFdGrW7dw5o7NHJeriN6qIQ3Byn3aARcPoY65xxJtRSqkpaq3ItFGlGpQ71gJljQEhaHQAmwouNdd0lgRN/9rgSiAkGCisC18r0wEyzvCZnEnOGlOBZLZeJO4noxFB4KpgETwzqx998veeQRCbwU08gfCh4onhEeCq4Xa9viAvGXBfwZAifCi4Q/Q+AScHMwcr5sLCaJkXXlWxanxphh4WdxVtncoXPJxoTtxswfpixkKxZCYZmFsDMWQgthp3tYCGMshBZCY0wKP4uzyuZunRsVXa274s+udmPmD9sdZBsWQmGZhbAzFkILYad7WAhjLIQWQmNMCj+Ls8rmDp1LNiZsN2b+MGUhW7EQCssshJ2xEFoIO93DQhhjIbQQGmNS+FmcbTa3qd3kjUm7MfOEKQvZioVQWGYh7IyF0ELY6R4WwhgLoYXQGJPCz+JsE0uspgUdmg30zNuNmSegrl23TkJoU7oThqDgy47C/aWXSsw7XhMzxvEULEpZzeqFmGpvjpy3OvYujYDFMKle5eKYNWtKTH693Lu0xFx5pQSdx9njyzGPP15iqIjambPS4Nbh7w6on9EZ08CfMCoe0GAmAHvTxV0VLS+598ADJWW5Bu4Bu8BelLmwi4ceksAfIFc4FieCPSLf/KYES3RCJ7By5mWXSTCN3ADzy4d5ojNcC770ox9JoMdYKBb2CF/C5eMp4PleeqkEK6PC8HFe7MWccb3oDD/ErOB4uM8Y6ktfkkD5MA2IGYaC4eOKYK0YCp1xr/C4dc4sTo0xw8KvpjFmYFDmWghT5LzVsRZCC6GF0EJoIbQQGmP6wa+mMWZgUOZaCFPkvNWxFkILoYXQQmghtBAaY/rBr6YxZmBQ5loIU+S81bEWQguhhdBCaCG0EBpj+sGvpjFmYFDmWghT5LzVsRZCC6GF0EJoIbQQGmP6wa+mMWZgWOVrTfynP5WYuMjSO/zhDyUmX5MT9XTlHuAVzUbJwSWmqtRFrrCCJZasxCqUEKRZvYQ7NCKEudWccIJkB15CfHzLeCwldrcSUz0FZW/J2WdLcPmY1dtvS6D0eDegD6XcFDNmkljsdLGGS6Hi5oh5wsNxXmgLF11F1QtRwbKTEJVcCTAylAD6hL1Qgnwo2AWO7RVcAiYJTcU0EHTGJKFtucVh5Lwzzou/jWEoCBJMGx6ONwdDYXlPLBINS8ck85F/+EMJOsPEcAl4+2GemDM6w7Rxr3AsDBCT1JFZnBpjhoWfY2PMwFgIZ82miIUwYCEMQZXLUtVCGGMhtBA2sRAaM0/h59gYMzAWwlmzKWIhDFgIQ1DlslS1EMZYCC2ETSyExsxT+Dk2xgyMhXDWbIpYCAMWwhBUuSxVLYQxFkILYRMLoTHzFH6OjTEDYyGcNZsiFsKAhTAEVS5LVQthjIXQQtjEQmjMPIWfY2PMwFT+MNKVJqh6z4t5660SQ23TY1Eic43KRRIsK0pvKSdqFB15zz0l5EiNrhS6aFGJwRWhVqmGulDzTAzvhl4+VUTDu7FMsnGjBA6PS8BQr78uQecqQPfi+fLduDEG54U+YdHR6oqUZXDatZq7NbgicXicCOUlni+0/IUXJGNEFBUzHiHKawQGiL033CCJ0vJO4ABYKhPKh8fwta9JMA0sWIq9KOuxsGSufLgE6ARkEkPhivBEMQ10hk7gkcEAcdsxFEwMjocrwkKa11wjwc3BUPivDOaMy8efUtA5v3UwsU2bJHifcXPwn1HcSQQr0OJlwJzzl0Hfdhanxphh4WeRbE6zo2ipMbbS1W7MLoyF0EJoIdweC6GF0EJoITTGDA0/i6SWwJjetBQPgWZvV7eu9oRRIdHamO+KLdgwZjaxEFoILYTbYyG0EFoILYTGmKHhZ5FsTrOjaKkxttLVnjAqJNDS9bN1u94wZjaxEFoILYTbYyG0EFoILYTGmKHhZ5FsTpOBOmH0MzY2X3n0ibu6OqBP0wiaXV2DRMa2d3UwZkZYCC2EFsLtsRBaCC2EFkJjzNDws0g2p8lAnTD62TTGvXXj6Ovfut3a2GyD+kBsR8a2d3UwZoZITTx6oRtQyC5eLME6kxjqrLNKDL77tBo9FntxLMtr2BTdQ8DI114rKftpdCgs70kWa1StURRVyOWX3YtE9/IpKNy7TMNHdm8Mnv6Y6y2ParI/JeSPu5QzNb2QoZYvLzHjeESiEls9Mp3zMr2xiyX5G/vssxIKElaDRBF8220SLP8IJUDFjLIewaRR9OfKB2+BLmLOOBaqCTPBXiwsiUniRDgWk4Tj4Vj4IfbiXuFdwXmvukoCb8ETxIlwvXi+cEu8SPmxEKRLLpFcfrkE7yRuOy4fC8PiP7KYRv4CQwjhw7hevO3QVDwyHZnFqTFmWPhxJpvTjGFzpVL1RqRrb93e1QEk/RtiY+gyRdcgxswWUubGt3OzhdBCmFyvhTBmsYXQQmghtBAaY6YDP85kc5oxbK5UqtkYbY+ILdjoam+ObZjqvR00tvYpbYODsR2MmSFS5sbXerOF0EKYXK+FMGaxhdBCaCG0EBpjpgM/zmRzmjFsrlSq2YjUe9Gtbm8dBzQ1VQN7bKVpn3YHY2aIlLn60loILYTd12shjFlsIbQQWggthMaY6cCPMxmJX1fGM6pq4k9stDbGo7BdN8b2CBrrQeqfrdv1hjGzi5S5o5e7wUJoIey8XgthzGILoYXQQmghNMZMB36cyeY04xlVNfEndrXubXZ1dUCfpjHuZVPH+NplzKyaRmNmjd12k6AmhhKgrKcwLJUce6yklPUxp55aYvbbT4L1S6uVQu/XaKWu0yjlPs30p1Gp5usSlUnenPJkDAzhwgslREc+4QQJVmTF3aA8417pFVHb9tWMYXUMH9l2U9oWvSIs74m6nbMqp2oe0Ai4Oc1/Ybf9d3afEoOVQquRJW++WWJQbeKPFI89JinlZQkKaNTxGBprJyIooFH0o/hGZwTlNY7N9yIozbE2Js6LzjgR9tZaO3kwVD5n3GdYOq4InfF8EUgdArc85RQJxAwujaHwXsW7+k4w5x/9SAIhhNJjfVrcjQcekOAp4BXFnxJw+bmIwuG//GUJTqR/4GBxaowZFny7jTFDYyGcfBoWwhQLoYWwI5ArC6GFsImF0BhjITRmzrEQTj4NC2GKhdBC2BHIlYXQQtjEQmiMsRAaM+dYCCefhoUwxUJoIewI5MpCaCFsYiE0xlgIjZlzLISTT8NCmGIhtBB2BHJlIbQQNrEQGmMshMbMPcs0ZJ3mGY1w5ZWSnshyl/AHKsEKjUoOyvrXXpOgRsLItDh6C5DzYs4Y6o03JCg+wXHHSTDJ1aslkNjq5qzVnBBDjSlrNHqBKjnlAI360m9+U2Kw9ilsCiuU8nFjGkCngWN//nNJKS9I9M8fAJfwpz9JcDeee05SXaDAoVCpf+MbWVD1wp4RVMx4+zdtkmiJzBOhM+Z8yy0SnAi1OKp8dIYwYNVNrH65bp0El4BjYXG4BKxgibVAMUncHPxDgi/h8iFXeGT4TwNsGdr28MNZYGK18ycjY5LojMcNt8R5odbYi+vFebEXunj99RL48A9/KMFT0NeMxakxZlj4mTTGDM0yC+FULIQWwgYLoYXQQmghNMYMAD+TxpihWWYhnIqF0ELYYCG0EFoILYTGmAHgZ9IYMzTLLIRTsRBaCBsshBZCC6GF0BgzAPxMGmOGZpmFcCoWQgthg4XQQmghtBAaYwaAn0ljzBxzpEaXjizlvBgU36zj1aZQBGJ9y1//usTALiAMVee7Y+AeXEZ1s2a7v22Lcu65kmqtSBEVLIDHBS3h0svUw5dq9Nah2kTZg3UHQbXKKDhNc0oMVZNiplExw73iu7Fvvn7pL2NefbXEYChcIE9EdM7vvA8xCrWtPBqDtV7H3Wd52/GqlA0bJFikEYtSPvSQBBUzKvXrrpPcfrsE+oTzYmQIA67hqqskuQPAW6ATcC1cLyb56KMSKB+GwhXhxmKS3/ymBFeE4Lype/B6ZxI8lPy8uBt4grheuDTOi70YGfZ4442SG26Q4L9ueEa4sRgKTwHH4lXB265DsTg1xgwLv5kAlRsyd2yt7lroajdm18FCGLAQWggthNtiIUxiIYyxEBpjesJvJkDlhoxjGnqWH9Ls7erW1Z6wvVZsacx3xRZsGDMDLIQBC6GF0EK4LRbCJBbCGAuhMaYn/GYCVG7I3NGlXl3tCdtrRWnp+tm6XW8YMwMshAELoYXQQrgtFsIkFsIYC6Expif8ZgJUbsg4YEqhMJO96BNbYv+4t9nV1QF9mkbQ7OoaJDK2vauDMX2wEAYshBZCC+G2WAiTWAhjLITGmJ7wmwlQuSHjiKbUbDftsaVurPtjo2u7tbHZBvWB2I6Mbe/qYExOVdmHQK6ef15SIceOXv2GyvGk6K/qeDHAaqlMzFNZDMfLOvOKeGyOjHz44SXmkEMklNgVEhS9lV3oJexRYvbeW1L9h/JyzcsSNc9yqEb/OlAp/VsaoboEAe8GOy+ScK8+I745uhe3DkMhXGNWj8Uyk9ibLyv61lsS1MAsoHEmrLuIvwcgKJGxgiWEEFU+KnUs0oiVM1GaQyewgCcuAZ1RqWNlVFT5uFdQIFwROuNE2IvLx+t+7bUSnCg/L277I49IoG352qe4k3Ba+CGuCCNj9VpMAy8S5AonwsuA9zv30gcflOCKcF68z9ibPwWsT6vvFYtTY8yw8KsJUNiwzhnD1hJUNrrak41I1966vasDSPo3xMbQZYquQYyZEKlrEQthioxsIYxUlyDg3WBnC6GF0EJoIbQQGrNg4FcToLBhnTOGrSWobHS11xuj7RGxBRtd7c2xDVO9t4PG1j6lbXAwtoMxOVLXIhbCFBnZQhipLkHAu8HOFkILoYXQQmghNGbBwK8mQGHDOmcMW0tQ2ehqrzci9d7JB0wYFUIR9thK0z7tDsbkSF2LWAhTZGQLYaS6BAHvBjtbCC2EFkILoYXQmAUDv5oAhQ3rnDFsLUFlo/45qkbqXXljPArbdWNsj6CxHqT+2bpdbxjTC6lrEQthioxsIYxUlyDg3WBnC6GF0EJoIbQQGrNg4FcToLBhnTOGrSWobNQ/R9VIsqt1b7OrqwP6NI1xL5s6xtcuY2bVNBozO7DaJlITl3KiJkcc7/XXS0x13o0xRxxRYo46SkLzXFIkyyXVSpIyKxQ2NJOyKQbramKF0uqKTtbIrUPn6ljc9lM1evlU61c0b2tkZFz+nntKMKt8LVBQueVNkqWy5uoLL0hee02C5wv1qpYzhR4L+Zyxl511kdVSXo/hm6NKz78HoET+9rclqKchG/BD3GisQQpBQrUN14IhwNNgF/mc8zoee6ETuATshbXi8iEbOC8kB4uOYk3Of/5nyde+JoG25aoJb8EkcYF4RnjcUE10xtKgsLhcvDENvDlYzBZKj6eP275pkwQr7uISrr9egkvAnDEyHoqGxakxZlj4xTXG7FSw6iUWQgvhtlgILYQWQguhhdAYMw34xTXG7FSw6iUWQgvhtlgILYQWQguhhdAYMw34xTXG7FSw6iUWQgvhtlgILYQWQguhhdAYMw34xTXG7FSw6iUWQgvhtlgILYQWQguhhdAYMw34xTXGDAzq2kquxMRKeV6yOFuTs1kBCesgbQdGpGbyvhLDJTqVPfaQVMCXxHlY1iu/+Y0EYAlWFv1AzQQ3Z9GiEkMoG6J81c05SSPXW8pKjVBdwsMxuF68G7BHqtcRRUJWxzz3XImBPr39tqSUVRq5OfEcW8n3CtV7JXcSTxDHPv64hKu5lvMkMEDUtVhnEmU9liRF4Q6pgz2inkZZj6FQ5aPavugiCa4I/gDlwyXALRFcPhYsxZyxrib0CQYI48Uiq7gEZP16SW7LmCTkGbqIe4V3A9PA48a/ScwKgadhKIgZ/oQBv4I84wLxEuIZ4fnibuRqjX8pEFHcDT0vi1NjzLDgG2qMGRoLoYWwoboEC6GF0EJoIbQQGmN2LPiGGmOGxkJoIWyoLsFCaCG0EFoILYTGmB0LvqHGmKGxEFoIG6pLsBBaCC2EFkILoTFmx4JvqDFmaCyEFsKG6hIshBZCC6GF0EJojNmx4BtqjBka1LWVEugalWomOBblVimvaoTqRPCWrHNlcWImVdG/ToPOOO/WVS63BzVwWarRJUmhfD/9qaSskKxeLSnlrphKrgRUbtWdzMAjw5qrAKpZzUpv3T4lBlIH9dhtN0kpT8csWVJisHzrySdLAF7C6lV5QfOyZpXksCIBSyQoTflQFmd/OmGJjJoYooICGkUwXg4U/VdeKcFeLNGJZ4YqH3thJnhXcAm4XqzniQvEyDATCFK+FyaGoDPmjAcMXcRrBx+GEMK1MA08BcwKa5CiMxQXzxcOj5GhbQ8/LMF7BU3FvYIuojPmjAVaEQyF2w7lwzPCS5jKJItTY8yw8LOovFOtJDHGzAIwBBayFkILoYXQQmghxAO2EFoIjTGzBz+LSi2BO4kQbiul2hrzXbEFG8bMDc3bOYKFrIXQQmghtBBaCPGALYQWQmPM7MHPolJL4E4rhMnP1u16w5i5YbsabIOFrIXQQmghtBBaCPGALYQWQmPM7MHPolJLYMxYtlQ7of7Brrp9tF23g2ZXfWzN2PauDsYMRPPGj2AhayG0EFoILYQWQjxgC6GF0Bgze/CzqET9qzOWbQVP+Fm3d22Pfjbbkdi/bgRj27s6GDMYUtazkEWJTFSuVBdRbb/xRolBPYljMQ2W9Wl5XV3CGg1QqeMlgLck2hnlFjjwQAkX4SQXxqDOKeUNjTzB/fcvMZA63JxqZHmguO0/+Ymk0mN9GcqLGv3LgoI5V8t7Kmpi55wjKYs0sNa9ikSp/qLxO839msc04DnNsxodKi/NYWKXXy6BL+FYuMctt0hQbT/6qAS3A2U9DAHnRdGP80KBsFIohoI9Yho/+pEEDgCrwV6cCDKJy8cfh3BFmOSGDRL8x+7aayUYGc8XezFn3A0IIfbibwdQL8wZ+oQ5X3yx5JJLJFddJcHqtXjbcetgvOefL8ElYFa4oiuukHz1qxKdFYtTYxYq/3OO4CdUifpXZyxwrS4HG9sOkv4NsTF0maJrEGOGRyrmyqZWWQgDFkILoYXQQmghtBAaMz+hqA0FP6FK1L86Y6mFbdrtjeZ19QFdYzaM7WDMYEjFXNnUKgthwEJoIbQQWggthBZCY+YnFLWh4CdUadyvNWPpkre+7WgE7LGVpn3aHYwZDKmYK5taZSEMWAgthBZCC6GF0EJozPyEojYU/IQqMEBkLHCt6GBd26ON1p+tjZMc27pdbxgzV0jFXNnUKgthwEJoIbQQWggthBZCY+YnFLWh4CdUGYlfV8aSS1pDa4f6Z2tLbGwdE7tiCzaMmSte0LyieapP4ACoiZ/W3KzBsVih9A0NjtWRqQQvSfYvknKiBlcUfeB3HIq3DheI/FaD6/2F5ieahzR4RidrlEabR+mFqlfF3RqhkquZ8LbmTU0v7tXMgBWa3TSA76SC4vvqqyWop1EEozMU//rrJbALnBd7cyPCXggSJBazwl4MhevFJaDoh2vlwTQwZ6wFikli6VfsxbErV0o+9CHJscdK/vZvJSeeKPmLv5CccILkL/9S8tGPSo48UoK9+SSPP16CW/fe90pw7HveI8FQ/+k/SXDspZdK/vqvJUcfLcG7gZtz+ukSnOgzn4lhcWqMGRZ+Fo0xg2MhtBB2YCFMWKGxEFoILYSjWAiNMT3hZ9EYMzgWQgthBxbChBUaC6GF0EI4ioXQGNMTfhaNMYNjIbQQdmAhTFihsRBaCC2Eo1gIjTE94WfRGDM4FkILYQcWwoQVGguhhdBCOIqF0BjTE34WjTFDM6bonwl3atZplHQat94qmSuefFIyjrMl6QXiXp12WonBgo5EV8589VXJuedKcpr1r7atgjVGJu/SPC/JBWlG4L0SVq+W5PB6+4G/DsyAv/s7ycknS445RvKxj0lOPVWCov+kkyR/9VeST3xC8v73Sz7+ccl//a+Sf/gHyRlnSD75SclZZ0kwMi7hwx+W4G5gzh/5iAQ3B0PBTHBzcIGYFTpD21atknz+8xJ1j7JmjQTr5OJYvNCf+5zks5/NglnhKWDvmWdKMBTOi6f/hS9IsBcPBU8fFodZnXKKBHcD/zQwZ7yEeJH0ZWBxaowZFn4WjTFDM0ZUZoKF0EJoIZwAC6GF0EJoITRmAcPPojFmaMaIykywEFoILYQTYCG0EFoILYTGLGD4WTTGDM0YUZkJFkILoYVwAiyEFkILoYXQmAUMP4vGmKEZIyozwUJoIbQQToCF0EJoIbQQGrOA4WfRGLMzA9mYEf1kQ9lbA/bUkBM1OSfFYH3Hins0wqJFkl6M85ZMkHAsFguseE1zuUbAyOWwIlmh6YesX4oTgVKOkeTv1b4aLN96VJEoPHEf8qHKBz8oQdWLahuiguIbQogqHyOjgMaJzj5b8qUvSWBEKL4hV2eoLl50kQRSh0l++tMS+BJEBUPhAiEbn/qUBIt/fvnLEmjMF78owb3C9R53nASChGeUP27sxTTw5x+IKI7FNLAm58UXS/7Lf5HAaf/+7yW4fHRG8LjXrpWsWCHBMzrkEAnc8n3vk2C91sMPj2FxaowZFnwldzme2Apbe9I1QtPe1aFhVqZhzHgshBbCBoxsIUzIh7IQWggthNtiITRmQYKvZM1IdSLsoYztMLv0Ol1X57HtXR0ik/QxZqZYCC2EDRjZQpiQD2UhtBBaCLfFQmjMggRfyZq+ntO3/wyZldN1DWIhNDsdFkILYQNGthAm5ENZCC2EFsJtsRAasyDBV7Kmy3NG7U9sp2msW5r2rj5obNpjh/pn3RIG2NIet5sOcTuSt3d1aBqbXWgxZpaxEFoIGzCyhTAhH8pCaCG0EG6LhdCYBQm+kjVdkgMjarbRv+4We+bbTUvTHn/WLfFn63bc6Lvd2thsNy3xpzHTAaUqKOUEzXOaFzTYe6PmRc2zGuz9tQYn+p3mFc0fNY9ortVgZD3vCkgO5rxWg1mdp3lKg+u9WYNLwLHna+7XYBqY8zMajKxPkJd/kwaPGyfCmpwvSzjyJzW4Ob/U6FD5JfBOYpI49lcaTAPn1QvkFb2i0aFQi2NBS9Ti+LPExo2S22+X3HKLBH8PuPNOyde+JvnGNyTf+pYE08De666T3HCDBCPfdZdk0yYJ5nz11Vluu02ST/KaaySY5De/KcFQl1wiwfXedJMEezFnTGP9egkeCh43ToRLuPlmyZVXSq66KgtGxuVjLyaZvww40aWXSnA30HnDBgleFUzyssskd98t0TvJ4tQYMyxlHCPtiTTt6Ja35z/HtqPDiK6jurbrjb7tXR1afxozHaiAioVQq3zM2UIYgxNZCGN0KAuhhdBCaCE0ZgFTxtElOV0u1NWe/xzbjg4juo7q2q43+rY/UbGtq3YzZvpQARULoVb5mLOFMAYnshDG6FAWQguhhdBCaMwCpoyjS3K6XKirPf/Z1d5so8OIsUdhu97o244OIN9rzERQARULoVb5mLOFMAYnshDG6FAWQguhhdBCaMwCpoyjS3LGulPXz9hz7Hb9E6Bnvh03+m7XjbEd28ZMHyqgYiHUKh9zthDG4EQWwhgdykJoIbQQWgiNWcCUcYwUKNK0o1uzkXQbtaAPGmN7sxctDXHX2G00RvL2rg5N46g9/jRmcvI6fuQJTVATP6+Be+BY7EU9/XvN6xqcF0HhDp3Q865ApY5pQAh/rIEwQHJECA87rMRgLb1+7K/JWarJV93M2UsDFmnAbpocneSvfy0ZQz6Nftyt6cHbb0sInsISzRVXSGBxKJFvvFGCY9E5PxZ2gYUl68OToa6/XoJKHZ1vvVWCkVH0P/64BEU/RsZSqFjOFJM8/njJAQdI/uN/lCxdKsHCobpkpfzLfyerdHXTFSsk73+/BGtjvuc9kve+V5Lv/bu/k/zt30o+qGvb4m6sXCnBXyX+6q8kOBGuCLPCedEZwX3G6rX408l550n+8i8lWK9VHwqLU2PMsPCjOUfkNpXsrcVsTthJpmF2USyEMRbCgIVwYiyEFkILoYXQGDM9+NGcIxKbSnYZMz+wEMZYCAMWwomxEFoILYQWQmPM9OBHc45otT7/n93MAsFCGGMhDFgIJ8ZCaCG0EFoIjTHTgx9NY8zgWAhjLIQBC+HEWAgthBZCC6ExZnrwo2mMGZqZCENZo8k4+WRJKedqenGPpJd7lE2aDFTI5ShNH15/XTIgx2ky7r1XUq0j2od9NTmUulWajHPOkVTr4vbiGE3G2rWSUjZq+oAiGP7woQ9Jjj5aAn/4wAckEBUoAfairIch/M3fSD78YclHPyqBP8AuTjhBgkuAbOBY7MXdQGeoyIknSo46SoKnkDsPpA578RRw2485RoIT/fVfS7AX58VejAwFwhNE52OPlaAzToS9OBYj4/liL54gngLuBh4o/mlgkp//vATPSC+BxakxZlj4WTTGDI2FsBsLoYWwCwuhhdBCuC0WQmPMzOBnsWL0P+Qb/W/5vD2322aeYiHsxkJoIezCQmghtBBui4XQGDMz+Fk0xgyNhbAbC6GFsAsLoYXQQrgtFkJjzMzgZ9EYMzQWwm4shBbCLiyEFkIL4bZYCI0xM4OfRWPMwFx5pWQMWuUffLCkVy3+xz9KxkBh0J2LJDn9VrCcCZzzSk0GJKdy6T4crcnhnPuAY9+tSXnxRckpp0h6gnViU/r9KUHB9a7Q5OyugZlAJ444QoJFGlFef+QjEhTBKL5RXqOeRpUPq8F6j+icSyyOxRWtVKnDyFhXE50R3Enszb0F50XQGYthwmqg1njcuHy4FowIpo0T4YrwFDAyOuOhYJIrVkiwvCdWVcUk8ebgncRfFnCfcWOxF8fiPuPpY9FRvXwWp8aYYeFXEvzFX2QZkEnq252ceXAJZodgIdxRcM4rLYRdWAgthBZCC6GF0JgFC7+SoJbAnkI4SXU6YR82zTY4RfOzq30azORYM2+xEO4oOOeVFsIuLIQWQguhhdBCaMyChV9JUEtgfyHEBojtSRHb1T6LdJ2iq30azOJQZv5gIdxRcM4rLYRdWAgthBZCC6GF0JgFC7+SoJbAPkKIinRsgVo6+rSOEyvepgCOPWNjbMeupCVp7zqq6VC3x73GTGEh3FFwzisthF1YCC2EFkILoYXQmAULv5KglsCdQwhjS/w5w+3RBn4m7WO3Rz+b7fqnMT3RIviuuyQ569dL8O3uxe9+JxmDzrkfeuybb0pyHntMMhx7SF55RTKrXK4BD2iUJRq1RxhQxR0xS5aUmIrTNOANCTyN3K0RXn1VMmYoLO2LMheFbC4MKK/zWhyGkPsDjm1koDUo3HEJedGPOWMauHycFyNjHVFc4D77SHDrMCsIEobCifCfM3SGacNMsHfZMsm/+TeSf/tvJdiLfOITkrPOknz2s5IzzpCcdpoEK3ZecYXki1+U7Luv5OqrJeiMWeEvGnivIKK47V/5iuSiiyQ47+mnx7A4NcYMC7+SoJbAHSmEXR3ycbp+7mztrT+N6clWL2piIUywEFoIO4eyEFoILYQWQmPMdviVBLUE7jAhTPbm42yu6OrWbAB0wM/Zam/9aUxPtnpREwthgoXQQtg5lIXQQmghtBAaY7bDrySoJXDHCGGyq1R7858NXd1m2H/a7a0/jenJVi9qYiFMsBBaCDuHshBaCC2EFkJjzHb4lQS1BPYRwtKhSdNwpPzw1r2xvWt79BMbk7d3bY826p/YZUx/tnpREwthgoXQQtg5lIXQQmghtBAaY7bDrySoJbC/EDbExtYOI5pdkdhe92k9PDbGduyqG5ufeXvchcZmGz+xy5g23qVRDjpIslIX7atALf6y5inNmZpnNb/VvKR5UfMLzQsadH5F80vN85qnNfnIuF7sxQUi6PyM5neaKzUYCk/h15qTNbjA1RrsPUlTX0VyRbh1eBnye4Wnv0mDY3H52IvzojNOdJMmnxXynEZP9KUvSS64QII1Z888U3LqqZKPfUxy4YWSyy6TYInhjRsll18uufFGyfXXS269VXLddRKU5lddJcF5r71WcumlEhyLS8Ak0fmmmyTo/LWvZcEV4dhNmyTXXCPBBWKoG26QYCicCJ0xSdw6BOfF8734YgmeL+7zV78q6fUE0RnvJC4QJ8LI8FKcCCKKzvpusDg1xgwL68edFUjXJPTtv6OZxiWYBYmF0EJoIdwWnMhCGGIhjLEQTv4E0dlCaIzZdYRwGti+zK6JhdBCaCHcFpzIQhhiIYyxEE7+BNHZQmiMsRAas9NhIbQQWgi3BSeyEIZYCGMshJM/QXS2EBpj5rUQGrNrYiG0EFoItwUnshCGWAhjLISTP0F0thAaYyyExuwEoHJFmftKGnharnzonBffmMYmDcprdEbRD+fJJwn1wonO0byiwTQQqCaSX9HNmgc08ENcILQNJ8Llv6HByHhkeKC5ieGKMA3M+WYN3g10xp38heaPmhs1d2p+o8GJsBcXiL2f1OAp6I1F5QqNOf98SV7mQr3QuVc9vWGDBErw9a9LUNbDaqAi0BgMhcAQbr5ZklsrrheTxH3Obw6OxYkQOE++F7cd00DnSy6R4Bl985sSPAUE1goDzJ8gJomhcL3oDC3Hy4AHiml84xsSdMaJcK9wCXqvWJwaY4aFlakxZnByE3slDZQABbSFMKaWwJj8im62EFoILYQWQkqOhdBCaMy8gJWpMWZwchN7JQ2UAAW0hTCmlsCY/IputhBaCC2EFkJKjoXQQmjMvICVqTFmcHITeyUNlAAFtIUwppbAmPyKbrYQWggthBZCSo6F0EJozLyAlakxZnByE3slDZQABbSFMKaWwJj8im62EFoILYQWQkqOhdBCaMy8gJWpMWZwnk5XztQsLjFYZXSzwvPsr+F5Ubi/psHeXIHQGYW7sq8G7KXZTfLb30rKPpolmkWavTUwk+VFslRy330S7OWJyj0xBxxQYkq5XaIXOObmHKE5WKPTWLVKwknqe4UKmdPQST79tIQjv0uDC0TQGdHne9RRkjFD6QUu1rBEhhGhUv/UpyRr1kiwBukXviD53OckKKChfFAgiNlValPr10tgCBgK573zTsm6dZK1ayVQAugEdPFb35LgTiLf/rYEe7/7XQlEBQqEaWDOuHWwuNtvl+BYnAjH4hnlS79iknfdJcH1onNu6ZgV3mdcPq4XDxQ+fNttEjwjTCN/vno3WJwaY4aFBQbYsCHLgLTXt/0ZO8hsnciYyXnaQtjpPBbC5OZYCC2ETSyEFsImFkJjTE9YYIANG7JMQFadbiV26OpTJhC5CZlknEn6GDOLPG0h7HQeC2FycyyEFsImFkILYRMLoTGmJywwwIYNWSagKUpbqtOtdLWDCbuNZZJxJuljzCzytIWw03kshMnNsRBaCJtYCC2ETSyExpiesMAAGzZkGQcq0pYCtaMR1H1aK96mMWmPu1obm11oMWbH8bSFsNN5LITJzbEQWgibWAgthE0shMaYnrDAABs2ZBkHKtKWArXb1iL1OE1L3JiV7aYl/jRmR7KnRitXltdYZhNVry4didKUHJamnKgBZ0lQi5d1kt1LzD77SMoyzVEancZhh5WYsofk5Zcl75T5EtzYgzS4BL3txx0nOeEESSknSCCivDm/kuD5ak45RYK7gb1//rPkT3+SVNO4UIK9+sh46/bT0FqPkegzwolgIuysf8L42c8kvF24BAyloKrnbxSy0EVUvai24Q9YKhOLjmJk+AO0DbU4yut//EcJpoGRsRfT+MEPJPffL/nOdyTwBzxRmAkmieDGQpAwMvb+0z9J7rlHgutF7rhDct55Etyce++V4FXBrHDbcTdgy3iRcHNw+ZgzhsodDy8hJvnf/psEI0NEMY3clnHbdZIsTo0xw8LPJNiwIcs4+lpWLWZNe/KztTHKXq/21p/G7EgshDEWwhALoYXQQmgh3BJcvoXQGDOr8DMJNmzIMo5pWFZrn0nG6eqTtIPWbsbseCyEMRbCEAuhhdBCaCHcEly+hdAYM6vwMwk2bMgyjmlYVmufScbp6jNhO8j3GjOrWAhjLIQhFkILoYXQQrgluHwLoTFmVuFnEmzYkGUCWgUs2e4ysa5ucWPa26OfrdvG7HgshDEWwhALoYXQQmgh3BJcvoXQGDOr8DMJNmzIMgEj70rsa/Sz7gO6DmltTNrjrtbGUXv8acwOZqkGOgFdVAM86CDJSy9JWMejYi6vS3p56YEandUbb0h4XvrDmTFvvVVieGweTBJXtJemvCWBWh+gAfAluMfeGh3qwAMl1Wqup0sw1BEaXD5MTP92gEqVl5DfycM16IxXBS8wbk5+IuzVHHGEhM9X/6KxerXkpJMkHBylKkpzKAECJUARjNIcFoe9MCLU4ii+EVT5WFYUJ8r9Ac6DOWNk3Kt8ZFhNboBwD3gLzosnCDPBip24V1iRFefFMpvYi8eNh4LOuBvYiwvM/yrx/e9LYOm4fMwq/8sCOuORIQ89JMF9xhVdcIHke9+LYXFqjBkW1jk7K7W27SAGO5Ex21lqIZyKhdBC2BULYRYLoYXQQmiMmS6sc4wxQ7PUQjgVC6GFsCsWwiwWQguhhdAYM11Y5xhjhmaphXAqFkILYVcshFkshBZCC6ExZrqwzjHGDM1SC+FULIQWwq5YCLNYCC2EFkJjzHRhnWOMGZqlmnKa5ibN4xItvo8+WkLJQRFMVklU2xYvlrCOhxKUWyXoXNZI4A/ovI8Gx+oqlLzA5ZrySQlnpUBjytclsKmDsgVLzz5bQo3BrcPdwBUhWO1TjYgj65zf9S4J7wZOhDljkodqcN5DNPhzAO4zglkdqEFnvO3lHgkeGYIyF3UtvAVlPfbCprDcJWpxLP8Iu4ADYNlJHIuyHoaAOV93nQTuATFDWX/33RL4A4QQ2pYvK4qhsMgqRBQXiBNt2iTBzYGJ4US33JIFdxJPAUPhRHigkNj8RLDWq66SYOQrr5Tk7wbeduyFDyP4h4PXG+8zNFXfKxanxphhYRVkjBmapRbCEHS2ECaxEMZYCJOiH3O2EFoIm1gIjTEWQmPmnqUWwhB0thAmsRDGWAiToh9zthBaCJtYCI0xFkJj5p6lFsIQdLYQJrEQxlgIk6Ifc7YQWgibWAiNMRZCY+aepRbCEHS2ECaxEMZYCJOiH3O2EFoIm1gIjTEWQmN2Al6QLFeNebemrI95/fUSwzq+3KFZKUGVjxJZh9p3XwmLfoDCnayWYChcAmYFP1ykSW1q0SIJz5te/pi9Za0EooLOM9m7TLNcg8vH8wX5bYdp61B77SUp5WcSDHWwBo/sSA0uAZ1xc5ZqcF4E17u3BqIC54Hk5BoDm7roIgmqfFTMV2mVn+sEAl9CaY4qH44Hm8IFwh4xMgzhAx+QfPazknPPlVx4oWT58iz4c9dpp0mwcOjSpTsquM94ZOvXS2DaeKAQQjxQqCYeGYbC88WsIJN4YzEytA0vA4wXna+4QoJ7hVdF/1mxODXGDEssEFr413/NMiCbt8LWGTCT0ZpjZ31WZmFiIew2E8zKQhiz3EIYgvMiuF4LoYVwerEQWgiNmY/EAqGFWgJ7CuFImXJxmrAPm2bGTAaMx85kHGNGWAi7zQSzshDGLLcQhuC8CK7XQmghnF4shBZCY+YjsUBooZbA/kKIDYD2CbvNnJkMaCE0s4uFsNtMMCsLYcxyC2EIzovgei2EFsLpxUJoITRmPhILhBZqCewjhJPI3vT6RLp2tbbHlq7tujPa613xpzF9sRB2mwlmZSGMWW4hDMF5EVyvhdBCOL1YCC2ExsxHYoHQQi2BO40Qtm5PdQo/W/vUG6PtrqNat5uW+NOYnqDqReVajpWgzC0/l7xb7RGdUW1zVcY/SlAxl0c0p0lwIuQoyZIlkiOOkHAVStycwySoGMteGhgR9sIt99Ogcy6EEBXYFDpjKFwgbiz2jnmCZ0pwXs3KlRIuwZqLGUbD9ZbfSpYWSXlUgredd+NeyfuKhP9SFOzFMwKoa1GpY/lHlMj5CpYo61Ei5w6AOh7atmKFBCZ2wQUSHIuRYVO4G5gknDYv+nHrvv99CYaCS8PDsaAl9uaaioeCK8LI8KUvfUmCzrhABNPIXzPYFCaJJ4ihcCz8EEP1es1WrZI8+KAETxDXi/PiKWhYnBpjhoWfRVBL4GwLYdmuWLVoNeTjjD2qtcOoMR+qa4T8pzE9QRHMMvdYC+FULITZEzzTQjgF9loIYyyEMRbC5DWzEBqzMOBnEdQSONtCOPM+8edmpe7QEDugMdK0o1vy05ieoAhmmXushXAqFsLsCZ5pIZwCey2EMRbCGAth8ppZCI1ZGPCzCGoJ3ImFcML22Nh1CMi7dR1lzGSgCGaZe6yFcCoWwuwJnmkhnAJ7LYQxFsIYC2HymlkIjVkY8LMIagnsI4Slw8q6tuufDTgkDtt1irxPvTHaxs+6vauPMdMFRTDL3GMthFOxEGZP8EwL4RTYayGMsRDGWAiT18xCaMzCgJ9FUEtgfyFsiI2hS3sfgMO7DomNcVfdOdmuO6M97kI3Y2YMamJWvSoMqMVhNSjc4XiHa8rVEkxjqQYjo3M5Kwbr0tHTwKGaIzSwKbXHZcskixbpsqKbNbgEvc9vvCHhBeJYzY9/LKFbAhwOb0EwDY58q0bBbcd54eEYGeaJdzK/fGgq53yz5iRJfvn614GnnpJwznr5zz0n4UKLUD6U1yiCsfeeeyQQlc99TvLBD0rOOUdyySWSE0/MAgPE0qBr10qgBKjOcUW4BNwciBmGwl4EGnP55RJMErPCND7/eQnmnD9fyBXOm3fGFeFYdMbfDjZtkkA1sQItkq/2ibuBy4e15ooLXcw1FYqLOePd0BOxODXGDAtrhp2VqGE7j4NBDo2ZDVD1WggthF1GxJEthBZCC6GF0EJojOkNa4ZdATuYmdeg6rUQWgi7jIgjWwgthBZCC6GF0BjTG9YMuwIWQjOvQdVrIbQQdhkRR7YQWggthBZCC6ExpjesGYwxcwyqXguhhbDLiDiyhdBCaCG0EFoIjTG9Yc1gjBkalLkILA6grM8LaO28kutM/kqj5NOgtV4o2UfW8/zTnyRjVvssf5DoJTz0kITXi0BFVmh4CTdKIKIYGcfiKXDk4yXwtEM05VkJHf53mpUSXK/qE2eFF4nTOF0C18LNwYlwLG4OOvPpnyrBFWHOeCjlBMnS9C8a118vQeUKJUARjFocwQKeOBYjY31L5Hvfk8A9UPT/4AcSGAJGRpWPE8HE0BnnxZ3EJKFAsFbIFZashON99asSaAyeIK733nsl8DRozH33SbAUKu7zD38owV5cIC4/l9h16yS4Ilw+xAx/wsjfOjzfK6+UYM44L/4agvNC+PX5sjg1xgxLMcbMMShkkb1TE0NdayFMAp1YoeElWAgthBZCC6GF0EJozIKgGGPmGBSyyN6piaGutRAmgU6s0PASLIQWQguhhdBCaCE0ZkFQjDFzDApZZO/UxFDXWgiTQCdWaHgJFkILoYXQQmghtBAasyAoxpg5BoUssndqYqhrLYRJoBMrNLwEC6GF0EJoIbQQWgiNWRAUY8wco7XpWWdJWLkiANU2OqOeLtdK6sFjUPRjddOjNDjRgRoK0lMa4eijJZzV0RryZJqcdTGHHVZiCG7OcglqJKIac+SRkqOOkhCVSVRupdyjUfROQluWL5cQCGF5U7JU1UvZnDLm7w4pJ5wgGQNOdNllEhSyMBME7oFVGVEx40bDAeBLqNRR5SMQFez97nclmAYcAAuWXnWVBCNDFz/zGckXviD5h3+QQHLOP1/yla9I1q+XXHSR5EtfkuAZ4d8GzAR78TKgM6YBL8W6qVgLFDaFy8ebg9uOR4ZgZEwDI/+7fyf50Ick+IeExWxPOUXysY9JPvEJyamnSk47TaJ7WZwaY4aFX0kTeGIrbJ2MCQ+cySnMfEFLcwthxEJoIZwQC6GF0EJoITTGTA9+JStGxtLQ1f5Eh9W0dujqPA1mcaiaZPBk14iuDnV73WIWGFqaWwgjFkIL4YRYCC2EFkILoTFmevArWQFdaX5OojEzOXZCZnGompkM3nVs3V63mAWGluYWwoiF0EI4IRZCC6GF0EJojJke/EpWzETqWvs8EWhamvbmZ0P8OerTtDQ/Y8u2rvpztIGeDaMWgPbRz6Z/3DtqbGga466656ilaY8/zQJDS3MLYcRCaCGcEAuhhdBCaCE0xkwPfiUrutRlEofp6lOPGVvqvc1G3MZG/jMei5/Y1YBGdGs9vGt79BMbkdZGs1CgAfbh7rslOSi3ysGaFIgK6/gxPBTT89g/aO6OGTfU6TGrVpWYnGrkVTHYCy68sMT04o03JD0lVsCsuBvgTwl96HciFeBSjolZs6bEjGF3Tblfk3OxBKUqglfnU5+SrF4t+fSnJeic780L6Hwa6HzGGRL8Vwba9slPSj73OQk647xQAtwNGEKez35Wkl8vZoVj4S1///dZcCKMjDuJOeOBYhof/7gEI+O2Y+/ZZ0vOPFMCtcYqsniCePr4Z4ahcF6Y9jnnSDAUbg7uMy5Bw+LUGDMs/EhWjMSmoav9iQ6lae2AzhP+RPuIrs742dXe+nNE3mfsyBO2j2htNAsFC2HKHyyEFsJ2drcQhqDzGRZCC6GF0BgzKfxIVnS5Sld7QpcUTfiz9YxdnfGzbgdx7wg0dv2cYfuI1kazULAQpvzBQmghbGd3C2EIOp9hIbQQWgiNMZPCj2RFl6t0tSd0SdGEP1vP2NUZP7vaE/JDxo48YfuI1kazULAQpvzBQmghbGd3C2EIOp9hIbQQWgiNMZPCj2RFl6t0tUcmlKLk5xNbad3GRv2ztX+9a/Sz2Y4kfeLIXdujDfxEe2uLWVhYCFP+YCG0ELazu4UwBJ3PsBBaCC2ExphJ4UeyoktXRvITYY+ttHZAS9zVtDQd4t7YPklL0x47NC2xZytxF7phV6TuEH+iW9xlFiyrJHvq6pEsoDfFvPhiiclL83zvGDiNlDGdz9OkqKhcfLGE5OfdHf7Qg9dek1QLpSrvk8zotvdiBlLHl7APuMC99y4xZDdNOU4jYGTsLeUsTR9wr1DXwgFQ16LaRtGPehpDoTRHWQydgFyhcMexqNS/+EUJzosrWrtWgqVBMY1e7oFZ5dPAUzj3XAkuH+c97zwJngLmjFlhL6aBE2FkPIV8VvlDwZ8DMCvcK5wXs8IThNRhL2b1kY9ITj9dgvcZTosXGJeA69V7xeLUGDMs/EqaAMxtEqbRv+8hZv6xSmIhjGjhbiHMgOT0Y5WmB7hAC6EEQ6EmRllvIbQQWgiNMXMBv5KmP43R2e7M9FglsRBGtHC3EGZAcvqxStMDXKCFUIKhUBOjrLcQWggthMaYuYBfSTMtRipoGzTTY5XEQhjRwt1CmAHJ6ccqTQ9wgRZCCYZCTYyy3kJoIbQQGmPmAn4ljTGDs0piIYxo4W4hzIDk9GOVpge4QAuhBEOhJkZZbyG0EFoIjTFzAb+SxpiBGVf1ZvzkJxLC4vvmmBUrSswYVIGeeUbSj4PT1U11zjO5OdXlr9Fk7L675J57JDn77COZiYiOQS/w0kslva4XgsQFaUH6jA45pMSM4UDJunWSntyh6QPKayQXJDgAamLU8Sj6MTLKeigQ9qJSx2qfWHQU1rpqlQSTxAXiik48UYJJwqZwgbny4bzwBwTLe+IpQEUwDexFcolF8svHUBAzmBiewgUXSCDteEVhnjhvrtaYM86Lm4OXECfCXtz29NaxODXGDAs/i8aYgUE9zd0pFsIMXn4PQbIQWggthBbCLalPHZNfPoayEHbfOhanxphh4WexYtv/Nu6JJ7w959tmfoJ6mrtTLIQZvPwegrS7hdBCaCEcxUKYJL98DGUh7L51LE6NMcPCz6IxZmBQT3N3ioUwg5ffQ5AshBZCC6GFcEvqU8fkl4+hLITdt47FqTFmWPhZNMYMDOpp7k6xEGbw8nsIkoXQQmghtBBuSX3qmPzyMZSFsPvWsTg1xgwLP4vGmMH5k0aBTuytKT/X9OFdmhx1gF6CVHGtRoBdlHccMGYfTR+wImvOBz4g6bVy5q9+JSmHaIA+hauvlpQVGjB7qvn730suv1wC+IzIkxpF/7JQymka+ZvFuGPlRXr22RJDeOxGCWrxmVS9KPpRbcMBUKljZOxF0Y8ToTOcHv6AY3EJmAYCnYCo4ALzwBAgdTgvOuPGInhkuEDcHNzYXIFwIuytrzEGzwjqheA+51cEacckcevO0JVC63nG4G5gVvlbhweKV0VHZnFqjBkWfjSVJ1LYewHTVhQZMykWwikoGxbCGGAhtBBaCFuT65OF0EJojFH40VSogAp7V7SVCtLYWlTExthed+hqr3eNqNvrlukxW+OYhYmFcIr4z3jLv6vNFkILYdexFkILYUdyfbIQWgiNMQo/mgoVUGHvirpaiC31rry9/tm1Xf/saqxbpsdsjWMWJhbCKUb/jWiwEFoIu4+1EFoIO5Lrk4XQQmiMUfjRVKiACntX1NVCbGkrJLZQtyeHJLtq6j6xZTS3EaHLRO1xV1djs6tpNGaEhXCK+O9ny7+Wd/69xFgIIxZCC6GFsDW5PlkILYTGGIUfTYUKqLB3xahUaAqG1p81dXtySLKrpu4TD+/aHm3gZ9J/7LYx4FhNH5ZpAIvg2zW/1/TiOY2iglTKU5pNkiOKZJEG7K8B+bH53n01AMfmyT1thUaPHf2XokEOfIf3aZZqygkSHRk+fNNNklLOjRkjwOUhDThJszLm/vtLzAMPSDBngr18ZDdqhGOOkZSySoKyHmUuiu8vf1mCSh1BEYyRUZqjgMaiq6jFUbjnhnDXXVk+8xkJpnHKKZIPfUiycqUEf0r5ylckBx8sef/7JR/+sASW/jd/I7n4YgmM9/jjJR/5iOTrX5d89KOSDRskWL0Xt/2aayS4OZdcIvnOd7JcdJEEdwMvA27sJz4hwZKzGzdKbrxRgueLO4nVXG+9VYKlbvHWITjvN74Rw+J01+e7xuxSxC9mDRVQYe+KUT3TVDX4OdquK5+6CsIIkbGjRWKHhmYXesafDWP7T9huTMRCaCHclqn/Mm1FDiwWQg0fmYXQQmghtBDuLLDcNmbnJn4xa6iACntXRB2K21M9AkmHSXaB1va6ETOMxD51e+wQf6JzbJ/qbYxiIbQQbkvrfz6msBDG8JFZCC2EFkIL4c4Cy21jdm7iF7OGCqiwd0XUobg91SOQdJhkF2htrxuTkUegvat/V3tDV7sxxUJoIWyyWZEDi4VQw0dmIbQQWggthDsLLLeN2bmJX8waKqDC3hUt9Uy3O41tr392bdc/uxrjSVtHQ2Nr/67t0U9sGFNjIbQQbsvovyANcmCxEGr4yCyEFkILoYVwZ4HltjE7N/GLWUMFVNi7oqWeaVMsVD6xMbbXHbra610j6vbY0nV4bIy7pnpv31u3x8Zm2xgFZe7RkjvvlFSupY6X19PgQI0W7tWJ9NADJQTT2EeyerVkjOMpy5ZJyhLNIRpdwBMLaRLMGUCtdeRKrsDrGiU/b8o++0iIjnzqqZIx5LPC3sM05Vca5UANT3SiJmWpBi+DEv+73PKf402bJCigb7tNgjVYUYvDtU47TXLiiRKtiVkxX3aZ5OMflxx7rAR7UcdfdZXk7rslmAaG+uQnJfCHa6+VXH+9BHtvuUWCoSCieGWxFzfniiskkDpYOtbzxCqj/+E/SP79v5dg73XXSWCPmCSewkknSeClJ58swZuDZ5QHTxDW+t73SvC3E0wDmnr00VlwImj5Bz8Yw+LUGDMs/CwaY4YGNbGFsBsLYcRCaCG0EFoIx8dCaIwZBz+LxpihQU1sIezGQhixEFoILYQWwvGxEBpjxsHPojFmaFATWwi7sRBGLIQWQguhhXB8LITGmHHws2iMGRrUxBbCbiyEEQuhhdBCaCEcHwuhMWYc/CwaYwbnas2PY973vhJTygOSvUsMCpuypwaFu+beeyUAtdkhh0hKOV9ycIlB1Yd1JssBEmjbmDp+x6Gi8pOfSDCrHMpkPy7XCDzTUJRyjkYnuVQ9bYVkv/0kzz4rwb+FAw4oMeVQyUpd3rKUn8Y89liJKXtI7rhDUh58UPKv/yp5+mnJL34h+Zd/kTzzjOT//B8J9v7f/yvBpG++WZIPlZ8Xk8R9xxXhevffXzKLYJVRBEtlIr2APP/n/yzB37ewnCn2HnaY5D3vkRx5pGQWwUK4eEZ43Hi+SH5svhev2f/+3xL8w8HrnU6SxakxZlj43xxjzOBYCC2EXVgILYQWwrb0wkIYkx+b78VrZiE0Zr7A/+YYYwbHQmgh7MJCaCG0ELalFxbCmPzYfC9eMwuhMfMF/jfHGDM4FkILYRcWQguhhbAtvbAQxuTH5nvxmlkIjZkv8L85xpjBsRBaCLuwEFoILYRt6YWFMCY/Nt+L18xCaMx8gf/NMcYMzjMxDz1UYtavl3AhzfKk5mHN8ZJ3F0l5KubVV0sMVjdFRVHKMZo1Mahjqal6vWV5kejIVdH/huaVGNy6s86SQBiweF4p90kOKhLe9nMlRxWJWg1WB4Q+obzEvUL1xduusxr3yI6NufXWEoPVAUt5Oea3vy0xpdwb88YbJebhhyWHHiop5WTNi5p1mtNjsPwhX2+9wOOPLzHlcAluO28WKlf4EjpjL54ZymsEFTPKa+zFefO99bli8qHyS0BnBHcj34tp4LbX006mgVuHzvmNxXnzy8dQuATszUfOj4Vc4VgkvyIMhb04Fp0xK3TGNJ56SoK96TSkMjXGDE5J2ZDC3jsrW/+iPffsJNMwOyEWQguhhdBCWFkN9uK8+d76XDH5UPkloDOCu5HvxTRw2+tpJ9PArUPn/MbivPnlYyhcAvbmI+fHQp9wLJJfUWpiPBadMSt0xjQshMbsspQUKqDC3h2E/z+j8e1NY9zV2hhp7VBvTELduW6ZHrM1jpl/WAgthBZCC2FlNdiL8+Z763PF5EPll4DOCO5GvhfTwG2vp51MA7cOnfMbi/Pml4+hcAnYm4+cHwt9wrFIfkWpifFYdMas0BnTsBAas8tSUqiACnu3ES2o73beGMk75HtB3blumR6zNY6Zf1gILYQWQgthZTXYi/Pme+tzxeRD5ZeAzgjuRr4X08Btr6edTAO3Dp3zG4vz5pePoXAJ2JuPnB8LfcKxSH5FqYnxWHTGrNAZ07AQGrPLUlKogAp7V3QpUN3etNS7uhojrR1ax9wcaBojdfskh0/SHnd1NTa7mkazELAQWggthBbCymqwF+fN99bnismHyi8BnRHcjXwvpoHbXk87mQZuHTrnNxbnzS8fQ+ESsDcfOT8W+oRjkfyKUhPjseiMWaEzpmEhNGaXpaRQARX2rugSm7q9aal3dTVGWjvUY0bX6vKuurH1EGyPNvAz6T922ywg9t1XwgU836cpD2mei0FZf/HFkjfflJTyQsyFF5aYUv4Qs3FjiXn7bcn550tKOU5zqebHMXvuWWIqffpjDGTjl7+UoHMpq2KWLCkxP/2ppDKT1ZI9dJlKrPVaPhCDSUKuqmVjr4w588wSg+VbFy0qMVD6l18uMV//uqTsLqEPq9PizcFKofjLwt13S5YulaxdKynltzFHHVVi4Jb33Scp5WyNvGaPP15iIM977FFisGwsi34k95ZewVD/oot/5ufNa3HsxXmxt1eVj1lhb+7DmAbOi875JfTqnB9bP+LkArEXI9eHJ53/3/+T1P1jcIH5rasvOQadEZwI7yTOmweXgL24fJ0Gi1NjzLCUFCqgwt4VXXpTt0OKGpLGSGuHZKP1Z9NY0+xCz/izYWz/CdvNQsFCaCG0EFoILYScBo7t1Tk/tn7EyQViL0auD086WwgthMbsrJQUKqDC3hVdhlO351LU2hhp7VCPubliqvd26samhQeHnq3tsUP8ic6xfaq3WThYCC2EFkILoYWQ08CxvTrnx9aPOLlA7MXI9eFJZwuhhdCYnZWSQgVU2Luiy3Dq9lyKWhsjrR3qMVu7gbrP2MPR3tW/q72hq93McyyEFkILoYXQQshp4NhenfNj60ecXCD2YuT68KSzhdBCaMzOSkmhAirs3UaUnL7beWOktUMtYJu3UneI1I1jD0dja/+u7dFPbJiFhYXQQmghtBBaCDkNHNurc35s/YiTC8RejFwfnnS2EFoIjdlZKSlUQIW9Oxj5T207re11t67GSGuHpjHubU7aekhpG2qSw2Nj3DXVe/veuj02NttmIXG0ZNkySdlLgk859mLR0dtvLzGbNkmwJidWCsWSldXikDdK9i4xBx0kKeWOmNNOKzGwGnSGxZXypmaVZn3MsceWmEoYboo58MASUy1nKsr33HMlplruUp5CeechxugapJScdxVJ+WUMyq3VqyWQ2D//ucTgZVi8WFJUF6v36teSRoxH2U8C18KSs7jP55wj2W03yaOPSvBe7befBM8Izxdu+eKLkjEFNOra//W/JLku4ljsxRPFeXsFZT32YpI4L45F5/wCsTcfCncjnwb24th8VgjuBkZGZ+x98kkJJpmPjFcFnfPzYk1O7MVQ+ci9ghuL82Jvr6RDsTg1xgxLMcbMMRZCC6GF0EL49LgqP08uKnlpjmPROb9A7M2Hwt3Ip4G9ODafFYK7gZHRGXsthDHY2yvpUCxOjTHDUowxc4yF0EJoIbQQPj2uys+Ti0pemuNYdM4vEHvzoXA38mlgL47NZ4XgbmBkdMZeC2EM9vZKOhSLU2PMsBRjzBxjIbQQWggthE+Pq/Lz5KKSl+Y4Fp3zC8TefCjcjXwa2Itj81khuBsYGZ2x10IYg729kg7F4tQYMyzFGDPHWAgthBZCC+HT46r8PLmo5KU5jkXn/AKxNx8KdyOfBvbi2HxWCO4GRkZn7LUQxmBvr6RDsTg1xgxLMcbMNQ9Ldisxv/udpFqFcm3MSy+VmFI2aS6MOeaYElMO0pSfacQA4VrlMMmvfiXBUplY77GUdTGoGbBW5I03lphyuGSprm+JaUCQSjkvBgulQlRKeTbmAx8oMaU8EoNHBgE++2xJKc9rRBe5Fmj5RczPf15isDAsOpdyqubPkkNLTPUEfx9z660lphygKb+S6Pv8+99LSlkZAwOE8u2+uwQrlOIJwksxK6yMOmapzF576wo7pq7dYyAb+cg4FsU39AlLR2IonBdD1VeRTAP/gNEZs8rPi735efOR80ni2Pxx53cyv3X5eXEiDIW9+bGQSTht/l7hHz/+TeYPJQ/OqxfI4tQYMyzFGDPXWAgthBZCC6GFUM+Lvfl585HzSeLY/HHndzK/dfl5cSIMhb35sRZCY0xPijFmrrEQWggthBZCC6GeF3vz8+Yj55PEsfnjzu9kfuvy8+JEGAp782MthMaYnhRjzFxjIbQQWggthBZCPS/25ufNR84niWPzx53fyfzW5efFiTAU9ubHWgiNMT0pxpi5xkJoIbQQWggthHpe7M3Pm4+cTxLH5o87v5P5rcvPixNhKOzNj7UQGmN6UowxcwtrUy3r7723xNxzjwTadsopJea3v5WUIzTlyZjcPOEe69dLoG2vvVZisFRmJWZnxUCfSnksZvnyEgMVef55SSlPa06LoVuWjZrXNbp33yIpj8ds2FBiHntMwodSntGIEN5xR4nBmquvvirhwqH6fEs5Iebww0tMpYvyyMpRRbK3ppyi+UkMKlUsZlu9KngKj2rujKHyrZBsVvhnF/y9Iy+v87oWhpArAYIT4dg8sAsEhTv2Yhq//GUWXGCuBDgRbmweDJVrDG5dfr04Uf5882DkfBr5nOvBY/C480vIR8ZQ0EWMnN9J7MV5ZzBnFqfGmGEpKZv/T5Zdka2FwXAMfDqzS2IhtBBaCC2EW4Jj86BSzwt37MU0agm0EHYFI+fTyOdcDx6Dx51fQj4yhrIQGmMqSkotgdMQwvBFHg+6TXjU5LQOWDfWLdNjtsYx8xkLoYXQQmgh3BIcmweVel64Yy+mUUughbArGDmfRj7nevAYPO78EvKRMZSF0BhTUVJqCewrhNGIJrGjSfrMhNbx68a6ZXrM1jhmPmMhtBBaCC2EW4Jj86BSzwt37MU0agm0EHYFI+fTyOdcDx6Dx51fQj4yhrIQGmMqSkotgb2EsNahpqX6WLMR/Vv3Nh3q9tgY29GnqxGH1ONM2B53dTU2u5pGs7CwEFoILYQWwi3BsXlQqeeFO/ZiGrUEWgi7gpHzaeRzrgePwePOLyEfGUNZCI0xFSWllsDZFcLW7dEGfib94yGTjBPbuxpbx8f2aAM/k/5jt80CZe1ayU03SfbZRwKrKe8uMViVsZSzJUcXSblY8/MYrkFa7pfsJktHYvnHZcsk5UDJvvtKSjk+5mc/KzEYed06CbwU60xi5FWrSkwp10reVWJ+/GNJKW/G8OYcJDn6aAmWM+UT1GPPPVcCw8fCoZyGrthZyh9jsDQo7uT/z97bgFpZtWvbFxIiIhIiISIhERIRISIRESIiEhESIiERIiERESESIiFSn4SEiISIRIQ7QiSkN3wjQto9/fHQfnaUREhEr0hEiIhIiIhI+LlcNb3OY8x5rTVdNqfLdZ4cbOa6x7jHz31P8zqWD2OfPi3AafFbiTfeECJ+UbZkIN7btwsRezOrV0dmyRIBO4K24DcpzddbThmNuChgLNS1KF4hSHXFjFbU4k1ZLOBerApFPzoDlOZ1pT6Re7EqdO5rC7W3YF48dnTGUPUGsSqAiQC+GxgZfoingVXVrRiqXiTu/eoroX6D9apwL8AiMZQuksWp4ziDTZRpJfAmCuE/eh3p1b9zsU2nCT3zj52M2X+c152pGAuhhdBCaCHsAu7FqurCHcBMQD1v27+4F6tC5762YCEsWi2EjuPc1ESZVgInkRBe0bQdOmkv5v5I7tNezx3yj+icr1/v7UzNWAgthBZCC2EXcC9WVRfuAGYC6nnb/sW9WBU697UFC2HRaiF0HOemJsq0EjhZhHCc13tdrPtHc71X/17XO+l13ZlCsRBaCC2EFsIu4F6sqi7cAcwE1PO2/Yt7sSp07msLFsKi1ULoOM5NTZRpJbAvIQwVHnzOstRLnHr1GU//fLHr9U7ai13nwvV8sWv/Xp9Hf8QHZ+rGQmghtBBaCLuAe7GqunAHMBNQz9v2L+7FqtC5ry1YCItWC6HjODc1UaaVwH6FMP52IZhP5yKacKVrEy52PuPH3LlzHf17Xew6Drrli7npeu+/W9vr+WLnszNlc1p5LoOTM1GpR1wW1C4ifhIWRwYHPB47JqCOb06S/FzZkKEwzBQaaz2hvJOZNSsyEDMcOwmXPnJEwNGgL74owC0jflXgPB8rokA4/RLnteJpRLyiPKnImZxr10YGhv/ww0LE4xlscPlyodngf5RdGTznVauEr78W5swRYIARf2ZgnjhF9vXXBZybGvF0AfbLo277KmTRGRuuK/UvvhAwMvwB1LU4qnzMi84YGa2YqO4MBYKK4F604t56zQAj41604jnjHWEZ9duv30L9QrH9vvZbPzqsuV4kqJ9k2z9Tz4vWciIWp47jDDYxpFiEHKcTC6GF0EJoIWz8AdRVvoUwg1Y8Z7yjWq5wb/0W6heK7fe13/rRYc31IkH9JNv+mXpetJYTsTh1HGewiSHFQug4nVgILYQWQgth4w+grvIthBm04jnjHdVyhXvrt1C/UGy/r/3Wjw5rrhcJ6ifZ9s/U86K1nIjFqeM4g00MKRZCx+nEQmghtBBaCBt/AHWVbyHMoBXPGe+olivcW7+F+oVi+33tt350WHO9SFA/ybZ/pp4XreVELE4dxxlswnGcYcdCaCG0EFoIG38AdZVvIcygFc8Z76iWK9xbv4X6hWL7fe23fnRYc71IUD/Jtn+mnhet5UQsTh3HGWzCcZzhhodSzhegbSg+cRgmj9mcpixVtGKeNi0yBw4IMVtAaY46HueIXr4sRBzP7NgRmYifhTvkOFN4aXMEq1gNjm9dvFigqKin3X+/gINSG1/6LDN9upyMGnE489tvkcE5sUuXCjgnFiNv2iTwXE2+7jczeN0Rr2fWr48MbGrPHgHfjViuxJEMvqJPPik056aKD69bF5mFC4WIlZm33opMxO/KGqGu1AFqcTgAKmaM3JbUmXoolNftwjK1EtTe0tfxnngaaK0fLJaBVgyFk2DRuZQNtmJeUM+LVlDvCM8KDwe/k8MbxFD1vLgXLxTztk+goH6waMW8WLMug8Wp4ziDTTiOM9xYCC2EFkIL4Qj1UBZCC2GHel4LoeM4fSYcxxluLIQWQguhhXCEeigLoYWwQz2vhdBxnD4TjuMMNxZCC6GF0EI4Qj2UhdBC2KGe10LoOE6fCcdxhhsLoYXQQmghHKEeykJoIexQz2shdBynz4TjOMPOKmFWZFavFuA8OCrz6FEBQnjmjAC7OHhQ2LpVeP99gTYVP2R++SUye/cKH38soOiPOJP59dfI4MzV8+cF2EXEzsznn0fmqacEuCXssTkK9XwGp27iDFLo8YwZAjwt7gshDmV27YpMxA7h0RBGT5r9G9R1p04Jc+cKJ08KL7wgRKzLnD0bGZ4xGyeVSxmMjN8s4LvRtH4kXPX2DM8gPSc8GAIK2ZraLtAZDlDfi4q5vhcTwQFgj5ioXgaEofYHtGILWEa9SPy6q526mKh+R2itO2Oivh4ddoSh6nnRipHx6NAZE2EZtZjVLwUToTO+omitN6itLE4dxxlsosyVDz8sYO/bNL3+Xyb2uu44/cZCaCG0EFoILYQWwgRGxqNDZ0yEZVgIHccZK1GmlcB+hfBKCtvGF9x4w+N0kpfUCTul9Grtdd1x+o2F0EJoIbQQWggthAmMjEeHzpgIy7AQOo4zVqJMK4F9CSGU6cYM6sbuGk/GOXKvbr2uO06/sRBaCC2EFkILoYUwgZHx6NAZE2EZFkLHccZKlGklcCJCmNP5p7lWGvPF1Ov6lbYzLuamzvU2bWvnrtyUL+J61z6di44zzlgILYQWQguhhdBCmMDIeHTojImwDAuh4zhjJcq0EnhThDCLU/EZH9rrY34e/bHzGek1Mn7sNXivi53PjjOuNMdsvp9BxXzpkoBzJtesEWAIhw4JJ04IEXuVTRV6guXFi0LME3ga5HRF9xtxKgMRXbVKiHhO2SPcI0eDPvOMEHFAuaD8W3lW0YnUPe69NzKNEY0eTNphfQbHt+7eLaC12ZGsGdL+++/ChQsCTmSNeEKRLcyfH5mI9zIPPxwZbGH2bOGBB4RmZFHrWBJCPJl55JHINC90c+allyLDehp1LUClXt+LmhjUJ2fWQ+FeLKNeJCYCuBdAJzAypA73YiLcW+8XQ9WtmKi2x4ncizWD+lnB07CMelUAFoeHg9Z28AzuxRbqp9HXmhUWp47jDDYj9WjvtBLYlxDG34IETYIyZZvK17te7NV5zOttiqYYx4Dth64/Os4YsRBaCC2EFkIL4Rj7xVB1KyaaiMbU92LNoH5WFsIEi1PHcQabkXq0d1oJ7FcIc7JBIeiQg4u9Oo95vU3bdH1B19K5iD7tB+R6b8cZMxZCC6GF0EJoIRxjvxiqbsVEE9GY+l6sGdTPykKYYHHqOM5gM1KP9k4rgTdLCLXlr3S9jou9Bhnzepu655gDth8c50ZiIbQQWggthBbCMfaLoepWTDQRjanvxZpB/awshAkWp47jDDYj9WjvtBLYlxAWKpWbul5vP7TXe30e/dD1x5yiZzF4O1G+mK87zrhiIbQQWggthBbCMfaLoepWTDQRjanvxZpB/awshAkWp47jDDYj9WjvtBLYlxDG37IEZRrP9V5XujbhYudz+2NO25RH67R2LnaaOtfz57aD44wrKNxxwGPEMQVutjbzzjuRwTmTKM0jfhMWROaJJ4S4ojyoLFbilczy5ZG57z7hsceExg+PCKqaONCSXhprlHMZyPPGjQLkOeJXRQ4d3b8/Mtg+ziBdt05oTigVt4zYJUyTY2P37BGat/CzIsd74osE1YTjRRxVjgv6NYPiRvwhPBwCTXudcGdkPvhAiDkCXijOTYUt41BZVswo3Osyty6gMRTuxSGNuBcjYxkYGSaGezFvXdZPpBWLxIOtqY+sRGv9NNCKNePhfPGFgHvR+auvBGzhyy8FtGIZ9b3oXL9urLn+MgC8QbTidGa8lP/+bwEPp50ro/tlceo4zmAzUo86jjPEWAgthBZCC6GFkE/DQpipXzfWXH8ZAN4gWi2EjjM1MlKPOo4zxFgILYQWQguhhZBPw0KYqV831lx/GQDeIFothI4zNTJSjzqOM8RYCC2EFkILoYWQT8NCmKlfN9ZcfxkA3iBaLYSOMzUyUo86jjPEWAgthBZCC6GFkE/DQpipXzfWXH8ZAN4gWi2EjjM1MlKPOo4zxNx/vxCxXdmdOXcuMhGfK6pA6g8RF5WVyp+C1uIRLyobMu+9FxnqBOwRx2zOiMyzzwo8dvIRJbZlcOYqn9V0ARPdc4+wbZsAnWiW8Ysi5onzLeOqfmTi98yvv0YGJSJ9SV/K+fORwW8Hmnckv0qgW85X4jOl8+uJEfbujQze/sqVkTl9Woh4PXPwYGQiPsx88klk/vhDwPcZf6xw9unq1QLraVTqaP3oIwElMu5FHY/iG4V7X621A6Az7AJyhUodnScyLzrjC43O338vYBk4k7OeFy8FG6zfEe7FFtAZrVhGDe7FS0ErtoBWrKqmXUkBJkIr3lHdGeiOWJw6jjPYhOM4w42F0EJoIbQQdrGauhWrqjujcId7QDbQeSLzorOFMIN78VLQii2gFauqaVdSgInQindUdwa6IxanjuMMNuE4znBjIbQQWggthF2spm7FqurOKNzhHpANdJ7IvOhsIczgXrwUtGILaMWqatqVFGAitOId1Z2B7ojFqeM4g004jjPcWAgthBZCC2EXq6lbsaq6Mwp3uAdkA50nMi86WwgzuBcvBa3YAlqxqpp2JQWYCK14R3VnoDticeo4zmATjuMMNxZCC6GF0ELYxWrqVqyq7ozCHe4B2UDnicyLzhbCDO7FS0ErtoBWrKqmXUkBJkIr3lHdGeiOWJw6jjPYhOM4w80zzwixVKHy6ZmN8Uxm+XI5zxOFzQMPCBSV2JdZtSoyEZ8qevplbFQey/z0U2S2bhUiHs/cfXdkIlYoYiYPPRSZRnHPZl57LTJnzwo4KZRnvd6h0ABVFxfJqZtr1wqzZgmPPipEHBZgjwuVeEf5OLN5c2RiphJvKM9moE+w1gULItO8hReEqy8xo78OwMm3994r4PvcnFB6OXNFE3Fe0QcL40XFfOyYAH+oi+C+im/ci6IfQ/VVbQOMjC2gFRPV8+K/Mt99J2Ai3IuR6861ENaPrp4X9/YlZpgIW8C9eFboXL9uzIt76y3U1BPh0eHPAnaEzvVb0BfK4tRxnMEmyvy/MuztOM4NxEJoIbQQWgi71OIYCp3b0Qowcq0TmKieF/+VsRBmcC+eFTrXrxvz4t56CzX1RHh0FkLHuU0TZaiAGvYuc+0v6BvJDd/oOJMjFkILoYXQQtilFsdQ6NyOVoCRa53ARPW8+K+MhTCDe/Gs0Ll+3ZgX99ZbqKknwqOzEDrObZooQwXUsHeZG/a6G77RcSZHLIQWQguhhbBLLY6h0LkdrQAj1zqBiep58V8ZC2EG9+JZoXP9ujEv7q23UFNPhEdnIXSc2zRRhgqoYe/e0b+me17MreiAJse5fWIhtBBaCC2EXWpxDIXO7WgFGLnWCUxUz4v/ylgIM7gXzwqd69eNeXFvvYWaeiI8Oguh49ymiTJUQA17l4HR/f1XdpfPvT44zu2arZlFiyITsTezdGlkzpwR0BnHe/74o/Dzz0LEa4qo19GjkYGoTJsmRBwUpusJn7RH0ZiIC5nPP4/MhQvCW28JPPxzoYCDQ+Eec+YIEacyEARYzR13RCam4XDX7ZkNGyITcUC4+p+7DBVIHh19Sb0UrwyFXMRzmcbDoZqbMtDF5pjc4xn8vmP6dCHiFeUbRb6EfAvLFF0kzlzFLykiTgt1XVu34mxMiAqKb9xb+wPuRWcMBVDWY+S2fwbfFZT1GLk2hNo9MPIXXwjoXG8Bj73uXD/2+nWjc+08oH4poL0901dnzIs110PBw/Ho8OXHUP28falMHccZeKIMFVDD3mVaIez6Y/HBcW7XWAgthBZCC2FjJrgXnTEUqN2j7Z+xEBavG52xBXQG9UsB7e2ZvjpjXqy5HspC6DhTI1GGCqhh7zKtASJoyj92PjvObRkLoYXQQmghbMwE96IzhgK1e7T9MxbC4nWjM7aAzqB+KaC9PdNXZ8yLNddDWQgdZ2okylABNexdBl7XS/M619sPjnO7xkJoIbQQWggbM8G96IyhQO0ebf+MhbB43eiMLaAzqF8KaG/P9NUZ82LN9VAWQseZGokyVEANezcp/qGv1z8DFh8c53aNhdBCaCG0EDZmgnvRGUOB2j3a/hkLYfG60RlbQGdQvxTQ3p7pqzPmxZrroSyEjjM1EmWogBr2bgLlayUQF3Nr50f0cZzbLZ2v+N9f9C8VKWQfeywyOO/x4kUh4owi5vnUU5F5801h3z4h7hcgVxFPZKBtsJr77hM4EQ/wBKpPsUX5VDmmPJV5773IxKNKbBNmhBBPZ/74IzIR72egT9wR7FGfM05kfeUVYft2YedOAcfVLlkiRPyYueuuyDSO95ayTpgXGXyv5s4VItZmcPItfsGxbJkQsV6R3x1gg6dPC1u2CDz7tHYtOA+oq3zU0yiR0QoVARgZi0QrVgW++kqAIUCu8HCwfSwDE7W7yNRbAFgGJkJr/eiw37ozwLz1FjARFgnwYOsd1fPiF2kYClvAvH3tFyPXrRhZ52Vx6jjOYDNakTqOM7RYCC2EFkILoYWQWwBYBiZCa/3oLIQZzNvXfjFy3YqRdV4Wp47jDDajFanjOEOLhdBCaCG0EFoIuQWAZWAitNaPzkKYwbx97Rcj160YWedlceo4zmAzWpE6jjO0WAgthBZCC6GFkFsAWAYmQmv96CyEGczb134xct2KkXVeFqeO4ww2oxWp4zhDi4XQQmghtBBaCLkFgGVgIrTWj85CmMG8fe0XI9etGFnnZXHqOM5gM1qROo4zxKi2zQ5B/eHBByMT8bqyWsFZkfuEmSHQiF7MzJ4dmbhTQPkBt0TnRoBPZi5diszhw8I99wgRa5QPMljz/v0CrGb37sjs2CFEPJ5pWmGem5VVGRxJeuCAEPFuBjYFP/z4Y+GXX4QXXhA+/FBYuFCIeDMDT4v4SfkuM39+ZGBin34qxBIlDivy64+IDYq8hRkzIvPJJwJzh4AnycoV2oZCFr5Ulrlsrev4up5GaY5WuCWGquetjQitNZgIq8LDqZ9VTf2O+mrFmvGcIXVYM+7F08BEeGW4F621lteLxDLQinvrRQKsuea77wS8BV0Gi1PHcQYb/qXpOM7AYyG0EFoILYRNK1aFOh6tFsIbbsWa8ZwthBmsucZC6DiTJ/xL03GcgcdCaCG0EFoIm1asCnU8Wi2EN9yKNeM5WwgzWHONhdBxJk/4l6bjOAOPhdBCaCG0EDatWBXqeLRaCG+4FWvGc7YQZrDmGguh40ye8C9Nx3EGHguhhdBCaCFsWrEq1PFotRDecCvWjOdsIcxgzTUWQseZPOFfmo7jDDoPCjCiiO3CrBD0uEt0hqfFPYqeMzlvXmQ2bRIiPsqgSFi7Vog4KywOQd0DQ0X8O/Pyy5HBQZpPPCFEvJJ5553IRPycWbkyMhFvZ1asiAwOtGyOFYV4v5ahqMwRzp8XIi5mTp6MTOPS8ssCPOcnnxQifhV0GWOYmH5FI84pm4QZciLrhg3CwYNC44fy24GI08qHmZ9+ikwsEs6eFfC6+a1DqYq6FgU0WmEIKL7RuRaG+t66FVvADrEFtGJVGBll/URWVbdiVXVn+FL9FuqJ0FrPC8Wt14xVoTNeCr4MeClYBjZYf68wb1/fuvrh1GD7aNVVsTh1HGewiTL/KsPeE8i12sZxpmYshAkLoYXQQtj93roVW8AOLYTFRGit57UQjh9sH626KhanjuMMNlGGCqhh7wlkTCEcs4PjTNpYCBMWQguhhbD7vXUrtoAdWgiLidBaz2shHD/YPlp1VSxOHccZbKIMFVDD3hPImL43ZgfHmbSxECYshBZCC2H3e+tWbAE7tBAWE6G1ntdCOH6wfbTqqlicOo4z2EQZKqCGvcuMGt3fZcxfV3JyT1xsr/S66DiTMBbChIXQQmgh7H5v3YotYIcWwmIitNbzWgjHD7aPVl0Vi1PHcQabKEMF1LB3mb8LmC4/4nOnT/6x1/WuPzrOZMrmzQJrcdoUSmREWxeEwDM5xVsidig/KWuVbzKzZkWmOSj1vcy+fZGJ2JZB8fnuu0LEt5kXX4xMczamBAe0Nue1/q6I4335ZWQiXsos1BM7H3pImDZNiIcVPWMWq1q9WnjuOWHJEiHij8xvv0Xmzz+FZhly5mpcXWcmzmdwfimMFxJ79KjQGOAeZVcGWr5+vYDfWeBZzZkj3H23EPG8gIoZJXJfrSjN0Vq7JYpv3AsFwkQovtEK2to9U3fGqr76SkArdoTOaK0fDh477oWn1UNhgxAk3FsP1deq0Ll9LxkMhXnRiseOzmgF338vtB0y2BGWgfeLHZVbYHHqOM5g0ymWuoYKqGHvMrXC9TK6XkKI1K2Oc0vHQmghtBBaCNsSmfdaCDO410KYQWe0Aguh4zi3pBCO/HNhStuhc6Xt5jiTLxZCC6GF0ELYlsi810KYwb0Wwgw6oxVYCB3HufWEsN/rXX90nMkUC6GF0EJoIWxLZN5rIczgXgthBp3RCiyEjuP8w0KYPa1VuCx7XcWv13X8mLs5zuSLhdBCaCG0ELYlMu+1EGZwr4Uwg85oBRZCx3GGJ4SjV3La66Of24vtlXzdcSZZeO5iPKtsUZ4RtKxvjqx8TLhaByfgWrt2CffeK0An3nxT2L1bwCLnzo1MxHFhYQh62mdjy6JtMJMdOwSIypkzwuXLAuaN2Jvp/Ofmr//o6IGWETszixdHBvK8bVtkFi0SGi1fkaFbxonMsmWRefppIeJo5uGHI9OcyCqW3pxP+2UGQ0V8rvyg/JjZsiUyze8snsxACBu3fDNz6FBkcMYsRRSVOorguuiHMMAu4GkAJXLboeiMVaG1rsXrDYJWijIYCg+nHqreIFoxEdyj7ly7FsAysAV0xsgADo+hMBHuxRYA7q230C4sA8fDg8VQ9XMGUE3Mq0+DxanjOINNOI4z3FgILYQWQgthl2q77oxVoRXFN1rrDYJWAjMYCg+nHqreIFoxkYUwU2+hXVjGQug4joXQcYYeC6GF0EJoIexSbdedsSq0ovhGa71B0EpgBkPh4dRD1RtEKyayEGbqLbQLy1gIHcexEDrO0GMhtBBaCC2EXartujNWhVYU32itNwhaCcxgKDyceqh6g2jFRBbCTL2FdmEZC6HjOBZCxxl6LIQWQguhhbBLtV13xqrQiuIbrfUGQSuBGQyFh1MPVW8QrZjIQpipt9AuLGMhdBzHQug4Qw9ca8YM4fXXhZ07hU8/FeJ+JS5moEA4d/HZZwVo2+HDkYE/HD8uRJxTpMp/4onI4MROtELqIl5WjmSwKjjtunVCxClFheGuEOI5RbRt+/bI3HGHELE+0+iTmCfU+s47hYj3M488EpmzZ4VTpwQUYytXCi+9JOBJXrokvPKKEHEs0/jw/szatZF5/nnhsccEyGQzrygufPiHH4T9+4U33hBYTx87JsDxUDHXtThKZLyG+l60Qifa+juDzij6sQyAoh/bR2c4HrYAsIy2QwbLwERYFbaPzn3N2z7MAjxnrBmtWBWeJDrXE+FLiKHwzcG8+HrXXzPsqF4VXgpGRqueKM3i1HGcwSYcxxluLIQWQguhhbDLvWhF8Y2R60rdQjj+eduHWYDnjDWjFavCk0TneiILoeM4NzXhOM5wYyG0EFoILYRd7kUrim+MXFfqFsLxz9s+zAI8Z6wZrVgVniQ61xNZCB3HuakJx3GGGwuhhdBCaCHsci9aUXxj5LpStxCOf972YRbgOWPNaMWq8CTRuZ7IQug4zk1NOI4z3FgILYQWQgthl3vRiuIbI9eVuoVw/PO2D7MAzxlrRitWhSeJzvVEFkLHcW5qwnGcIedBJXZl9uyJzOOPC19+KTz0kBCLBR6VGZuEaZHRv6yvruonYaEcDQp/WLBAmD1baMr6zzI//hiZiLWZDRsiE7E1s2lTZGKp8MADQnN8q1hrxGphemR+/12IeDozf35kHnxQwEGpzdN4NnPXXZHhMZvqhzDPkycjE/cK0MVz5wSc2BlXXTQT/840ArxKeS9zzz2R4RbmhTBDeVSAPf7yi9B82zcr6v+omFH1oiau/QGtqIlBPTKqfBxZiVbcW++oXjP+8NdKgFVh3touao3BROiMkdHa7rEYCtvHyFgVrAY7al9xph65r1WhM0BngJEBnlVfy8COMFS7kgSLU8dxBpsow94a9u4n1/6CdhwnLIQWQguhhbDbyKi2LYQZjIzWdo/FUNg+RsaqLITFMrAjDNWuJMEC03GcwSbKsLeGvfvJtb+gq4zZwXFul1gILYQWQgthOzKqbQthBiOjtd1jMRS2j5GxKgthsQzsCEO1K0mwwHQcZ7CJMuytYe9+cu0v6CpjdnCc2yUWQguhhdBC2I6MattCmMHIaG33WAyF7WNkrMpCWCwDO8JQ7UoSLDAdxxlsogx7a9h7rDR/QXe53utKr4uOM/ljIbQQWggthO3IqLYthBmMjNZ2j8VQ2D5GxqoshMUysCMM1a4kwQLTcZzBJsqwt4a9y/z9l3KXz9c7pR97Xe/6o+NM6rytPJG5//7IvPCCEPGdQLeUk0JZXsch5d0MLC5io6J1/NUOGT3ddMmSyGC/TetjyksZnIwKIYz4PDNtWmSw31dfjQyEECeU8mTUmYqefT4yDHEAAFqESURBVPrxx5GBicGWz5wRUF/hLNCLFwWUWzR89cNVqyLz88/C9OkCvgwRL2bwWwmMHPGRoqatj+78eYG/0YjLAnQxTiobMo8+Ghn8ZgHvl48S1SpqYjgPqMvremS0wj1wsCROzqzNBBOhFffWW4AB1g5Qz4v94l50rqnXjNbaWtvBM7i3NiLMC/DY62VM5OHglWGi+oVizVgGhsLTqFt1IhaYjuMMNlGGvTXsXWacRtdLCJG61XEmVyyEFkILoYXQQqj3onNNvWa04pVhGe3gGdxbSg7nBRbCBAtMx3EGmyjD3hr2LlMI4eg/GHbSduhcabs5zm0QC6GF0EJoIbQQ6r3oXFOvGa14ZVhGO3gG95aSw3mBhTDBAtNxnMEmyrC3hr3LQOF6id+Y17v+6DiTOhZCC6GF0EJoIdR70bmmXjNa8cqwjHbwDO4tJYfzAgthggWm4ziDTZRhbw17N8nalv9ZD5979elcx4+5m+PcBrEQWggthBZCC6Hei8419ZrRileGZbSDZ3BvKTmcF1gIEywwHccZbKIMe2vYu0krdTnt9dHP7cX2Sr7uOJM7K1YIEc9n8Jf13r3C2rUCjo6MWJnZty8yET9kGkHantmwAcd7/ircKadQNidn6omOcTQD54n4MYMTOyO+yRw8GJlYJnT+kzEanF8KFXn7bWHZMiHiLWFWCDywVM6JpaXrInFU5o4dwq5dAs4ghfJRROOFzKVLkXn2WQHHim7dGplDh4S33hIiPs2g6tu/X4Bb4iDcq38alHMZnLka8Y7Al/JE5t13IxMLlbraxpbqEhnaVutiXTHX96IVa67BRH1RD4VVwXkAjBdPEvvFvXUrbLl9ApnaiLBIUD8c7Kh+VgAbBFhG2yHzxRcCDqfGo8MXGJ2xQawZ92JkoA+HBabjOINNOI4z3FgILYQWQguhhZBPEvvFvXWrhTBjIXQcZ6yE4zjDjYXQQmghtBBaCPkksV/cW7daCDMWQsdxxko4jjPcWAgthBZCC6GFkE8S+8W9dauFMGMhdBxnrITjOMONhdBCaCG0EFoI+SSxX9xbt1oIMxZCx3HGSjiOM+ysVg5kmkM4P8wsXx4ZVL2LFgkoryOeUj7K0LXiT0WFMJ4W7ojM668LH3wgxFzh11+FEycEFCenTwuXLwtQAkgdikDYIyq3uFs4e1aI2KY8lrnzzshAvWDLmzdHBg4/Z44QsT+DE2ihuLt3C5DJeDSEexT91uF3FhFfZ/A7CxxJinNiUSLC/yGieKF4VpiIf6wWqgHGawIKaFS9ABYH90CJXAsDWrEMFP349tdrLotv3guwQbRig1gkWtvBi6EwL9aM1va9ZHAvnkbbP4MXiqHwyrCFekeYCE8DEwEMVfPddwLmrZ8GWttNZWrxrr/8OhSLU8dxBptwHGfYsRBaCC2EI1gIBQthYUTte8ngXjyNtn/GQphpN5WxEDrO7ZJwHGfYsRBaCC2EI1gIBQthYUTte8ngXjyNtn/GQphpN5WxEDrO7ZJwHGfYsRBaCC2EI1gIBQthYUTte8ngXjyNtn/GQphpN5WxEDrO7ZJwHGfYsRBaCC2EI1gIBQthYUTte8ngXjyNtn/GQphpN5WxEDrO7ZJwHGe4OXJE+OEH4Z57BBaysUp5UZgXQjye2bYtMnGvgHm3bxcijgkzQ4jnMnAtnLq5geeX/keYFhno4qOPCjFDgBFFfKzAw09ljh2LzNNPCzgME6duvvmm8MknAk43bU7s/ER4IDKrVwuxRNE3eOCAgGNjI17JzJoVGYhZxNvClchgCwsWCL/9Jnz+ucAjWBco8Utm1arI4JXhWX32mdD8suCwgLoWhSxK87YszuCgxbayz9SChAIaRT9MrNWtQjbaDpm+Rq7X/P33AlrxnPEWajNpV5LBRG2HDB4OfleEobBIrAo7witDZ4B560ViVWjFo8NQ9cPBqurONfW9OhGLU8dxBpso8/+VYe8bykh96DhTORZCC6GF0ELYlsispy2EmXYlGUzUdsjg4VgIM3XnmvpenYjFqeM4g02UoQJq2LtML/Hrdb2TMTs4zuSOhdBCaCG0ELYlMutpC2GmXUkGE7UdMng4FsJM3bmmvlcnYnHqOM5gE2WogBr2vqGM6XtjdnCcyR0LoYXQQmghbEtk1tMWwky7kgwmajtk8HAshJm6c019r07E4tRxnMEmylABNexdJnsd68Nu13td6XXRcSZrLIQWQguhhbAtkVlPWwgz7UoymKjtkMHDsRBm6s419b06EYtTx3EGmyhDBdSwd5mOvP1VE3b7PPoBP/a63vVHx5mM+T2DYxivCqOgRX/MEXjvo4oWwU8+GRk6wN3C778LETuF+0LQHUEmR//YdxLxXmbXrsjcf7+AY0VfeUV46CEBx6jidNPDhwVILAQJZ3LC4XF8K2QSh6xiqJ9/jgzmRYmINaPqizidwTIeeUSI2QI9LbYozysrlWeFe+SE0uaQ1Q0ZbB/7nTFDoADjdwfxjMDfhlxQ9gmoXPFk6/IaJzq2hX4GutjXUOjclz5hZAyFe2u7qM0ECoR5a0MA6AywjPpZYQtoxVDYAjrjDeIttOvMQBfrB4vO+LPx3/8t/OtfAlqxjHpedMa8dWeA3yzgy6CPjsWp4ziDTZShAmrYu0zH3MZpdL36I3Wr40yKWAgthBZCC+FYQ6GzhTBTPytsAa0YykKYwbx1Z2AhdJzJkyhDBdSwd5legpd/bApFduhcabs5zuSNhdBCaCG0EI41FDpbCDP1s8IW0IqhLIQZzFt3BhZCx5k8iTJUQA17l+mYGxTuhq93/dFxJmMshBZCC6GFcKyh0NlCmKmfFbaAVgxlIcxg3rozsBA6zuRJlKECati7Sba1zue/i8Aun0c/FNfxY+7mOJM3FkILoYXQQjjWUOhsIczUzwpbQCuGshBmMG/dGVgIHWfyJMpQATXs3STbGj5rQcjruf84uznOpM1iJU4ojwlQL/XD3buFrVuFiM0ZGAJMDAd4HjwovPOOAG07dUp45hkhYq3yurBAzpmEtcZ8JX7N0D3UefCc9+4VYrkSe5WflVWCrhmS09jjCuHqOhNQvgsXhDlzhM5/CkezZUtkeIqsnqp6/Hhk9u8XKFfxfmbFisjgcNfmHclJoRFPZE6ciEzEWxlssDnr9U1FlH7nzsjco6fm4vtMB0AtjjIXhoBjZNFaq0jtHvVQWCSMqB4ZGoNW7BdDYSIMBQeAP9RDwT2wqnq/9SurV4WJMHK9ZkyEd4RWzAvqe7EMdK5XVe+ofrAYCp3rxw6wZt0+i1PHcQabcBxnyLEQWggthBbC/220rR4Ki6yLfgxlIcxgIoxcrxkT4R2hFfOC+l4sA53rVdU7qh8shkLn+rEDrFm3z+LUcZzBJhzHGXIshBZCC6GF8H8bbauHwiLroh9DWQgzmAgj12vGRHhHaMW8oL4Xy0DnelX1juoHi6HQuX7sAGvW7bM4dRxnsAnHcYYcC6GF0EJoIfzfRtvqobDIuujHUBbCDCbCyPWaMRHeEVoxL6jvxTLQuV5VvaP6wWIodK4fO8CadfssTh3HGWzCcZwhx0JoIbQQWgj/t9G2eigssi76MZSFMIOJMHK9ZkyEd4RWzAvqe7EMdK5XVe+ofrAYCp3rxw6wZt0+i1PHcQabcBxn2NmtQEUOCHdEZvNmIeKbzI4dkVmzRoj4UJF7eXTkQyHELuWMMD2EewQI0uzZQjysLFLiO2FhZL78UoC2vfdeZBoPfzqzZ09kcJorlC9mKlcUXcaLL0bmhReEiM8U/XVA7FdOZ1BuLVsmoNiGa+HRrV0r4HcH8+YJOMwWvw546y0h4g/hrsg895wAmTx7NjL45uCI3cuXhYivMw8+GBkqAU6SrEtklNd40Hgr6FyLSi0MqMWxBXTGFjAy7sXIWCRGBq0GZOploBXPCosEOMESx2yicz1R/XDwNNBaH++Je+ungXv7Wga+hN9/L2BefNvxQut31Nf7RWdtZXHqOM5gE47jDDsWQguhhdBCaCHUVjwrLBJYCDMWQsdx+kw4jjPsWAgthBZCC6GFUFvxrLBIYCHMWAgdx+kz4TjOsGMhtBBaCC2EFkJtxbPCIoGFMGMhdBynz4TjOMOOhdBCaCG0EFoItRXPCosEFsKMhdBxnD4TjuMMN6tXC/ir/OOPhfPnhZMnhYgvM/v2RebVV4VPPxUiLmeWLIlMxBsZnDIa8aSiEqtF//btQuOl4KDyQwZKgB3dowdLTp8u4LE3Z3IeUdYr2xXx4cWLI/P55wKO2WyUXo7ZxJGzOAkWnvbSS8KxY8LChUJMU/jYDwkw3ngtM39+ZH7/XYh4PANdjPi4Qr85OIIVizx0KDL4k4JXtm5dZFhPAwhSbWIogvsaCid2YqhaJjFRrRP1UHXRD9pdFOBeuAfmrVWzfrD1o0NnTISngVaAkdGKHeE/7vUi6/2iFUOhM1pxb7upzGefCbi33n69DEUqU8dxBp4os7EMe9+MXLky8gt1x5lCsRCWWAgthBbCa6D4thAWD7Z+dOiMiSyEGQuh40yNRBkqoIa9b0YshM6Ui4WwxEJoIbQQXgPFt4WweLD1o0NnTGQhzFgIHWdqJMpQATXsfTNiIXSmXCyEJRZCC6GF8Boovi2ExYOtHx06YyILYcZC6DhTI1GGCqhh7zKjpjd6fkHnSifoVnTI1/NFx5mssRCWWAgthBbCa6D4thAWD7Z+dOiMiSyEGQuh40yNRBkqoIa9y0Dh8o/43PVir8+jHxxnEgd/4UbsyUD5pk0TIjZljh6NTMQWRaQuZkSGBfQSZblw4YIQsVMRB4h4KoPTIDHvuXPCokVCzFM40Z+ZN9+MDPaLVcWCEKC4bP1RuHa65nXuUOKDzKxZkYn7hNOnBRzu+uGHAg7hxPZXroxMs4VtGbhWI7G/ZfDrAD7n+CjTGO8pYXYIsU8R8+R+50Zm6VIhYkemad0s1DoBT0NNjBNaUQQDyAbqaYB722I9gzXjXoyMMznRiqHwcGqrqaWufSAZPEmMjEViVfW8WDPeIKgfXd25BkMBdK4n6mtHNfUG+3qD6Iw3iJG1lcWp4ziDTZShAmrYuwzkrdeP7Yf6uuNM+lgILYQWQgthF+pquy6+cS9GthAW1I+u7lyDoQA61xP1taOaeoN9vUF0xhvEyNrK4tRxnMEmylABNexdphU8BN06H+rrjjPpYyG0EFoILYRdqKvtuvjGvRjZQlhQP7q6cw2GAuhcT9TXjmrqDfb1BtEZbxAjayuLU8dxBpsoQwXUsHeZXoKH9BK/XtcdZ9LHQmghtBBaCLtQV9t18Y17MbKFsKB+dHXnGgwF0LmeqK8d1dQb7OsNojPeIEbWVhanjuMMNlGGCqhh7yZZ3lrB69qaP4zn8+gHx5nEsRBaCC2EFsIu1NV2XXzjXoxsISyoH13duQZDAXSuJ+prRzX1Bvt6g+iMN4iRtZXFqeM4g02UoQJq2LtJV+XLVzrJF+sO+Xq+6DiTNlr0Q3L27o0M3QPEdxkc/8gjHB8JIZ7LbNoUmV9/FdAZp31GbFWOZe69NzJ//CGcOSPgkFVUQQv15ExUIzju8uJFIeLtzJo1kYl4JfPii5GJeDlz5EhkILFvvCGcOCG8/bYAjYn4T6bpfCmD3yw0Uif7jXheWZ2ZOTMy2MJzzwnN6z6eQRGI81qXLYtMzFHiqKC/DuAvC3Cv6uKePcJPPwn0NCwaVS/coy2LM6iJ8VbwhcY3GGCRtQL15Utoxb3wYYB7sV9QP0l0rn0Ji8SOcC9GxvvFUJjo+++FelVYRvsECjDU//k/Ap4VtlB/Y7FmLLLefrvODL7A9UQYWXfE4tRxnMEmHMcZciyEFkILoYXQQojOtXphkdgR7sXIeL8YChNZCAsshI5zuyQcxxlyLIQWQguhhdBCiM61emGR2BHuxch4vxgKE1kICyyEjnO7JBzHGXIshBZCC6GF0EKIzrV6YZHYEe7FyHi/GAoTWQgLLISOc7skHMcZciyEFkILoYXQQojOtXphkdgR7sXIeL8YChNZCAsshI5zuyQcxxly7hYWLBCgfNu2CW+9JeDMxg8+EI4dE7ZuFXgoJY/K/Eb5NtPYlOgi1owjK6GaPGYzXs80XvpWBueXRvyceeaZyDQRW16/PjLvvSdEnM+gRoo4mYGIPv20EHEkg9M+d+4UmoiJYfvY7/vvCxHPKE9ntmyJDA7/pP/fL8Dx6NJLBfzO4sEHheZ3JTuVy5mHHooMvt6wZZzIylIVhWytbSiCJ1Ii45sEAyzrad4LQ8Ay6lZMVLfWOwL1mjEUFonOOCi1r6GwKrRikWiFD+N14976DdYmVq8ZGwT16/70U+GrrwRMhA3WbwHbx70YWWFx6jjOYCPFheM4Q4iF0EJoIbQQ/o+FUIfCItHZQlhQv24LoeM4TaS4cBxnCLEQWggthBbC/7EQ6lBYJDpbCAvq120hdByniRQXjuMMIRZCC6GF0EL4PxZCHQqLRGcLYUH9ui2EjuM0keLCcZwhxEJoIbQQWgj/x0KoQ2GR6GwhLKhft4XQcZwmUlw4jjOMHMzg1M2IlzI4/BOHYUK91q4VIj7MzJoVmTffFCJWKS9nfvghMjzgMXYLC0NQXYQRffJJZF56SfjoIwHKx0Mp1Zcok6oxVzSHDkUGx3vOnStANs6fFyIOZ+66KzJxn6JrhvDDtfDdgP+jFV+Vn3+ODCQ24qnMhg2RidicgXpFfJ25cCEyEZ9lIIQ4VRVvP5Yp+vZxfucLLwgRBzJz5kSGZS7K66Z4FWp/wMi4F51hCNAJrAqd0Yp5MdFEllF3xtOoZRJyVT927KgeGavCmqExded63rq13hGeVV/7RWs9ct0ZraDeAsAisYzywWpp6jjOoBNlVpVh71spVys6XnKcWzUWQguhhdBC2MiVhTCDHdUjY1VYs4WwmAjUWwBYJJZRPlgtTR3HGXSiDBVQw94DyThNb5zdHOdWiIXQQmghtBA2cmUhzGBH9chYFdZsISwmAvUWABaJZZQPVktTx3EGnShDBdSw90AyTtMbZzfHuRViIbQQWggthI1cWQgz2FE9MlaFNVsIi4lAvQWARWIZ5YPV0tRxnEEnylABNew9Vjq1VudHtOY++LHTB1fGczFfd5xbMBZCC6GF0ELYyJWFMIMd1SNjVVizhbCYCNRbAFgkllE+WC1NHccZdKIMFVDD3mWylY1+hqe1F7t+7npX++NoUdd+dpxbMCIMESsVKWRR9cYSJS5keGBpPJ9Bxfzyy8KuXcLjjwsRxzMbN0Zm82bhvvsELGPRosjQS+8VYGI4LS9ib+bs2cjs2SNANhqruaisUFYrfx03Osq6dZGJu4R58wScMdtY3HblRObhhyPTON4lYame8KkiihNo8UXCrxLuvz8y2O97eiJrc2Cp+D9+Z4FvTsSzysnMgQORgabyixS/ZPhrFxTBqFxR10JjUBPXRTA696V89cgYCvfiJEnsF52xyPppYKi6FcJQg2WgtX4a7WiZekdord8CvgwALwXLwMPBfjFRTf2csaPa8TAytl+PjGWgtdw+i1PHcQabkWq0d6iAGvYu01XJWs3rKoH5c9dxOunVrb7LcYYbC6GF0EJoIbQQKlgGWuun0Y6WqXeE1vottBJoIeyA1nL7LE4dxxlsRqrR3qECath7rIz+S12teV1b8+dW7TrDjqZzEX3yj45zS8VCaCG0EFoILYQKloHW+mm0o2XqHaG1fgutBFoIO6C13D6LU8dxBpuRarR3qIAa9h53sp6Nfu4qcl0/16Y3zm6Oc0vFQmghtBBaCC2ECpaB1vpptKNl6h2htX4LrQRaCDugtdw+i1PHcQabkWq0d6iAGvZu0tXo2s9FU/u5ML08VK/PjnMLxkJoIbQQWggthAqWgdb6abSjZeodobV+C60EWgg7oLXcPotTx3EGm5FqtHeogBr2btLKW1c3y1fG/NwOkq+03TpNjnOLBqd9PvKIEPF0BsdOnjsnRGzK4KhMmEksEFBeo+hfulSYPl2IecKJEwI8jffGu5lTpyLT2DJEZb/wYGRwJufOnQK8BcsgiyLTnLr5pqAS+9RTQsTlDA7hPHpUiNilIOeEaZFZskTA+bR4Rzgo9a/zYP8GQ+HA0ieeiMzzzwsRv2cuXoxMxGsZvCOYdqPH+NXJJ8IdITwizJ4tsJBFEYy6thYVDIVW3FtPhKHq1rozlgFRwarA118LaIUCtSvJQDawSIyMe6Ex9YNFZ0xUz4uRsQzcizeIofoCD6deRj0vWvE06idZPxwsA634vUP93dAvIYtTx3EGm05hMcRY2JwpHQuhhdBCaCHsMhGGqlvrzliGhbCYFyNjGbgXbxBD9YWF0HGc4aVTWAwrtkFnqsdCaCG0EFoIu0yEoerWujOWYSEs5sXIWAbuxRvEUH1hIXQcZ3jpFBaDj//HnI4zEguhhdBCaCHsMhGGqlvrzliGhbCYFyNjGbgXbxBD9YWF0HGc4aVTWDiOM5xYCC2EFkILYZeJMFTdWnfGMiyExbwYGcvAvXiDGKovLISO4wwvncLCcZxh5RtlTwZngcZMgYeOxnvKfzLz50fm0iUBGvPnnwLubQr344KefXr4sPDYYwIPw4xjmXvuiQz0CWdURhwV1OLoWgsFjByxTTmjiNTt3x+ZiB2ZDz6IDB1vfmRwFCrn1R3hvNZHH40MWmNWZPBriJir6MOJWCssCyG2CHfLuak8zzO+y6xfHxmcFBqxVZFfjqC8fPttgc9ZJZbC31fxjcIdnWvnAZi3L1B8ozT/7jsBq4LjYVUQhg8/FPB7pv/7fwWoJtZcPzo85/rBYr9oxTIwMrZfU28BzgOwDOyo3gLmRWe8srq1HgpgGVgzdoT9Yt4a/ZqxOHUcZ7AJx3GGHQuhhdBCaCHsEwthoTFYhoWwGApgGVgzdmQhdJzbJeE4zrBjIbQQWggthH1iISw0BsuwEBZDASwDa8aOLISOc7skHMcZdiyEFkILoYWwTyyEhcZgGRbCYiiAZWDN2JGF0HFul4TjOMOOhdBCaCG0EPaJhbDQGCzDQlgMBbAMrBk7shA6zu2ScBxnuPn9d6E5lPJgZs2ayMDiUATjSNJ4VEDrQw8JmPfLLyOzbp0QcSTzyy+RiViniPItWhSZiBXKZ4oco0rXmif89JOA1rhTiaeUQ5lXX40Mysvm5MwLyq/KGxluAep1hxyV+eCDwr59Ajz8/fcFyDO+SDjcFb9owJGzEb8Jqpqvvy7gu4EvEr78Z84IEZ9mZsyIzMsvCxG/ZJrv1c8VqHpRuaJiRnld18S4F50xL75YZQHN1rpwR2dMhB1hKNAqRAFGhmygM1qxZnRuF5apnxWG+te/BHTGUJgI9ogHWwshWvGssAxQP0lQvwWMjHuxfawZ1ENh+9r5elnqOM4wEmXuK8PejuPcQCyEFkILoYVwBHyxMFQtORiqrtQxEXaEoQB2VFOrCDr3JSrtwjL1s8JQFsIM7sX2sWZQD4Xta+frZanjOMNIlKECatjbcZwbiIXQQmghtBCOgC8WhqolB0PVlTomwo4wFMCOamoVQee+RKVdWKZ+VhjKQpjBvdg+1gzqobB97Xy9LHUcZxiJMlRADXs7jnMDsRBaCC2EFsIR8MXCULXkYKi6UsdE2BGGAthRTa0i6NyXqLQLy9TPCkNZCDO4F9vHmkE9FLavna+XpY7jDCNRhgqoYe8yV65cGf2/ox86nzs/jrOP49xusRBaCC2EFsIR8MXCULXkYKi6UsdE2BGGAthRTa0i6NyXqLQLy9TPCkNZCDO4F9vHmkE9FLavna+XpY7jDCNRhgqoYe8yXd0Pn9s+ualz3XFuq/z8s3D8uIAyN+KZzMqVkbnrLgGHYZ47F5nly4WIzzOffRaZiMcFdY+IjZmNGyPz7rsCavE774xMLBdOnBDiLiVeyEDbIt5UxJYjVglzQtBTRs+fjwz0KZYq6RjYEeITQR8dzlzdsUOI2J6ZOzcy+N3BM88I2BHXzLNt3xYeCiF2Kq9nmm+sflXiRAblJb5meM5YFb7tAF9gfCfhw3RalKqomPuq1DEUDLCu1OuhajOpJ8Kho7i3nhf3wgH6KfrZOpF70YpXhs7QNjxJWBxWBTAvhkJnvN/awzFyvSpsEC8FTwNDgfp7VVP/SUFr+cpYnDqOM9hEGSqghr3LwOi6Ct54+jjO7RYLoYXQQmgh7DIyhqoL93oiC6GFsBf196qm/pOC1vKVsTh1HGewiTJUQA17l2ntbvQfAPN1C6EzFWMhtBBaCC2EXUbGUHXhXk9kIbQQ9qL+XtXUf1LQWr4yFqeO4ww2UYYKqGHvMoXddZoshM5UjIXQQmghtBB2GRlD1YV7PZGF0ELYi/p7VVP/SUFr+cpYnDqOM9hEGSqghr2bjPNf/woh7NXkOLdPLIQWQguhhbDLyBiqLtzriSyEFsJe1N+rmvpPClrLV8bi1HGcwSbKUAE17N2kq/XlK1n5Rq+k9r+uoI/j3G7B37ARL2ZWrIgMWu++OzI84FGPf1y4UIj4U5gbQpzKNIdhSpUfsUY5nHn44cjATLZvFyK2ZprjTL9WxAH+/DMye/YIEfuUVwTVp3nzhMuXhYgNGZyqinILp4xC6iDAEZsz06dHBqqJg2E7/7n8+z+a8lXBrwNw9Ovbb0cm4n3lJ+W7DISfh7vqKaP8BcfVTWXiHeHuyGzeLFy6JOBrhi8SvmZ4v6y2Ubm2dXCmrtTRiooZrXUBXY8M54EhQOrqZWAoLAPmia87Rsa99Qbrp1GPjHu/+krALx5wLzqjtZ4Ii/ziC6H2NBy5i5ExL7QNawb1VwWrwkRoxfvFUJi3Pq8VhxdrK4tTx3EGm3AcZ7jB390WQguhhdBCOEK9DNxrIcxAVCyEGawKE6HVQug4UyPhOM5wg7+7LYQWQguhhXCEehm410KYgahYCDNYFSZCq4XQcaZGwnGc4QZ/d1sILYQWQgvhCPUycK+FMANRsRBmsCpMhFYLoeNMjYTjOMMN/u62EFoILYQWwhHqZeBeC2EGomIhzGBVmAitFkLHmRoJx3GGm8cfF3btEpo8rvxb2S1Miwyk7uOPBZzKiGp7wQIh4ltF5p01KzKo8p94IjI4dDTig8zevZGh8cZHwj2ROXBAgIk98IAQ8XQGwoAdgTfeENDKkzOhQPMUdelnn43MmTNCLFR0+xGfCrMjc/iwEPGyIk/j4MHIYIMR5zI4Nbf5VcInmdmzI0MhjL2Ze++NTMT6DPS4GUpElEOh6kUhW5fXdSuGQrXd173QiVqQ0BkT1Z3RCiCEEBXIZK2LuBcPB+BegFXVG+zrDaIVYBm4F9uvJ4K0128Q8+KxY2RQv250Rmu9jHrNQEdmceo4zmATjuMMNxZCC6GF0EI49r2otlGL150xUd0ZrcBCmMEycK+FsEBHZnHqOM5gE47jDDcWQguhhdBCOPa9qLZRi9edMVHdGa3AQpjBMnCvhbBAR2Zx6jjOYBOO4ww3FkILoYXQQjj2vai2UYvXnTFR3RmtwEKYwTJwr4WwQEdmceo4zmATjuMMNxZCC6GF0EI49r2otlGL150xUd0ZrcBCmMEycK+FsEBHZnHqOM5gE47jDDfQCRyHiOPxNm0S1q8XIp7I7N4dmYhVygbhalmcWSDgONOI3zJr10amOe5yZQaF+6+/ChGPZU6fjgyOFcVRqDCTWBzCcgGHUn7yiQDVnD8/MqjcZs4U4DwRP2RQIuKgwZdfFrZtEyJeUvZkcKrq8eNCQETx9vVMzoinMnDa114T8H6bXxbIt27p0sg0Qx3N4HclEe9mmhNo9WTUuTg19z8CvhsoZFHm1lUvCujaTKBAGBlDoYDGvHAATFSvGWAi3IuRa8mBxeHeeqh6ZKwZzwr3ohXUEovOWAbAjvp6oeiM1npH9TLQuX6hAE8Djx2d27eWQedyVSxOHccZbKLOlRLn71wreruk13XHuR4LoYXQQmghHAFDoejHvBbCDO5FK7AQFlgIHWdKJuoUOlM0/Z2mLJw0wcpHw04pvVp7XXec67EQWggthBbCETAUin7MayHM4F60AgthgYXQcaZkos6ozlxp6DSVgQ5NRjsa55p7det13XGux0JoIbQQWghHwFAo+jGvhTCDe9EKLIQFFkLHmZKJOh33A52mMtCh/KOWi9dTX8zX2z75Q+7c3psv4jrStna9MV/E9a59Ohcdx0JoIbQQWgivgaFQ9GNeC2EG96IVWAgLLISOMyUTdUbN5UpDp6kMzKfz499VYpfPox/y5/F0zj/mPvixax/0R9DU68deA/a62PnsOE0gZg8rsU75TtmpPKcczEA14Xg4wvHVVyODWvzCBeGOOwQo348/CpCNxYuFiIuKCAPscdmyyJw7Jxw7JsR9igrwmjVCxOoMSibY4++/RyaWCTt2CBEnFLwy2f6WLZG5804BDzbiSAa/d8Ahq43wf52ZMSMyR44IESsyzUmw8ksKHCv61FNCxDZF1Pr55yOD4GsG4edhp0sVVL2wGrR+/rkAu0ARjMIdI9f2iHnroVBt496yFp8QGBlPo5WETL1ItOJePDo8HNxbvyPw1VcCRq7nxRbQionqp1GvGW8BQ/XVWn8JsQUsEq0AT6Pcr5amjuMMOvw7FRnVlisNnaYyo+bTSb6eeok15etdL/bqPOb14mLXPqMpmmIck7Yfuv7oOCkWQguhhdBC+I2FUFtxby1muLd+R8BCmMEWsEi0AjyNcr9amjqOM+jw71RkVFuuNHSaymTtwWekbcpXOp/zj/1ex0WEPf5O29T1RnRrr+OuznXHaWIhtBBaCC2E31gItRX31mKGe+t3BCyEGWwBi0QrwNMo96ulqeM4gw7/TkVGteVKQ6epDLSn8+N4dKhX5xu+PubFrqlHG3PS9oPjjBULoYXQQmgh/MZCqK24txYz3Fu/I2AhzGALWCRaAZ5GuV8tTR3HGXT4dypSWEzR9HcKTcpNXa2pa2d8Hv1QXO/VlC/m623a0fLnrgPic3sxX3ecJhZCC6GF0EL4jYVQW3FvLWa4t35HwEKYwRawSLQCPI1yv1qaOo4z6PDvVORKyVhptQeCBE3K17te7HV99HPnYu4zeqW4F9eRtjXf1WntXOw0da7nz20Hx4nLl4W77hIi9ipysCTUC1U+FOjiRSGWCNOmCbCpiC8zb78dGZQuMVPRsh6V+h9/CDhkNR5R4vXM5s2R4bxcxoUMtgAFijikfJbBQakR+4RpkUF99fTTwqlTAg6GhS3TaeNYpjmS9Hzmt98iE/GLci6zfHlkcLxnxGFlUwZaHnFa2SrMDiF+Un7NzJsXGXyf8UWKWKtcyuBcXFauAAV0bWKoidEZrfiTAxVpV5JBaY7vGVqxDIBlgHrevnSifjgYGU8DbwHU26+3gHvRGa19dcaTxLx4Gjhx+IsvBOwX8wKoF1bV1/br72S9o36+GyxOHccZbMJxnOHGQmghtBBaCEeoi29Ql/VoxTIAlgHqefsp+gmWgZEthBZCx3EGlXAcZ7ixEFoILYQWwhHq4hvUZT1asQyAZYB63n6KfoJlYGQLoYXQcZxBJRzHGW4shBZCC6GFcIS6+AZ1WY9WLANgGaCet5+in2AZGNlCaCF0HGdQCcdxhhsLoYXQQmghHKEuvkFd1qMVywBYBqjn7afoJ1gGRrYQWggdxxlUwnGcIecBYc8eAUrAUzfVPSJ2ZXbujMyhQwLOe4w5SvxH+SOD0iWmC01pLrLx6KOR+fRToTnAU+r41asjE48K69cLuBc29corAoaaO1d48kmBx2wuV+LxzIIFkYl4R3hYTpHFRBs3CpcuCTDeVasEfK8OHBAiPs9Aj2nLusGlS4WIDzI4ZfSdd4SI48puBZoKP3wjc999kYl4QXlNuaxsFGAmqFwBqnwUwSiRUZqjnkaVX5fXGKqvedFal/XtljP4I4ot4OHgXvyHA631g8U7wrzoDBWp30LdWn83sOZ6+5Crer+gr3fUF9hvDZ4VwMhoLb+ELE4dxxlswnGcIcdCaCG0EFoILYT1g7UQjv8d9QX2W4NnBTAyWssvIYtTx3EGm3AcZ8ixEFoILYQWQgth/WAthON/R32B/dbgWQGMjNbyS8ji1HGcwSYcxxlyLIQWQguhhdBCWD9YC+H431FfYL81eFYAI6O1/BKyOHUcZ7AJx3GGHAuhhdBCaCG0ENYP1kI4/nfUF9hvDZ4VwMhoLb+ELE4dxxlswnGcYedP5fkMqvwVKwTIxvvvC7FU4Pml2hrxnCLHbE6fHpk5cwSsCoX7Cy9EBn4Y8UOGB4fGS4IeOoqTUWOBMGOGEPFe5ujRyMQdyn0CJjp7VuAGZwnz5wsR32Zgnlc069ZFBj4Mw484lcHI+JphzW+9JUS8JSwLYZFyjzJDuUvRI0kXLYoM3HLr1sgcPChgkR98EBmoB87jxYMdo/guC1mW9XVNXOsTloGhIDlYBhaJzhgZ92KRE9lgX/vFIuuJvvtOwCIB7sXIWFW9IzxY3Fu/FMzbrrPojFeGeest4FmhM+bFRADbr98CtoBVYSg1bRanjuMMNtfK0Z65crU86Q17O45zQ7EQWggthBbCxgEwVO0eWCQ6Y2Tci0VOZIN97ReLrCeqVQTgXoyMVdU7woPFvfVLwbztOovOeGWYt96ChdBxnD5zrRztmcL6iqZOrtYzvPTPZGATOc4/EQuhhdBCaCFsHABD1e6BRaIzRsa9WORENtjXfrHIeqJaRQDuxchYVb0jPFjcW78UzNuus+iMV4Z56y1YCB3H6TPXytGeGbW+rv82aCF0nJsVC6GF0EJoIWwcAEPV7oFFojNGxr1Y5EQ22Nd+sch6olpFAO7FyFhVvSM8WNxbvxTM266z6IxXhnnrLVgIHcfpM9fK0Z65WUKYK5z8Y+6Z07mOpnwRTaNp7+pccZxbNhZCC6GF0ELYOACGqt0Di0RnjIx7sciJbLCv/WKR9US1igDci5GxqnpHeLC4t34pmLddZ9EZrwzz1luwEDqO02eulaM9cxOFsL2YP48WPzf2efTHzmf8iCbHufWiKvLnn8JPPwl79wpr1ggQlaefFnBg6f79Av7uXrxYgJhdvhwZnPd46pQQ8UymORzylczLL0cm4hvlWAbCcO+9Ag6WfOCByDTmuSYDecZLgXi/+qowc6YQcVTZoHyduXgxMhFvZrZsiUzEqsydd0Zm4UIh4iPlHeVABkeS8qRQ+KFuAQ/no48E2mOcyaxdGxk8dlgrDDDmKXrK6LlzkXnpJYGlaq0EdT1dF8GtMmXqeroeGffWlTrmxRbqoWph0CqfnetV1RPBanAvlgFP++ILoX6SWAZ21L6IDDpjKPyWAqtC68cfC//6l4DTmXFv/WBrmcS9MMB2y8X20Yp59f2yOHUcZ7CJMoMUws7FiVzv+qPj3NqxEFoILYQWwm8thOVEFkILoeM4/1iizCQVwtEro8F1x7n1YiG0EFoILYTfWgjLiSyEFkLHcf6xRJnJK4SdFE2Oc2vEQmghtBBaCL+1EJYTWQgthI7j/GOJMoX1FU2ddPW3rp+vXEtfn0c/jPkjmhzn1ouF0EJoIbQQfmshLCeyEFoIHcf5xxJl2n8bxL8T1unqb10/j8peJ50OaMoXU5frfYorjnOL5vXXhYiVyuEMKvWI7zLPPx+ZiIPKb5kff4wMyoDmRMdPMl9/HZl4WEC1GQuFDz8ULl0SIl4UlkQGyvfLL0LjeGKPEeczS5dGZv16IeJTRbJjhxDxRwYHeI418n+Uk8p24e4QKGYiwCdOROa334SIfQoiunjyZGRg+BGnM6hU4eER72Y2boxMxGeKSN0bb0QGXxXUz82flH8rvwi1A6BwR2eAIhh/GOoSGWZSd65Hxhbqe/GHH0OhFSOjM/7TgB3VYJEQQkyEx44dQQhxb037TjNYJO7FmmFTuBfbx0R9rQrbxzLqJ1lPhBeKVoxcb7CdKyGVqeM4A0+uAIYYm5szdWMhtBBaCC2EYxfQ6FyPjC3U91oIi5EBFol7sWYLYaadKyGVqeM4A0+uAIYYC6EzdWMhtBBaCC2EYxfQ6FyPjC3U91oIi5EBFol7sWYLYaadKyGVqeM4A0+uAIYYC6EzdWMhtBBaCC2EYxfQ6FyPjC3U91oIi5EBFol7sWYLYaadKyGVqeM4A0+uABzHGUIshBZCC6GFcOwCGp3rkbGF+l4LYTEywCJxL9ZsIcy0cyWkMnUcZ+DJFYDjOMOInru4aVNFxAVlozA7Mqi2335biNifaQ7/PJVBWf/cc8KePQJaG32SeWNWCAsVuocKw9wQVDYaH35LwER3KPG0Ivr0qh4rGjMFnAQLoIuPPCI0b2FEhBKifE3nZxXZPo+N1ce+apUQ9yuxQTmS2bkzMny/vBfKdymDrwpW1fzq5IByRvlB4PvV70Zd9aJ4/eoroS6Rm8K3oh6qNahMPS9GhuOhFSOjFa6FVsxbeyk61/OiM8D2IUgYCuBebLBeFSbCg609DSOjtZarvlrxrOotYBn1c663gFb8KdNnNVKQOo4zvITjOEOOhdBCaCG0EH7TVOp1eV3X4vXIFsIM7rUQZurnXG8BrRZCx7mFE47jDDkWQguhhdBC+E1TqdfldV2L1yNbCDO410KYqZ9zvQW0Wggd5xZOOI4z5FgILYQWQgvhN02lXpfXdS1ej2whzOBeC2Gmfs71FtBqIXScWzjhOM6QYyG0EFoILYTfNJV6XV7XtXg9soUwg3sthJn6OddbQKuF0HFu4YTjOMMNzsa86y6Bp27qsaJ0AHXLiK2ZBx+MTMRa5c1Mc6Ljyczdd0cm4ltlU2bfvshE/JrZujUyOKPyzBmB+42jynuKPLrVqyNz9cFnjhyJDI5gbTTm58zx45HBvThGdfZsIeJs5uzZyPBY0diTOXUqMhG7lVEr7vCYIm4ZV30y0bx9bH99BgfS/vSTQLWeH0KsEO4MQQ9Z/fPPyOBLiCNnI1Yp7yi6I9TEOFYUZS5AeV0X37gXneviu3YAbAFDQXLgtOiMkesNAnTGquCH6Ix5sV+Ae7EjuAcWWftw+4oztQ/jWFFMhKGwKmwfnTEyOmMoPCsso32YBVgG3mC9jPrB6jticeo4zmATZTbO/H8F7D3h+P8boTMVYyG0EFoILYRdQGdU6qjFLYQWwg54VhZCx3HGSpQprK9o6uSKhs1NxtNn/MFoN3dwx7lpsRBaCC2EFsIuoDMqddTiFkILYQc8Kwuh4zhjJcqMWl/XfxscpxAWP7YZs0NfubmjOc4/FQuhhdBCaCHsAjqjUkctbiG0EHbAs7IQOo4zVqLMPyeEnX82xMW6Q77e9WLnetcrRf9Oh/Z6r4uOc3NiIbQQWggthF1AZ1TqqMUthBbCDnhWFkLHccZKlPmHhDDLFT53vdjrMz6M//qYn0d/xAd8dpyblZMKim85s/HRRyOzYoWAoS5ejAxK8zlzIjN/vsBKXU+DbOzilQyOJJ0+XaCIXlXTxNGjAs4v5bNaEBmcQrlmjYBVRfw7g9M+I34T5kUGbwGdDxyIzEsvCZjo/vuF3bsF2pROtHJlZOBLUE2ejBpfZtaujczhwwK+KrFYOHlSiNiVQS0KD2/EW9Yc0yKzbZtw6JDAR3eXgJNvf/hBGKOQBdgSnAdmgoq5rrZBrW0Ay8AisYW27s/AeTBRX1sA9aPDInEvniQWiaHqeduFZbBBrApPo15z/awwFFrrh4NWTISRYXH1IjFRX1vAqvDY8QZ1IhanjuMMNlFm4kKYk6+nXl3Ua8wORXp1vlnXHeem56SF0EJoIbQQEgthxkKYQSsmwsgWQsdxxkqUmbgQ9vqMoE/nQ329Ex2se+cbvj76OY/sODc3Jy2EFkILoYWQWAgzFsIMWjERRrYQOo4zVqLMTRTC/GMvs+rVodf1rhd7db7h62NedJwJ5qSF0EJoIbQQEgthxkKYQSsmwsgWQsdxxkqUKayvaOqkl2JduZau19sOxWd86NUBP445IH7M19HHcW5KTloILYQWQgshsRBmLIQZtGIijGwhdBxnrESZ9t8G8e+EdVp9gollH8utvTrk670udprQM9/SacLFzmf82HZ2nJuYM8rKDE7Le+01ATYVsSXDEjlOZD76KDLLlwsoviE5Ec9loHx79wpUzdnCzz8LEa9ldu2KzPPPCxEvK7DW08qvGRzat2CB0Gj5D8rPGWg5Xhle6IcfRub994WIHZn9+yPz+OPC3LkCTvuMeD6zaFFkItYoLylvKerwcSRz4UJkYq6CJ6kOj3Nxf/tNqNUap8jiMFs854jPMzygFaUqXiG+K6iJUW3XBXRfRoRqG6AzwI7qOh5yVYORMRQ2OJE1oxVb+PLLilpF8I6wSLwUzFuDbw6GwkTt7Zn63nqDfT1YtOL7jM41WCTAjnReFqeO4ww2I9Wo4zhDjYXQQmghtBBaCHVktGILrQRaCHs9ur5a8X1G5xosEmBHOi+LU8dxBpuRatRxnKHGQmghtBBaCC2EOjJasYVWAi2EvR5dX634PqNzDRYJsCOdl8Wp4ziDzUg16jjOUGMhtBBaCC2EFkIdGa3YQiuBFsJej66vVnyf0bkGiwTYkc7L4tRxnMFmpBp1HGeosRBaCC2EFkILoY6MVmyhlUALYa9H11crvs/oXINFAuxI52Vx6jjOYDNSjTqOM9QczFy6FJmIT5T/ZGBTly8L8YjwyivCsmUCjWimcPasgAo5Fgn33itEHM+cPh2ZiD8z585FJuIj5RdhmpxCCfXCIp94Qoj4JrNzZ2Q+/1y47z6BzznOZzARj+iMA8ofyiblVOahhyLTHO+JZ/VG5r33IvPGG8KddwpPPingsW/ZEpmIC8pPwtUtJzZvFiCEixcLcNqI1wX9zUJMV/SlRGxQ/i18+qmAEhlVLwp33ItKHUUwhkLneiLIBu5FHQ+wo3pk+BJWhc44ChUj1+qFoeo1188KrVgGwFnGGKrePraA1vrhYJH116xeRr1fdK7XjNb6bFvci1dWD4U/C7oFLU0dxxl0wnGcYcdCaCG0EFoIG8nBRJAN3IvSHGBH9ci1itTOg5ExFIQBQ9Vrrp8VWrEMYCEsWrHm+l68snooC6Hj3MIJx3GGHQuhhdBCaCFsJAcTQTZwL0pzgB3VI9cqUjsPRsZQEAYMVa+5flZoxTKAhbBoxZrre/HK6qEshI5zCyccxxl2LIQWQguhhbCRHEwE2cC9KM0BdlSPXKtI7TwYGUNBGDBUveb6WaEVywAWwqIVa67vxSurh7IQOs4tnHAcZ9ixEFoILYQWwkZyMBFkA/eiNAfYUT1yrSK182BkDAVhwFD1mutnhVYsA1gIi1asub4Xr6weykLoOLdwwnGcYeeIoCUyynr8lRr3Kiyg31EgDM9l3nknMocOCXGX8PbbQtyvxNvKd5kVeibnrFkCn0Z8kJk2LTIRL2SgMTDPF14QsKo//4xMxCuZ+++PDEQUZ4FCgHHIKtQrHlbgPOqHzRYuKj9mfvwxMvjtwMaNAqwVZe2DDwoRj2d48m18mMHpj0uWCDgplG75UGTWrRMinshc0UBiZ86MDFbF4rsuglHH1xqDoVC4Yx2YCMd7YpFQAvynod4CmIh7TORpADwNzPvFF0Itk2jFROgMb8Fvktp1ZvCssAUsA08D4MECbL9+Vhi5fin47Rd2VPshVoXO2D4Wqd86FqeO4ww2Uea/vv6vAvZ2HOeGYiG0EFoILYQWwlJy4B74jmJetGIidLYQWggdZ8onyhTWVzR10vwF3eXiaPS+v7rx0t8XeXOPkXFje71Xn/YiruQfHWfisRBaCC2EFkILYSk5cA98RzEvWjEROlsILYSOM+UTZUat77+6/dvg6P+tU6tUbVZdW0cvdm2K5nrnx/FcLz73ut1xblYshBZCC6GF0EJYSg7cA99RzItWTITOFkILoeNM+USZUev7r2EIYTQdOj/2uvGG+7cd0JQ7tJ0dZ4KxEFoILYQWQgthKTlwD3xHMS9aMRE6WwgthI4z5RNlRq3vvyyEFkLnn8y6zL59kUEhG7FCOZyBAxw/LvCYTa22H3hAeP55gX6o7hGxXVGrWRpCnFU2CjP1gNPYm3nppcjgaFAY4NatAoqTxjy/Fq66SmLNGuHddwVGHQ/LiHhPEX1aujQyjfLJIiHAER9ncI4ozsJsVrUqc/58ZCJ+y9Rfhocfjgx+ldD4/+pMo4ufZPB9xjG5jbXKs9q1KzIMbAo1cV3XorzGvSjrcS/qaUyE4hsToRVbqB0Ai4R5YmTQ1731mjEU1oxHh86QWIB7MS86Y+T6/WKRuBfz4qWgFctAZzzYekf1c66XAbfEveiMobD9vp6kdmZx6jjOYMO/FjUTF8KcthVXEHTo/Ihhe12/fqc25Yv40Enb1H5wnJsVC6GF0EJoIbQQWggTFkLHcQYY/rWombgQdv3c60qbrhrW68bx9IluY7aduzaNfm47O84EYyG0EFoILYQWQgthwkLoOM4Aw78WNTdRCMf8sWsKMWszzvHbMdueXZsshM4/FAuhhdBCaCG0EFoIExZCx3EGGP61qCmsr2jqpDa0cZrVlWvBlfxjJ726jef6eD6P/thrdse54VgILYQWQguhhdBCmLAQOo4zwPCvRU3nnwS7wt5NWncqXKtXWgcbvZLTuZ675Stt59za+REdRi/iR1xxnInnh8yrr0YmYociZyfiL9yVK4XFi4XXXxdQfG/bJkQ8mdm7NzIRWxTR1EuXIvPDD8KHHwq7dwsffSRAYyJOKd8q7yujB1d2EHmOWJk5ciQyq1cLJ08KEO9Nm4S77xY+/liI2J3BG4xlSjybad7RmgzWHHEo88wzkfngA+HeewV8J5sHq4fZPhCZs2cFGC++G9BFnIuLxw57jPgpM40n0B7L4FxcinetE3VNjMIdZ1S2VXJRMWMitKJSr4dq5yqoBakGVT6GKh2AnWvXgrfUL6V+GnhlaMXI2ALeQl8vBSPXnTFyX0NhzXg49TuqJwL1bzQwLybSDbI4dRxnsAnHcYYdC6GF8C8shBbC66C1L/do5yrA9tsOBajya9nAvehsIcxg5L6GwprxcOp3VE8ELISOc7skHMcZdiyEFsK/sBBaCK+D1r7co52rANtvOxSgyq9lA/eis4Uwg5H7GgprxsOp31E9EbAQOs7tkrg10vmfa3bCHo5z+8ZCaCH8CwuhhfA6aO3LPdq5CrD9tkMBqvxaNnAvOlsIMxi5r6GwZjyc+h39/+2dDcidZRnHL4YMESmJIVIWYwxZS0qkbITZi0mYSQwzszKdU1apqaiI3x/T/P6odOa3bjqnm19zTFNTUzPzK4mKEBUZIhISQ8YIEVnv69mO1/93P+c+5/045311/z8/5Dz3cz/3cz/Pc97zXr/zjtv6iYCF0HE+KQnHcSY7FkIL4WYshBbCj8DeUblHea4KuPyyQwVU+XXZwLHobCHMYORRDYU54+bUn1H9RMBC6DiflITjOJObdesELO8JqYvtFfVD1OInnCD8+99CxA2ZN9+MTGEm5wpzQtDVIItFR+XYjRsjE/GEsLss74klKw88UIidhD33FIqlUEWfuLpp3CIMH55YtEiIWKKckYEuRizNzJwZmZim6L3CQpoot2K28O67AvMN4brrBFRuMUOJxxTRNogZ7tVNNwlvvy1EvKJ8R/hyZObMEfivSraNzLbKSScJQ0MC7yzK3Gohy1r8qacEdMZQ4IknBAwFX0JZj84AJ8Kx9SvCsVACHIu9OFEdvAuhbfWRMWdQnqsCrgh3sn6v6tTvFS4fnXE38GbAXryfcYGYVf0rDDx9zApzxhXVFVdPxOLUcZzBRisGx3EGHguhhdBCaCEcwUKYsRBmLISO4/QzWjE4jjPwWAgthBZCC+EIFsKMhTBjIXQcp5/RisFxnIHHQmghtBBaCEewEGYshBkLoeM4/YxWDI7jDDwWQguhhdBCOIKFMGMhzFgIHcfpZ7RicBxn4MHSoFzREaX5kAL12i6EeDSz446RgYnhl/UeewgRvxe0+Ibj7bKLEHGgsreyPLPDDpGJeCNzwAGRwQVG7CuoPMPTYI9vvSVgsdOIgzLLl0eGjyw+ELI5DxOHCJtCiA3KoRmsyIoHOo3LbMrzxbHHHivAPLEw7IYNAlcKjauU1Yo43qxZkcE3GjH8xBPz5wuvvy5EnKKsVxZkUKlyuVq8+9EboERGPV23C1TqGBnldb2Ox14cW6/U69eLvfUTjWqS9b0As8JeTBIPBeC89QvEseiMoQDEDEPVLwGOV798UL9APLL6zakDxytnksElAJ2VlqaO4ww6Uc3i5YsrsLfjOGOIhdBCaCG0EI4wHtfCsQAnql8v9tZPNKpJ1vcCzAp7MUk8lLrz1C8Qx6IzhgIWwgwuAeistDR1HGfQiWoq1lfZ1Q7/RU9TYyt63OY0tqOxPLyxpXyR09jYbseusqWddn/HGUUshBZCC6GFcITxuBaOBThR/Xqxt36iUU2yvhdgVtiLSeKh1J2nfoE4Fp0xFLAQZnAJQGelpanjOINOVNOyvsa/DfYohL1vlikta8wtnV7kNDZG0V7fdJxRx0JoIbQQWghHGI9r4ViAE9WvF3vrJxrVJOt7AWaFvZgkHkrdeeoXiGPRGUMBC2EGlwB0VlqaOo4z6EQ1U1wI26/LxrKl8UVOY2N0bm+lvtdxusdCaCG0EFoIRxiPa+FYgBPVrxd76yca1STrewFmhb2YJB5K3XnqF4hj0RlDAQthBpcAdFZamjqOM+hENZMuhO3/lpvlrvy6bGl8kdPYGJ3bW6nvdZzuQbV98MFCTFdilbJAOTiDwh1rkEasVa7MnHNOZGbPFmKmwlnNV7Toj9cV0Ynp0yODJVgnNC8Iu4UwrtyT2XnnyDz5pMCHMkv43/8EjMzTMmcolwq7hqAmFvH3zE47RQar18Y2wsKFQsT7mWOOiQye7yYNVpHFeq0R7yiSGTMELDrKFVkhdSigUciiREZ5XV8pFEOhcMc0sBfHovhG5/re+hVhGtg7gTnuOAFLKn/uc8KnPy3MnSvgTXn33cIFFwhYY/fqq4U77xRuu0245BKBPwyalSuFu+4SsALv9dcL99wjXHmlgFmtWCHccYdwww3Cb34j4PKXLhVwr7AX08AVLVsmXHWVcMstGRanjuMMNvz40oxfCOWXe7EXLUirQ7sbNstdnRobX+Q0Nrbbsavd2N6FFscZXSyEFkILoYVwBAuhhdBC6DjOZIQfX5rxC2Hj604tSLvD5tqgaGy9qLS3Xpe7Gk/d2Fim03kdZ4yxEFoILYQWwhEshBZCC6HjOJMRfnxpJlAIu26WaXfYXBs0NeagQ/t1uSv3aaexsQy69XiU43SMhdBCaCG0EI5gIbQQWggdx5mM8ONLU7G+yq526u7UVaUaO7QbO41Wtpe76iMj5YCVTccZdSyEFkILoYVwBAuhhdBC6DjOZIQfX5ryb4P4O2E9pSzllnIv0tih1dj7rs11ReqQX+S0euY07kpHbN6FFscZXbCiI2qG004TsLzneIISOb/Lh4NZwRAiblA2KBIW31yTEyNL0Y9ZIdtvHxksaFn4gwQqgqGOOkpA1q8X4DyvvBKZiBMEqNc0oX6B554r0IjmRgZDsbMuSIs3AyepI8Npi6dwriISiy8pqHz4+kNVszjRqszxx0emuFf/ykBxWchCCW6+WUC1vWqVgPL6d78TUJpjKPzwo9qGIdx/v4DCve4PS5YIWDYX14uyHnu1rOeJrrhCgLdcdpkA2fjtbwXcK+y9/XYBJ6r7EuwRV4TbjmcE5cMl1B8oniCmgfNiL6733nsFvIFxLMAbGMfi6a9eLdQlFjfnoosEnQaLU8dxBptU4ziOMxmxEFoILYQWwhHq/oBq20JoIbQQOo4zQUk1juM4kxELoYXQQmghHKHuD6i2LYQWQguh4zgTlFTjTGZQunxYvTjO1hELoYXQQmghHKHuD6i2LYQWQguh4zgTlFTjOI4zGbEQWggthBbCEer+gGrbQmghtBA6jjNBSTWO4ziTkerSa7JA5TAs69V54ADbbBMZVts0sfMy8CWMzLUx1Yg45zkChkIdi4qChftuQiFmLwlfiBrxmCKLrBadkTUZTnKmwHu1s4D7jEuAluPWXXhhZBAqvZpnt6zIFCe6PIN3LCaJtygW/8R7I+LkDIeaibVtbxN2CUFXVX3zzchwKJTmqIlR1g//4qxQr+Pvu0+AP8Bb6sdCYiE5N94o4IoApvHAAwIuHxcIAcbP88UXC9h77bXCNdcIOC+uF287dIYv4XqhT5jVmWcKmCTuFQQJPyq4V9AnLFiKkWFiuEA8I0gdOkPMFi8WsOgo7hUuH29C3MnSvSserg90S1HqOM7kJBzHmdxYCDOooOhaFsKUwtMkFkILoYXQQjiChdBxnG4Jx3EmNxbCDCooupaFMKXwNImF0EJoIbQQjmAhdBynW8JxnMmNhTCDCoquZSFMKTxNYiG0EFoILYQjWAgdx+mWcBxncmMhzKCComtZCFMKT5NYCC2EFkIL4QgWQsdxuiUcx5lS2WcfgTVxnCR8KjLPPSegGEOtsnatEHGT8p8MpgHZgAGi87HHRgZKQHvUhSWxCiV1AkqgQZlXZJEipo0lDIuFUkVyZs2KDBbSLNbGlPPiXtHi4lFFozcn4j5FvzuYCZtSeVYDjHhBmBeCXj59eAdFH+iaNQIuH6vXcmQFb2++kfTWffBBZLAkKWtxVK6oa3ENWDpyua7YiWNR5UPbUMdjKJwIhTvsEaub4ryYFazmwQcFqBcuH+qFkWHaWKEUjofrxUOBt1x+uYCRL71UgGpCcrAiK+Sq/rjxVsGJcDdwRfA0PH0ci+eL6/397wU8bhggHugppwg4L95mmDO+zsTNwTTwiaydWZw6jjPYbCksmvPaptcqsLfjOOOPhdBCaCG0EFoI+VAshBZCx3H6li2FRXMq1lfZ1U7xu76hsRU9bnPQ3qlzY3tjS950nCkaC6GF0EJoIbQQ8qFYCC2EjuP0LVsKi+a0rK/xb4M9CmHvm2VyhzG8Hu3pHGdKxEJoIbQQWggthHwoFkILoeM4fcuWwqI5U0QIO/Us23FI7lB2dpypGAuhhdBCaCG0EPKhWAgthI7j9C1bCovmWAgdZ9DpoiJaEw8NCRFvKw8r/1CgBAiGekNRYVB7jLhKQaTo5864UMHI7yqvKC8ruMBDFD12KATmSeU5BTcWwZ2s87SyQsHdWK9gVuiMoepzxq17VcF58WbYoCDojLyl7CcM4RmtUnD5miEcq/cZ9TREBUX/MccIixYJl10mwFt+/WvhpJOEI44QsNzlaacJ+ILn/POFK64QfvIT4ac/FQ46SPjxjwUshomhMI0TTxRg7ZgktA3ecsghwmGHCeedJ5x7rnDRRcKppwpnny3gRJgVfOmsswQ8X+zFzcEkMSs8FDz9M84QcK9OP13A1wG4V5jV4YcLF1wg1N/AX/yigMd9wgkCrkiHYnHqOM5gk35fNmT8QphT7kUL0u7QqWfZXh5SvnCcKR0LoYXQQmghtBDS0yyEFkLHcfqW9PuyIeMXwsbXnVqQri5Xtjce0npddnacqRgLoYXQQmghtBDS0yyEFkLHcfqW9PuyIRMohF03yzTaXU7Z3niIhdD5OMVCaCG0EFoILYT0NAuhhdBxnL4l/b5sSMX6KrvaqRtgV0MrpW5sr1ubXU/nOFMiFkILoYXQQmghpKdZCC2EjuP0Len3ZUPKvw3i74T1lA5WcbYyjVJXHtXYXm6WBzrOFAmKb9Tx9cJdPG3JksgUQbWNE2mmKdWsXy8gqAoiFir1iD8sWBCZiGMVyT33CBGXK6PKO4oGK6NqvvENocizSi3Tpgkvvyy0Pwp7+7xbLmBp0C55Xdg1BNojgsVs1ylvK9g7nsgbiT8LqKdRMWMVStTiqNSxqC5GhgNgqL32EiBX9fzzn8L++wuQWEgdQNH/l78Izz8vYC8WHf3lLwUI8MknC3vsIfzgB8KBBwrf/75w9NHCr34lHHecgJuz777C974nfOUrwqGHCg8/LPzsZ8IPfyhgVrg5BxwgfPe7AmQS70ksmwuLw/v5+usFrIyK1Vyvvlr49reFz39eQHbfXTjySEG/OpHK1HGcgYc/v47jDDwWwkoshB/FQjiOWAgthBZCC6HjOM3hz6/jOAOPhbASC+FHsRCOIxZCC6GF0ELoOE5z+PM7SUEl00Mx4zifnFgIK7EQfhQL4ThiIbQQWggthI7jNIc/v47jDDwWwkoshB/FQjiOWAgthBZCC6HjOM3hz6/jOAPOttsKwwKV+de/IrNwoVCs2HmUAuU7WfhMCLq30JiThO1DiDcVKN8Zwo4hqNMOe1xm+vTI0PGGlDhGmKZOu5dQl9h164TYJOCh3HWXEPF+BsUnFix99NHIrFkjcJ3YGSHEkswLL0SmCJz2v4q+N7aLDFZhhJY/95yAE0FT4RqAgWnPU/T54inwrRJ7KwcIWFb0ttuEZcsELDp6yy0CFnhculS48UZh5UoBq0Gec46ApVBRqT/zjLBihYArGv7dn0HnP/5RuO8+ASfCI3z2WQHv77/+VSjeOhJ0fvJJ4emnBQyFvZgVzARXhBNh5CeeEPBTh/M+9ZTw+OMC9mKoP/9ZwCXg5sDS0RnUrwjnRWf4P64Xx2KSQGcllanjOAMPP4EdxxlwLIQWQguhhdBCyKePzhbCDG6OhdBxnPGFn8CO4ww4FkILoYXQQmgh5NNHZwthBjfHQug4zvjCT2DHcQYcC6GF0EJoIbQQ8umjs4Uwg5tjIXQcZ3zhJ7DjOAOOhdBCaCG0EFoI+fTR2UKYwc2xEDqOM77wE9hxnIHnFeGzIag+feELQsT/MgcfHJmIX2dQXkZcrGxQNipvKVcKc0PQwv2oo4SYrcR9mbVrI4MVLLGgI9YsXL5cQA2MVQnhh1QvzaxZQswUsK5k7CZgfUecF4sUvveegEe2YYNA0+aCtPtmrrsuMhGHZLCEIUpEfEnBbwf0gcIAoV6QGpwXtswbGw8pZwlcKPU6RTrPmxeZLmUuhAHlNfaCP/xBwImgBDgvavF6pV4W3Jn6BeKKcGz9RBgZQwGcd1QnwlBQIBwLXnpJwDOq3xxMA+eFxeG8mHP9enFe7MWxjzwi1I+tD4W9q1cLuN76iepvBiyLrNNgceo4zmCzudzpkMfXPV6BvR3HGVMshBZCC6GF0EJYPRGGshBaCB3HmbhsLnc6pGJ9lV3tFIVBQ2MrepyksVtuzO3Yi8a8mVva/cujkHLMxkMa2xtb8qaz1cZCaCG0EFoILYTVE2EoC6GF0HGcicvmcqdDWtbX+LfBHoWw983GdDqkU3uPr9FSGQ3pNGCPr3s/kbNVxUJoIbQQWggthNUTYSgLoYXQcZyJy+Zyp0MmVwgrHToNVR4yhl1lz3Y6HdJO2Y5Dcoeys7N1xkJoIbQQWggthNUTYSgLoYXQcZyJy+Zyp0MshEinQ9op23FI7lB2drbGFMW3VPlXXRWZCy8UsM7k669HhvaoctUtVykfZN54IzIbNwqf/awAMdtzT+HyywUI0qiy445CEREkGFHEs8rbytPKC8IQFjt9Q8HynjcJXY49T9HzxkvKcwrmDKWfuGwnzJ8vRPw9g/UssVJoxGnC8CdkRk9ULJO7UBjSG7uNgLcoK1eUuS++KKAz7AIVM4QB5fUDDwhQPqyUiqEwDVD3FhTuuAQMVc+3viWceKJw2GHCj34kYIXS888XFi8WLrpIwN4rrxTwTQOWb8WispddJmAaF1wgYC++o8J5MefhkiszgcHatnjc+KoMi53ecIMAXQQ33yw8+KCAzvhpx6867SyVqeM4Aw8/VTTjF8Kcci9aELhTHqS9mRtb7e3XaKnvytFeksporZTt5SHlC2erjoXQQtj5WAthwkKYwTSAhdBC2MZC6DhOt/BTRTN+IWx83akFKTs0qlSn12gZ1a5O6XpI2d54SOt12dnZGmMhtBB2PtZCmLAQZjANYCG0ELaxEDqO0y38VNFMoBB23SxTdmiUq0p7bhnVrk7pekjZ3nhI63XZ2dkaYyG0EHY+1kKYsBBmMA1gIbQQtrEQOo7TLfxU0VSsr7KrnU7a1rjZmE6HdGqvv+602ctMWqkMPqrXrc3ez+t8kmMhtBB2PtZCmLAQZjANYCG0ELaxEDqO0y38VNGUfxvE3wnrKYWnIkid0hIn6FN5LPaiP9qxt+zZKehZDlVpLzfLA52tMkPCf/8rRPxEmKvrecYCYfvIwA+RdeuEer76VSFivlINCvdW6d9m4rLttgIzS6lml12E+KoyrryeeeedyET8IsPbjlvHO3mCMFNXQ9UvGnbbLTIRi4QZIcSRCiLnnT49MnyLxj3KMcp+Cs77pnKUAuPFeU9RFgqrVgn33iugvIYuop7GOqo4Fm+so48WTj1V2H13YdddBZgY9n796zW++U3ha18T6ifCm/JLXxJmzxb231/4+c8F6OJBBwm/+IWwaJEwquC7IojoNdcId9whwGruvFO45RYB7xwcC8O/++4aOBZSt3KlsGyZgL31kXEJuPzbbxduvFHArcObf8kSAT9lCotT55OVxZojnakXfmw6jjPoDAkWwjHHQmghtBBaCBtiIayMbCF0+p9hCdwUm9qM+Md2r32EN6fAJj82HccZdIYEC+GYYyG0EFoILYQNsRBWRrYQOv2PhXDqb/Jjc5LS/jeW7bDHwMMJTYEpOZ/QDAkWwjHHQmghtBBaCBtiIayMbCF0+h8L4dTf5Mem4ziDzpBgIRxzLIQWQguhhbAhFsLKyBZCp/+xEE79TX5sOo4z8KxRTsocemhkUCLvsENkiqr3P4oU7q++GpniWPEWysaeIeisTjklMhFnCcOSkIljlaXKyZn99otMcazYVMTxwk4hYFZzQlDZ2HvvyOBYLlmJkXljwbmKitmw1mYgSPNCwBKdsU4ZT2TJ2fffj0xx617NHH98ZIqvIdZnLr44Mg89JGC5Wi6iy7txiPCpyGBWrPJR14JrrxWuvlpA0V8voO+/X0DRD7tYulQoSmoBC2lef70AQ1izRjjzTOHSSwXsxSKcWO0TN+eSSwQsMXzOOQLWEcWxWBoUyzHjnXSerjIKITz7bAErhZ5+uoBZ4URYdBR7Z80SkDlzhH32EbB6LdaJxZcUWO0Ty8bi2PpQOLb+5QjOi1VzcawudjpSmzpOn/MdzRwnhZ9IjuMMPBZCC6GF0EJoIbQQbt1C2PlvF9705oRslkKY/89G5eZrm15r84nf5CeS4zgDj4XQQmghtBBaCC2EFsLmOt6b3pyQTQthZZOfSI7jDDwWQguhhdBCaCG0EFoIm+t4b3pzQjYthJVNfiI5jjPwWAgthBZCC6GF0EJoIWyu473pzQnZtBBWNvmJ5DjOgIPfklgBDvVVxDOZQr0eyxT/45SXlX8rLwmzQ4gDMyiZUE/SHrcJQYM6NmIfBUtHHiBwZNn7mc9EphgZy11KzjqrxrvvCudoHYsicER6E9ddJ0T8NoMbS8nZRYn3lY2KiNmCBZGJuFI5NHPXXZGJ+L4wF0vdinli0U1Y+k47Rebll4UYEl55RVi9Wli4UNi4UYhYIewaGXrpM88ITz4p1Otp7AXPPy+ggMZQTz0loJ5G58ceE3BeXBGGqnfGR1J5UZn6FcEQ/vQnAZ3hPPVJojNAZ0wSdwPHYlZ4KBgZzxfUxQyzGpVNAZy3fmNxCfUrwlAAx774olAfSu/GHMdxJjWt4qdTkik34DjOBAS/2S2EFkILoYXQQsgTYZLoXHceTBJ3A8diVhbCCjh2fEJY+duFN73pzX5vtoqfTqlYX2VXOyhHP6xIa+naoZJRnSh6OFfXDo4zMcFvdguhhdBCaCG0EPJEmCQ6150Hk8TdwLGYlYWwAo61EHrTmx/bzVbx0yktJWr822AvtjRapxpt/xwcO56hWhn/CI7TU/Cb3UJoIbQQWggthDwRJonOdefBJHE3cCxmZSGsgGMthN705sd2s1X8dEqfhLDVnsrUzY1lS9kt76q05M32CGjML9ChvdlucZx+Bb/ZLYQWQguhhdBCyBNhkuhcdx5MEncDx2JWFsIKONZC6E1vfmw3W8VPp7RkaFNBe1c9nWxqS3X60SZetDcru/Jm2ZIP7PS6bER7u9Fx+hop3GfMiMz8+cI//iGggN5zTyHi0cxee0XmvfcErsoYD9UY9qsEy/qdsJ7n6gxsqlgoVZcGpfOIxGJRxpihxHuZL385MjvvLEQ8nBkaikyhxzcpYmKFTe2fmTcvMhF/z+y6a2RiB4U5JbO3LoVaXKAE9eRwQwZD4esAvGOxFCqUj0vdameuEzstMtOnCzCguXOFiGeVRRms4MigYkaljr2o1NEZRTD2vvSSgMdQL9yhE3XZGBUYqn7ev/1NKEfLrF0rYGQA9cK9wsi4sZANXFH9CaIz9h5+uHDEEQKWYF2yRIAgPfKIgDljYVi83THJW28VVq4U0BnfMmL1XnTGI3vgAQHvWBx7883CsmUCfjQ0cxxnTPnQR0yPjD2tgxtH7GXclmvltNvRrd6OTbS3G3Nye+rVMEjXDo7T70h5bSG0EFoIW1gIa2KGWryUsd7BUPXzWggthP0RwsrfLry5tW0+vu7xNsObtz59a5vhzcXLF7f50EdMj4w9rYMbR+xl3E5O1aODddpsHLaxMYr2cpCuHRyn35Hy2kJoIbQQtrAQ1sQMtXgpY72DoerntRBaCC2E3uzzpoWwP4w9rYMbR+xl3E5O1aODlYe3Wsr2To1RtJfn6trBcfodKa8thBZCC2ELC2FNzFCLlzLWOxiqfl4LoYXQQujNPm9aCPvD2FM5uLKrnU5O1aODlYdv+jBobKXSnscvz9XppJ0GdJwJj5TXFkILoYWwhYWwJmaoxUsZ6x0MVT+vhdBCaCH0Zp83LYT9YewpxxrVuC0By2m3o1v7RaVbpTE6t4dOIzfiRdmOQxynH/k/kGpC8mczhzgAAAAASUVORK5CYII=7d:T550,IT0gIDw9PSBhcyAgYXQgIGZwPSBpcyAgbHI6IG9mICBvbiAgcGM9IHNwOiBzcD0nXCcnKSA9ICkgbT0rSW5mLUluZi5sb2cubXNpLm1zdDMxMjU6IHA9QUNEVEFDU1RBRURUQUVTVEFLRFRBS1NUQVdTVEFob21DRVNUQ2hhbURhc2hFRVNUR09HQ0p1bHlKdW5lTEVBRkxpc3VNaWFvTW9kaU5aRFROWlNUTmV3YVNBU1RTdGF0VGhhaVx1MDBtPV0gPSBdIG49YWxsZ2FsbHBhdngyYmFzZWJpbmRibWkxYm1pMmJvb2xjYWxsY2FzMWNhczJjYXMzY2FzNGNhczVjYXM2Y2hhbmRlYWRlcm1zZmlsZWZ1bmNob3VyaWRsZWludDhpdGFianNvbmtpbmRudWxsb3BlbnBpcGVyZWFkcm9vdHNicmtzc2UzdHJ1ZXVpbnQgIC0lcyAuLi4gTUIsICBhbmQgIGdvdD0gbWF4PSBtcywgIHB0ciAgdGFiPSB0b3A9Ki5tc2krMDMzMCswNDMwKzA1MzArMDU0NSswNjMwKzA4NDUrMTAzMCsxMjQ1KzEzNDUsIGZwOi0wOTMwMTU2MjU3ODEyNTxuaWw+QWRsYW1BcHJpbEJhbXVtQmF0YWtCdWhpZERvZ3JhRXJyb3JHcmVla0tobWVyTGF0aW5MaW1idUxvY2FsTHN0YXRNYXJjaE51c2h1T2doYW1Pcml5YU9zYWdlUnVuaWNTVGVybVRha3JpVGFtaWxcdTIwMl0gPSAoYXJyYXljbG9zZWRlZmVyZXhlY1JleGVjV2ZhbHNlZmF1bHRmbG9hdGdjaW5nZ3NjYW5oY2hhbmluaXQgaW50MTZpbnQzMmludDY0bWhlYXBta2Rpcm1vbnRobnRvaHNwYW5pY3NjYXYgc2NoZWRzbGVlcHNsaWNlc3NlNDFzc2U0MnNzc2Uzc3Vkb2dzd2VlcHRlc3RSdGVzdFd0cmFjZXVpbnQ4dXNhZ2V2YWx1ZXdyaXRlIEIgLT4gIFZhbHVlIGFkZHI9IGFsbG9jIGJhc2UgIGNvZGU9IGN0eHQ6IGN1cmc9IGZyZWUgIGdvaWQgIGpvYnM9IGxpc3Q9IG0tPnA9IG1heD0gIG1pbj0gIG5leHQ9IHAtPm09IHByZXY9IHNwYW49JSB1dGlsKC4uLiksIGkgPSAsIG5vdCAzOTA2MjU8LWNoYW5BcmFiaWNBdWd1c3RCcmFobWlDYXJpYW5DaGFrbWFDb21tb25Db3B0aWNGb3JtYXRGcmlkYXlHZXRBQ1BHb3RoaWNIYW5ndWxIYXRyYW5IZWJyZXdIeXBoZW5LYWl0aGlLaG9qa2lMZQ==7e:T550,IT0gIDw9PSBhcyAgYXQgIGZwPSBpcyAgbHI6IG9mICBvbiAgcGM9IHNwOiBzcD0nXCcnKSA9ICkgbT0rSW5mLUluZi5sb2cubXNpLm1zdDMxMjU6IHA9QUNEVEFDU1RBRURUQUVTVEFLRFRBS1NUQVdTVEFob21DRVNUQ2hhbURhc2hFRVNUR09HQ0p1bHlKdW5lTEVBRkxpc3VNaWFvTW9kaU5aRFROWlNUTmV3YVNBU1RTdGF0VGhhaVx1MDBtPV0gPSBdIG49YWxsZ2FsbHBhdngyYmFzZWJpbmRibWkxYm1pMmJvb2xjYWxsY2FzMWNhczJjYXMzY2FzNGNhczVjYXM2Y2hhbmRlYWRlcm1zZmlsZWZ1bmNob3VyaWRsZWludDhpdGFianNvbmtpbmRudWxsb3BlbnBpcGVyZWFkcm9vdHNicmtzc2UzdHJ1ZXVpbnQgIC0lcyAuLi4gTUIsICBhbmQgIGdvdD0gbWF4PSBtcywgIHB0ciAgdGFiPSB0b3A9Ki5tc2krMDMzMCswNDMwKzA1MzArMDU0NSswNjMwKzA4NDUrMTAzMCsxMjQ1KzEzNDUsIGZwOi0wOTMwMTU2MjU3ODEyNTxuaWw+QWRsYW1BcHJpbEJhbXVtQmF0YWtCdWhpZERvZ3JhRXJyb3JHcmVla0tobWVyTGF0aW5MaW1idUxvY2FsTHN0YXRNYXJjaE51c2h1T2doYW1Pcml5YU9zYWdlUnVuaWNTVGVybVRha3JpVGFtaWxcdTIwMl0gPSAoYXJyYXljbG9zZWRlZmVyZXhlY1JleGVjV2ZhbHNlZmF1bHRmbG9hdGdjaW5nZ3NjYW5oY2hhbmluaXQgaW50MTZpbnQzMmludDY0bWhlYXBta2Rpcm1vbnRobnRvaHNwYW5pY3NjYXYgc2NoZWRzbGVlcHNsaWNlc3NlNDFzc2U0MnNzc2Uzc3Vkb2dzd2VlcHRlc3RSdGVzdFd0cmFjZXVpbnQ4dXNhZ2V2YWx1ZXdyaXRlIEIgLT4gIFZhbHVlIGFkZHI9IGFsbG9jIGJhc2UgIGNvZGU9IGN0eHQ6IGN1cmc9IGZyZWUgIGdvaWQgIGpvYnM9IGxpc3Q9IG0tPnA9IG1heD0gIG1pbj0gIG5leHQ9IHAtPm09IHByZXY9IHNwYW49JSB1dGlsKC4uLiksIGkgPSAsIG5vdCAzOTA2MjU8LWNoYW5BcmFiaWNBdWd1c3RCcmFobWlDYXJpYW5DaGFrbWFDb21tb25Db3B0aWNGb3JtYXRGcmlkYXlHZXRBQ1BHb3RoaWNIYW5ndWxIYXRyYW5IZWJyZXdIeXBoZW5LYWl0aGlLaG9qa2lMZXA=7f:T165c,MSwiZnVzaW9uIiwiR0FDIiwwMSwiV2luUlQiLCJOb3RBcHAiLDEzLCJTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiJVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtXGU0M2RkOWM3M2FiNTYxNWU0NjFiZjUxMDljM2ZhY2Q2XFN5c3RlbS5uaS5kbGwiLDAzLCJTeXN0ZW0uQ29yZSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzY0XFN5c3RlbS5Db3JlXDBkNTliMGUyMzdkNzUxOTQxN2RlMTBjZDg0YmRhNGU3XFN5c3RlbS5Db3JlLm5pLmRsbCIsMDMsIk1pY3Jvc29mdC5Qb3dlclNoZWxsLkNvbnNvbGVIb3N0LCBWZXJzaW9uPTMuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBiMzc4ZWMwNyNcYjViYTM3ZTE1NThjZWQxNzhhOTkwMTFhMWQ2NTliNTJcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29uc29sZUhvc3QubmkuZGxsIiwwMywiU3lzdGVtLk1hbmFnZW1lbnQuQXV0b21hdGlvbiwgVmVyc2lvbj0zLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzUiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzY0XFN5c3RlbS5NYW5hYTU3ZmM4Y2MjXDZkYTAxOTEwYzI1NjIzMWQxYzUwYWQwYWFjZWU1OTQxXFN5c3RlbS5NYW5hZ2VtZW50LkF1dG9tYXRpb24ubmkuZGxsIiwwMywiU3lzdGVtLk1hbmFnZW1lbnQsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhIiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxTeXN0ZW0uTWFuYWdlbWVudFxiMjIxYWY4MTI4NWMxMzA1MzI0NjEyZTZkYzljODhmZlxTeXN0ZW0uTWFuYWdlbWVudC5uaS5kbGwiLDAzLCJTeXN0ZW0uRGlyZWN0b3J5U2VydmljZXMsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhIiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxTeXN0ZW0uRGlyZWQxM2IxOGE5I1w4YWQ0YzBhZjViM2Q1MWEwZjNhNGRhYzBkNDRkODVkNFxTeXN0ZW0uRGlyZWN0b3J5U2VydmljZXMubmkuZGxsIiwwMywiU3lzdGVtLlhtbCwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzY0XFN5c3RlbS5YbWxcNWVlMzVkZWJmYzIyZjcyN2U3MGU0NDc5ZGRjYmMwNDVcU3lzdGVtLlhtbC5uaS5kbGwiLDAzLCJTeXN0ZW0uTnVtZXJpY3MsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxTeXN0ZW0uTnVtZXJpY3NcODZjZmQ2OWNlMTI2MWJhZjQ3NDBlNzYwNmNhZGUwMTRcU3lzdGVtLk51bWVyaWNzLm5pLmRsbCIsMDMsIlN5c3RlbS5EYXRhLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkRhdGFcN2JlZDQ5YzQ2ZGU5Mjk1YTg0NTNkYjIwNWM2MGEwMjhcU3lzdGVtLkRhdGEubmkuZGxsIiwwMywiTWljcm9zb2Z0LlBvd2VyU2hlbGwuU2VjdXJpdHksIFZlcnNpb249My4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj0zMWJmMzg1NmFkMzY0ZTM1IiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxNaWNyb3NvZnQuUDZmNzkyNjI2I1w3ZmY1MTk5ZTc1N2NiOGFmOWFkOTQ5NDUzZjY5OGQwOVxNaWNyb3NvZnQuUG93ZXJTaGVsbC5TZWN1cml0eS5uaS5kbGwiLDAzLCJTeXN0ZW0uQ29uZmlndXJhdGlvbiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzY0XFN5c3RlbS5Db25maWd1cmF0aW9uXDRiZWIxZWVjYTIwYjI3ZDRiZDFiYjk4ODBmMDNjYzJhXFN5c3RlbS5Db25maWd1cmF0aW9uLm5pLmRsbCIsMDMsIlN5c3RlbS5UcmFuc2FjdGlvbnMsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxTeXN0ZW0uVHJhbnNhY3Rpb25zXDYwNDI3MmIwZmFlYzJlMDlkNTNkMzhlMDNiYzg5YzZjXFN5c3RlbS5UcmFuc2FjdGlvbnMubmkuZGxsIiwwMiwiTWljcm9zb2Z0LkFwcFYuQXBwdkNsaWVudENvbUNvbnN1bWVyLCBWZXJzaW9uPTEwLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzUiLDAzLCJNaWNyb3NvZnQuUG93ZXJTaGVsbC5Db21tYW5kcy5VdGlsaXR5LCBWZXJzaW9uPTMuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlA1MjEyMjBlYSNcZGY3ZDk0N2E5OWNiY2ZhYTcyNmIxMjc3MjZmMDU0NzZcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29tbWFuZHMuVXRpbGl0eS5uaS5kbGwiLDAzLCJTeXN0ZW0uQ29uZmlndXJhdGlvbi5JbnN0YWxsLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvbmZlNjRhOTA1MSNcMTIwYTA1MzI1NzdmODcxYzI0MTU1MDJkOWVkYWNkZDZcU3lzdGVtLkNvbmZpZ3VyYXRpb24uSW5zdGFsbC5uaS5kbGwiLDAzLCJNaWNyb3NvZnQuUG93ZXJTaGVsbC5Db21tYW5kcy5NYW5hZ2VtZW50LCBWZXJzaW9uPTMuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBhZTM0OThkOSNcZDkyMjQ0NWE4MjhiMzA5MzhjNzJkMzc1YTNiMzRhNjBcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29tbWFuZHMuTWFuYWdlbWVudC5uaS5kbGwiLDAzLCJNaWNyb3NvZnQuSUlTLlBvd2Vyc2hlbGwuQ29tbWFuZHMsIFZlcnNpb249MTAuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LkliYWFlNWVkOSNcZTg2ZjdmODM2YTA3ZjY3M2NkZWY0YzlhNGQ0YjRkODBcTWljcm9zb2Z0LklJUy5Qb3dlcnNoZWxsLkNvbW1hbmRzLm5pLmRsbCIsMDMsIk1pY3Jvc29mdC5LZXlEaXN0cmlidXRpb25TZXJ2aWNlLkNtZGxldHMsIFZlcnNpb249MTAuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LktkNTg4MjBhNSNcMDBmOWU5ZmYzMjFkOGExNDFmM2Q3MTE2M2M3MGM5MDZcTWljcm9zb2Z0LktleURpc3RyaWJ1dGlvblNlcnZpY2UuQ21kbGV0cy5uaS5kbGwiLDAzLCJNaWNyb3NvZnQuTWFuYWdlbWVudC5JbmZyYXN0cnVjdHVyZS5OYXRpdmUsIFZlcnNpb249MS4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj0zMWJmMzg1NmFkMzY0ZTM1IiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxNaWNyb3NvZnQuTTg3MGQ1NThhI1w1ZjY0ODgwYzg2Yzk4ZTdkZGVjZGYyOGU2MTkxNzMwN1xNaWNyb3NvZnQuTWFuYWdlbWVudC5JbmZyYXN0cnVjdHVyZS5OYXRpdmUubmkuZGxsIiww80:T554,YWx1ZS5FbGVtIG9uIGFuIGludmFsaWQgbm90aW5oZWFwIHBvaW50ZXJzeW5jOiBXYWl0R3JvdXAgaXMgcmV1c2VkIGJlZm9yZSBwcmV2aW91cyBXYWl0IGhhcyByZXR1cm5lZGFkZHIgcmFuZ2UgYmFzZSBhbmQgbGltaXQgYXJlIG5vdCBpbiB0aGUgc2FtZSBtZW1vcnkgc2VnbWVudG1hbnVhbCBzcGFuIGFsbG9jYXRpb24gY2FsbGVkIHdpdGggbm9uLW1hbnVhbGx5LW1hbmFnZWQgdHlwZXJlZmxlY3Q6IGNhbGwgb2YgcmVmbGVjdC5WYWx1ZS5MZW4gb24gcHRyIHRvIG5vbi1hcnJheSBWYWx1ZXJ1bnRpbWU6IEdldFF1ZXVlZENvbXBsZXRpb25TdGF0dXNFeCByZXR1cm5lZCBpbnZhbGlkIG1vZGU9IHJ1bnRpbWU6IG5ldHBvbGw6IFBvc3RRdWV1ZWRDb21wbGV0aW9uU3RhdHVzIGZhaWxlZCAoZXJybm89IGFiaVJlZ0FyZ3NUeXBlIG5lZWRzIEdDIFByb2csIHVwZGF0ZSBtZXRob2RWYWx1ZUNhbGxGcmFtZU9ianNmb3VuZCBiYWQgcG9pbnRlciBpbiBHbyBoZWFwIChpbmNvcnJlY3QgdXNlIG9mIHVuc2FmZSBvciBjZ28/KWxpbWl0ZXJFdmVudC5zdG9wOiBmb3VuZCB3cm9uZyBldmVudCBpbiBwJ3MgbGltaXRlciBldmVudCBzbG90cmVmbGVjdDogcmVmbGVjdC5WYWx1ZS5Qb2ludGVyIG9uIGFuIGludmFsaWQgbm90aW5oZWFwIHBvaW50ZXJydW50aW1lOiBpbnRlcm5hbCBlcnJvcjogbWlzdXNlIG9mIGxvY2tPU1RocmVhZC91bmxvY2tPU1RocmVhZG1hbGZvcm1lZCBHT01FTUxJTUlUOyBzZWUgYGdvIGRvYyBydW50aW1lL2RlYnVnLlNldE1lbW9yeUxpbWl0YEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky9BQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OS1fRHVwbGljYXRlIGRlcGxveW1lbnQgSUQgZm91bmQgd2l0aCBJRDogJXYsIHNraXBwaW5nIGluc3RhbGxhdGlvbmNvbXBpbGVDYWxsYmFjazogZXhwZWN0ZWQgZnVuY3Rpb24gd2l0aCBvbmUgdWludHB0ci1zaXplZCBy81:T558,YWx1ZS5FbGVtIG9uIGFuIGludmFsaWQgbm90aW5oZWFwIHBvaW50ZXJzeW5jOiBXYWl0R3JvdXAgaXMgcmV1c2VkIGJlZm9yZSBwcmV2aW91cyBXYWl0IGhhcyByZXR1cm5lZGFkZHIgcmFuZ2UgYmFzZSBhbmQgbGltaXQgYXJlIG5vdCBpbiB0aGUgc2FtZSBtZW1vcnkgc2VnbWVudG1hbnVhbCBzcGFuIGFsbG9jYXRpb24gY2FsbGVkIHdpdGggbm9uLW1hbnVhbGx5LW1hbmFnZWQgdHlwZXJlZmxlY3Q6IGNhbGwgb2YgcmVmbGVjdC5WYWx1ZS5MZW4gb24gcHRyIHRvIG5vbi1hcnJheSBWYWx1ZXJ1bnRpbWU6IEdldFF1ZXVlZENvbXBsZXRpb25TdGF0dXNFeCByZXR1cm5lZCBpbnZhbGlkIG1vZGU9IHJ1bnRpbWU6IG5ldHBvbGw6IFBvc3RRdWV1ZWRDb21wbGV0aW9uU3RhdHVzIGZhaWxlZCAoZXJybm89IGFiaVJlZ0FyZ3NUeXBlIG5lZWRzIEdDIFByb2csIHVwZGF0ZSBtZXRob2RWYWx1ZUNhbGxGcmFtZU9ianNmb3VuZCBiYWQgcG9pbnRlciBpbiBHbyBoZWFwIChpbmNvcnJlY3QgdXNlIG9mIHVuc2FmZSBvciBjZ28/KWxpbWl0ZXJFdmVudC5zdG9wOiBmb3VuZCB3cm9uZyBldmVudCBpbiBwJ3MgbGltaXRlciBldmVudCBzbG90cmVmbGVjdDogcmVmbGVjdC5WYWx1ZS5Qb2ludGVyIG9uIGFuIGludmFsaWQgbm90aW5oZWFwIHBvaW50ZXJydW50aW1lOiBpbnRlcm5hbCBlcnJvcjogbWlzdXNlIG9mIGxvY2tPU1RocmVhZC91bmxvY2tPU1RocmVhZG1hbGZvcm1lZCBHT01FTUxJTUlUOyBzZWUgYGdvIGRvYyBydW50aW1lL2RlYnVnLlNldE1lbW9yeUxpbWl0YEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky9BQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OS1fRHVwbGljYXRlIGRlcGxveW1lbnQgSUQgZm91bmQgd2l0aCBJRDogJXYsIHNraXBwaW5nIGluc3RhbGxhdGlvbmNvbXBpbGVDYWxsYmFjazogZXhwZWN0ZWQgZnVuY3Rpb24gd2l0aCBvbmUgdWludHB0ci1zaXplZCByZQ==82:T554,YXVzZWQgY29ubmVjdGlvbiBhYm9ydHN3ZWVwIGluY3JlYXNlZCBhbGxvY2F0aW9uIGNvdW50c3luYzogbmVnYXRpdmUgV2FpdEdyb3VwIGNvdW50ZXJ1c2Ugb2YgY2xvc2VkIG5ldHdvcmsgY29ubmVjdGlvbiBvZiBtZXRob2Qgb24gbmlsIGludGVyZmFjZSB2YWx1ZSB0byBwb2ludGVyIHRvIGFycmF5IHdpdGggbGVuZ3RoIDE0MjEwODU0NzE1MjAyMDAzNzE3NDIyNDg1MzUxNTYyNTcxMDU0MjczNTc2MDEwMDE4NTg3MTEyNDI2NzU3ODEyNUVycm9yIGNhbGxpbmcgTXNpT3BlbkRhdGFiYXNlOiAldkVycm9yIGNyZWF0aW5nIGxvZ2ZpbGUgZm9sZGVyOiAldkVycm9yIHJ1bm5pbmcgTXNpT3BlbkRhdGFiYXNlOiAldkdPREVCVUc6IG5vIHZhbHVlIHNwZWNpZmllZCBmb3IgIkluaXRpYWxpemVQcm9jVGhyZWFkQXR0cmlidXRlTGlzdGNvbmN1cnJlbnQgbWFwIHJlYWQgYW5kIG1hcCB3cml0ZWZpbmRydW5uYWJsZTogbmVnYXRpdmUgbm1zcGlubmluZ2ZyZWVpbmcgc3RhY2sgbm90IGluIGEgc3RhY2sgc3BhbmludmFsaWQgdmFsdWUgJXEgZm9yIGZsYWcgLSVzOiAldm1pbiBtdXN0IGJlIGEgbm9uLXplcm8gcG93ZXIgb2YgMm1pc3JvdW5kZWQgYWxsb2NhdGlvbiBpbiBzeXNBbGxvY3JlZmxlY3QubmFtZUZyb206IG5hbWUgdG9vIGxvbmc6IHJlZmxlY3Q6IEZpZWxkIGluZGV4IG91dCBvZiByYW5nZXJlZmxlY3Q6IE51bU91dCBvZiBub24tZnVuYyB0eXBlIHJlZmxlY3Q6IGFycmF5IGluZGV4IG91dCBvZiByYW5nZXJlZmxlY3Q6IHNsaWNlIGluZGV4IG91dCBvZiByYW5nZXJ1bnRpbWU6IGNhc3RvZ3NjYW5zdGF0dXMgb2xkdmFsPXJ1bnRpbWU6IGZhaWxlZCBtU3Bhbkxpc3QuaW5zZXJ0IHJ1bnRpbWU6IGZhaWxlZCB0byBkZWNvbW1pdCBwYWdlc3J1bnRpbWU6IGdvcm91dGluZSBzdGFjayBleGNlZWRzIHJ1bnRpbWU6IG1lbW9yeSBhbGxvY2F0ZWQgYnkgT1MgW3J1bnRpbWU6IG5hbWUgb2Zmc2V0IG91dCBvZiByYW5nZXJ1bnRpbWU6IHRleHQgb2Zmc2V0IG91dCBvZiByYW5nZXJ1bnRpbWU6IHR5cGU=83:T558,YXVzZWQgY29ubmVjdGlvbiBhYm9ydHN3ZWVwIGluY3JlYXNlZCBhbGxvY2F0aW9uIGNvdW50c3luYzogbmVnYXRpdmUgV2FpdEdyb3VwIGNvdW50ZXJ1c2Ugb2YgY2xvc2VkIG5ldHdvcmsgY29ubmVjdGlvbiBvZiBtZXRob2Qgb24gbmlsIGludGVyZmFjZSB2YWx1ZSB0byBwb2ludGVyIHRvIGFycmF5IHdpdGggbGVuZ3RoIDE0MjEwODU0NzE1MjAyMDAzNzE3NDIyNDg1MzUxNTYyNTcxMDU0MjczNTc2MDEwMDE4NTg3MTEyNDI2NzU3ODEyNUVycm9yIGNhbGxpbmcgTXNpT3BlbkRhdGFiYXNlOiAldkVycm9yIGNyZWF0aW5nIGxvZ2ZpbGUgZm9sZGVyOiAldkVycm9yIHJ1bm5pbmcgTXNpT3BlbkRhdGFiYXNlOiAldkdPREVCVUc6IG5vIHZhbHVlIHNwZWNpZmllZCBmb3IgIkluaXRpYWxpemVQcm9jVGhyZWFkQXR0cmlidXRlTGlzdGNvbmN1cnJlbnQgbWFwIHJlYWQgYW5kIG1hcCB3cml0ZWZpbmRydW5uYWJsZTogbmVnYXRpdmUgbm1zcGlubmluZ2ZyZWVpbmcgc3RhY2sgbm90IGluIGEgc3RhY2sgc3BhbmludmFsaWQgdmFsdWUgJXEgZm9yIGZsYWcgLSVzOiAldm1pbiBtdXN0IGJlIGEgbm9uLXplcm8gcG93ZXIgb2YgMm1pc3JvdW5kZWQgYWxsb2NhdGlvbiBpbiBzeXNBbGxvY3JlZmxlY3QubmFtZUZyb206IG5hbWUgdG9vIGxvbmc6IHJlZmxlY3Q6IEZpZWxkIGluZGV4IG91dCBvZiByYW5nZXJlZmxlY3Q6IE51bU91dCBvZiBub24tZnVuYyB0eXBlIHJlZmxlY3Q6IGFycmF5IGluZGV4IG91dCBvZiByYW5nZXJlZmxlY3Q6IHNsaWNlIGluZGV4IG91dCBvZiByYW5nZXJ1bnRpbWU6IGNhc3RvZ3NjYW5zdGF0dXMgb2xkdmFsPXJ1bnRpbWU6IGZhaWxlZCBtU3Bhbkxpc3QuaW5zZXJ0IHJ1bnRpbWU6IGZhaWxlZCB0byBkZWNvbW1pdCBwYWdlc3J1bnRpbWU6IGdvcm91dGluZSBzdGFjayBleGNlZWRzIHJ1bnRpbWU6IG1lbW9yeSBhbGxvY2F0ZWQgYnkgT1MgW3J1bnRpbWU6IG5hbWUgb2Zmc2V0IG91dCBvZiByYW5nZXJ1bnRpbWU6IHRleHQgb2Zmc2V0IG91dCBvZiByYW5nZXJ1bnRpbWU6IHR5cGUgbw==84:T444,Q2VydEVudW1DZXJ0aWZpY2F0ZXNJblN0b3JlRWFzdGVyIElzbGFuZCBTdGFuZGFyZCBUaW1lRyB3YWl0aW5nIGxpc3QgaXMgY29ycnVwdGVkYWRkcmVzcyBub3QgYSBzdGFjayBhZGRyZXNzYWZ0ZXIgb2JqZWN0IGtleTp2YWx1ZSBwYWlyY2hhbm5lbCBudW1iZXIgb3V0IG9mIHJhbmdlY29tbXVuaWNhdGlvbiBlcnJvciBvbiBzZW5kY291bGQgbm90IGZpbmQgUVBDIHN5c2NhbGxzZmFpbGVkIHRvIHNldCBzd2VlcCBiYXJyaWVyZmxhZyBuZWVkcyBhbiBhcmd1bWVudDogLSVzZ2NzdG9wbTogbm90IHdhaXRpbmcgZm9yIGdjZ3Jvd3NsaWNlOiBsZW4gb3V0IG9mIHJhbmdlaW50ZXJuYWwgbG9ja09TVGhyZWFkIGVycm9yaW52YWxpZCBib29sZWFuIGZsYWcgJXM6ICV2aW52YWxpZCBwcm9maWxlIGJ1Y2tldCB0eXBla2V5IHdhcyByZWplY3RlZCBieSBzZXJ2aWNlbWFrZWNoYW46IHNpemUgb3V0IG9mIHJhbmdlbWFrZXNsaWNlOiBjYXAgb3V0IG9mIHJhbmdlbWFrZXNsaWNlOiBsZW4gb3V0IG9mIHJhbmdlbXNwYW4uc3dlZXA6IGJhZCBzcGFuIHN0YXRlbm90IGEgWEVOSVggbmFtZWQgdHlwZSBmaWxlcHJvZ1RvUG9pbnRlck1hc2s6IG92ZXJmbG93cmVmbGVjdC5WYWx1ZS5VbnNhZmVQb2ludGVycnVubG9jayBvZiB1bmxvY2tlZCByd211dGV4cnVudGltZTogYXN5bmNQcmVlbXB0U3RhY2s9cnVudGltZTogY2hlY2tkZWFkOiBmaW5kIGcgcnVudGltZTogY2hlY2tkZWFkOiBubWlkbGU9cnVudGltZTogY29ycnVwdGVkIHBvbGxkZXNjcnVudGltZTogbmV0cG9sbGluaXQgZmFpbGVkcnVudGltZTogdGhyZWFkIElEIG92ZXJmbG93cnVudGltZQ==85:T468,Q3JlYXRlRGlyZWN0b3J5V0Ruc05hbWVDb21wYXJlX1dEdXBsaWNhdGVUb2tlbkV4Rmx1c2hGaWxlQnVmZmVyc0dDIHNjYXZlbmdlIHdhaXRHQyB3b3JrZXIgKGlkbGUpR09ERUJVRzogdmFsdWUgIkdldENvbXB1dGVyTmFtZVdHZXRDdXJyZW50VGhyZWFkR2V0RnVsbFBhdGhOYW1lV0dldExvbmdQYXRoTmFtZVdJbXBlcmlhbF9BcmFtYWljTWVyb2l0aWNfQ3Vyc2l2ZU1zaU9wZW5EYXRhYmFzZUFNc2lTZXRJbnRlcm5hbFVJTmV0QXBpQnVmZmVyRnJlZU9wZW5Qcm9jZXNzVG9rZW5PdGhlcl9BbHBoYWJldGljUmVnUXVlcnlJbmZvS2V5V1JlZ1F1ZXJ5VmFsdWVFeFdSZW1vdmVEaXJlY3RvcnlXU2V0RmlsZVBvaW50ZXJFeFRlcm1pbmF0ZVByb2Nlc3NaYW5hYmF6YXJfU3F1YXJlcnVudGltZSBzdGFjazphZnRlciBvYmplY3Qga2V5YmFkIGcgdHJhbnNpdGlvbmJhZCBzcGVjaWFsIGtpbmRiYWQgc3VtbWFyeSBkYXRhYmFkIHN5bWJvbCB0YWJsZWNhc3RvZ3NjYW5zdGF0dXNnYzogdW5zd2VwdCBzcGFuZ2NzaHJpbmtzdGFja29mZmludGVnZXIgb3ZlcmZsb3dpbnZhbGlkIGFyZ3VtZW50aW52YWxpZCBleGNoYW5nZWludmFsaWQgZyBzdGF0dXNtU3Bhbkxpc3QuaW5zZXJ0bVNwYW5MaXN0LnJlbW92ZW1lc3NhZ2UgdG9vIGxvbmdtaXNzaW5nIHN0YWNrbWFwbm8gcm91dGUgdG8gaG9zdG5vbi1HbyBmdW5jdGlvbm9iamVjdCBpcyByZW1vdGVyZWZsZWN0IG1pc21hdGNocmVtb3RlIEkvTyBlcnJvcnJ1bnRpbWU6IGFkZHIgPSBydW50aW1lOiBiYXNlID0gcnVudGltZTogaGVhZCA9IHJ1bnRpbWU6IG5lbGVtcz1zY2hlZHVsZTogaW4gY2dvdGltZTogYmFkIFswLTldKnRpbWVCZWdpblBlcmlvZA==86:T554,ZCBpbmRpcmNoYW4gc2VuZGNvbXBsZXg2NGNvcHlzdGFja2N0eHQgIT0gMGZ1bmNhcmdzKGhjaGFuTGVhZmluaXR0cmFjZWludGVyZmFjZWludmFsaWQgbm1TcGFuRGVhZG50ZGxsLmRsbG9taXRlbXB0eXBhbmljd2FpdHBjbG11bHFkcXByZWVtcHRlZHByb2ZCbG9ja3BzYXBpLmRsbHJlY292ZXI6IHJlZmxlY3Q6IHJ3eHJ3eHJ3eHNjYXZ0cmFjZXN0YWNrcG9vbHRyYWNlYmFja3didWZTcGFuc30gc3RhY2s9WyBNQiBnb2FsLCAgZmx1c2hHZW4gIGZvciB0eXBlICBnZnJlZWNudD0gaGVhcEdvYWw9IHBhZ2VzIGF0ICBwdHJTaXplPSAgcnVucXNpemU9IHJ1bnF1ZXVlPSBzLmJhc2UoKT0gc3Bpbm5pbmc9IHN0b3B3YWl0PSBzd2VlcGdlbiAgc3dlZXBnZW49IHRhcmdldHBjPSB0aHJvd2luZz0gdW50aWwgcGM9JSEoTk9WRVJCKSUhV2Vla2RheSgoQkFESU5ERVgpLCBib3VuZCA9ICwgbGltaXQgPSAvZGV2L3N0ZGluMTIyMDcwMzEyNTYxMDM1MTU2MjU6IHBhcnNpbmcgQVNLRk9STkFNRUJhZCB2YXJpbnRDYW5jZWxJb0V4Q2hvcmFzbWlhbkNyZWF0ZUZpbGVDcmVhdGVQaXBlRGVwcmVjYXRlZERldmFuYWdhcmlEbnNRdWVyeV9XRXhjZXB0aW9uIEdDIGZvcmNlZEdPTUFYUFJPQ1NHT01FTUxJTUlUR2V0SWZFbnRyeUdldFZlcnNpb25HbGFnb2xpdGljS2hhcm9zaHRoaUxvY2tGaWxlRXhNYW5pY2hhZWFuT2xkX0l0YWxpY09sZF9QZXJtaWNPbGRfVHVya2ljT3RoZXJfTWF0aFBhcnNlRmxvYXRQaG9lbmljaWFuU2F1cmFzaHRyYVVzZXIzMi5kbGxXU0FDbGVhbnVwV1NBU29ja2V0V1dTQVN0YXJ0dXBhdG9taWNhbmQ4Y29tcGxleDEyOGNyZWF0ZXRlbXBkZWJ1ZyBjYWxsZG5zYXBpLmRsbGV4aXRUaHJlYWRmbG9hdDMybmFuZmxvYXQ2NG5hbmdldHNvY2tvcHRnb3JvdXRpbmUgaW52YWxpZHB0cm1TcGFuSW5Vc2Vub3RpZnlMaXN0b3duZXIgZGllZHByb2ZJbnNlcnRydW50aW1lOiBncy5zdGF0ZSA9IHNjaGVkdHJhY2VzZW1hY3F1aXJlc2V0c29ja29wdHN0YWNrTGFyZ2V0LktpbmQgPT0gdGltZS5EYXRlKHQ=87:T554,ZCBpbmRpcmNoYW4gc2VuZGNvbXBsZXg2NGNvcHlzdGFja2N0eHQgIT0gMGZ1bmNhcmdzKGhjaGFuTGVhZmluaXR0cmFjZWludGVyZmFjZWludmFsaWQgbm1TcGFuRGVhZG50ZGxsLmRsbG9taXRlbXB0eXBhbmljd2FpdHBjbG11bHFkcXByZWVtcHRlZHByb2ZCbG9ja3BzYXBpLmRsbHJlY292ZXI6IHJlZmxlY3Q6IHJ3eHJ3eHJ3eHNjYXZ0cmFjZXN0YWNrcG9vbHRyYWNlYmFja3didWZTcGFuc30gc3RhY2s9WyBNQiBnb2FsLCAgZmx1c2hHZW4gIGZvciB0eXBlICBnZnJlZWNudD0gaGVhcEdvYWw9IHBhZ2VzIGF0ICBwdHJTaXplPSAgcnVucXNpemU9IHJ1bnF1ZXVlPSBzLmJhc2UoKT0gc3Bpbm5pbmc9IHN0b3B3YWl0PSBzd2VlcGdlbiAgc3dlZXBnZW49IHRhcmdldHBjPSB0aHJvd2luZz0gdW50aWwgcGM9JSEoTk9WRVJCKSUhV2Vla2RheSgoQkFESU5ERVgpLCBib3VuZCA9ICwgbGltaXQgPSAvZGV2L3N0ZGluMTIyMDcwMzEyNTYxMDM1MTU2MjU6IHBhcnNpbmcgQVNLRk9STkFNRUJhZCB2YXJpbnRDYW5jZWxJb0V4Q2hvcmFzbWlhbkNyZWF0ZUZpbGVDcmVhdGVQaXBlRGVwcmVjYXRlZERldmFuYWdhcmlEbnNRdWVyeV9XRXhjZXB0aW9uIEdDIGZvcmNlZEdPTUFYUFJPQ1NHT01FTUxJTUlUR2V0SWZFbnRyeUdldFZlcnNpb25HbGFnb2xpdGljS2hhcm9zaHRoaUxvY2tGaWxlRXhNYW5pY2hhZWFuT2xkX0l0YWxpY09sZF9QZXJtaWNPbGRfVHVya2ljT3RoZXJfTWF0aFBhcnNlRmxvYXRQaG9lbmljaWFuU2F1cmFzaHRyYVVzZXIzMi5kbGxXU0FDbGVhbnVwV1NBU29ja2V0V1dTQVN0YXJ0dXBhdG9taWNhbmQ4Y29tcGxleDEyOGNyZWF0ZXRlbXBkZWJ1ZyBjYWxsZG5zYXBpLmRsbGV4aXRUaHJlYWRmbG9hdDMybmFuZmxvYXQ2NG5hbmdldHNvY2tvcHRnb3JvdXRpbmUgaW52YWxpZHB0cm1TcGFuSW5Vc2Vub3RpZnlMaXN0b3duZXIgZGllZHByb2ZJbnNlcnRydW50aW1lOiBncy5zdGF0ZSA9IHNjaGVkdHJhY2VzZW1hY3F1aXJlc2V0c29ja29wdHN0YWNrTGFyZ2V0LktpbmQgPT0gdGltZS5EYXRlKHRp88:T51c,RUJVRzogY2FuIG5vdCBlbmFibGUgIkdldEZpbmFsUGF0aE5hbWVCeUhhbmRsZVdHZXRRdWV1ZWRDb21wbGV0aW9uU3RhdHVzS2FsaW5pbmdyYWQgU3RhbmRhcmQgVGltZU1pZGRsZSBFYXN0IFN0YW5kYXJkIFRpbWVOZXcgWmVhbGFuZCBTdGFuZGFyZCBUaW1lTm9ydGggS29yZWEgU3RhbmRhcmQgVGltZVNvdXRoIFN1ZGFuIFN0YW5kYXJkIFRpbWVUcmFuc2JhaWthbCBTdGFuZGFyZCBUaW1lVVMgTW91bnRhaW4gU3RhbmRhcmQgVGltZVVsYWFuYmFhdGFyIFN0YW5kYXJkIFRpbWVVcGRhdGVQcm9jVGhyZWFkQXR0cmlidXRlVmxhZGl2b3N0b2sgU3RhbmRhcmQgVGltZVcuIE1vbmdvbGlhIFN0YW5kYXJkIFRpbWVfY2dvX3RocmVhZF9zdGFydCBtaXNzaW5nYWxsZ2FkZDogYmFkIHN0YXR1cyBHaWRsZWFyZW5hIGFscmVhZHkgaW5pdGlhbGl6ZWRiYWQgc3RhdHVzIGluIHNocmlua3N0YWNrYmFkIHN5c3RlbSBodWdlIHBhZ2Ugc2l6ZWNoYW5zZW5kOiBzcHVyaW91cyB3YWtldXBjaGVja2RlYWQ6IG5vIG0gZm9yIHRpbWVyY2hlY2tkZWFkOiBubyBwIGZvciB0aW1lcmluY29uc2lzdGVudCBwb2xsLmZkTXV0ZXhpbnZhbGlkIGNyb3NzLWRldmljZSBsaW5ranNvbjogVW5leHBlY3RlZCBrZXkgdHlwZWpzb246IHVuc3VwcG9ydGVkIHZhbHVlOiBtaXNzaW5nIHN0YWNrIGluIG5ld3N0YWNrbWlzc2luZyB0cmFjZUdDU3dlZXBTdGFydG5vIGJ1ZmZlciBzcGFjZSBhdmFpbGFibGVubyBzdWNoIGRldmljZSBvciBhZGRyZXNzb3BlcmF0aW9uIG5vdyBpbiBwcm9ncmVzc3JlZmxlY3QuVmFsdWUuT3ZlcmZsb3dJbnRyZWZsZWN0LlZhbHVlLlNldE1hcEluZGV4cmVmbGVjdDogQml0cyBvZiBuaWwgVHlwZXJlbGVhc2VwOiBpbnZhbGlkIHAgc3RhdGVyZW1haW5pbmcgcG9pbnRlciBidWZmZXJzcmVzb3VyY2UgZGVhZGxvY2sgYXZvaWRlZHJ1bnRpbWU6IFZpcnR1YWxBbGxvYyBvZiBydW50aW1lOiBwcm9ncmFtIGV4Y2VlZHMgcnVudGltZQ==89:T554,ZXI6IHRydW5jYXRpb24gb3V0IG9mIHJhbmdlY2Fubm90IGV4ZWMgYSBzaGFyZWQgbGlicmFyeSBkaXJlY3RseWZhaWxlZCB0byByZXNlcnZlIHBhZ2Ugc3VtbWFyeSBtZW1vcnlpbnRlcm5hbCBlcnJvcjogdW5rbm93biBuZXR3b3JrIHR5cGUgbWV0aG9kIEFCSSBhbmQgdmFsdWUgQUJJIGRvIG5vdCBhbGlnbnJlZmxlY3QuVmFsdWUuQnl0ZXMgb2Ygbm9uLWJ5dGUgYXJyYXlyZWZsZWN0LlZhbHVlLkJ5dGVzIG9mIG5vbi1ieXRlIHNsaWNlcmVmbGVjdC5WYWx1ZS5CeXRlcyBvZiBub24tcnVuZSBzbGljZXJlZmxlY3QuVmFsdWUuQ29udmVydDogdmFsdWUgb2YgdHlwZSByZWZsZWN0OiBCaXRzIG9mIG5vbi1hcml0aG1ldGljIFR5cGUgcmVmbGVjdDogTnVtRmllbGQgb2Ygbm9uLXN0cnVjdCB0eXBlIHJlZmxlY3Q6IGZ1bmNMYXlvdXQgb2Ygbm9uLWZ1bmMgdHlwZSBydW50aW1lLm1pbml0OiBkdXBsaWNhdGVoYW5kbGUgZmFpbGVkcnVudGltZTogYWxsb2NhdGlvbiBzaXplIG91dCBvZiByYW5nZXJ1bnRpbWU6IHVuZXhwZWN0ZWQgU1BXUklURSBmdW5jdGlvbiBzZXRwcm9maWxlYnVja2V0OiBwcm9maWxlIGFscmVhZHkgc2V0c3RhcnRUaGVXb3JsZDogaW5jb25zaXN0ZW50IG1wLT5uZXh0cHRpbWV6b25lIGhvdXIgb3V0c2lkZSBvZiByYW5nZSBbMCwyM112YWx1ZSB0b28gbGFyZ2UgZm9yIGRlZmluZWQgZGF0YSB0eXBlMTExMDIyMzAyNDYyNTE1NjU0MDQyMzYzMTY2ODA5MDgyMDMxMjU1NTUxMTE1MTIzMTI1NzgyNzAyMTE4MTU4MzQwNDU0MTAxNTYyNUVycm9yIGNhbGxpbmcgTXNpQ29uZmlndXJlUHJvZHVjdEE6ICV2RXJyb3IgY2FsbGluZyBNc2lEYXRhYmFzZU9wZW5WaWV3QTogJXZJbnN0YWxsZWQgQWdlbnQgd2l0aCBkZXBsb3ltZW50IElEOiAldlVuYWJsZSB0byBkZXRlcm1pbmUgc3lzdGVtIGRpcmVjdG9yeTogYWZ0ZXIgZGVjaW1hbCBwb2ludCBpbiBudW1lcmljIGxpdGVyYWxhcmcgc2l6ZSB0byByZWZsZWN0LmNhbGwgbW9yZSB0aGFuIDFHQmNhbiBub3QgYWNjZXNzIGEgbmVlZGVkIHNo8a:T558,ZXI6IHRydW5jYXRpb24gb3V0IG9mIHJhbmdlY2Fubm90IGV4ZWMgYSBzaGFyZWQgbGlicmFyeSBkaXJlY3RseWZhaWxlZCB0byByZXNlcnZlIHBhZ2Ugc3VtbWFyeSBtZW1vcnlpbnRlcm5hbCBlcnJvcjogdW5rbm93biBuZXR3b3JrIHR5cGUgbWV0aG9kIEFCSSBhbmQgdmFsdWUgQUJJIGRvIG5vdCBhbGlnbnJlZmxlY3QuVmFsdWUuQnl0ZXMgb2Ygbm9uLWJ5dGUgYXJyYXlyZWZsZWN0LlZhbHVlLkJ5dGVzIG9mIG5vbi1ieXRlIHNsaWNlcmVmbGVjdC5WYWx1ZS5CeXRlcyBvZiBub24tcnVuZSBzbGljZXJlZmxlY3QuVmFsdWUuQ29udmVydDogdmFsdWUgb2YgdHlwZSByZWZsZWN0OiBCaXRzIG9mIG5vbi1hcml0aG1ldGljIFR5cGUgcmVmbGVjdDogTnVtRmllbGQgb2Ygbm9uLXN0cnVjdCB0eXBlIHJlZmxlY3Q6IGZ1bmNMYXlvdXQgb2Ygbm9uLWZ1bmMgdHlwZSBydW50aW1lLm1pbml0OiBkdXBsaWNhdGVoYW5kbGUgZmFpbGVkcnVudGltZTogYWxsb2NhdGlvbiBzaXplIG91dCBvZiByYW5nZXJ1bnRpbWU6IHVuZXhwZWN0ZWQgU1BXUklURSBmdW5jdGlvbiBzZXRwcm9maWxlYnVja2V0OiBwcm9maWxlIGFscmVhZHkgc2V0c3RhcnRUaGVXb3JsZDogaW5jb25zaXN0ZW50IG1wLT5uZXh0cHRpbWV6b25lIGhvdXIgb3V0c2lkZSBvZiByYW5nZSBbMCwyM112YWx1ZSB0b28gbGFyZ2UgZm9yIGRlZmluZWQgZGF0YSB0eXBlMTExMDIyMzAyNDYyNTE1NjU0MDQyMzYzMTY2ODA5MDgyMDMxMjU1NTUxMTE1MTIzMTI1NzgyNzAyMTE4MTU4MzQwNDU0MTAxNTYyNUVycm9yIGNhbGxpbmcgTXNpQ29uZmlndXJlUHJvZHVjdEE6ICV2RXJyb3IgY2FsbGluZyBNc2lEYXRhYmFzZU9wZW5WaWV3QTogJXZJbnN0YWxsZWQgQWdlbnQgd2l0aCBkZXBsb3ltZW50IElEOiAldlVuYWJsZSB0byBkZXRlcm1pbmUgc3lzdGVtIGRpcmVjdG9yeTogYWZ0ZXIgZGVjaW1hbCBwb2ludCBpbiBudW1lcmljIGxpdGVyYWxhcmcgc2l6ZSB0byByZWZsZWN0LmNhbGwgbW9yZSB0aGFuIDFHQmNhbiBub3QgYWNjZXNzIGEgbmVlZGVkIHNoYQ==8b:T554,ZmZzZXQgb3V0IG9mIHJhbmdlc2tpcCBldmVyeXRoaW5nIGFuZCBzdG9wIHRoZSB3YWxrc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbJXg6JXldc3RhY2thbGxvYyBub3Qgb24gc2NoZWR1bGVyIHN0YWNrc3RvcGxvY2tlZG06IGluY29uc2lzdGVudCBsb2NraW5ndGltZXIgcGVyaW9kIG11c3QgYmUgbm9uLW5lZ2F0aXZldG9vIG1hbnkgbGV2ZWxzIG9mIHN5bWJvbGljIGxpbmtzdW5hbGlnbmVkIDY0LWJpdCBhdG9taWMgb3BlcmF0aW9ud2FpdGluZyBmb3IgdW5zdXBwb3J0ZWQgZmlsZSB0eXBlMzU1MjcxMzY3ODgwMDUwMDkyOTM1NTYyMTMzNzg5MDYyNTogZGF5LW9mLXllYXIgZG9lcyBub3QgbWF0Y2ggbW9udGhFcnJvciBjYWxsaW5nIE1zaVNldEludGVybmFsVUk6ICV2RXJyb3IgcnVubmluZyBNc2lTZXRJbnRlcm5hbFVJOiAldk90aGVyX0RlZmF1bHRfSWdub3JhYmxlX0NvZGVfUG9pbnRTZXRGaWxlQ29tcGxldGlvbk5vdGlmaWNhdGlvbk1vZGVzVmlydHVhbFF1ZXJ5IGZvciBzdGFjayBiYXNlIGZhaWxlZGRvYWRkdGltZXI6IFAgYWxyZWFkeSBzZXQgaW4gdGltZXJmbGFnIHByb3ZpZGVkIGJ1dCBub3QgZGVmaW5lZDogLSVzZm9yRWFjaFA6IHNjaGVkLnNhZmVQb2ludFdhaXQgIT0gMGlsbGVnYWwgYmFzZTY0IGRhdGEgYXQgaW5wdXQgYnl0ZSBpbiBcdSBoZXhhZGVjaW1hbCBjaGFyYWN0ZXIgZXNjYXBlbXNwYW4uZW5zdXJlU3dlcHQ6IG0gaXMgbm90IGxvY2tlZG91dCBvZiBtZW1vcnkgYWxsb2NhdGluZyBhbGxBcmVuYXNyZWZsZWN0OiBDaGFuRGlyIG9mIG5vbi1jaGFuIHR5cGUgcmVmbGVjdDogRmllbGQgaW5kZXggb3V0IG9mIGJvdW5kc3JlZmxlY3Q6IEZpZWxkIG9mIG5vbi1zdHJ1Y3QgdHlwZSByZWZsZWN0OiBzdHJpbmcgaW5kZXggb3V0IG9mIHJhbmdlcnVudGltZS5TZXRGaW5hbGl6ZXI6IGNhbm5vdCBwYXNzIHJ1bnRpbWU6IGcgaXMgcnVubmluZyBidXQgcCBpcyBub3RzY2hlZHVsZTogc3Bpbm5pbmcgd2l0aCBsb2NhbCB3b3Jrc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBb8c:T558,ZmZzZXQgb3V0IG9mIHJhbmdlc2tpcCBldmVyeXRoaW5nIGFuZCBzdG9wIHRoZSB3YWxrc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbJXg6JXldc3RhY2thbGxvYyBub3Qgb24gc2NoZWR1bGVyIHN0YWNrc3RvcGxvY2tlZG06IGluY29uc2lzdGVudCBsb2NraW5ndGltZXIgcGVyaW9kIG11c3QgYmUgbm9uLW5lZ2F0aXZldG9vIG1hbnkgbGV2ZWxzIG9mIHN5bWJvbGljIGxpbmtzdW5hbGlnbmVkIDY0LWJpdCBhdG9taWMgb3BlcmF0aW9ud2FpdGluZyBmb3IgdW5zdXBwb3J0ZWQgZmlsZSB0eXBlMzU1MjcxMzY3ODgwMDUwMDkyOTM1NTYyMTMzNzg5MDYyNTogZGF5LW9mLXllYXIgZG9lcyBub3QgbWF0Y2ggbW9udGhFcnJvciBjYWxsaW5nIE1zaVNldEludGVybmFsVUk6ICV2RXJyb3IgcnVubmluZyBNc2lTZXRJbnRlcm5hbFVJOiAldk90aGVyX0RlZmF1bHRfSWdub3JhYmxlX0NvZGVfUG9pbnRTZXRGaWxlQ29tcGxldGlvbk5vdGlmaWNhdGlvbk1vZGVzVmlydHVhbFF1ZXJ5IGZvciBzdGFjayBiYXNlIGZhaWxlZGRvYWRkdGltZXI6IFAgYWxyZWFkeSBzZXQgaW4gdGltZXJmbGFnIHByb3ZpZGVkIGJ1dCBub3QgZGVmaW5lZDogLSVzZm9yRWFjaFA6IHNjaGVkLnNhZmVQb2ludFdhaXQgIT0gMGlsbGVnYWwgYmFzZTY0IGRhdGEgYXQgaW5wdXQgYnl0ZSBpbiBcdSBoZXhhZGVjaW1hbCBjaGFyYWN0ZXIgZXNjYXBlbXNwYW4uZW5zdXJlU3dlcHQ6IG0gaXMgbm90IGxvY2tlZG91dCBvZiBtZW1vcnkgYWxsb2NhdGluZyBhbGxBcmVuYXNyZWZsZWN0OiBDaGFuRGlyIG9mIG5vbi1jaGFuIHR5cGUgcmVmbGVjdDogRmllbGQgaW5kZXggb3V0IG9mIGJvdW5kc3JlZmxlY3Q6IEZpZWxkIG9mIG5vbi1zdHJ1Y3QgdHlwZSByZWZsZWN0OiBzdHJpbmcgaW5kZXggb3V0IG9mIHJhbmdlcnVudGltZS5TZXRGaW5hbGl6ZXI6IGNhbm5vdCBwYXNzIHJ1bnRpbWU6IGcgaXMgcnVubmluZyBidXQgcCBpcyBub3RzY2hlZHVsZTogc3Bpbm5pbmcgd2l0aCBsb2NhbCB3b3Jrc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbJQ==8d:T554,Z2luZXNlQ2FuY2VsSW9DaGVyb2tlZUN5cmlsbGljRGVjZW1iZXJEdXBsb3lhbkV0aGlvcGljRXh0ZW5kZXJGZWJydWFyeUZ1bGxQYXRoR2VvcmdpYW5Hb1N0cmluZ0d1amFyYXRpR3VybXVraGlIaXJhZ2FuYUphdmFuZXNlS2F0YWthbmFLYXlhaF9MaUxpbmVhcl9BTGluZWFyX0JNYWhhamFuaU5vdmVtYmVyT2xfQ2hpa2lQYXJzZUludFBoYWdzX1BhUmVhZEZpbGVTYXR1cmRheVRhZ2JhbndhVGFpX1RoYW1UYWlfVmlldFRodXJzZGF5VGlmaW5hZ2hVZ2FyaXRpY1dTQUlvY3RsW3NpZ25hbCBzdGFjaz1bY2dvY2hlY2tjcyAgICAgIGRlYWRsb2NrZHVyYXRpb25lYXggICAgIGVicCAgICAgZWJ4ICAgICBlY3ggICAgIGVkaSAgICAgZWR4ICAgICBlZmxhZ3MgIGVpcCAgICAgZXNpICAgICBlc3AgICAgIGZzICAgICAgZ3MgICAgICBpbmZpbml0eW5vIGFub2RlcG9sbERlc2NyZWZsZWN0LnJ1bm5hYmxlcnVudGltZS5zY2F2ZW5nZXNodXRkb3duc3RyY29udi50cmFjZUJ1ZnRyaWdnZXI9dW5rbm93bih3c2Fpb2N0bCAoZm9yY2VkKSBCIGV4cC4pICBCIHdvcmsgKCBibG9ja2VkPSBpbiB1c2UpIGxvY2tlZGc9IGxvY2tlZG09IG0tPmN1cmc9IG1hcmtlZCAgIG1ldGhvZDogIG1zIGNwdSwgIG5vdCBpbiBbIG9mIHR5cGUgIHJ1bnRpbWU9IHMubGltaXQ9IHMuc3RhdGU9IHRocmVhZHM9IHVubWFya2VkIHdidWYxLm49IHdidWYyLm49JSEoRVhUUkEgKE1JU1NJTkcpKHVua25vd24pLCBuZXd2YWw9LCBvbGR2YWw9LCBzaXplID0gLCB0YWlsID0gLTA3OjAwOjAwMjQ0MTQwNjI1OiBzdGF0dXM9QmFzc2FfVmFoQmhhaWtzdWtpQ3VuZWlmb3JtRGlhY3JpdGljRmluZENsb3NlRmxlZXREZWNrSGV4X0RpZ2l0SW5oZXJpdGVkSW50ZXJmYWNlS2h1ZGF3YWRpTG9jYWxGcmVlTWFsYXlhbGFtTW9uZ29saWFuTW92ZUZpbGVXTmFiYXRhZWFuUGFsbXlyZW5lUGFyc2VCb29sUGFyc2VVaW50U2FtYXJpdGFuU2VwdGVtYmVyU3VuZGFuZXNlV1NBU2VuZFRvV2VkbmVzZGF5V3JpdGVGaWxlWjA3OjAwOjAwYXRvbWljb3I4Yg==8e:T554,Z2luZXNlQ2FuY2VsSW9DaGVyb2tlZUN5cmlsbGljRGVjZW1iZXJEdXBsb3lhbkV0aGlvcGljRXh0ZW5kZXJGZWJydWFyeUZ1bGxQYXRoR2VvcmdpYW5Hb1N0cmluZ0d1amFyYXRpR3VybXVraGlIaXJhZ2FuYUphdmFuZXNlS2F0YWthbmFLYXlhaF9MaUxpbmVhcl9BTGluZWFyX0JNYWhhamFuaU5vdmVtYmVyT2xfQ2hpa2lQYXJzZUludFBoYWdzX1BhUmVhZEZpbGVTYXR1cmRheVRhZ2JhbndhVGFpX1RoYW1UYWlfVmlldFRodXJzZGF5VGlmaW5hZ2hVZ2FyaXRpY1dTQUlvY3RsW3NpZ25hbCBzdGFjaz1bY2dvY2hlY2tjcyAgICAgIGRlYWRsb2NrZHVyYXRpb25lYXggICAgIGVicCAgICAgZWJ4ICAgICBlY3ggICAgIGVkaSAgICAgZWR4ICAgICBlZmxhZ3MgIGVpcCAgICAgZXNpICAgICBlc3AgICAgIGZzICAgICAgZ3MgICAgICBpbmZpbml0eW5vIGFub2RlcG9sbERlc2NyZWZsZWN0LnJ1bm5hYmxlcnVudGltZS5zY2F2ZW5nZXNodXRkb3duc3RyY29udi50cmFjZUJ1ZnRyaWdnZXI9dW5rbm93bih3c2Fpb2N0bCAoZm9yY2VkKSBCIGV4cC4pICBCIHdvcmsgKCBibG9ja2VkPSBpbiB1c2UpIGxvY2tlZGc9IGxvY2tlZG09IG0tPmN1cmc9IG1hcmtlZCAgIG1ldGhvZDogIG1zIGNwdSwgIG5vdCBpbiBbIG9mIHR5cGUgIHJ1bnRpbWU9IHMubGltaXQ9IHMuc3RhdGU9IHRocmVhZHM9IHVubWFya2VkIHdidWYxLm49IHdidWYyLm49JSEoRVhUUkEgKE1JU1NJTkcpKHVua25vd24pLCBuZXd2YWw9LCBvbGR2YWw9LCBzaXplID0gLCB0YWlsID0gLTA3OjAwOjAwMjQ0MTQwNjI1OiBzdGF0dXM9QmFzc2FfVmFoQmhhaWtzdWtpQ3VuZWlmb3JtRGlhY3JpdGljRmluZENsb3NlRmxlZXREZWNrSGV4X0RpZ2l0SW5oZXJpdGVkSW50ZXJmYWNlS2h1ZGF3YWRpTG9jYWxGcmVlTWFsYXlhbGFtTW9uZ29saWFuTW92ZUZpbGVXTmFiYXRhZWFuUGFsbXlyZW5lUGFyc2VCb29sUGFyc2VVaW50U2FtYXJpdGFuU2VwdGVtYmVyU3VuZGFuZXNlV1NBU2VuZFRvV2VkbmVzZGF5V3JpdGVGaWxlWjA3OjAwOjAwYXRvbWljb3I4YmE=8f:T550,Z29hbCAgS2lCIHRvdGFsLCAgTUIgc3RhY2tzLCAgW3JlY292ZXJlZF0gYWxsb2NDb3VudCAgZm91bmQgYXQgKiggZ2NzY2FuZG9uZSAgbS0+Z3NpZ25hbD0gbWF4VHJpZ2dlcj0gbkRhdGFSb290cz0gblNwYW5Sb290cz0gcGFnZXMvYnl0ZSBwcmVlbXB0b2ZmPSBzLmVsZW1zaXplPSBzLnN3ZWVwZ2VuPSBzcGFuLmxpbWl0PSBzcGFuLnN0YXRlPSBzeXNtb253YWl0PSB3YnVmMT08bmlsPiB3YnVmMj08bmlsPiUhKEJBRFdJRFRIKSkgcC0+c3RhdHVzPSwgY29ucy9tYXJrIC1ieXRlIGxpbWl0MTUyNTg3ODkwNjI1NzYyOTM5NDUzMTI1QmlkaV9Db250cm9sREVQTE9ZTUVOVElER2V0QWRkckluZm9XR2V0Q29uc29sZUNQR2V0TGFzdEVycm9yR2V0TGVuZ3RoU2lkR2V0U3RkSGFuZGxlR2V0VGVtcFBhdGhXSm9pbl9Db250cm9sTG9hZExpYnJhcnlXTWVldGVpX01heWVrTXNpVmlld0Nsb3NlTXNpVmlld0ZldGNoUGFoYXdoX0htb25nUmVhZENvbnNvbGVXUmV2ZXJ0VG9TZWxmU2V0RW5kT2ZGaWxlU29yYV9Tb21wZW5nU3lsb3RpX05hZ3JpVHJhbnNtaXRGaWxlVW5sb2NrRmlsZUV4VmlydHVhbFF1ZXJ5YWJpIG1pc21hdGNoYWR2YXBpMzIuZGxsYmFkIGZsdXNoR2VuYmFkIGcgc3RhdHVzYmFkIGcwIHN0YWNrYmFkIHJlY292ZXJ5Y2FuJ3QgaGFwcGVuY2FzNjQgZmFpbGVkY2hhbiByZWNlaXZlZHVtcGluZyBoZWFwZW5kIHRyYWNlZ2NlbnRlcnN5c2NhbGxnY0JpdHNBcmVuYXNnY3BhY2VydHJhY2VoYXJkZGVjb21taXRob3N0IGlzIGRvd25pbGxlZ2FsIHNlZWtpbnZhbGlkIHBhdGhpbnZhbGlkIHNsb3RpcGhscGFwaS5kbGxrZXJuZWwzMi5kbGxtYWR2ZG9udG5lZWRtaGVhcFNwZWNpYWxtc3BhblNwZWNpYWxuZXRhcGkzMi5kbGxub3QgcG9sbGFibGVyZWZsZWN0LkNvcHlyZWxlYXNlcDogbT1ydW50aW1lOiBncD1ydW50aW1lOiBzcD1zZWxmLXByZWVtcHRzaG9ydCBidWZmZXJzcGFuU2V0U3BpbmVzd2VlcFdhaXRlcnN0cmFjZVN0cmluZ3N3aXJlcDogcC0+bT13b3JrZXIgbW9kZSAgIT0gc3dlZXBn90:T554,Z29hbCAgS2lCIHRvdGFsLCAgTUIgc3RhY2tzLCAgW3JlY292ZXJlZF0gYWxsb2NDb3VudCAgZm91bmQgYXQgKiggZ2NzY2FuZG9uZSAgbS0+Z3NpZ25hbD0gbWF4VHJpZ2dlcj0gbkRhdGFSb290cz0gblNwYW5Sb290cz0gcGFnZXMvYnl0ZSBwcmVlbXB0b2ZmPSBzLmVsZW1zaXplPSBzLnN3ZWVwZ2VuPSBzcGFuLmxpbWl0PSBzcGFuLnN0YXRlPSBzeXNtb253YWl0PSB3YnVmMT08bmlsPiB3YnVmMj08bmlsPiUhKEJBRFdJRFRIKSkgcC0+c3RhdHVzPSwgY29ucy9tYXJrIC1ieXRlIGxpbWl0MTUyNTg3ODkwNjI1NzYyOTM5NDUzMTI1QmlkaV9Db250cm9sREVQTE9ZTUVOVElER2V0QWRkckluZm9XR2V0Q29uc29sZUNQR2V0TGFzdEVycm9yR2V0TGVuZ3RoU2lkR2V0U3RkSGFuZGxlR2V0VGVtcFBhdGhXSm9pbl9Db250cm9sTG9hZExpYnJhcnlXTWVldGVpX01heWVrTXNpVmlld0Nsb3NlTXNpVmlld0ZldGNoUGFoYXdoX0htb25nUmVhZENvbnNvbGVXUmV2ZXJ0VG9TZWxmU2V0RW5kT2ZGaWxlU29yYV9Tb21wZW5nU3lsb3RpX05hZ3JpVHJhbnNtaXRGaWxlVW5sb2NrRmlsZUV4VmlydHVhbFF1ZXJ5YWJpIG1pc21hdGNoYWR2YXBpMzIuZGxsYmFkIGZsdXNoR2VuYmFkIGcgc3RhdHVzYmFkIGcwIHN0YWNrYmFkIHJlY292ZXJ5Y2FuJ3QgaGFwcGVuY2FzNjQgZmFpbGVkY2hhbiByZWNlaXZlZHVtcGluZyBoZWFwZW5kIHRyYWNlZ2NlbnRlcnN5c2NhbGxnY0JpdHNBcmVuYXNnY3BhY2VydHJhY2VoYXJkZGVjb21taXRob3N0IGlzIGRvd25pbGxlZ2FsIHNlZWtpbnZhbGlkIHBhdGhpbnZhbGlkIHNsb3RpcGhscGFwaS5kbGxrZXJuZWwzMi5kbGxtYWR2ZG9udG5lZWRtaGVhcFNwZWNpYWxtc3BhblNwZWNpYWxuZXRhcGkzMi5kbGxub3QgcG9sbGFibGVyZWZsZWN0LkNvcHlyZWxlYXNlcDogbT1ydW50aW1lOiBncD1ydW50aW1lOiBzcD1zZWxmLXByZWVtcHRzaG9ydCBidWZmZXJzcGFuU2V0U3BpbmVzd2VlcFdhaXRlcnN0cmFjZVN0cmluZ3N3aXJlcDogcC0+bT13b3JrZXIgbW9kZSAgIT0gc3dlZXBnZQ==91:T554,aGFiZXRwcm90b2NvbCBmYW1pbHkgbm90IHN1cHBvcnRlZHJlZmxlY3Q6IEVsZW0gb2YgaW52YWxpZCB0eXBlcmVmbGVjdDogSW4gb2Ygbm9uLWZ1bmMgdHlwZSByZWZsZWN0OiBLZXkgb2Ygbm9uLW1hcCB0eXBlIHJ1bnRpbWUuc2VtYXNsZWVwIHdhaXRfZmFpbGVkcnVudGltZTogaW1wb3NzaWJsZSB0eXBlIGtpbmRydW50aW1lOiBsZXZlbFNoaWZ0W2xldmVsXSA9IHJ1bnRpbWU6IG1hcmtpbmcgZnJlZSBvYmplY3QgcnVudGltZTogcC5nY01hcmtXb3JrZXJNb2RlPSBydW50aW1lOiBzcGxpdCBzdGFjayBvdmVyZmxvd3J1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCBjcnVudGltZTogc3VtbWFyeSBtYXggcGFnZXMgPSBydW50aW1lOiB0cmFjZWJhY2sgc3R1Y2suIHBjPXNjYW5vYmplY3Qgb2YgYSBub3NjYW4gb2JqZWN0c2VtYWNxdWlyZSBub3Qgb24gdGhlIEcgc3RhY2tzdHJpbmcgY29uY2F0ZW5hdGlvbiB0b28gbG9uZ3N5bnRheCBlcnJvciBzY2FubmluZyBib29sZWFudGltZUJlZ2luL0VuZFBlcmlvZCBub3QgZm91bmR0b28gbWFueSBvcGVuIGZpbGVzIGluIHN5c3RlbSAodHlwZXMgZnJvbSBkaWZmZXJlbnQgc2NvcGVzKSBpbiBwcmVwYXJlRm9yU3dlZXA7IHN3ZWVwZ2VuICBsb2NhbHMgc3RhY2sgbWFwIGVudHJpZXMgZm9yIDIyNzM3MzY3NTQ0MzIzMjA1OTQ3ODc1OTc2NTYyNUNlbnRyYWwgRXVyb3BlYW4gU3RhbmRhcmQgVGltZUNlbnRyYWwgU3RhbmRhcmQgVGltZSAoTWV4aWNvKUUuIFNvdXRoIEFtZXJpY2EgU3RhbmRhcmQgVGltZUVhc3Rlcm4gU3RhbmRhcmQgVGltZSAoTWV4aWNvKUVycm9yIGNhbGxpbmcgTXNpVmlld0Nsb3NlOiAldkVycm9yIGNhbGxpbmcgTXNpVmlld0ZldGNoOiAldkVycm9yIHJ1bm5pbmcgTW9kaWZ5UmVjb3JkOiAldkdPREVCVUc6IHVua25vd24gY3B1IGZlYXR1cmUgIk1hcEl0ZXIuS2V5IGNhbGxlZCBiZWZvcmUgTmV4dE1zaUNyZWF0ZVRyYW5zZm9ybVN1bW1hcnlJbmZvQVBhY2lmaWMgU3RhbmRhcmQgVGltZSAoTWV4aWNvKVR1cmtzIEFuZCBDYWljb3M=92:T558,aGFiZXRwcm90b2NvbCBmYW1pbHkgbm90IHN1cHBvcnRlZHJlZmxlY3Q6IEVsZW0gb2YgaW52YWxpZCB0eXBlcmVmbGVjdDogSW4gb2Ygbm9uLWZ1bmMgdHlwZSByZWZsZWN0OiBLZXkgb2Ygbm9uLW1hcCB0eXBlIHJ1bnRpbWUuc2VtYXNsZWVwIHdhaXRfZmFpbGVkcnVudGltZTogaW1wb3NzaWJsZSB0eXBlIGtpbmRydW50aW1lOiBsZXZlbFNoaWZ0W2xldmVsXSA9IHJ1bnRpbWU6IG1hcmtpbmcgZnJlZSBvYmplY3QgcnVudGltZTogcC5nY01hcmtXb3JrZXJNb2RlPSBydW50aW1lOiBzcGxpdCBzdGFjayBvdmVyZmxvd3J1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCBjcnVudGltZTogc3VtbWFyeSBtYXggcGFnZXMgPSBydW50aW1lOiB0cmFjZWJhY2sgc3R1Y2suIHBjPXNjYW5vYmplY3Qgb2YgYSBub3NjYW4gb2JqZWN0c2VtYWNxdWlyZSBub3Qgb24gdGhlIEcgc3RhY2tzdHJpbmcgY29uY2F0ZW5hdGlvbiB0b28gbG9uZ3N5bnRheCBlcnJvciBzY2FubmluZyBib29sZWFudGltZUJlZ2luL0VuZFBlcmlvZCBub3QgZm91bmR0b28gbWFueSBvcGVuIGZpbGVzIGluIHN5c3RlbSAodHlwZXMgZnJvbSBkaWZmZXJlbnQgc2NvcGVzKSBpbiBwcmVwYXJlRm9yU3dlZXA7IHN3ZWVwZ2VuICBsb2NhbHMgc3RhY2sgbWFwIGVudHJpZXMgZm9yIDIyNzM3MzY3NTQ0MzIzMjA1OTQ3ODc1OTc2NTYyNUNlbnRyYWwgRXVyb3BlYW4gU3RhbmRhcmQgVGltZUNlbnRyYWwgU3RhbmRhcmQgVGltZSAoTWV4aWNvKUUuIFNvdXRoIEFtZXJpY2EgU3RhbmRhcmQgVGltZUVhc3Rlcm4gU3RhbmRhcmQgVGltZSAoTWV4aWNvKUVycm9yIGNhbGxpbmcgTXNpVmlld0Nsb3NlOiAldkVycm9yIGNhbGxpbmcgTXNpVmlld0ZldGNoOiAldkVycm9yIHJ1bm5pbmcgTW9kaWZ5UmVjb3JkOiAldkdPREVCVUc6IHVua25vd24gY3B1IGZlYXR1cmUgIk1hcEl0ZXIuS2V5IGNhbGxlZCBiZWZvcmUgTmV4dE1zaUNyZWF0ZVRyYW5zZm9ybVN1bW1hcnlJbmZvQVBhY2lmaWMgU3RhbmRhcmQgVGltZSAoTWV4aWNvKVR1cmtzIEFuZCBDYWljb3MgUw==93:T554,aWNhIFN0YW5kYXJkIFRpbWViYWQgd3JpdGUgYmFycmllciBidWZmZXIgYm91bmRzY2Fubm90IGFzc2lnbiByZXF1ZXN0ZWQgYWRkcmVzc2Nhc2dzdGF0dXM6IGJhZCBpbmNvbWluZyB2YWx1ZXNjaGVja21hcmsgZm91bmQgdW5tYXJrZWQgb2JqZWN0ZW50ZXJzeXNjYWxsYmxvY2sgaW5jb25zaXN0ZW50IGZtdDogdW5rbm93biBiYXNlOyBjYW4ndCBoYXBwZW5pbiBsaXRlcmFsIG51bGwgKGV4cGVjdGluZyAnbCcpaW4gbGl0ZXJhbCBudWxsIChleHBlY3RpbmcgJ3UnKWluIGxpdGVyYWwgdHJ1ZSAoZXhwZWN0aW5nICdlJylpbiBsaXRlcmFsIHRydWUgKGV4cGVjdGluZyAncicpaW4gbGl0ZXJhbCB0cnVlIChleHBlY3RpbmcgJ3UnKWludGVybmFsIGVycm9yIC0gbWlzdXNlIG9mIGl0YWJqc29uOiBpbnZhbGlkIG51bWJlciBsaXRlcmFsICVxbWFsZm9ybWVkIHRpbWUgem9uZSBpbmZvcm1hdGlvbm5vbiBpbi11c2Ugc3BhbiBpbiB1bnN3ZXB0IGxpc3RwYWNlcjogc3dlZXAgZG9uZSBhdCBoZWFwIHNpemUgcGF0dGVybiBjb250YWlucyBwYXRoIHNlcGFyYXRvcnJlZmxlY3QuTWFrZVNsaWNlOiBuZWdhdGl2ZSBjYXByZWZsZWN0Lk1ha2VTbGljZTogbmVnYXRpdmUgbGVucmVmbGVjdDogTGVuIG9mIG5vbi1hcnJheSB0eXBlIHJlc2V0c3Bpbm5pbmc6IG5vdCBhIHNwaW5uaW5nIG1ydW50aW1lOiBjYW5ub3QgYWxsb2NhdGUgbWVtb3J5cnVudGltZTogZmFpbGVkIHRvIGNvbW1pdCBwYWdlc3J1bnRpbWU6IHNwbGl0IHN0YWNrIG92ZXJmbG93OiBzbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFsleDpdc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOiV4XXVuc2FmZS5TdHJpbmc6IGxlbiBvdXQgb2YgcmFuZ2UgKHR5cGVzIGZyb20gZGlmZmVyZW50IHBhY2thZ2VzKTI4NDIxNzA5NDMwNDA0MDA3NDM0ODQ0OTcwNzAzMTI1OiBkYXktb2YteWVhciBkb2VzIG5vdCBtYXRjaCBkYXlDZXJ0QWRkQ2VydGlmaWNhdGVDb250ZXh0VG9TdG9yZUNlcnRWZXJpZnlDZXJ0aWZpY2F0ZUNoYWluUG9saWN5RXJyb3IgY2Fs94:T558,aWNhIFN0YW5kYXJkIFRpbWViYWQgd3JpdGUgYmFycmllciBidWZmZXIgYm91bmRzY2Fubm90IGFzc2lnbiByZXF1ZXN0ZWQgYWRkcmVzc2Nhc2dzdGF0dXM6IGJhZCBpbmNvbWluZyB2YWx1ZXNjaGVja21hcmsgZm91bmQgdW5tYXJrZWQgb2JqZWN0ZW50ZXJzeXNjYWxsYmxvY2sgaW5jb25zaXN0ZW50IGZtdDogdW5rbm93biBiYXNlOyBjYW4ndCBoYXBwZW5pbiBsaXRlcmFsIG51bGwgKGV4cGVjdGluZyAnbCcpaW4gbGl0ZXJhbCBudWxsIChleHBlY3RpbmcgJ3UnKWluIGxpdGVyYWwgdHJ1ZSAoZXhwZWN0aW5nICdlJylpbiBsaXRlcmFsIHRydWUgKGV4cGVjdGluZyAncicpaW4gbGl0ZXJhbCB0cnVlIChleHBlY3RpbmcgJ3UnKWludGVybmFsIGVycm9yIC0gbWlzdXNlIG9mIGl0YWJqc29uOiBpbnZhbGlkIG51bWJlciBsaXRlcmFsICVxbWFsZm9ybWVkIHRpbWUgem9uZSBpbmZvcm1hdGlvbm5vbiBpbi11c2Ugc3BhbiBpbiB1bnN3ZXB0IGxpc3RwYWNlcjogc3dlZXAgZG9uZSBhdCBoZWFwIHNpemUgcGF0dGVybiBjb250YWlucyBwYXRoIHNlcGFyYXRvcnJlZmxlY3QuTWFrZVNsaWNlOiBuZWdhdGl2ZSBjYXByZWZsZWN0Lk1ha2VTbGljZTogbmVnYXRpdmUgbGVucmVmbGVjdDogTGVuIG9mIG5vbi1hcnJheSB0eXBlIHJlc2V0c3Bpbm5pbmc6IG5vdCBhIHNwaW5uaW5nIG1ydW50aW1lOiBjYW5ub3QgYWxsb2NhdGUgbWVtb3J5cnVudGltZTogZmFpbGVkIHRvIGNvbW1pdCBwYWdlc3J1bnRpbWU6IHNwbGl0IHN0YWNrIG92ZXJmbG93OiBzbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFsleDpdc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOiV4XXVuc2FmZS5TdHJpbmc6IGxlbiBvdXQgb2YgcmFuZ2UgKHR5cGVzIGZyb20gZGlmZmVyZW50IHBhY2thZ2VzKTI4NDIxNzA5NDMwNDA0MDA3NDM0ODQ0OTcwNzAzMTI1OiBkYXktb2YteWVhciBkb2VzIG5vdCBtYXRjaCBkYXlDZXJ0QWRkQ2VydGlmaWNhdGVDb250ZXh0VG9TdG9yZUNlcnRWZXJpZnlDZXJ0aWZpY2F0ZUNoYWluUG9saWN5RXJyb3IgY2FsbA==95:T554,aW5nIE1zaUNsb3NlSGFuZGxlOiAldkVycm9yIGNhbGxpbmcgTXNpVmlld0V4ZWN1dGU6ICV2TWFwSXRlci5WYWx1ZSBjYWxsZWQgYmVmb3JlIE5leHRXU0FHZXRPdmVybGFwcGVkUmVzdWx0IG5vdCBmb3VuZCIgbm90IHN1cHBvcnRlZCBmb3IgY3B1IG9wdGlvbiAiaW4gbGl0ZXJhbCBmYWxzZSAoZXhwZWN0aW5nICdhJylpbiBsaXRlcmFsIGZhbHNlIChleHBlY3RpbmcgJ2UnKWluIGxpdGVyYWwgZmFsc2UgKGV4cGVjdGluZyAnbCcpaW4gbGl0ZXJhbCBmYWxzZSAoZXhwZWN0aW5nICdzJylpbnZhbGlkIGxpbWl0ZXIgZXZlbnQgdHlwZSBmb3VuZG51bWVyaWNhbCBhcmd1bWVudCBvdXQgb2YgZG9tYWlucGFuaWMgd2hpbGUgcHJpbnRpbmcgcGFuaWMgdmFsdWVyZWZsZWN0Lm5hbWVGcm9tOiB0YWcgdG9vIGxvbmc6IHJlZmxlY3Q6IE51bUluIG9mIG5vbi1mdW5jIHR5cGUgcmVtb3Zlc3BlY2lhbCBvbiBpbnZhbGlkIHBvaW50ZXJyZXNvdXJjZSB0ZW1wb3JhcmlseSB1bmF2YWlsYWJsZXJ1bnRpbWUuc2VtYXNsZWVwIHdhaXRfYWJhbmRvbmVkcnVudGltZTogZmFpbGVkIHRvIHJlbGVhc2UgcGFnZXNydW50aW1lOiBmaXhhbGxvYyBzaXplIHRvbyBsYXJnZXJ1bnRpbWU6IG1jYWxsIGZ1bmN0aW9uIHJldHVybmVkcnVudGltZTogbmV3c3RhY2sgY2FsbGVkIGZyb20gZz1ydW50aW1lOiByb290IGxldmVsIG1heCBwYWdlcyA9IHJ1bnRpbWU6IHNldGV2ZW50IGZhaWxlZDsgZXJybm89cnVudGltZTogc3RhY2sgc3BsaXQgYXQgYmFkIHRpbWVydW50aW1lOiBzdWRvZyB3aXRoIG5vbi1uaWwgZWxlbXJ1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCBuZXh0cnVudGltZTogc3Vkb2cgd2l0aCBub24tbmlsIHByZXZzY2Fuc3RhY2s6IGdvcm91dGluZSBub3Qgc3RvcHBlZHNjYXZlbmdlciBzdGF0ZSBpcyBhbHJlYWR5IHdpcmVkc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbJXg6Ol1zbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFs6JXg6XXNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzo6JXhdc29mdHdhcmU=96:T558,aW5nIE1zaUNsb3NlSGFuZGxlOiAldkVycm9yIGNhbGxpbmcgTXNpVmlld0V4ZWN1dGU6ICV2TWFwSXRlci5WYWx1ZSBjYWxsZWQgYmVmb3JlIE5leHRXU0FHZXRPdmVybGFwcGVkUmVzdWx0IG5vdCBmb3VuZCIgbm90IHN1cHBvcnRlZCBmb3IgY3B1IG9wdGlvbiAiaW4gbGl0ZXJhbCBmYWxzZSAoZXhwZWN0aW5nICdhJylpbiBsaXRlcmFsIGZhbHNlIChleHBlY3RpbmcgJ2UnKWluIGxpdGVyYWwgZmFsc2UgKGV4cGVjdGluZyAnbCcpaW4gbGl0ZXJhbCBmYWxzZSAoZXhwZWN0aW5nICdzJylpbnZhbGlkIGxpbWl0ZXIgZXZlbnQgdHlwZSBmb3VuZG51bWVyaWNhbCBhcmd1bWVudCBvdXQgb2YgZG9tYWlucGFuaWMgd2hpbGUgcHJpbnRpbmcgcGFuaWMgdmFsdWVyZWZsZWN0Lm5hbWVGcm9tOiB0YWcgdG9vIGxvbmc6IHJlZmxlY3Q6IE51bUluIG9mIG5vbi1mdW5jIHR5cGUgcmVtb3Zlc3BlY2lhbCBvbiBpbnZhbGlkIHBvaW50ZXJyZXNvdXJjZSB0ZW1wb3JhcmlseSB1bmF2YWlsYWJsZXJ1bnRpbWUuc2VtYXNsZWVwIHdhaXRfYWJhbmRvbmVkcnVudGltZTogZmFpbGVkIHRvIHJlbGVhc2UgcGFnZXNydW50aW1lOiBmaXhhbGxvYyBzaXplIHRvbyBsYXJnZXJ1bnRpbWU6IG1jYWxsIGZ1bmN0aW9uIHJldHVybmVkcnVudGltZTogbmV3c3RhY2sgY2FsbGVkIGZyb20gZz1ydW50aW1lOiByb290IGxldmVsIG1heCBwYWdlcyA9IHJ1bnRpbWU6IHNldGV2ZW50IGZhaWxlZDsgZXJybm89cnVudGltZTogc3RhY2sgc3BsaXQgYXQgYmFkIHRpbWVydW50aW1lOiBzdWRvZyB3aXRoIG5vbi1uaWwgZWxlbXJ1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCBuZXh0cnVudGltZTogc3Vkb2cgd2l0aCBub24tbmlsIHByZXZzY2Fuc3RhY2s6IGdvcm91dGluZSBub3Qgc3RvcHBlZHNjYXZlbmdlciBzdGF0ZSBpcyBhbHJlYWR5IHdpcmVkc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbJXg6Ol1zbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFs6JXg6XXNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzo6JXhdc29mdHdhcmUgYw==97:T554,aW50ZXJuYWwgZXJyb3I6IGV4aXQgaG9vayBpbnZva2VkIHBhbmljbWlzbWF0Y2hlZCBjb3VudCBkdXJpbmcgaXRhYiB0YWJsZSBjb3B5bXNwYW4uc3dlZXA6IGJhZCBzcGFuIHN0YXRlIGFmdGVyIHN3ZWVwb3V0IG9mIG1lbW9yeSBhbGxvY2F0aW5nIGhlYXAgYXJlbmEgbWFwcmVmbGVjdC5NYWtlTWFwV2l0aFNpemUgb2Ygbm9uLW1hcCB0eXBlcnVudGltZTogYmxvY2tlZCB3cml0ZSBvbiBmcmVlIHBvbGxkZXNjcnVudGltZTogY2FzZnJvbV9Hc2NhbnN0YXR1cyBmYWlsZWQgZ3A9c3RhY2sgZ3Jvd3RoIG5vdCBhbGxvd2VkIGluIHN5c3RlbSBjYWxsc3VzcGVuZEcgZnJvbSBub24tcHJlZW1wdGlibGUgZ29yb3V0aW5ldHJhY2ViYWNrOiB1bmV4cGVjdGVkIFNQV1JJVEUgZnVuY3Rpb24gdHJhbnNwb3J0IGVuZHBvaW50IGlzIGFscmVhZHkgY29ubmVjdGVkMTM4Nzc3ODc4MDc4MTQ0NTY3NTUyOTUzOTU4NTExMzUyNTM5MDYyNTY5Mzg4OTM5MDM5MDcyMjgzNzc2NDc2OTc5MjU1Njc2MjY5NTMxMjVFcnJvciB3aGVuIHJ1bm5pbmcgTXNpSW5zdGFsbFByb2R1Y3Q6ICV2TWFwSXRlci5LZXkgY2FsbGVkIG9uIGV4aGF1c3RlZCBpdGVyYXRvclVuaW5zdGFsbGVkIEFnZW50IHdpdGggZGVwbG95bWVudCBJRDogJXZhZGRyZXNzIGZhbWlseSBub3Qgc3VwcG9ydGVkIGJ5IHByb3RvY29sYnVsa0JhcnJpZXJQcmVXcml0ZTogdW5hbGlnbmVkIGFyZ3VtZW50c2Nhbm5vdCBmcmVlIHdvcmtidWZzIHdoZW4gd29yay5mdWxsICE9IDBmYWlsZWQgdG8gYWNxdWlyZSBsb2NrIHRvIHJlc2V0IGNhcGFjaXR5aW52YWxpZCBzcGFuIGluIGhlYXBBcmVuYSBmb3IgdXNlciBhcmVuYW1hcmtXb3JrZXJTdG9wOiB1bmtub3duIG1hcmsgd29ya2VyIG1vZGVtdXN0IGJlIGFibGUgdG8gdHJhY2sgaWRsZSBsaW1pdGVyIGV2ZW50cmVmaWxsIG9mIHNwYW4gd2l0aCBmcmVlIHNwYWNlIHJlbWFpbmluZ3JlZmxlY3QuVmFsdWUuU2V0Qnl0ZXMgb2Ygbm9uLWJ5dGUgc2xpY2VyZWZsZWN0LlZhbHVlLnNldFJ1bmVzIG9mIG5vbi1ydW5l98:T554,bGF5ZWQgemVyb2luZyBvbiBkYXRhIHRoYXQgbWF5IGNvbnRhaW4gcG9pbnRlcnNmdWxseSBlbXB0eSB1bmZyZWVkIHNwYW4gc2V0IGJsb2NrIGZvdW5kIGluIHJlc2V0aW52YWxpZCBtZW1vcnkgYWRkcmVzcyBvciBuaWwgcG9pbnRlciBkZXJlZmVyZW5jZWludmFsaWQgb3IgaW5jb21wbGV0ZSBtdWx0aWJ5dGUgb3Igd2lkZSBjaGFyYWN0ZXJub3QgZW5vdWdoIHNpZ25pZmljYW50IGJpdHMgYWZ0ZXIgbXVsdDEyOGJpdFBvdzEwcGFuaWN3cmFwOiB1bmV4cGVjdGVkIHN0cmluZyBhZnRlciBwYWNrYWdlIG5hbWU6IHJlZmxlY3QuVmFsdWUuU2xpY2U6IHNsaWNlIG9mIHVuYWRkcmVzc2FibGUgYXJyYXlydW50aW1lLnJlZmxlY3RfbWFrZW1hcDogdW5zdXBwb3J0ZWQgbWFwIGtleSB0eXBlcnVudGltZTogdW5leHBlY3RlZCB3YWl0bSAtIHNlbWFwaG9yZSBvdXQgb2Ygc3luY3MuYWxsb2NDb3VudCAhPSBzLm5lbGVtcyAmJiBmcmVlSW5kZXggPT0gcy5uZWxlbXNzbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFs6OiV4XSB3aXRoIGNhcGFjaXR5ICV5c3dlZXBlciBsZWZ0IG91dHN0YW5kaW5nIGFjcm9zcyBzd2VlcCBnZW5lcmF0aW9uc2F0dGVtcHQgdG8gZXhlY3V0ZSBzeXN0ZW0gc3RhY2sgY29kZSBvbiB1c2VyIHN0YWNrY29tcGlsZUNhbGxiYWNrOiBmdW5jdGlvbiBhcmd1bWVudCBmcmFtZSB0b28gbGFyZ2VtYWxsb2NnYyBjYWxsZWQgd2l0aCBnY3BoYXNlID09IF9HQ21hcmt0ZXJtaW5hdGlvbnJlY3Vyc2l2ZSBjYWxsIGR1cmluZyBpbml0aWFsaXphdGlvbiAtIGxpbmtlciBza2V3cnVudGltZTogdW5hYmxlIHRvIGFjcXVpcmUgLSBzZW1hcGhvcmUgb3V0IG9mIHN5bmNzeXNjYWxsOiBzdHJpbmcgd2l0aCBOVUwgcGFzc2VkIHRvIFN0cmluZ0J5dGVTbGljZUpTT04gZGVjb2RlciBvdXQgb2Ygc3luYyAtIGRhdGEgY2hhbmdpbmcgdW5kZXJmb290P2ZhdGFsOiBzeXN0ZW1zdGFjayBjYWxsZWQgZnJvbSB1bmV4cGVjdGVkIGdvcm91dGluZWxpbWl0ZXJFdmVudC5zdG9wOiBpbnZhbGlkIGxpbWl0ZXI=99:T558,bGF5ZWQgemVyb2luZyBvbiBkYXRhIHRoYXQgbWF5IGNvbnRhaW4gcG9pbnRlcnNmdWxseSBlbXB0eSB1bmZyZWVkIHNwYW4gc2V0IGJsb2NrIGZvdW5kIGluIHJlc2V0aW52YWxpZCBtZW1vcnkgYWRkcmVzcyBvciBuaWwgcG9pbnRlciBkZXJlZmVyZW5jZWludmFsaWQgb3IgaW5jb21wbGV0ZSBtdWx0aWJ5dGUgb3Igd2lkZSBjaGFyYWN0ZXJub3QgZW5vdWdoIHNpZ25pZmljYW50IGJpdHMgYWZ0ZXIgbXVsdDEyOGJpdFBvdzEwcGFuaWN3cmFwOiB1bmV4cGVjdGVkIHN0cmluZyBhZnRlciBwYWNrYWdlIG5hbWU6IHJlZmxlY3QuVmFsdWUuU2xpY2U6IHNsaWNlIG9mIHVuYWRkcmVzc2FibGUgYXJyYXlydW50aW1lLnJlZmxlY3RfbWFrZW1hcDogdW5zdXBwb3J0ZWQgbWFwIGtleSB0eXBlcnVudGltZTogdW5leHBlY3RlZCB3YWl0bSAtIHNlbWFwaG9yZSBvdXQgb2Ygc3luY3MuYWxsb2NDb3VudCAhPSBzLm5lbGVtcyAmJiBmcmVlSW5kZXggPT0gcy5uZWxlbXNzbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFs6OiV4XSB3aXRoIGNhcGFjaXR5ICV5c3dlZXBlciBsZWZ0IG91dHN0YW5kaW5nIGFjcm9zcyBzd2VlcCBnZW5lcmF0aW9uc2F0dGVtcHQgdG8gZXhlY3V0ZSBzeXN0ZW0gc3RhY2sgY29kZSBvbiB1c2VyIHN0YWNrY29tcGlsZUNhbGxiYWNrOiBmdW5jdGlvbiBhcmd1bWVudCBmcmFtZSB0b28gbGFyZ2VtYWxsb2NnYyBjYWxsZWQgd2l0aCBnY3BoYXNlID09IF9HQ21hcmt0ZXJtaW5hdGlvbnJlY3Vyc2l2ZSBjYWxsIGR1cmluZyBpbml0aWFsaXphdGlvbiAtIGxpbmtlciBza2V3cnVudGltZTogdW5hYmxlIHRvIGFjcXVpcmUgLSBzZW1hcGhvcmUgb3V0IG9mIHN5bmNzeXNjYWxsOiBzdHJpbmcgd2l0aCBOVUwgcGFzc2VkIHRvIFN0cmluZ0J5dGVTbGljZUpTT04gZGVjb2RlciBvdXQgb2Ygc3luYyAtIGRhdGEgY2hhbmdpbmcgdW5kZXJmb290P2ZhdGFsOiBzeXN0ZW1zdGFjayBjYWxsZWQgZnJvbSB1bmV4cGVjdGVkIGdvcm91dGluZWxpbWl0ZXJFdmVudC5zdG9wOiBpbnZhbGlkIGxpbWl0ZXIgZQ==9a:T554,bWUuTG9jYWx0cmFjZWZyZWUodHJhY2VnYygpdW5peHBhY2tldHVua25vd24gcGN3czJfMzIuZGxsICBvZiBzaXplICAgKHRhcmdldHBjPSAsIHBsdWdpbjogIEtpQiB3b3JrLCAgZXhwLikgZm9yICBmcmVlaW5kZXg9IGdjd2FpdGluZz0gaWRsZXByb2NzPSBpbiBzdGF0dXMgIG1hbGxvY2luZz0gbXMgY2xvY2ssICBuQlNTUm9vdHM9IHAtPnN0YXR1cz0gcy5uZWxlbXM9ICBzY2hlZHRpY2s9IHNwYW4ubGlzdD0gdGltZXJzbGVuPSUhKEJBRFBSRUMpKSBhdCBlbnRyeSssIGVsZW1zaXplPSwgbnBhZ2VzID0gL2Rldi9zdGRlcnIvZGV2L3N0ZG91dDMwNTE3NTc4MTI1OiBmcmFtZS5zcD1DbG9zZUhhbmRsZUNyZWF0ZUZpbGVXRGVsZXRlRmlsZVdEaXZlc19Ba3VydUV4aXRQcm9jZXNzRnJlZUxpYnJhcnlHT01FTUxJTUlUPUdPVFJBQ0VCQUNLR2V0RmlsZVR5cGVJZGVvZ3JhcGhpY01hcnNoYWxKU09OTWFyc2hhbFRleHRNZWRlZmFpZHJpbk1lc3NhZ2VCb3hBTW92ZUZpbGVFeFdOYW5kaW5hZ2FyaU5ldFNoYXJlQWRkTmV0U2hhcmVEZWxOZXdfVGFpX0x1ZU9sZF9QZXJzaWFuT2xkX1NvZ2RpYW5PcGVuUHJvY2Vzc1BhdV9DaW5fSGF1UmVnQ2xvc2VLZXlTZXRGaWxlVGltZVNpZ25Xcml0aW5nU29mdF9Eb3R0ZWRWaXJ0dWFsTG9ja1dTQVJlY3ZGcm9tV2FyYW5nX0NpdGlXaGl0ZV9TcGFjZWFzc2lzdFF1ZXVlYmFkIGFkZHJlc3NiYWQgYXJnU2l6ZWJhZCBtIHZhbHVlYmFkIG1lc3NhZ2ViYWQgdGltZWRpdmJyb2tlbiBwaXBlY2dvY2FsbCBuaWxjbG9iYmVyZnJlZWNsb3Nlc29ja2V0Y3JlYXRlZCBieSBjcnlwdDMyLmRsbGZpbGUgZXhpc3RzZmxvYXQzMm5hbjJmbG9hdDY0bmFuMWZsb2F0NjRuYW4yZmxvYXQ2NG5hbjNnY2NoZWNrbWFya2dldHBlZXJuYW1lZ2V0c29ja25hbWVnbG9iYWxBbGxvY2kvbyB0aW1lb3V0bVNwYW5NYW51YWxtZXRob2RhcmdzKG1pblRyaWdnZXI9bXN3c29jay5kbGxuZXRwb2xsSW5pdHBhcnNlIGVycm9ycmVmbGVjdC5TZXRyZWZsZWN0T2Zmc3J1bnRpbWU6IFAgcnVudGltZTo=9b:T554,bXN0YXJ0YmFkIHNlcXVlbmNlIG51bWJlcmJhZCB2YWx1ZSBmb3IgZmllbGRkZXZpY2Ugbm90IGEgc3RyZWFtZGlyZWN0b3J5IG5vdCBlbXB0eWRpc2sgcXVvdGEgZXhjZWVkZWRkb2RlbHRpbWVyOiB3cm9uZyBQZmlsZSBhbHJlYWR5IGNsb3NlZGZpbGUgYWxyZWFkeSBleGlzdHNmaWxlIGRvZXMgbm90IGV4aXN0bSBub3QgZm91bmQgaW4gYWxsbW1hcmtpbmcgZnJlZSBvYmplY3RtYXJrcm9vdDogYmFkIGluZGV4bWlzc2luZyBkZWZlcnJldHVybm1zcGFuLnN3ZWVwOiBzdGF0ZT1ub3Rlc2xlZXAgbm90IG9uIGcwbnRkbGwuZGxsIG5vdCBmb3VuZG53YWl0ID4gd29yay5ucHJvY3NwYW5pYyBkdXJpbmcgbWFsbG9jcGFuaWMgZHVyaW5nIHBhbmljcGFuaWMgaG9sZGluZyBsb2Nrc3Bhbmljd3JhcDogbm8gKCBpbiBwYW5pY3dyYXA6IG5vICkgaW4gcmVmbGVjdC5WYWx1ZS5CeXRlc3JlZmxlY3QuVmFsdWUuRmllbGRyZWZsZWN0LlZhbHVlLkZsb2F0cmVmbGVjdC5WYWx1ZS5JbmRleHJlZmxlY3QuVmFsdWUuSXNOaWxyZWZsZWN0LlZhbHVlLlNsaWNlcnVudGltZTogZzAgc3RhY2sgW3J1bnRpbWU6IHBjZGF0YSBpcyBydW50aW1lOiBwcmVlbXB0IGcwc2VtYVJvb3Qgcm90YXRlTGVmdHNraXAgdGhpcyBkaXJlY3RvcnlzdG9wbSBob2xkaW5nIGxvY2tzc3lzTWVtU3RhdCBvdmVyZmxvd3RvbyBtYW55IG9wZW4gZmlsZXN1bmV4cGVjdGVkIGcgc3RhdHVzdW5rbm93biB3YWl0IHJlYXNvbndpbm1tLmRsbCBub3QgZm91bmQgbWFya3Jvb3Qgam9icyBkb25lIHRvIHVuYWxsb2NhdGVkIHNwYW4zNzI1MjkwMjk4NDYxOTE0MDYyNUFyYWJpYyBTdGFuZGFyZCBUaW1lQXpvcmVzIFN0YW5kYXJkIFRpbWVDZXJ0T3BlblN5c3RlbVN0b3JlV0NyZWF0ZVByb2Nlc3NBc1VzZXJXQ3J5cHRBY3F1aXJlQ29udGV4dFdFZ3lwdGlhbl9IaWVyb2dseXBoc0dldEFjY2VwdEV4U29ja2FkZHJzR2V0QWRhcHRlcnNBZGRyZXNzZXNHZXRDdXJyZW50RGlyZWN0b3J5V0dldEZpbGVBdHRyaWJ1dGVzRXhXR2V0UHJvY2Vzc01lbW9yeQ==9c:T554,bXN0YXJ0YmFkIHNlcXVlbmNlIG51bWJlcmJhZCB2YWx1ZSBmb3IgZmllbGRkZXZpY2Ugbm90IGEgc3RyZWFtZGlyZWN0b3J5IG5vdCBlbXB0eWRpc2sgcXVvdGEgZXhjZWVkZWRkb2RlbHRpbWVyOiB3cm9uZyBQZmlsZSBhbHJlYWR5IGNsb3NlZGZpbGUgYWxyZWFkeSBleGlzdHNmaWxlIGRvZXMgbm90IGV4aXN0bSBub3QgZm91bmQgaW4gYWxsbW1hcmtpbmcgZnJlZSBvYmplY3RtYXJrcm9vdDogYmFkIGluZGV4bWlzc2luZyBkZWZlcnJldHVybm1zcGFuLnN3ZWVwOiBzdGF0ZT1ub3Rlc2xlZXAgbm90IG9uIGcwbnRkbGwuZGxsIG5vdCBmb3VuZG53YWl0ID4gd29yay5ucHJvY3NwYW5pYyBkdXJpbmcgbWFsbG9jcGFuaWMgZHVyaW5nIHBhbmljcGFuaWMgaG9sZGluZyBsb2Nrc3Bhbmljd3JhcDogbm8gKCBpbiBwYW5pY3dyYXA6IG5vICkgaW4gcmVmbGVjdC5WYWx1ZS5CeXRlc3JlZmxlY3QuVmFsdWUuRmllbGRyZWZsZWN0LlZhbHVlLkZsb2F0cmVmbGVjdC5WYWx1ZS5JbmRleHJlZmxlY3QuVmFsdWUuSXNOaWxyZWZsZWN0LlZhbHVlLlNsaWNlcnVudGltZTogZzAgc3RhY2sgW3J1bnRpbWU6IHBjZGF0YSBpcyBydW50aW1lOiBwcmVlbXB0IGcwc2VtYVJvb3Qgcm90YXRlTGVmdHNraXAgdGhpcyBkaXJlY3RvcnlzdG9wbSBob2xkaW5nIGxvY2tzc3lzTWVtU3RhdCBvdmVyZmxvd3RvbyBtYW55IG9wZW4gZmlsZXN1bmV4cGVjdGVkIGcgc3RhdHVzdW5rbm93biB3YWl0IHJlYXNvbndpbm1tLmRsbCBub3QgZm91bmQgbWFya3Jvb3Qgam9icyBkb25lIHRvIHVuYWxsb2NhdGVkIHNwYW4zNzI1MjkwMjk4NDYxOTE0MDYyNUFyYWJpYyBTdGFuZGFyZCBUaW1lQXpvcmVzIFN0YW5kYXJkIFRpbWVDZXJ0T3BlblN5c3RlbVN0b3JlV0NyZWF0ZVByb2Nlc3NBc1VzZXJXQ3J5cHRBY3F1aXJlQ29udGV4dFdFZ3lwdGlhbl9IaWVyb2dseXBoc0dldEFjY2VwdEV4U29ja2FkZHJzR2V0QWRhcHRlcnNBZGRyZXNzZXNHZXRDdXJyZW50RGlyZWN0b3J5V0dldEZpbGVBdHRyaWJ1dGVzRXhXR2V0UHJvY2Vzc01lbW9yeUk=9d:T554,bmZvSURTX1RyaW5hcnlfT3BlcmF0b3JJc3JhZWwgU3RhbmRhcmQgVGltZUpvcmRhbiBTdGFuZGFyZCBUaW1lTWVyb2l0aWNfSGllcm9nbHlwaHNNc2lDb25maWd1cmVQcm9kdWN0QU1zaURhdGFiYXNlT3BlblZpZXdBU2VlazogaW52YWxpZCBvZmZzZXRTZWVrOiBpbnZhbGlkIHdoZW5jZVNldEN1cnJlbnREaXJlY3RvcnlXU2V0SGFuZGxlSW5mb3JtYXRpb25UYWlwZWkgU3RhbmRhcmQgVGltZVRlcm1pbmFsX1B1bmN0dWF0aW9uVHVya2V5IFN0YW5kYXJkIFRpbWViYWQgZm9udCBmaWxlIGZvcm1hdGJhZCBzeXN0ZW0gcGFnZSBzaXplYmFkIHVzZSBvZiBidWNrZXQuYnBiYWQgdXNlIG9mIGJ1Y2tldC5tcGNoYW4gc2VuZCAobmlsIGNoYW4pY2xvc2Ugb2YgbmlsIGNoYW5uZWxjb25uZWN0aW9uIHRpbWVkIG91dGRvZGVsdGltZXIwOiB3cm9uZyBQZmxhZzogaGVscCByZXF1ZXN0ZWRmbG9hdGluZyBwb2ludCBlcnJvcmZvcmNlZ2M6IHBoYXNlIGVycm9yZ28gb2YgbmlsIGZ1bmMgdmFsdWVnb3Bhcms6IGJhZCBnIHN0YXR1c2ludmFsaWQgcmVxdWVzdCBjb2RlaW52YWxpZCB3cml0ZSByZXN1bHRpcyBhIG5hbWVkIHR5cGUgZmlsZWpzb246IFVubWFyc2hhbChuaWwganNvbjogVW5tYXJzaGFsKG5pbClqc29uOiBlcnJvciBjYWxsaW5nIGtleSBoYXMgYmVlbiByZXZva2VkbWFsbG9jIGR1cmluZyBzaWduYWxub3RldHNsZWVwIG5vdCBvbiBnMHAgbWNhY2hlIG5vdCBmbHVzaGVkcGFjZXI6IGFzc2lzdCByYXRpbz1wcmVlbXB0IG9mZiByZWFzb246IHJlZmxlY3QuVmFsdWUuU2V0SW50cmVmbGVjdC5tYWtlRnVuY1N0dWJydW50aW1lOiBkb3VibGUgd2FpdHNlbWFSb290IHJvdGF0ZVJpZ2h0dGltZTogaW52YWxpZCBudW1iZXJ0cmFjZTogb3V0IG9mIG1lbW9yeXdpcmVwOiBhbHJlYWR5IGluIGdvd29ya2J1ZiBpcyBub3QgZW1wdHl3cml0ZSBvZiBHbyBwb2ludGVyIHdzMl8zMi5kbGwgbm90IGZvdW5kIG9mIHVuZXhwb3J0ZWQgbWV0aG9kIHBjSGVhZGVyLnRleHRTdGFydD0gIHByZXZpb3VzIGFsbG9jQ2919e:T558,bmZvSURTX1RyaW5hcnlfT3BlcmF0b3JJc3JhZWwgU3RhbmRhcmQgVGltZUpvcmRhbiBTdGFuZGFyZCBUaW1lTWVyb2l0aWNfSGllcm9nbHlwaHNNc2lDb25maWd1cmVQcm9kdWN0QU1zaURhdGFiYXNlT3BlblZpZXdBU2VlazogaW52YWxpZCBvZmZzZXRTZWVrOiBpbnZhbGlkIHdoZW5jZVNldEN1cnJlbnREaXJlY3RvcnlXU2V0SGFuZGxlSW5mb3JtYXRpb25UYWlwZWkgU3RhbmRhcmQgVGltZVRlcm1pbmFsX1B1bmN0dWF0aW9uVHVya2V5IFN0YW5kYXJkIFRpbWViYWQgZm9udCBmaWxlIGZvcm1hdGJhZCBzeXN0ZW0gcGFnZSBzaXplYmFkIHVzZSBvZiBidWNrZXQuYnBiYWQgdXNlIG9mIGJ1Y2tldC5tcGNoYW4gc2VuZCAobmlsIGNoYW4pY2xvc2Ugb2YgbmlsIGNoYW5uZWxjb25uZWN0aW9uIHRpbWVkIG91dGRvZGVsdGltZXIwOiB3cm9uZyBQZmxhZzogaGVscCByZXF1ZXN0ZWRmbG9hdGluZyBwb2ludCBlcnJvcmZvcmNlZ2M6IHBoYXNlIGVycm9yZ28gb2YgbmlsIGZ1bmMgdmFsdWVnb3Bhcms6IGJhZCBnIHN0YXR1c2ludmFsaWQgcmVxdWVzdCBjb2RlaW52YWxpZCB3cml0ZSByZXN1bHRpcyBhIG5hbWVkIHR5cGUgZmlsZWpzb246IFVubWFyc2hhbChuaWwganNvbjogVW5tYXJzaGFsKG5pbClqc29uOiBlcnJvciBjYWxsaW5nIGtleSBoYXMgYmVlbiByZXZva2VkbWFsbG9jIGR1cmluZyBzaWduYWxub3RldHNsZWVwIG5vdCBvbiBnMHAgbWNhY2hlIG5vdCBmbHVzaGVkcGFjZXI6IGFzc2lzdCByYXRpbz1wcmVlbXB0IG9mZiByZWFzb246IHJlZmxlY3QuVmFsdWUuU2V0SW50cmVmbGVjdC5tYWtlRnVuY1N0dWJydW50aW1lOiBkb3VibGUgd2FpdHNlbWFSb290IHJvdGF0ZVJpZ2h0dGltZTogaW52YWxpZCBudW1iZXJ0cmFjZTogb3V0IG9mIG1lbW9yeXdpcmVwOiBhbHJlYWR5IGluIGdvd29ya2J1ZiBpcyBub3QgZW1wdHl3cml0ZSBvZiBHbyBwb2ludGVyIHdzMl8zMi5kbGwgbm90IGZvdW5kIG9mIHVuZXhwb3J0ZWQgbWV0aG9kIHBjSGVhZGVyLnRleHRTdGFydD0gIHByZXZpb3VzIGFsbG9jQ291bg==9f:T554,TnlpYWtlbmdfUHVhY2h1ZV9IbW9uZ1Bha2lzdGFuIFN0YW5kYXJkIFRpbWVQYW5pY2tlZDogJXZTdGFjazogJXZQYXJhZ3VheSBTdGFuZGFyZCBUaW1lUnRsR2V0TnRWZXJzaW9uTnVtYmVyc1Nha2hhbGluIFN0YW5kYXJkIFRpbWVTYW8gVG9tZSBTdGFuZGFyZCBUaW1lVGFzbWFuaWEgU3RhbmRhcmQgVGltZWFkZHJlc3MgYWxyZWFkeSBpbiB1c2VhZHZhcGkzMi5kbGwgbm90IGZvdW5kYXJndW1lbnQgbGlzdCB0b28gbG9uZ2Fzc2VtYmx5IGNoZWNrcyBmYWlsZWRiYWQgZy0+c3RhdHVzIGluIHJlYWR5YmFkIHN3ZWVwZ2VuIGluIHJlZmlsbGNhbm5vdCBhbGxvY2F0ZSBtZW1vcnljb21waWxlQ2FsbGFiY2s6IHR5cGUgZHVwbGljYXRlZCBkZWZlciBlbnRyeWZyZWVJbmRleCBpcyBub3QgdmFsaWRnZXRlbnYgYmVmb3JlIGVudiBpbml0aGVhZFRhaWxJbmRleCBvdmVyZmxvd2ludGVnZXIgZGl2aWRlIGJ5IHplcm9pbnRlcmZhY2UgY29udmVyc2lvbjoganNvbjogdW5rbm93biBmaWVsZCAlcWtlcm5lbDMyLmRsbCBub3QgZm91bmRtaW5wYyBvciBtYXhwYyBpbnZhbGlkbmV0d29yayBpcyB1bnJlYWNoYWJsZW5vbi1HbyBmdW5jdGlvbiBhdCBwYz1vbGRvdmVyZmxvdyBpcyBub3QgbmlscHJvdG9jb2wgbm90IGF2YWlsYWJsZXByb3RvY29sIG5vdCBzdXBwb3J0ZWRyZWZsZWN0LlZhbHVlLlNldEZsb2F0cmVtb3RlIGFkZHJlc3MgY2hhbmdlZHJ1bnRpbWUubWFpbiBub3Qgb24gbTBydW50aW1lOiB3b3JrLm53YWl0ID0gcnVudGltZTpzY2Fuc3RhY2s6IGdwPXMuZnJlZWluZGV4ID4gcy5uZWxlbXNzY2Fuc3RhY2sgLSBiYWQgc3RhdHVzc2VuZCBvbiBjbG9zZWQgY2hhbm5lbHNwYW4gaGFzIG5vIGZyZWUgc3BhY2VzdGFjayBub3QgYSBwb3dlciBvZiAydHJhY2UgcmVhZGVyIChibG9ja2VkKXRyYWNlOiBhbGxvYyB0b28gbGFyZ2V1bmV4cGVjdGVkIG1ldGhvZCBzdGVwd2lyZXA6IGludmFsaWQgcCBzdGF0ZSBpbnRvIEdvIHZhbHVlIG9mIHR5cGUgKSBtdXN0IGJlIGEgcG93ZXIgb2YgMjIzMjgzMDY0Mw==a0:T554,TnlpYWtlbmdfUHVhY2h1ZV9IbW9uZ1Bha2lzdGFuIFN0YW5kYXJkIFRpbWVQYW5pY2tlZDogJXZTdGFjazogJXZQYXJhZ3VheSBTdGFuZGFyZCBUaW1lUnRsR2V0TnRWZXJzaW9uTnVtYmVyc1Nha2hhbGluIFN0YW5kYXJkIFRpbWVTYW8gVG9tZSBTdGFuZGFyZCBUaW1lVGFzbWFuaWEgU3RhbmRhcmQgVGltZWFkZHJlc3MgYWxyZWFkeSBpbiB1c2VhZHZhcGkzMi5kbGwgbm90IGZvdW5kYXJndW1lbnQgbGlzdCB0b28gbG9uZ2Fzc2VtYmx5IGNoZWNrcyBmYWlsZWRiYWQgZy0+c3RhdHVzIGluIHJlYWR5YmFkIHN3ZWVwZ2VuIGluIHJlZmlsbGNhbm5vdCBhbGxvY2F0ZSBtZW1vcnljb21waWxlQ2FsbGFiY2s6IHR5cGUgZHVwbGljYXRlZCBkZWZlciBlbnRyeWZyZWVJbmRleCBpcyBub3QgdmFsaWRnZXRlbnYgYmVmb3JlIGVudiBpbml0aGVhZFRhaWxJbmRleCBvdmVyZmxvd2ludGVnZXIgZGl2aWRlIGJ5IHplcm9pbnRlcmZhY2UgY29udmVyc2lvbjoganNvbjogdW5rbm93biBmaWVsZCAlcWtlcm5lbDMyLmRsbCBub3QgZm91bmRtaW5wYyBvciBtYXhwYyBpbnZhbGlkbmV0d29yayBpcyB1bnJlYWNoYWJsZW5vbi1HbyBmdW5jdGlvbiBhdCBwYz1vbGRvdmVyZmxvdyBpcyBub3QgbmlscHJvdG9jb2wgbm90IGF2YWlsYWJsZXByb3RvY29sIG5vdCBzdXBwb3J0ZWRyZWZsZWN0LlZhbHVlLlNldEZsb2F0cmVtb3RlIGFkZHJlc3MgY2hhbmdlZHJ1bnRpbWUubWFpbiBub3Qgb24gbTBydW50aW1lOiB3b3JrLm53YWl0ID0gcnVudGltZTpzY2Fuc3RhY2s6IGdwPXMuZnJlZWluZGV4ID4gcy5uZWxlbXNzY2Fuc3RhY2sgLSBiYWQgc3RhdHVzc2VuZCBvbiBjbG9zZWQgY2hhbm5lbHNwYW4gaGFzIG5vIGZyZWUgc3BhY2VzdGFjayBub3QgYSBwb3dlciBvZiAydHJhY2UgcmVhZGVyIChibG9ja2VkKXRyYWNlOiBhbGxvYyB0b28gbGFyZ2V1bmV4cGVjdGVkIG1ldGhvZCBzdGVwd2lyZXA6IGludmFsaWQgcCBzdGF0ZSBpbnRvIEdvIHZhbHVlIG9mIHR5cGUgKSBtdXN0IGJlIGEgcG93ZXIgb2YgMjIzMjgzMDY0MzY=a1:T554,b2MxOiBuZXdnIG1pc3Npbmcgc3RhY2tvczogcHJvY2VzcyBhbHJlYWR5IGZpbmlzaGVkcHJvdG9jb2wgZHJpdmVyIG5vdCBhdHRhY2hlZHJlZmxlY3QuTWFrZVNsaWNlOiBsZW4gPiBjYXByZWdpb24gZXhjZWVkcyB1aW50cHRyIHJhbmdlcnVudGltZS5zZW1hc2xlZXAgdW5leHBlY3RlZHJ1bnRpbWU6IGNhc2dzdGF0dXM6IG9sZHZhbD1ydW50aW1lOiBubyBtb2R1bGUgZGF0YSBmb3Igc2F2ZSBvbiBzeXN0ZW0gZyBub3QgYWxsb3dlZHVuZXhwZWN0ZWQgZW5kIG9mIEpTT04gaW5wdXQgY2Fubm90IGJlIGNvbnZlcnRlZCB0byB0eXBlIDQ1NDc0NzM1MDg4NjQ2NDExODk1NzUxOTUzMTI1Q2VudHJhbCBBbWVyaWNhIFN0YW5kYXJkIFRpbWVDZW50cmFsIFBhY2lmaWMgU3RhbmRhcmQgVGltZUNoYXRoYW0gSXNsYW5kcyBTdGFuZGFyZCBUaW1lREVQTE9ZTUVOVElEPSV2IEFTS0ZPUk5BTUU9JXZEZWxldGVQcm9jVGhyZWFkQXR0cmlidXRlTGlzdExvY2tPU1RocmVhZCBuZXN0aW5nIG92ZXJmbG93TXNpRGF0YWJhc2VHZW5lcmF0ZVRyYW5zZm9ybUFOLiBDZW50cmFsIEFzaWEgU3RhbmRhcmQgVGltZU5vcnRoIEFzaWEgRWFzdCBTdGFuZGFyZCBUaW1lV293NjRSZXZlcnRXb3c2NEZzUmVkaXJlY3Rpb25hZGRzcGVjaWFsIG9uIGludmFsaWQgcG9pbnRlcmRvUmVjb3JkR29yb3V0aW5lUHJvZmlsZSBncDE9Z2MgZG9uZSBidXQgZ2NwaGFzZSAhPSBfR0NvZmZnZnB1dDogYmFkIHN0YXR1cyAobm90IEdkZWFkKWludmFsaWQgZnVuY3Rpb24gc3ltYm9sIHRhYmxlaW52YWxpZCBsZW5ndGggb2YgdHJhY2UgZXZlbnRpbzogcmVhZC93cml0ZSBvbiBjbG9zZWQgcGlwZW1hY2hpbmUgaXMgbm90IG9uIHRoZSBuZXR3b3JrbmVlZCBwYWRkaW5nIGluIGJ1Y2tldCAoZWxlbSlubyBYRU5JWCBzZW1hcGhvcmVzIGF2YWlsYWJsZW5vdGVzbGVlcCAtIHdhaXRtIG91dCBvZiBzeW5jbnVtZXJpY2FsIHJlc3VsdCBvdXQgb2YgcmFuZ2VvcGVyYXRpb24gYWxyZWFkeSBpbiBwcm9ncmVzc3BhZGRpbmcgY29udGFpbmVkIGluIGFsa2:T558,b2MxOiBuZXdnIG1pc3Npbmcgc3RhY2tvczogcHJvY2VzcyBhbHJlYWR5IGZpbmlzaGVkcHJvdG9jb2wgZHJpdmVyIG5vdCBhdHRhY2hlZHJlZmxlY3QuTWFrZVNsaWNlOiBsZW4gPiBjYXByZWdpb24gZXhjZWVkcyB1aW50cHRyIHJhbmdlcnVudGltZS5zZW1hc2xlZXAgdW5leHBlY3RlZHJ1bnRpbWU6IGNhc2dzdGF0dXM6IG9sZHZhbD1ydW50aW1lOiBubyBtb2R1bGUgZGF0YSBmb3Igc2F2ZSBvbiBzeXN0ZW0gZyBub3QgYWxsb3dlZHVuZXhwZWN0ZWQgZW5kIG9mIEpTT04gaW5wdXQgY2Fubm90IGJlIGNvbnZlcnRlZCB0byB0eXBlIDQ1NDc0NzM1MDg4NjQ2NDExODk1NzUxOTUzMTI1Q2VudHJhbCBBbWVyaWNhIFN0YW5kYXJkIFRpbWVDZW50cmFsIFBhY2lmaWMgU3RhbmRhcmQgVGltZUNoYXRoYW0gSXNsYW5kcyBTdGFuZGFyZCBUaW1lREVQTE9ZTUVOVElEPSV2IEFTS0ZPUk5BTUU9JXZEZWxldGVQcm9jVGhyZWFkQXR0cmlidXRlTGlzdExvY2tPU1RocmVhZCBuZXN0aW5nIG92ZXJmbG93TXNpRGF0YWJhc2VHZW5lcmF0ZVRyYW5zZm9ybUFOLiBDZW50cmFsIEFzaWEgU3RhbmRhcmQgVGltZU5vcnRoIEFzaWEgRWFzdCBTdGFuZGFyZCBUaW1lV293NjRSZXZlcnRXb3c2NEZzUmVkaXJlY3Rpb25hZGRzcGVjaWFsIG9uIGludmFsaWQgcG9pbnRlcmRvUmVjb3JkR29yb3V0aW5lUHJvZmlsZSBncDE9Z2MgZG9uZSBidXQgZ2NwaGFzZSAhPSBfR0NvZmZnZnB1dDogYmFkIHN0YXR1cyAobm90IEdkZWFkKWludmFsaWQgZnVuY3Rpb24gc3ltYm9sIHRhYmxlaW52YWxpZCBsZW5ndGggb2YgdHJhY2UgZXZlbnRpbzogcmVhZC93cml0ZSBvbiBjbG9zZWQgcGlwZW1hY2hpbmUgaXMgbm90IG9uIHRoZSBuZXR3b3JrbmVlZCBwYWRkaW5nIGluIGJ1Y2tldCAoZWxlbSlubyBYRU5JWCBzZW1hcGhvcmVzIGF2YWlsYWJsZW5vdGVzbGVlcCAtIHdhaXRtIG91dCBvZiBzeW5jbnVtZXJpY2FsIHJlc3VsdCBvdXQgb2YgcmFuZ2VvcGVyYXRpb24gYWxyZWFkeSBpbiBwcm9ncmVzc3BhZGRpbmcgY29udGFpbmVkIGluIGFscA==a3:T550,b25pbmcgR0MgdG8gdGhlIHNhbWUgc3RhdGUgYXMgYmVmb3JlP3RyaWVkIHRvIHJ1biBzY2F2ZW5nZXIgZnJvbSBhbm90aGVyIGdvcm91dGluZXVuc2FmZS5TdHJpbmc6IHB0ciBpcyBuaWwgYW5kIGxlbiBpcyBub3QgemVybyAoYmFkIHVzZSBvZiB1bnNhZmUuUG9pbnRlcj8gdHJ5IC1kPWNoZWNrcHRyKUFnZW50IGFscmVhZHkgaW5zdGFsbGVkLCBza2lwcGluZyBpbnN0YWxsYXRpb25FcnJvciBydW5uaW5nIE1zaURhdGFiYXNlR2VuZXJhdGVUcmFuc2Zvcm06ICV2U0VMRUNUIFZhbHVlIEZST00gUHJvcGVydHkgV0hFUkUgUHJvcGVydHk9JyV2J1RpbWUuVW5tYXJzaGFsSlNPTjogaW5wdXQgaXMgbm90IGEgSlNPTiBzdHJpbmdtZW1vcnkgcmVzZXJ2YXRpb24gZXhjZWVkcyBhZGRyZXNzIHNwYWNlIGxpbWl0cGFuaWN3cmFwOiB1bmV4cGVjdGVkIHN0cmluZyBhZnRlciB0eXBlIG5hbWU6IHJlZmxlY3QuVmFsdWUuU2xpY2U6IHNsaWNlIGluZGV4IG91dCBvZiBib3VuZHNyZWxlYXNlZCBsZXNzIHRoYW4gb25lIHBoeXNpY2FsIHBhZ2Ugb2YgbWVtb3J5cnVudGltZTogZmFpbGVkIHRvIGNyZWF0ZSBuZXcgT1MgdGhyZWFkIChoYXZlIHJ1bnRpbWU6IG5hbWUgb2Zmc2V0IGJhc2UgcG9pbnRlciBvdXQgb2YgcmFuZ2VydW50aW1lOiBwYW5pYyBiZWZvcmUgbWFsbG9jIGhlYXAgaW5pdGlhbGl6ZWRydW50aW1lOiB0ZXh0IG9mZnNldCBiYXNlIHBvaW50ZXIgb3V0IG9mIHJhbmdlcnVudGltZTogdHlwZSBvZmZzZXQgYmFzZSBwb2ludGVyIG91dCBvZiByYW5nZXNpZ25hbCBhcnJpdmVkIGR1cmluZyBleHRlcm5hbCBjb2RlIGV4ZWN1dGlvbnNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzoleF0gd2l0aCBsZW5ndGggJXlzdG9wVGhlV29ybGQ6IG5vdCBzdG9wcGVkIChzdGF0dXMgIT0gX1BnY3N0b3Apc3lzR3JvdyBib3VuZHMgbm90IGFsaWduZWQgdG8gcGFsbG9jQ2h1bmtCeXRlc3RyaWVkIHRvIHBhcmsgc2NhdmVuZ2VyIGZyb20gYW5vdGhlciBnb3JvdXRpbmVFcnJvciBjYWxsaW5nIE1zaURhdGFia4:T554,b25pbmcgR0MgdG8gdGhlIHNhbWUgc3RhdGUgYXMgYmVmb3JlP3RyaWVkIHRvIHJ1biBzY2F2ZW5nZXIgZnJvbSBhbm90aGVyIGdvcm91dGluZXVuc2FmZS5TdHJpbmc6IHB0ciBpcyBuaWwgYW5kIGxlbiBpcyBub3QgemVybyAoYmFkIHVzZSBvZiB1bnNhZmUuUG9pbnRlcj8gdHJ5IC1kPWNoZWNrcHRyKUFnZW50IGFscmVhZHkgaW5zdGFsbGVkLCBza2lwcGluZyBpbnN0YWxsYXRpb25FcnJvciBydW5uaW5nIE1zaURhdGFiYXNlR2VuZXJhdGVUcmFuc2Zvcm06ICV2U0VMRUNUIFZhbHVlIEZST00gUHJvcGVydHkgV0hFUkUgUHJvcGVydHk9JyV2J1RpbWUuVW5tYXJzaGFsSlNPTjogaW5wdXQgaXMgbm90IGEgSlNPTiBzdHJpbmdtZW1vcnkgcmVzZXJ2YXRpb24gZXhjZWVkcyBhZGRyZXNzIHNwYWNlIGxpbWl0cGFuaWN3cmFwOiB1bmV4cGVjdGVkIHN0cmluZyBhZnRlciB0eXBlIG5hbWU6IHJlZmxlY3QuVmFsdWUuU2xpY2U6IHNsaWNlIGluZGV4IG91dCBvZiBib3VuZHNyZWxlYXNlZCBsZXNzIHRoYW4gb25lIHBoeXNpY2FsIHBhZ2Ugb2YgbWVtb3J5cnVudGltZTogZmFpbGVkIHRvIGNyZWF0ZSBuZXcgT1MgdGhyZWFkIChoYXZlIHJ1bnRpbWU6IG5hbWUgb2Zmc2V0IGJhc2UgcG9pbnRlciBvdXQgb2YgcmFuZ2VydW50aW1lOiBwYW5pYyBiZWZvcmUgbWFsbG9jIGhlYXAgaW5pdGlhbGl6ZWRydW50aW1lOiB0ZXh0IG9mZnNldCBiYXNlIHBvaW50ZXIgb3V0IG9mIHJhbmdlcnVudGltZTogdHlwZSBvZmZzZXQgYmFzZSBwb2ludGVyIG91dCBvZiByYW5nZXNpZ25hbCBhcnJpdmVkIGR1cmluZyBleHRlcm5hbCBjb2RlIGV4ZWN1dGlvbnNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzoleF0gd2l0aCBsZW5ndGggJXlzdG9wVGhlV29ybGQ6IG5vdCBzdG9wcGVkIChzdGF0dXMgIT0gX1BnY3N0b3Apc3lzR3JvdyBib3VuZHMgbm90IGFsaWduZWQgdG8gcGFsbG9jQ2h1bmtCeXRlc3RyaWVkIHRvIHBhcmsgc2NhdmVuZ2VyIGZyb20gYW5vdGhlciBnb3JvdXRpbmVFcnJvciBjYWxsaW5nIE1zaURhdGFiYQ==a5:T550,cHJvZk1lbUFjdGl2ZXByb2ZNZW1GdXR1cmVydW50aW1lOiBzZXE9cnVudGltZTogdmFsPXNybW91bnQgZXJyb3J0ZXN0UkludGVybmFsdGltZXIgZXhwaXJlZHRyYWNlU3RhY2tUYWJ1bmltcGxlbWVudGVkdmFsdWUgbWV0aG9kIHhhZGQ2NCBmYWlsZWR4Y2hnNjQgZmFpbGVkfXNjaGVkPXtwYzogbmVlZHNwaW5uaW5nPSBubWlkbGVsb2NrZWQ9IG9uIHplcm8gVmFsdWUgb3V0IG9mIHJhbmdlICBwcm9jZWR1cmUgaW4gIHRvIGZpbmFsaXplciAgdW50eXBlZCBhcmdzIC10aHJlYWQgbGltaXQxOTA3MzQ4NjMyODEyNTk1MzY3NDMxNjQwNjI1OiBleHRyYSB0ZXh0OiBDZXJ0Q2xvc2VTdG9yZUNyZWF0ZVByb2Nlc3NXQ3J5cHRHZW5SYW5kb21GaW5kRmlyc3RGaWxlV0Zvcm1hdE1lc3NhZ2VXR0MgYXNzaXN0IHdhaXRHQyB3b3JrZXIgaW5pdEdldENvbnNvbGVNb2RlR2V0UHJvY0FkZHJlc3NHZXRVc2VyTmFtZUV4V0lzV293NjRQcm9jZXNzTUI7IGFsbG9jYXRlZCBNb2R1bGUzMkZpcnN0V01zaUNsb3NlSGFuZGxlTXNpVmlld0V4ZWN1dGVOZXRVc2VyR2V0SW5mb090aGVyX0lEX1N0YXJ0UGF0dGVybl9TeW50YXhQcm9jZXNzMzJOZXh0V1F1b3RhdGlvbl9NYXJrUmVnU2V0VmFsdWVFeFdTZXRGaWxlUG9pbnRlclRyYW5zbGF0ZU5hbWVXYWxsb2NmcmVldHJhY2ViYWQgYWxsb2NDb3VudGJhZCByZXN0YXJ0IFBDYmFkIHNwYW4gc3RhdGVmaWxlIHRvbyBsYXJnZWZpbmFsaXplciB3YWl0Z2NzdG9wdGhld29ybGRnZXRwcm90b2J5bmFtZWludmFsaWQgc3ludGF4aXMgYSBkaXJlY3RvcnlrZXkgc2l6ZSB3cm9uZ2xldmVsIDIgaGFsdGVkbGV2ZWwgMyBoYWx0ZWRtZW1wcm9maWxlcmF0ZW5pbCBlbGVtIHR5cGUhbm8gbW9kdWxlIGRhdGFubyBzdWNoIGRldmljZXByb3RvY29sIGVycm9ycmVmbGVjdC5WYWx1ZS5ydW50aW1lOiBmdWxsPXJ1bnRpbWU6IHdhbnQ9cy5hbGxvY0NvdW50PSBzZW1hUm9vdCBxdWV1ZXN0YWNrIG92ZXJmbG93c3RvcG0gc3Bpbm5pbmdzdG9yZTY0IGZhaWxlZHN5bmMuQ29uZC5XYWl0a6:T554,cHJvZk1lbUFjdGl2ZXByb2ZNZW1GdXR1cmVydW50aW1lOiBzZXE9cnVudGltZTogdmFsPXNybW91bnQgZXJyb3J0ZXN0UkludGVybmFsdGltZXIgZXhwaXJlZHRyYWNlU3RhY2tUYWJ1bmltcGxlbWVudGVkdmFsdWUgbWV0aG9kIHhhZGQ2NCBmYWlsZWR4Y2hnNjQgZmFpbGVkfXNjaGVkPXtwYzogbmVlZHNwaW5uaW5nPSBubWlkbGVsb2NrZWQ9IG9uIHplcm8gVmFsdWUgb3V0IG9mIHJhbmdlICBwcm9jZWR1cmUgaW4gIHRvIGZpbmFsaXplciAgdW50eXBlZCBhcmdzIC10aHJlYWQgbGltaXQxOTA3MzQ4NjMyODEyNTk1MzY3NDMxNjQwNjI1OiBleHRyYSB0ZXh0OiBDZXJ0Q2xvc2VTdG9yZUNyZWF0ZVByb2Nlc3NXQ3J5cHRHZW5SYW5kb21GaW5kRmlyc3RGaWxlV0Zvcm1hdE1lc3NhZ2VXR0MgYXNzaXN0IHdhaXRHQyB3b3JrZXIgaW5pdEdldENvbnNvbGVNb2RlR2V0UHJvY0FkZHJlc3NHZXRVc2VyTmFtZUV4V0lzV293NjRQcm9jZXNzTUI7IGFsbG9jYXRlZCBNb2R1bGUzMkZpcnN0V01zaUNsb3NlSGFuZGxlTXNpVmlld0V4ZWN1dGVOZXRVc2VyR2V0SW5mb090aGVyX0lEX1N0YXJ0UGF0dGVybl9TeW50YXhQcm9jZXNzMzJOZXh0V1F1b3RhdGlvbl9NYXJrUmVnU2V0VmFsdWVFeFdTZXRGaWxlUG9pbnRlclRyYW5zbGF0ZU5hbWVXYWxsb2NmcmVldHJhY2ViYWQgYWxsb2NDb3VudGJhZCByZXN0YXJ0IFBDYmFkIHNwYW4gc3RhdGVmaWxlIHRvbyBsYXJnZWZpbmFsaXplciB3YWl0Z2NzdG9wdGhld29ybGRnZXRwcm90b2J5bmFtZWludmFsaWQgc3ludGF4aXMgYSBkaXJlY3RvcnlrZXkgc2l6ZSB3cm9uZ2xldmVsIDIgaGFsdGVkbGV2ZWwgMyBoYWx0ZWRtZW1wcm9maWxlcmF0ZW5pbCBlbGVtIHR5cGUhbm8gbW9kdWxlIGRhdGFubyBzdWNoIGRldmljZXByb3RvY29sIGVycm9ycmVmbGVjdC5WYWx1ZS5ydW50aW1lOiBmdWxsPXJ1bnRpbWU6IHdhbnQ9cy5hbGxvY0NvdW50PSBzZW1hUm9vdCBxdWV1ZXN0YWNrIG92ZXJmbG93c3RvcG0gc3Bpbm5pbmdzdG9yZTY0IGZhaWxlZHN5bmMuQ29uZC5XYWl0dA==a7:T554,cnVudGltZTpzdG9wbG9ja2VkbTogbG9ja2VkZyAoYXRvbWljc3RhdHVzPXVuZmluaXNoZWQgb3Blbi1jb2RlZCBkZWZlcnMgaW4gZGVmZXJyZXR1cm51bmtub3duIHJ1bm5hYmxlIGdvcm91dGluZSBkdXJpbmcgYm9vdHN0cmFwIHVzaW5nIHZhbHVlIG9idGFpbmVkIHVzaW5nIHVuZXhwb3J0ZWQgZmllbGRDcmVhdGUgYW4gTVNJIGFuZCBNU1QgZmlsZSBmb3IgQUQgZGVwbG95bWVudGFjdGl2ZSBzd2VlcGVycyBmb3VuZCBhdCBzdGFydCBvZiBtYXJrIHBoYXNlY29tcGlsZUNhbGxiYWNrOiBmbG9hdCByZXN1bHRzIG5vdCBzdXBwb3J0ZWRlbmNvZGluZyBhbHBoYWJldCBjb250YWlucyBuZXdsaW5lIGNoYXJhY3RlcmdjbWFya25ld29iamVjdCBjYWxsZWQgd2hpbGUgZG9pbmcgY2hlY2ttYXJrbXVsdDEyOGJpdFBvdzEwOiBwb3dlciBvZiAxMCBpcyBvdXQgb2YgcmFuZ2VubyBQIGF2YWlsYWJsZSwgd3JpdGUgYmFycmllcnMgYXJlIGZvcmJpZGRlbm91dCBvZiBtZW1vcnkgYWxsb2NhdGluZyBoZWFwIGFyZW5hIG1ldGFkYXRhcmVmbGVjdDogZnVuY0xheW91dCB3aXRoIGludGVyZmFjZSByZWNlaXZlciByZWZsZWN0OiBzbGljZSBsZW5ndGggb3V0IG9mIHJhbmdlIGluIFNldExlbnNwYW4gb24gdXNlckFyZW5hLmZhdWx0TGlzdCBoYXMgaW52YWxpZCBzaXpldW5zYWZlLlNsaWNlOiBwdHIgaXMgbmlsIGFuZCBsZW4gaXMgbm90IHplcm9jYW5ub3Qgc2VuZCBhZnRlciB0cmFuc3BvcnQgZW5kcG9pbnQgc2h1dGRvd25leGl0c3lzY2FsbDogc3lzY2FsbCBmcmFtZSBpcyBubyBsb25nZXIgdmFsaWRwcm9kdWNlZCBhIHRyaWdnZXIgZ3JlYXRlciB0aGFuIHRoZSBoZWFwIGdvYWxyZWZsZWN0OiBpbnRlcm5hbCBlcnJvcjogaW52YWxpZCBtZXRob2QgaW5kZXhydW50aW1lLm1pbml0OiBkdXBsaWNhdGVoYW5kbGUgZmFpbGVkOyBlcnJubz1ydW50aW1lOiBDcmVhdGVXYWl0YWJsZVRpbWVyRXggZmFpbGVkOyBlcnJubz1ydW50aW1lOiBmYWlsZWQgbVNwYW5MaXN0LnJlbW92ZSBzcGFuLm5wYWdlcz10cmFuc2l0a8:T558,cnVudGltZTpzdG9wbG9ja2VkbTogbG9ja2VkZyAoYXRvbWljc3RhdHVzPXVuZmluaXNoZWQgb3Blbi1jb2RlZCBkZWZlcnMgaW4gZGVmZXJyZXR1cm51bmtub3duIHJ1bm5hYmxlIGdvcm91dGluZSBkdXJpbmcgYm9vdHN0cmFwIHVzaW5nIHZhbHVlIG9idGFpbmVkIHVzaW5nIHVuZXhwb3J0ZWQgZmllbGRDcmVhdGUgYW4gTVNJIGFuZCBNU1QgZmlsZSBmb3IgQUQgZGVwbG95bWVudGFjdGl2ZSBzd2VlcGVycyBmb3VuZCBhdCBzdGFydCBvZiBtYXJrIHBoYXNlY29tcGlsZUNhbGxiYWNrOiBmbG9hdCByZXN1bHRzIG5vdCBzdXBwb3J0ZWRlbmNvZGluZyBhbHBoYWJldCBjb250YWlucyBuZXdsaW5lIGNoYXJhY3RlcmdjbWFya25ld29iamVjdCBjYWxsZWQgd2hpbGUgZG9pbmcgY2hlY2ttYXJrbXVsdDEyOGJpdFBvdzEwOiBwb3dlciBvZiAxMCBpcyBvdXQgb2YgcmFuZ2VubyBQIGF2YWlsYWJsZSwgd3JpdGUgYmFycmllcnMgYXJlIGZvcmJpZGRlbm91dCBvZiBtZW1vcnkgYWxsb2NhdGluZyBoZWFwIGFyZW5hIG1ldGFkYXRhcmVmbGVjdDogZnVuY0xheW91dCB3aXRoIGludGVyZmFjZSByZWNlaXZlciByZWZsZWN0OiBzbGljZSBsZW5ndGggb3V0IG9mIHJhbmdlIGluIFNldExlbnNwYW4gb24gdXNlckFyZW5hLmZhdWx0TGlzdCBoYXMgaW52YWxpZCBzaXpldW5zYWZlLlNsaWNlOiBwdHIgaXMgbmlsIGFuZCBsZW4gaXMgbm90IHplcm9jYW5ub3Qgc2VuZCBhZnRlciB0cmFuc3BvcnQgZW5kcG9pbnQgc2h1dGRvd25leGl0c3lzY2FsbDogc3lzY2FsbCBmcmFtZSBpcyBubyBsb25nZXIgdmFsaWRwcm9kdWNlZCBhIHRyaWdnZXIgZ3JlYXRlciB0aGFuIHRoZSBoZWFwIGdvYWxyZWZsZWN0OiBpbnRlcm5hbCBlcnJvcjogaW52YWxpZCBtZXRob2QgaW5kZXhydW50aW1lLm1pbml0OiBkdXBsaWNhdGVoYW5kbGUgZmFpbGVkOyBlcnJubz1ydW50aW1lOiBDcmVhdGVXYWl0YWJsZVRpbWVyRXggZmFpbGVkOyBlcnJubz1ydW50aW1lOiBmYWlsZWQgbVNwYW5MaXN0LnJlbW92ZSBzcGFuLm5wYWdlcz10cmFuc2l0aQ==a9:T554,U0EgRWFzdGVybiBTdGFuZGFyZCBUaW1lU0EgUGFjaWZpYyBTdGFuZGFyZCBUaW1lU0EgV2VzdGVybiBTdGFuZGFyZCBUaW1lVVMgRWFzdGVybiBTdGFuZGFyZCBUaW1lYmFkIGRlZmVyIGVudHJ5IGluIHBhbmljYnlwYXNzZWQgcmVjb3ZlcnkgZmFpbGVkY2FuJ3Qgc2NhbiBvdXIgb3duIHN0YWNrY29ubmVjdGlvbiByZXNldCBieSBwZWVyZG91YmxlIHRyYWNlR0NTd2VlcFN0YXJ0ZnVuY3Rpb24gbm90IGltcGxlbWVudGVkZ2NEcmFpbk4gcGhhc2UgaW5jb3JyZWN0aGFzaCBvZiB1bmhhc2hhYmxlIHR5cGUganNvbjogdW5zdXBwb3J0ZWQgdHlwZTogbGV2ZWwgMiBub3Qgc3luY2hyb25pemVkbGluayBudW1iZXIgb3V0IG9mIHJhbmdlbm90IHN1cHBvcnRlZCBieSB3aW5kb3dzb3V0IG9mIHN0cmVhbXMgcmVzb3VyY2VzcGFnZUFsbG9jOiBvdXQgb2YgbWVtb3J5cXVldWVmaW5hbGl6ZXIgZHVyaW5nIEdDcmFuZ2UgcGFydGlhbGx5IG92ZXJsYXBzcnVucXN0ZWFsOiBydW5xIG92ZXJmbG93cnVudGltZTogVmlydHVhbEZyZWUgb2YgcnVudGltZTogZm91bmQgb2JqIGF0ICoocnVudGltZTogbWFya3Jvb3QgaW5kZXggcnVudGltZTogcC5zZWFyY2hBZGRyID0gc3BhbiBoYXMgbm8gZnJlZSBvYmplY3Rzc3RhY2sgdHJhY2UgdW5hdmFpbGFibGVzdHJ1Y3R1cmUgbmVlZHMgY2xlYW5pbmd1cGRhdGUgZHVyaW5nIHRyYW5zaXRpb24gYnl0ZXMgZmFpbGVkIHdpdGggZXJybm89IHRvIHVudXNlZCByZWdpb24gb2Ygc3BhbjIwMDYtMDEtMDJUMTU6MDQ6MDVaMDc6MDAyOTEwMzgzMDQ1NjczMzcwMzYxMzI4MTI1QVVTIENlbnRyYWwgU3RhbmRhcmQgVGltZUFVUyBFYXN0ZXJuIFN0YW5kYXJkIFRpbWVBZmdoYW5pc3RhbiBTdGFuZGFyZCBUaW1lRXJyb3IgY2xvc2luZyB0bXBGaWxlOiAldkVycm9yIGdldHRpbmcgZXhlUGF0aDogJXZFcnJvciBvcGVuaW5nIGxvZ2ZpbGU6ICV2RXJyb3Igd3JpdGluZyB0bXBGaWxlOiAldkV4cGFuZEVudmlyb25tZW50U3RyaW5nc1dGbGVldERlY2sgQWdlbnQgSW5zdGFsbGVyR08=aa:T554,U0EgRWFzdGVybiBTdGFuZGFyZCBUaW1lU0EgUGFjaWZpYyBTdGFuZGFyZCBUaW1lU0EgV2VzdGVybiBTdGFuZGFyZCBUaW1lVVMgRWFzdGVybiBTdGFuZGFyZCBUaW1lYmFkIGRlZmVyIGVudHJ5IGluIHBhbmljYnlwYXNzZWQgcmVjb3ZlcnkgZmFpbGVkY2FuJ3Qgc2NhbiBvdXIgb3duIHN0YWNrY29ubmVjdGlvbiByZXNldCBieSBwZWVyZG91YmxlIHRyYWNlR0NTd2VlcFN0YXJ0ZnVuY3Rpb24gbm90IGltcGxlbWVudGVkZ2NEcmFpbk4gcGhhc2UgaW5jb3JyZWN0aGFzaCBvZiB1bmhhc2hhYmxlIHR5cGUganNvbjogdW5zdXBwb3J0ZWQgdHlwZTogbGV2ZWwgMiBub3Qgc3luY2hyb25pemVkbGluayBudW1iZXIgb3V0IG9mIHJhbmdlbm90IHN1cHBvcnRlZCBieSB3aW5kb3dzb3V0IG9mIHN0cmVhbXMgcmVzb3VyY2VzcGFnZUFsbG9jOiBvdXQgb2YgbWVtb3J5cXVldWVmaW5hbGl6ZXIgZHVyaW5nIEdDcmFuZ2UgcGFydGlhbGx5IG92ZXJsYXBzcnVucXN0ZWFsOiBydW5xIG92ZXJmbG93cnVudGltZTogVmlydHVhbEZyZWUgb2YgcnVudGltZTogZm91bmQgb2JqIGF0ICoocnVudGltZTogbWFya3Jvb3QgaW5kZXggcnVudGltZTogcC5zZWFyY2hBZGRyID0gc3BhbiBoYXMgbm8gZnJlZSBvYmplY3Rzc3RhY2sgdHJhY2UgdW5hdmFpbGFibGVzdHJ1Y3R1cmUgbmVlZHMgY2xlYW5pbmd1cGRhdGUgZHVyaW5nIHRyYW5zaXRpb24gYnl0ZXMgZmFpbGVkIHdpdGggZXJybm89IHRvIHVudXNlZCByZWdpb24gb2Ygc3BhbjIwMDYtMDEtMDJUMTU6MDQ6MDVaMDc6MDAyOTEwMzgzMDQ1NjczMzcwMzYxMzI4MTI1QVVTIENlbnRyYWwgU3RhbmRhcmQgVGltZUFVUyBFYXN0ZXJuIFN0YW5kYXJkIFRpbWVBZmdoYW5pc3RhbiBTdGFuZGFyZCBUaW1lRXJyb3IgY2xvc2luZyB0bXBGaWxlOiAldkVycm9yIGdldHRpbmcgZXhlUGF0aDogJXZFcnJvciBvcGVuaW5nIGxvZ2ZpbGU6ICV2RXJyb3Igd3JpdGluZyB0bXBGaWxlOiAldkV4cGFuZEVudmlyb25tZW50U3RyaW5nc1dGbGVldERlY2sgQWdlbnQgSW5zdGFsbGVyR09Eab:T45c,U2FpbnQgUGllcnJlIFN0YW5kYXJkIFRpbWVTZXRGaWxlSW5mb3JtYXRpb25CeUhhbmRsZVNvdXRoIEFmcmljYSBTdGFuZGFyZCBUaW1lVy4gQXVzdHJhbGlhIFN0YW5kYXJkIFRpbWVXZXN0IFBhY2lmaWMgU3RhbmRhcmQgVGltZWNvcnJ1cHRlZCBzZW1hcGhvcmUgdGlja2V0ZW5jb3VudGVyZWQgYSBjeWNsZSB2aWEgJXNlbnRlcnN5c2NhbGwgaW5jb25zaXN0ZW50IGZvckVhY2hQOiBQIGRpZCBub3QgcnVuIGZuZnJlZWRlZmVyIHdpdGggZC5mbiAhPSBuaWxpbnZhbGlkIHJlcXVlc3QgZGVzY3JpcHRvcm5hbWUgbm90IHVuaXF1ZSBvbiBuZXR3b3JrbmVnYXRpdmUgaWRsZSBtYXJrIHdvcmtlcnNubyBDU0kgc3RydWN0dXJlIGF2YWlsYWJsZW5vIG1lc3NhZ2Ugb2YgZGVzaXJlZCB0eXBlbm90ZXdha2V1cCAtIGRvdWJsZSB3YWtldXBvdXQgb2YgbWVtb3J5IChzdGFja2FsbG9jKXBlcnNpc3RlbnRhbGxvYzogc2l6ZSA9PSAwcmVmbGVjdC5WYWx1ZS5PdmVyZmxvd1VpbnRyZXF1aXJlZCBrZXkgbm90IGF2YWlsYWJsZXJ1bnRpbWU6IGJhZCBzcGFuIHMuc3RhdGU9cnVudGltZTogcGNIZWFkZXI6IG1hZ2ljPSBzaHJpbmtpbmcgc3RhY2sgaW4gbGliY2FsbHN0YXJ0bG9ja2VkbTogbG9ja2VkIHRvIG1ldW5rbm93biBBQkkgcGFyYW1ldGVyIGtpbmR1c2Ugb2YgaW52YWxpZCBzd2VlcExvY2tlcndha2VwOiBuZWdhdGl2ZSBubXNwaW5uaW5nIGlzIG5vdCBhc3NpZ25hYmxlIHRvIHR5cGUgIG5vdCBpbiBzdGFjayByb290cyByYW5nZSBbMzYzNzk3ODgwNzA5MTcxMjk1MTY2MDE1NjI1OiB1bmV4cGVjdGVkIHJldHVybiBwYyBmb3IgQWRkVmVjdG9yZWRDb250aW51ZUhhbmRsZXI=ac:T554,c2VHZW5lcmF0ZVRyYW5zZm9ybUE6ICV2RXJyb3IgcnVubmluZyBNc2lDcmVhdGVUcmFuc2Zvcm1TdW1tYXJ5SW5mbzogJXZQIGhhcyBjYWNoZWQgR0Mgd29yayBhdCBlbmQgb2YgbWFyayB0ZXJtaW5hdGlvbmF0dGVtcHRpbmcgdG8gbGluayBpbiB0b28gbWFueSBzaGFyZWQgbGlicmFyaWVzZmFpbGVkIHRvIGFjcXVpcmUgbG9jayB0byBzdGFydCBhIEdDIHRyYW5zaXRpb25maW5pc2hHQ1RyYW5zaXRpb24gY2FsbGVkIHdpdGhvdXQgc3RhcnRpbmcgb25lP2Z1bmN0aW9uIHN5bWJvbCB0YWJsZSBub3Qgc29ydGVkIGJ5IFBDIG9mZnNldDogcmFjeSBzdWRvZyBhZGp1c3RtZW50IGR1ZSB0byBwYXJraW5nIG9uIGNoYW5uZWxyZWZsZWN0LlZhbHVlLkJ5dGVzIG9mIHVuYWRkcmVzc2FibGUgYnl0ZSBhcnJheXJ1bnRpbWU6IENyZWF0ZUlvQ29tcGxldGlvblBvcnQgZmFpbGVkIChlcnJubz0gc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOjoleF0gd2l0aCBsZW5ndGggJXl0cmllZCB0byBzbGVlcCBzY2F2ZW5nZXIgZnJvbSBhbm90aGVyIGdvcm91dGluZUNyZWF0ZVdhaXRhYmxlVGltZXJFeCB3aGVuIGNyZWF0aW5nIHRpbWVyIGZhaWxlZEVycm9yIGNhbGxpbmcgTXNpQ3JlYXRlVHJhbnNmb3JtU3VtbWFyeUluZm9BOiAldmNvdWxkIG5vdCBmaW5kIEdldFN5c3RlbVRpbWVBc0ZpbGVUaW1lKCkgc3lzY2FsbG5vdCBlbm91Z2ggc2lnbmlmaWNhbnQgYml0cyBhZnRlciBtdWx0NjRiaXRQb3cxMHJ1bnRpbWUucHJlZW1wdE06IGR1cGxpY2F0ZWhhbmRsZSBmYWlsZWQ7IGVycm5vPXJ1bnRpbWU6IHdhaXRmb3JzaW5nbGVvYmplY3QgdW5leHBlY3RlZDsgcmVzdWx0PXJ1bnRpbWU6IHdhaXRmb3JzaW5nbGVvYmplY3Qgd2FpdF9mYWlsZWQ7IGVycm5vPXNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzoleF0gd2l0aCBjYXBhY2l0eSAleXN0cmNvbnY6IGlsbGVnYWwgQXBwZW5kRmxvYXQvRm9ybWF0RmxvYXQgYml0U2l6ZWNhc2dzdGF0dXM6IHdhaXRpbmcgZm9yIEd3YWl0aW5nIGJ1dCBpcyBHcnVubmFibGVkad:T558,c2VHZW5lcmF0ZVRyYW5zZm9ybUE6ICV2RXJyb3IgcnVubmluZyBNc2lDcmVhdGVUcmFuc2Zvcm1TdW1tYXJ5SW5mbzogJXZQIGhhcyBjYWNoZWQgR0Mgd29yayBhdCBlbmQgb2YgbWFyayB0ZXJtaW5hdGlvbmF0dGVtcHRpbmcgdG8gbGluayBpbiB0b28gbWFueSBzaGFyZWQgbGlicmFyaWVzZmFpbGVkIHRvIGFjcXVpcmUgbG9jayB0byBzdGFydCBhIEdDIHRyYW5zaXRpb25maW5pc2hHQ1RyYW5zaXRpb24gY2FsbGVkIHdpdGhvdXQgc3RhcnRpbmcgb25lP2Z1bmN0aW9uIHN5bWJvbCB0YWJsZSBub3Qgc29ydGVkIGJ5IFBDIG9mZnNldDogcmFjeSBzdWRvZyBhZGp1c3RtZW50IGR1ZSB0byBwYXJraW5nIG9uIGNoYW5uZWxyZWZsZWN0LlZhbHVlLkJ5dGVzIG9mIHVuYWRkcmVzc2FibGUgYnl0ZSBhcnJheXJ1bnRpbWU6IENyZWF0ZUlvQ29tcGxldGlvblBvcnQgZmFpbGVkIChlcnJubz0gc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOjoleF0gd2l0aCBsZW5ndGggJXl0cmllZCB0byBzbGVlcCBzY2F2ZW5nZXIgZnJvbSBhbm90aGVyIGdvcm91dGluZUNyZWF0ZVdhaXRhYmxlVGltZXJFeCB3aGVuIGNyZWF0aW5nIHRpbWVyIGZhaWxlZEVycm9yIGNhbGxpbmcgTXNpQ3JlYXRlVHJhbnNmb3JtU3VtbWFyeUluZm9BOiAldmNvdWxkIG5vdCBmaW5kIEdldFN5c3RlbVRpbWVBc0ZpbGVUaW1lKCkgc3lzY2FsbG5vdCBlbm91Z2ggc2lnbmlmaWNhbnQgYml0cyBhZnRlciBtdWx0NjRiaXRQb3cxMHJ1bnRpbWUucHJlZW1wdE06IGR1cGxpY2F0ZWhhbmRsZSBmYWlsZWQ7IGVycm5vPXJ1bnRpbWU6IHdhaXRmb3JzaW5nbGVvYmplY3QgdW5leHBlY3RlZDsgcmVzdWx0PXJ1bnRpbWU6IHdhaXRmb3JzaW5nbGVvYmplY3Qgd2FpdF9mYWlsZWQ7IGVycm5vPXNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzoleF0gd2l0aCBjYXBhY2l0eSAleXN0cmNvbnY6IGlsbGVnYWwgQXBwZW5kRmxvYXQvRm9ybWF0RmxvYXQgYml0U2l6ZWNhc2dzdGF0dXM6IHdhaXRpbmcgZm9yIEd3YWl0aW5nIGJ1dCBpcyBHcnVubmFibGVkZQ==ae:T554,c2xpY2VydW50aW1lLlNldEZpbmFsaXplcjogZmlyc3QgYXJndW1lbnQgaXMgcnVudGltZS5wcmVlbXB0TTogZHVwbGljYXRlaGFuZGxlIGZhaWxlZHJ1bnRpbWU6IFN5c2NhbGxOIGhhcyB0b28gbWFueSBhcmd1bWVudHNydW50aW1lOiBvdXQgb2YgbWVtb3J5OiBjYW5ub3QgYWxsb2NhdGUgcnVudGltZTogdHlwZUJpdHNCdWxrQmFycmllciB3aXRoIHR5cGUgIHJ5dUZ0b2FGaXhlZDMyIGNhbGxlZCB3aXRoIG5lZ2F0aXZlIHByZWMzNDY5NDQ2OTUxOTUzNjE0MTg4ODIzODQ4OTYyNzgzODEzNDc2NTYyNU1hcEl0ZXIuTmV4dCBjYWxsZWQgb24gZXhoYXVzdGVkIGl0ZXJhdG9yYXR0ZW1wdGVkIHRvIGFkZCB6ZXJvLXNpemVkIGFkZHJlc3MgcmFuZ2ViaW5hcnk6IHZhcmludCBvdmVyZmxvd3MgYSA2NC1iaXQgaW50ZWdlcmNhbid0IGNhbGwgcG9pbnRlciBvbiBhIG5vbi1wb2ludGVyIFZhbHVlZ2NTd2VlcCBiZWluZyBkb25lIGJ1dCBwaGFzZSBpcyBub3QgR0NvZmZtaGVhcC5mcmVlU3BhbkxvY2tlZCAtIGludmFsaWQgc3BhbiBzdGF0ZW1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBzdGFjayBmcmVlb2JqZWN0cyBhZGRlZCBvdXQgb2Ygb3JkZXIgb3Igb3ZlcmxhcHBpbmdyZWZsZWN0LlZhbHVlLkFkZHIgb2YgdW5hZGRyZXNzYWJsZSB2YWx1ZXJ1bnRpbWUuU2V0RmluYWxpemVyOiBzZWNvbmQgYXJndW1lbnQgaXMgcnVudGltZTogYmxvY2tlZCByZWFkIG9uIGNsb3NpbmcgcG9sbGRlc2NydW50aW1lOiB0eXBlQml0c0J1bGtCYXJyaWVyIHdpdGhvdXQgdHlwZXN0b3BUaGVXb3JsZDogbm90IHN0b3BwZWQgKHN0b3B3YWl0ICE9IDApc3RyY29udjogaWxsZWdhbCBBcHBlbmRJbnQvRm9ybWF0SW50IGJhc2V1bmV4cGVjdGVkIGNhbGwgdG8gb3MuRXhpdCgwKSBkdXJpbmcgdGVzdDE3MzQ3MjM0NzU5NzY4MDcwOTQ0MTE5MjQ0ODEzOTE5MDY3MzgyODEyNTg2NzM2MTczNzk4ODQwMzU0NzIwNTk2MjI0MDY5NTk1MzM2OTE0MDYyNU1hcEl0ZXIuVmFsdWUgY2FsbGVkIG9uIGV4aGF1c3RlZCBpdGVyaf:T558,c2xpY2VydW50aW1lLlNldEZpbmFsaXplcjogZmlyc3QgYXJndW1lbnQgaXMgcnVudGltZS5wcmVlbXB0TTogZHVwbGljYXRlaGFuZGxlIGZhaWxlZHJ1bnRpbWU6IFN5c2NhbGxOIGhhcyB0b28gbWFueSBhcmd1bWVudHNydW50aW1lOiBvdXQgb2YgbWVtb3J5OiBjYW5ub3QgYWxsb2NhdGUgcnVudGltZTogdHlwZUJpdHNCdWxrQmFycmllciB3aXRoIHR5cGUgIHJ5dUZ0b2FGaXhlZDMyIGNhbGxlZCB3aXRoIG5lZ2F0aXZlIHByZWMzNDY5NDQ2OTUxOTUzNjE0MTg4ODIzODQ4OTYyNzgzODEzNDc2NTYyNU1hcEl0ZXIuTmV4dCBjYWxsZWQgb24gZXhoYXVzdGVkIGl0ZXJhdG9yYXR0ZW1wdGVkIHRvIGFkZCB6ZXJvLXNpemVkIGFkZHJlc3MgcmFuZ2ViaW5hcnk6IHZhcmludCBvdmVyZmxvd3MgYSA2NC1iaXQgaW50ZWdlcmNhbid0IGNhbGwgcG9pbnRlciBvbiBhIG5vbi1wb2ludGVyIFZhbHVlZ2NTd2VlcCBiZWluZyBkb25lIGJ1dCBwaGFzZSBpcyBub3QgR0NvZmZtaGVhcC5mcmVlU3BhbkxvY2tlZCAtIGludmFsaWQgc3BhbiBzdGF0ZW1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBzdGFjayBmcmVlb2JqZWN0cyBhZGRlZCBvdXQgb2Ygb3JkZXIgb3Igb3ZlcmxhcHBpbmdyZWZsZWN0LlZhbHVlLkFkZHIgb2YgdW5hZGRyZXNzYWJsZSB2YWx1ZXJ1bnRpbWUuU2V0RmluYWxpemVyOiBzZWNvbmQgYXJndW1lbnQgaXMgcnVudGltZTogYmxvY2tlZCByZWFkIG9uIGNsb3NpbmcgcG9sbGRlc2NydW50aW1lOiB0eXBlQml0c0J1bGtCYXJyaWVyIHdpdGhvdXQgdHlwZXN0b3BUaGVXb3JsZDogbm90IHN0b3BwZWQgKHN0b3B3YWl0ICE9IDApc3RyY29udjogaWxsZWdhbCBBcHBlbmRJbnQvRm9ybWF0SW50IGJhc2V1bmV4cGVjdGVkIGNhbGwgdG8gb3MuRXhpdCgwKSBkdXJpbmcgdGVzdDE3MzQ3MjM0NzU5NzY4MDcwOTQ0MTE5MjQ0ODEzOTE5MDY3MzgyODEyNTg2NzM2MTczNzk4ODQwMzU0NzIwNTk2MjI0MDY5NTk1MzM2OTE0MDYyNU1hcEl0ZXIuVmFsdWUgY2FsbGVkIG9uIGV4aGF1c3RlZCBpdGVyYQ==b0:T558,c3VsdGpzb246IGludmFsaWQgbnVtYmVyIGxpdGVyYWwsIHRyeWluZyB0byB1bm1hcnNoYWwgJXEgaW50byBOdW1iZXJydW50aW1lLlNldEZpbmFsaXplcjogZmlyc3QgYXJndW1lbnQgd2FzIGFsbG9jYXRlZCBpbnRvIGFuIGFyZW5hcnVudGltZS5TZXRGaW5hbGl6ZXI6IHBvaW50ZXIgbm90IGF0IGJlZ2lubmluZyBvZiBhbGxvY2F0ZWQgYmxvY2t1c2VyIGFyZW5hIGNodW5rIHNpemUgaXMgbm90IGEgbXV0bGlwbGUgb2YgdGhlIHBoeXNpY2FsIHBhZ2Ugc2l6ZXJlZmxlY3Q6IHJlZmxlY3QuVmFsdWUuVW5zYWZlUG9pbnRlciBvbiBhbiBpbnZhbGlkIG5vdGluaGVhcCBwb2ludGVyYnl0ZXMuQnVmZmVyOiBVbnJlYWRCeXRlOiBwcmV2aW91cyBvcGVyYXRpb24gd2FzIG5vdCBhIHN1Y2Nlc3NmdWwgcmVhZGpzb246IGludmFsaWQgdXNlIG9mICxzdHJpbmcgc3RydWN0IHRhZywgdHJ5aW5nIHRvIHVubWFyc2hhbCAlcSBpbnRvICV2dG9vIG1hbnkgY29uY3VycmVudCBvcGVyYXRpb25zIG9uIGEgc2luZ2xlIGZpbGUgb3Igc29ja2V0IChtYXggMTA0ODU3NSlNYXBJdGVyLk5leHQgY2FsbGVkIG9uIGFuIGl0ZXJhdG9yIHRoYXQgZG9lcyBub3QgaGF2ZSBhbiBhc3NvY2lhdGVkIG1hcCBWYWx1ZWNhbm5vdCBjb252ZXJ0IHNsaWNlIHdpdGggbGVuZ3RoICV5IHRvIGFycmF5IG9yIHBvaW50ZXIgdG8gYXJyYXkgd2l0aCBsZW5ndGggJXhRdWVyeVBlcmZvcm1hbmNlRnJlcXVlbmN5IHN5c2NhbGwgcmV0dXJuZWQgemVybywgcnVubmluZyBvbiB1bnN1cHBvcnRlZCBoYXJkd2FyZWpzb246IGludmFsaWQgdXNlIG9mICxzdHJpbmcgc3RydWN0IHRhZywgdHJ5aW5nIHRvIHVubWFyc2hhbCB1bnF1b3RlZCB2YWx1ZSBpbnRvICV2cmVmbGVjdC5WYWx1ZS5JbnRlcmZhY2U6IGNhbm5vdCByZXR1cm4gdmFsdWUgb2J0YWluZWQgZnJvbSB1bmV4cG9ydGVkIGZpZWxkIG9yIG1ldGhvZFF1ZXJ5UGVyZm9ybWFuY2VGcmVxdWVuY3kgb3ZlcmZsb3cgMzIgYml0IGRpdmlkZXIsIGNoZWNrIG5vc3BsaXQgZGlzY3Vzc2lvbiB0bw==b1:T554,dD0lcyBmbGFnIHJlZGVmaW5lZDogJXMsIGxldmVsQml0c1tsZXZlbF0gPSAxODYyNjQ1MTQ5MjMwOTU3MDMxMjU5MzEzMjI1NzQ2MTU0Nzg1MTU2MjVBZGp1c3RUb2tlblByaXZpbGVnZXNBbGFza2FuIFN0YW5kYXJkIFRpbWVBbmF0b2xpYW5fSGllcm9nbHlwaHNBcmFiaWFuIFN0YW5kYXJkIFRpbWVCZWxhcnVzIFN0YW5kYXJkIFRpbWVDZW50cmFsIFN0YW5kYXJkIFRpbWVFYXN0ZXJuIFN0YW5kYXJkIFRpbWVFcnJvciByZWFkaW5nIGV4ZTogJXZFcnJvciB3cml0aW5nIG1zaTogJXZHZXRQcm9maWxlc0RpcmVjdG9yeVdJbnNjcmlwdGlvbmFsX1BhaGxhdmlMb29rdXBQcml2aWxlZ2VWYWx1ZVdNYWdhZGFuIFN0YW5kYXJkIFRpbWVNb3JvY2NvIFN0YW5kYXJkIFRpbWVNeWFubWFyIFN0YW5kYXJkIFRpbWVOYW1pYmlhIFN0YW5kYXJkIFRpbWVOZXRHZXRKb2luSW5mb3JtYXRpb25OZXRVc2VyR2V0TG9jYWxHcm91cHNOb3Jmb2xrIFN0YW5kYXJkIFRpbWVPdGhlcl9HcmFwaGVtZV9FeHRlbmRQYWNpZmljIFN0YW5kYXJkIFRpbWVSZWFkRGlyZWN0b3J5Q2hhbmdlc1dSb21hbmNlIFN0YW5kYXJkIFRpbWVSdXNzaWFuIFN0YW5kYXJkIFRpbWVTRSBBc2lhIFN0YW5kYXJkIFRpbWVTYXJhdG92IFN0YW5kYXJkIFRpbWVZYWt1dHNrIFN0YW5kYXJkIFRpbWVhZnRlciB0b3AtbGV2ZWwgdmFsdWVhc3luYyBzdGFjayB0b28gbGFyZ2ViYWQgdHlwZSBpbiBjb21wYXJlOiBibG9jayBkZXZpY2UgcmVxdWlyZWRjaGVja2RlYWQ6IHJ1bm5hYmxlIGdjb25jdXJyZW50IG1hcCB3cml0ZXNkZWZlciBvbiBzeXN0ZW0gc3RhY2tmaW5kcnVubmFibGU6IHdyb25nIHBmbGFnICVxIGJlZ2lucyB3aXRoIC1pbiBzdHJpbmcgZXNjYXBlIGNvZGVsaW5rIGhhcyBiZWVuIHNldmVyZWRuZWdhdGl2ZSBzaGlmdCBhbW91bnRwYWNrYWdlIG5vdCBpbnN0YWxsZWRwYW5pYyBvbiBzeXN0ZW0gc3RhY2twcmVlbXB0IGF0IHVua25vd24gcGNyZWFkLW9ubHkgZmlsZSBzeXN0ZW1yZWZsZWN0LlZhbHVlLkNvbXBsZXhyZWZsZWN0LlZhbHVlb2:T558,dD0lcyBmbGFnIHJlZGVmaW5lZDogJXMsIGxldmVsQml0c1tsZXZlbF0gPSAxODYyNjQ1MTQ5MjMwOTU3MDMxMjU5MzEzMjI1NzQ2MTU0Nzg1MTU2MjVBZGp1c3RUb2tlblByaXZpbGVnZXNBbGFza2FuIFN0YW5kYXJkIFRpbWVBbmF0b2xpYW5fSGllcm9nbHlwaHNBcmFiaWFuIFN0YW5kYXJkIFRpbWVCZWxhcnVzIFN0YW5kYXJkIFRpbWVDZW50cmFsIFN0YW5kYXJkIFRpbWVFYXN0ZXJuIFN0YW5kYXJkIFRpbWVFcnJvciByZWFkaW5nIGV4ZTogJXZFcnJvciB3cml0aW5nIG1zaTogJXZHZXRQcm9maWxlc0RpcmVjdG9yeVdJbnNjcmlwdGlvbmFsX1BhaGxhdmlMb29rdXBQcml2aWxlZ2VWYWx1ZVdNYWdhZGFuIFN0YW5kYXJkIFRpbWVNb3JvY2NvIFN0YW5kYXJkIFRpbWVNeWFubWFyIFN0YW5kYXJkIFRpbWVOYW1pYmlhIFN0YW5kYXJkIFRpbWVOZXRHZXRKb2luSW5mb3JtYXRpb25OZXRVc2VyR2V0TG9jYWxHcm91cHNOb3Jmb2xrIFN0YW5kYXJkIFRpbWVPdGhlcl9HcmFwaGVtZV9FeHRlbmRQYWNpZmljIFN0YW5kYXJkIFRpbWVSZWFkRGlyZWN0b3J5Q2hhbmdlc1dSb21hbmNlIFN0YW5kYXJkIFRpbWVSdXNzaWFuIFN0YW5kYXJkIFRpbWVTRSBBc2lhIFN0YW5kYXJkIFRpbWVTYXJhdG92IFN0YW5kYXJkIFRpbWVZYWt1dHNrIFN0YW5kYXJkIFRpbWVhZnRlciB0b3AtbGV2ZWwgdmFsdWVhc3luYyBzdGFjayB0b28gbGFyZ2ViYWQgdHlwZSBpbiBjb21wYXJlOiBibG9jayBkZXZpY2UgcmVxdWlyZWRjaGVja2RlYWQ6IHJ1bm5hYmxlIGdjb25jdXJyZW50IG1hcCB3cml0ZXNkZWZlciBvbiBzeXN0ZW0gc3RhY2tmaW5kcnVubmFibGU6IHdyb25nIHBmbGFnICVxIGJlZ2lucyB3aXRoIC1pbiBzdHJpbmcgZXNjYXBlIGNvZGVsaW5rIGhhcyBiZWVuIHNldmVyZWRuZWdhdGl2ZSBzaGlmdCBhbW91bnRwYWNrYWdlIG5vdCBpbnN0YWxsZWRwYW5pYyBvbiBzeXN0ZW0gc3RhY2twcmVlbXB0IGF0IHVua25vd24gcGNyZWFkLW9ubHkgZmlsZSBzeXN0ZW1yZWZsZWN0LlZhbHVlLkNvbXBsZXhyZWZsZWN0LlZhbHVlLg==b3:T554,dGFuZGFyZCBUaW1lV293NjREaXNhYmxlV293NjRGc1JlZGlyZWN0aW9uYWJpIG1pc21hdGNoIGRldGVjdGVkIGJldHdlZW4gYXNzaWdubWVudCB0byBlbnRyeSBpbiBuaWwgbWFwY2hlY2tkZWFkOiBpbmNvbnNpc3RlbnQgY291bnRzZmFpbGVkIHRvIGdldCBzeXN0ZW0gcGFnZSBzaXplZnJlZWRlZmVyIHdpdGggZC5fcGFuaWMgIT0gbmlsaW4gZXhwb25lbnQgb2YgbnVtZXJpYyBsaXRlcmFsaW5hcHByb3ByaWF0ZSBpb2N0bCBmb3IgZGV2aWNlaW52YWxpZCBwb2ludGVyIGZvdW5kIG9uIHN0YWNrbG9va2luZyBmb3IgYmVnaW5uaW5nIG9mIHZhbHVlbm90ZXRzbGVlcCAtIHdhaXRtIG91dCBvZiBzeW5jcHJvdG9jb2wgd3JvbmcgdHlwZSBmb3Igc29ja2V0cmVmbGVjdDogRWxlbSBvZiBpbnZhbGlkIHR5cGUgcmVmbGVjdDogTGVuIG9mIG5vbi1hcnJheSB0eXBlcmVmbGVjdDogT3V0IG9mIG5vbi1mdW5jIHR5cGUgcnVucXB1dHNsb3c6IHF1ZXVlIGlzIG5vdCBmdWxscnVudGltZTogYmFkIGcgaW4gY2dvY2FsbGJhY2tydW50aW1lOiBiYWQgcG9pbnRlciBpbiBmcmFtZSBydW50aW1lOiBmb3VuZCBpbiBvYmplY3QgYXQgKihydW50aW1lOiBpbXBvc3NpYmxlIHR5cGUga2luZCBzb2NrZXQgb3BlcmF0aW9uIG9uIG5vbi1zb2NrZXRzeW5jOiBpbmNvbnNpc3RlbnQgbXV0ZXggc3RhdGVzeW5jOiB1bmxvY2sgb2YgdW5sb2NrZWQgbXV0ZXh1bnNhZmUuU2xpY2U6IGxlbiBvdXQgb2YgcmFuZ2V5ZWFyIG91dHNpZGUgb2YgcmFuZ2UgWzAsOTk5OV0pIG5vdCBpbiB1c2FibGUgYWRkcmVzcyBzcGFjZTogLi4uYWRkaXRpb25hbCBmcmFtZXMgZWxpZGVkLi4uLmxpYiBzZWN0aW9uIGluIGEub3V0IGNvcnJ1cHRlZDExMzY4NjgzNzcyMTYxNjAyOTczOTM3OTg4MjgxMjU1Njg0MzQxODg2MDgwODAxNDg2OTY4OTk0MTQwNjI1Q2VudHJhbCBCcmF6aWxpYW4gU3RhbmRhcmQgVGltZUVycm9yIGNhbGxpbmcgTXNpVmlld01vZGlmeTogJXZNb3VudGFpbiBTdGFuZGFyZCBUaW1lIChNZXhpY28pVy4gQ2VudHJhbCBBZg==b4:T554,dGFuZGFyZCBUaW1lV293NjREaXNhYmxlV293NjRGc1JlZGlyZWN0aW9uYWJpIG1pc21hdGNoIGRldGVjdGVkIGJldHdlZW4gYXNzaWdubWVudCB0byBlbnRyeSBpbiBuaWwgbWFwY2hlY2tkZWFkOiBpbmNvbnNpc3RlbnQgY291bnRzZmFpbGVkIHRvIGdldCBzeXN0ZW0gcGFnZSBzaXplZnJlZWRlZmVyIHdpdGggZC5fcGFuaWMgIT0gbmlsaW4gZXhwb25lbnQgb2YgbnVtZXJpYyBsaXRlcmFsaW5hcHByb3ByaWF0ZSBpb2N0bCBmb3IgZGV2aWNlaW52YWxpZCBwb2ludGVyIGZvdW5kIG9uIHN0YWNrbG9va2luZyBmb3IgYmVnaW5uaW5nIG9mIHZhbHVlbm90ZXRzbGVlcCAtIHdhaXRtIG91dCBvZiBzeW5jcHJvdG9jb2wgd3JvbmcgdHlwZSBmb3Igc29ja2V0cmVmbGVjdDogRWxlbSBvZiBpbnZhbGlkIHR5cGUgcmVmbGVjdDogTGVuIG9mIG5vbi1hcnJheSB0eXBlcmVmbGVjdDogT3V0IG9mIG5vbi1mdW5jIHR5cGUgcnVucXB1dHNsb3c6IHF1ZXVlIGlzIG5vdCBmdWxscnVudGltZTogYmFkIGcgaW4gY2dvY2FsbGJhY2tydW50aW1lOiBiYWQgcG9pbnRlciBpbiBmcmFtZSBydW50aW1lOiBmb3VuZCBpbiBvYmplY3QgYXQgKihydW50aW1lOiBpbXBvc3NpYmxlIHR5cGUga2luZCBzb2NrZXQgb3BlcmF0aW9uIG9uIG5vbi1zb2NrZXRzeW5jOiBpbmNvbnNpc3RlbnQgbXV0ZXggc3RhdGVzeW5jOiB1bmxvY2sgb2YgdW5sb2NrZWQgbXV0ZXh1bnNhZmUuU2xpY2U6IGxlbiBvdXQgb2YgcmFuZ2V5ZWFyIG91dHNpZGUgb2YgcmFuZ2UgWzAsOTk5OV0pIG5vdCBpbiB1c2FibGUgYWRkcmVzcyBzcGFjZTogLi4uYWRkaXRpb25hbCBmcmFtZXMgZWxpZGVkLi4uLmxpYiBzZWN0aW9uIGluIGEub3V0IGNvcnJ1cHRlZDExMzY4NjgzNzcyMTYxNjAyOTczOTM3OTg4MjgxMjU1Njg0MzQxODg2MDgwODAxNDg2OTY4OTk0MTQwNjI1Q2VudHJhbCBCcmF6aWxpYW4gU3RhbmRhcmQgVGltZUVycm9yIGNhbGxpbmcgTXNpVmlld01vZGlmeTogJXZNb3VudGFpbiBTdGFuZGFyZCBUaW1lIChNZXhpY28pVy4gQ2VudHJhbCBBZnI=b5:T554,VGltZS5NYXJzaGFsSlNPTjogVGltZS5NYXJzaGFsVGV4dDogVmFyaWF0aW9uX1NlbGVjdG9yYWRhcHRpdmVzdGFja3N0YXJ0YmFkIG1hbnVhbEZyZWVMaXN0Y29ubmVjdGlvbiByZWZ1c2VkZWxlbSBhbGlnbiB0b28gYmlnZXhjZWVkZWQgbWF4IGRlcHRoZmlsZSBuYW1lIHRvbyBsb25nZmxhZyAlcSBjb250YWlucyA9ZmxhZyByZWRlZmluZWQ6ICVzZm9yRWFjaFA6IG5vdCBkb25lZ2FyYmFnZSBjb2xsZWN0aW9uaWRlbnRpZmllciByZW1vdmVkaW4gbnVtZXJpYyBsaXRlcmFsaW5kZXggb3V0IG9mIHJhbmdlaW5wdXQvb3V0cHV0IGVycm9yaW52YWxpZCBjaGFyYWN0ZXIgbXVsdGlob3AgYXR0ZW1wdGVkbm8gY2hpbGQgcHJvY2Vzc2Vzbm8gbG9ja3MgYXZhaWxhYmxlb3BlcmF0aW9uIGNhbmNlbGVkcmVmbGVjdC5WYWx1ZS5FbGVtcmVmbGVjdC5WYWx1ZS5UeXBlcmVmbGVjdC5WYWx1ZS5VaW50cmVmbGVjdDogWmVybyhuaWwpcnVudGltZS5zZW1hY3JlYXRlcnVudGltZS5zZW1hd2FrZXVwcnVudGltZTogICBncDogZ3A9cnVudGltZTogZ2V0ZzogIGc9cnVudGltZTogbnBhZ2VzID0gcnVudGltZTogcmFuZ2UgPSB7cnVudGltZTogdGV4dEFkZHIgc3RvcHBpbmcgdGhlIHdvcmxkc3RyZWFtcyBwaXBlIGVycm9yc3luYy5SV011dGV4LlJMb2Nrc3lzdGVtIHBhZ2Ugc2l6ZSAodHJhY2ViYWNrYW5jZXN0b3JzdXNlIG9mIGNsb3NlZCBmaWxldmFsdWUgb3V0IG9mIHJhbmdlIFtjb250cm9sbGVyIHJlc2V0XSBjYWxsZWQgdXNpbmcgbmlsICosICBnLT5hdG9taWNzdGF0dXM9LCBncC0+YXRvbWljc3RhdHVzPTE0OTAxMTYxMTkzODQ3NjU2MjU3NDUwNTgwNTk2OTIzODI4MTI1QWx0YWkgU3RhbmRhcmQgVGltZUJhaGlhIFN0YW5kYXJkIFRpbWVDYW5hZGlhbl9BYm9yaWdpbmFsQ2hpbmEgU3RhbmRhcmQgVGltZUNyZWF0ZVN5bWJvbGljTGlua1dDcnlwdFJlbGVhc2VDb250ZXh0RWd5cHQgU3RhbmRhcmQgVGltZUdDIG1hcmsgdGVybWluYXRpb25HQyB3b3JrIG5vdCBmbHVzaGVkR2V0Q3VycmVudFByb2Nlc3NJb6:T558,VGltZS5NYXJzaGFsSlNPTjogVGltZS5NYXJzaGFsVGV4dDogVmFyaWF0aW9uX1NlbGVjdG9yYWRhcHRpdmVzdGFja3N0YXJ0YmFkIG1hbnVhbEZyZWVMaXN0Y29ubmVjdGlvbiByZWZ1c2VkZWxlbSBhbGlnbiB0b28gYmlnZXhjZWVkZWQgbWF4IGRlcHRoZmlsZSBuYW1lIHRvbyBsb25nZmxhZyAlcSBjb250YWlucyA9ZmxhZyByZWRlZmluZWQ6ICVzZm9yRWFjaFA6IG5vdCBkb25lZ2FyYmFnZSBjb2xsZWN0aW9uaWRlbnRpZmllciByZW1vdmVkaW4gbnVtZXJpYyBsaXRlcmFsaW5kZXggb3V0IG9mIHJhbmdlaW5wdXQvb3V0cHV0IGVycm9yaW52YWxpZCBjaGFyYWN0ZXIgbXVsdGlob3AgYXR0ZW1wdGVkbm8gY2hpbGQgcHJvY2Vzc2Vzbm8gbG9ja3MgYXZhaWxhYmxlb3BlcmF0aW9uIGNhbmNlbGVkcmVmbGVjdC5WYWx1ZS5FbGVtcmVmbGVjdC5WYWx1ZS5UeXBlcmVmbGVjdC5WYWx1ZS5VaW50cmVmbGVjdDogWmVybyhuaWwpcnVudGltZS5zZW1hY3JlYXRlcnVudGltZS5zZW1hd2FrZXVwcnVudGltZTogICBncDogZ3A9cnVudGltZTogZ2V0ZzogIGc9cnVudGltZTogbnBhZ2VzID0gcnVudGltZTogcmFuZ2UgPSB7cnVudGltZTogdGV4dEFkZHIgc3RvcHBpbmcgdGhlIHdvcmxkc3RyZWFtcyBwaXBlIGVycm9yc3luYy5SV011dGV4LlJMb2Nrc3lzdGVtIHBhZ2Ugc2l6ZSAodHJhY2ViYWNrYW5jZXN0b3JzdXNlIG9mIGNsb3NlZCBmaWxldmFsdWUgb3V0IG9mIHJhbmdlIFtjb250cm9sbGVyIHJlc2V0XSBjYWxsZWQgdXNpbmcgbmlsICosICBnLT5hdG9taWNzdGF0dXM9LCBncC0+YXRvbWljc3RhdHVzPTE0OTAxMTYxMTkzODQ3NjU2MjU3NDUwNTgwNTk2OTIzODI4MTI1QWx0YWkgU3RhbmRhcmQgVGltZUJhaGlhIFN0YW5kYXJkIFRpbWVDYW5hZGlhbl9BYm9yaWdpbmFsQ2hpbmEgU3RhbmRhcmQgVGltZUNyZWF0ZVN5bWJvbGljTGlua1dDcnlwdFJlbGVhc2VDb250ZXh0RWd5cHQgU3RhbmRhcmQgVGltZUdDIG1hcmsgdGVybWluYXRpb25HQyB3b3JrIG5vdCBmbHVzaGVkR2V0Q3VycmVudFByb2Nlc3NJZA==b7:T554,dG9yYWNxdWlyZVN1ZG9nOiBmb3VuZCBzLmVsZW0gIT0gbmlsIGluIGNhY2hlZmF0YWwgZXJyb3I6IGNnbyBjYWxsYmFjayBiZWZvcmUgY2dvIGNhbGxsb29raW5nIGZvciBiZWdpbm5pbmcgb2Ygb2JqZWN0IGtleSBzdHJpbmdub24tZW1wdHkgbWFyayBxdWV1ZSBhZnRlciBjb25jdXJyZW50IG1hcmtvbiBhIGxvY2tlZCB0aHJlYWQgd2l0aCBubyB0ZW1wbGF0ZSB0aHJlYWRvdXQgb2YgbWVtb3J5IGFsbG9jYXRpbmcgY2hlY2ttYXJrcyBiaXRtYXBwZXJzaXN0ZW50YWxsb2M6IGFsaWduIGlzIG5vdCBhIHBvd2VyIG9mIDJyZWZsZWN0OiBjYW5ub3QgY29udmVydCBzbGljZSB3aXRoIGxlbmd0aCBydW50aW1lOiBibG9ja2VkIHdyaXRlIG9uIGNsb3NpbmcgcG9sbGRlc2Nzd2VlcDogdHJpZWQgdG8gcHJlc2VydmUgYSB1c2VyIGFyZW5hIHNwYW51bmV4cGVjdGVkIHNpZ25hbCBkdXJpbmcgcnVudGltZSBleGVjdXRpb25nY0JnTWFya1dvcmtlcjogdW5leHBlY3RlZCBnY01hcmtXb3JrZXJNb2RlZ3JldyBoZWFwLCBidXQgbm8gYWRlcXVhdGUgZnJlZSBzcGFjZSBmb3VuZGludGVycnVwdGVkIHN5c3RlbSBjYWxsIHNob3VsZCBiZSByZXN0YXJ0ZWRtZXRob2RWYWx1ZUNhbGxGcmFtZU9ianMgaXMgbm90IGluIGEgbW9kdWxlbXVsdDY0Yml0UG93MTA6IHBvd2VyIG9mIDEwIGlzIG91dCBvZiByYW5nZW11bHRpcGxlIFJlYWQgY2FsbHMgcmV0dXJuIG5vIGRhdGEgb3IgZXJyb3Jub24gaW4tdXNlIHNwYW4gZm91bmQgd2l0aCBzcGVjaWFscyBiaXQgc2V0cmVmbGVjdDogbmlsIHR5cGUgcGFzc2VkIHRvIFR5cGUuSW1wbGVtZW50c3Jvb3QgbGV2ZWwgbWF4IHBhZ2VzIGRvZXNuJ3QgZml0IGluIHN1bW1hcnlydW50aW1lLlNldEZpbmFsaXplcjogZmluYWxpemVyIGFscmVhZHkgc2V0cnVudGltZS5TZXRGaW5hbGl6ZXI6IGZpcnN0IGFyZ3VtZW50IGlzIG5pbHJ1bnRpbWU6IGNhc2Zyb21fR3NjYW5zdGF0dXMgYmFkIG9sZHZhbCBncD1ydW50aW1lOiByZWxlYXNlU3Vkb2cgd2l0aCBub24tbmlsIGdwLnBhcmE=b8:T554,dG9yYWNxdWlyZVN1ZG9nOiBmb3VuZCBzLmVsZW0gIT0gbmlsIGluIGNhY2hlZmF0YWwgZXJyb3I6IGNnbyBjYWxsYmFjayBiZWZvcmUgY2dvIGNhbGxsb29raW5nIGZvciBiZWdpbm5pbmcgb2Ygb2JqZWN0IGtleSBzdHJpbmdub24tZW1wdHkgbWFyayBxdWV1ZSBhZnRlciBjb25jdXJyZW50IG1hcmtvbiBhIGxvY2tlZCB0aHJlYWQgd2l0aCBubyB0ZW1wbGF0ZSB0aHJlYWRvdXQgb2YgbWVtb3J5IGFsbG9jYXRpbmcgY2hlY2ttYXJrcyBiaXRtYXBwZXJzaXN0ZW50YWxsb2M6IGFsaWduIGlzIG5vdCBhIHBvd2VyIG9mIDJyZWZsZWN0OiBjYW5ub3QgY29udmVydCBzbGljZSB3aXRoIGxlbmd0aCBydW50aW1lOiBibG9ja2VkIHdyaXRlIG9uIGNsb3NpbmcgcG9sbGRlc2Nzd2VlcDogdHJpZWQgdG8gcHJlc2VydmUgYSB1c2VyIGFyZW5hIHNwYW51bmV4cGVjdGVkIHNpZ25hbCBkdXJpbmcgcnVudGltZSBleGVjdXRpb25nY0JnTWFya1dvcmtlcjogdW5leHBlY3RlZCBnY01hcmtXb3JrZXJNb2RlZ3JldyBoZWFwLCBidXQgbm8gYWRlcXVhdGUgZnJlZSBzcGFjZSBmb3VuZGludGVycnVwdGVkIHN5c3RlbSBjYWxsIHNob3VsZCBiZSByZXN0YXJ0ZWRtZXRob2RWYWx1ZUNhbGxGcmFtZU9ianMgaXMgbm90IGluIGEgbW9kdWxlbXVsdDY0Yml0UG93MTA6IHBvd2VyIG9mIDEwIGlzIG91dCBvZiByYW5nZW11bHRpcGxlIFJlYWQgY2FsbHMgcmV0dXJuIG5vIGRhdGEgb3IgZXJyb3Jub24gaW4tdXNlIHNwYW4gZm91bmQgd2l0aCBzcGVjaWFscyBiaXQgc2V0cmVmbGVjdDogbmlsIHR5cGUgcGFzc2VkIHRvIFR5cGUuSW1wbGVtZW50c3Jvb3QgbGV2ZWwgbWF4IHBhZ2VzIGRvZXNuJ3QgZml0IGluIHN1bW1hcnlydW50aW1lLlNldEZpbmFsaXplcjogZmluYWxpemVyIGFscmVhZHkgc2V0cnVudGltZS5TZXRGaW5hbGl6ZXI6IGZpcnN0IGFyZ3VtZW50IGlzIG5pbHJ1bnRpbWU6IGNhc2Zyb21fR3NjYW5zdGF0dXMgYmFkIG9sZHZhbCBncD1ydW50aW1lOiByZWxlYXNlU3Vkb2cgd2l0aCBub24tbmlsIGdwLnBhcmFtb9:T554,VFdBUkVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cVGltZSBab25lc1VuZXhwZWN0ZWQgcmV0dXJuIHZhbHVlIGZyb20gTXNpTG9jYXRlQ29tcG9uZW50OiAldi4gJXZjYXNmcm9tX0dzY2Fuc3RhdHVzOnRvcCBncC0+c3RhdHVzIGlzIG5vdCBpbiBzY2FuIHN0YXRlZ2VudHJhY2ViYWNrIGNhbGxiYWNrIGNhbm5vdCBiZSB1c2VkIHdpdGggbm9uLXplcm8gc2tpcG1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBmcmVlIG9mIHVzZXIgYXJlbmEgY2h1bmtvczogaW52YWxpZCB1c2Ugb2YgV3JpdGVBdCBvbiBmaWxlIG9wZW5lZCB3aXRoIE9fQVBQRU5EcmVmbGVjdDogaW50ZXJuYWwgZXJyb3I6IGludmFsaWQgdXNlIG9mIG1ha2VNZXRob2RWYWx1ZWZhaWxlZCB0byBhbGxvY2F0ZSBhbGlnbmVkIGhlYXAgbWVtb3J5OyB0b28gbWFueSByZXRyaWVzaW4gZ2NNYXJrIGV4cGVjdGluZyB0byBzZWUgZ2NwaGFzZSBhcyBfR0NtYXJrdGVybWluYXRpb25ub24tZW1wdHkgcG9pbnRlciBtYXAgcGFzc2VkIGZvciBub24tcG9pbnRlci1zaXplIHZhbHVlc3Byb2ZpbGVhbGxvYyBjYWxsZWQgd2l0aG91dCBhIFAgb3Igb3V0c2lkZSBib290c3RyYXBwaW5ncHRyRW5jb2Rlci5lbmNvZGUgc2hvdWxkIGhhdmUgZW1wdGllZCBwdHJTZWVuIHZpYSBkZWZlcnNzdHJpbmdzOiBpbGxlZ2FsIHVzZSBvZiBub24temVybyBCdWlsZGVyIGNvcGllZCBieSB2YWx1ZWdlbnRyYWNlYmFjayBjYW5ub3QgdHJhY2UgdXNlciBnb3JvdXRpbmUgb24gaXRzIG93biBzdGFja3J1bnRpbWU6IGNoZWNrbWFya3MgZm91bmQgdW5leHBlY3RlZCB1bm1hcmtlZCBvYmplY3Qgb2JqPXN5bmM6IFdhaXRHcm91cCBtaXN1c2U6IEFkZCBjYWxsZWQgY29uY3VycmVudGx5IHdpdGggV2FpdGpzb246IGNhbm5vdCBzZXQgZW1iZWRkZWQgcG9pbnRlciB0byB1bmV4cG9ydGVkIHN0cnVjdDogJXZFcnJvciB3aGVuIHF1ZXJ5aW5nIGZvciBwcmV2aW91c2x5IGluc3RhbGxlZCBkZXBsb3ltZW50OiAldnJlZmxlY3Q6IHJlZmxlY3Quba:T558,VFdBUkVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cVGltZSBab25lc1VuZXhwZWN0ZWQgcmV0dXJuIHZhbHVlIGZyb20gTXNpTG9jYXRlQ29tcG9uZW50OiAldi4gJXZjYXNmcm9tX0dzY2Fuc3RhdHVzOnRvcCBncC0+c3RhdHVzIGlzIG5vdCBpbiBzY2FuIHN0YXRlZ2VudHJhY2ViYWNrIGNhbGxiYWNrIGNhbm5vdCBiZSB1c2VkIHdpdGggbm9uLXplcm8gc2tpcG1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBmcmVlIG9mIHVzZXIgYXJlbmEgY2h1bmtvczogaW52YWxpZCB1c2Ugb2YgV3JpdGVBdCBvbiBmaWxlIG9wZW5lZCB3aXRoIE9fQVBQRU5EcmVmbGVjdDogaW50ZXJuYWwgZXJyb3I6IGludmFsaWQgdXNlIG9mIG1ha2VNZXRob2RWYWx1ZWZhaWxlZCB0byBhbGxvY2F0ZSBhbGlnbmVkIGhlYXAgbWVtb3J5OyB0b28gbWFueSByZXRyaWVzaW4gZ2NNYXJrIGV4cGVjdGluZyB0byBzZWUgZ2NwaGFzZSBhcyBfR0NtYXJrdGVybWluYXRpb25ub24tZW1wdHkgcG9pbnRlciBtYXAgcGFzc2VkIGZvciBub24tcG9pbnRlci1zaXplIHZhbHVlc3Byb2ZpbGVhbGxvYyBjYWxsZWQgd2l0aG91dCBhIFAgb3Igb3V0c2lkZSBib290c3RyYXBwaW5ncHRyRW5jb2Rlci5lbmNvZGUgc2hvdWxkIGhhdmUgZW1wdGllZCBwdHJTZWVuIHZpYSBkZWZlcnNzdHJpbmdzOiBpbGxlZ2FsIHVzZSBvZiBub24temVybyBCdWlsZGVyIGNvcGllZCBieSB2YWx1ZWdlbnRyYWNlYmFjayBjYW5ub3QgdHJhY2UgdXNlciBnb3JvdXRpbmUgb24gaXRzIG93biBzdGFja3J1bnRpbWU6IGNoZWNrbWFya3MgZm91bmQgdW5leHBlY3RlZCB1bm1hcmtlZCBvYmplY3Qgb2JqPXN5bmM6IFdhaXRHcm91cCBtaXN1c2U6IEFkZCBjYWxsZWQgY29uY3VycmVudGx5IHdpdGggV2FpdGpzb246IGNhbm5vdCBzZXQgZW1iZWRkZWQgcG9pbnRlciB0byB1bmV4cG9ydGVkIHN0cnVjdDogJXZFcnJvciB3aGVuIHF1ZXJ5aW5nIGZvciBwcmV2aW91c2x5IGluc3RhbGxlZCBkZXBsb3ltZW50OiAldnJlZmxlY3Q6IHJlZmxlY3QuVg==bb:T554,dW5sb2NrOiBsb2NrIGNvdW50c2lnc2VuZDogaW5jb25zaXN0ZW50IHN0YXRlc3RhY2sgc2l6ZSBub3QgYSBwb3dlciBvZiAyc3RvcFRoZVdvcmxkOiBob2xkaW5nIGxvY2tzdGltZTogaW52YWxpZCBsb2NhdGlvbiBuYW1ldGltZXIgd2hlbiBtdXN0IGJlIHBvc2l0aXZldG9vIG1hbnkgY2FsbGJhY2sgZnVuY3Rpb25zd29yay5ud2FpdCB3YXMgPiB3b3JrLm5wcm9jIGFyZ3Mgc3RhY2sgbWFwIGVudHJpZXMgZm9yICEjJCUmKCkqKy0uLzo7PD0+P0BbXV5fe3x9fiAxODE4OTg5NDAzNTQ1ODU2NDc1ODMwMDc4MTI1OTA5NDk0NzAxNzcyOTI4MjM3OTE1MDM5MDYyNUF1cyBDZW50cmFsIFcuIFN0YW5kYXJkIFRpbWVDYW5hZGEgQ2VudHJhbCBTdGFuZGFyZCBUaW1lQ2VuLiBBdXN0cmFsaWEgU3RhbmRhcmQgVGltZUNlbnRyYWwgRXVyb3BlIFN0YW5kYXJkIFRpbWVDZXJ0Q3JlYXRlQ2VydGlmaWNhdGVDb250ZXh0RW5nbGlzaCBuYW1lIGZvciB0aW1lIHpvbmUgIkZpeGVkU3RhY2sgaXMgbm90IHBvd2VyLW9mLTJHZXRGaWxlSW5mb3JtYXRpb25CeUhhbmRsZUV4UHJlcGVuZGVkX0NvbmNhdGVuYXRpb25fTWFya1tvcmlnaW5hdGluZyBmcm9tIGdvcm91dGluZSBjb21wYXJpbmcgdW5jb21wYXJhYmxlIHR5cGUgZGVzdGluYXRpb24gYWRkcmVzcyByZXF1aXJlZGZhdGFsOiBtb3Jlc3RhY2sgb24gZ3NpZ25hbGZpbGUgZGVzY3JpcHRvciBpbiBiYWQgc3RhdGVmaW5kcnVubmFibGU6IG5ldHBvbGwgd2l0aCBwZm91bmQgcG9pbnRlciB0byBmcmVlIG9iamVjdGdjQmdNYXJrV29ya2VyOiBtb2RlIG5vdCBzZXRnY3N0b3BtOiBuZWdhdGl2ZSBubXNwaW5uaW5naW52YWxpZCBydW50aW1lIHN5bWJvbCB0YWJsZWpzb246IFVubWFyc2hhbChub24tcG9pbnRlciBtaGVhcC5mcmVlU3BhbkxvY2tlZCAtIHNwYW4gbWlzc2luZyBzdGFjayBpbiBzaHJpbmtzdGFja21zcGFuLnN3ZWVwOiBtIGlzIG5vdCBsb2NrZWRuZWVkIHBhZGRpbmcgaW4gYnVja2V0IChrZXkpbmV3cHJvYzE6IG5ldyBnIGlzIG5vdCBHZGVhZG5ld3A=bc:T554,dW5sb2NrOiBsb2NrIGNvdW50c2lnc2VuZDogaW5jb25zaXN0ZW50IHN0YXRlc3RhY2sgc2l6ZSBub3QgYSBwb3dlciBvZiAyc3RvcFRoZVdvcmxkOiBob2xkaW5nIGxvY2tzdGltZTogaW52YWxpZCBsb2NhdGlvbiBuYW1ldGltZXIgd2hlbiBtdXN0IGJlIHBvc2l0aXZldG9vIG1hbnkgY2FsbGJhY2sgZnVuY3Rpb25zd29yay5ud2FpdCB3YXMgPiB3b3JrLm5wcm9jIGFyZ3Mgc3RhY2sgbWFwIGVudHJpZXMgZm9yICEjJCUmKCkqKy0uLzo7PD0+P0BbXV5fe3x9fiAxODE4OTg5NDAzNTQ1ODU2NDc1ODMwMDc4MTI1OTA5NDk0NzAxNzcyOTI4MjM3OTE1MDM5MDYyNUF1cyBDZW50cmFsIFcuIFN0YW5kYXJkIFRpbWVDYW5hZGEgQ2VudHJhbCBTdGFuZGFyZCBUaW1lQ2VuLiBBdXN0cmFsaWEgU3RhbmRhcmQgVGltZUNlbnRyYWwgRXVyb3BlIFN0YW5kYXJkIFRpbWVDZXJ0Q3JlYXRlQ2VydGlmaWNhdGVDb250ZXh0RW5nbGlzaCBuYW1lIGZvciB0aW1lIHpvbmUgIkZpeGVkU3RhY2sgaXMgbm90IHBvd2VyLW9mLTJHZXRGaWxlSW5mb3JtYXRpb25CeUhhbmRsZUV4UHJlcGVuZGVkX0NvbmNhdGVuYXRpb25fTWFya1tvcmlnaW5hdGluZyBmcm9tIGdvcm91dGluZSBjb21wYXJpbmcgdW5jb21wYXJhYmxlIHR5cGUgZGVzdGluYXRpb24gYWRkcmVzcyByZXF1aXJlZGZhdGFsOiBtb3Jlc3RhY2sgb24gZ3NpZ25hbGZpbGUgZGVzY3JpcHRvciBpbiBiYWQgc3RhdGVmaW5kcnVubmFibGU6IG5ldHBvbGwgd2l0aCBwZm91bmQgcG9pbnRlciB0byBmcmVlIG9iamVjdGdjQmdNYXJrV29ya2VyOiBtb2RlIG5vdCBzZXRnY3N0b3BtOiBuZWdhdGl2ZSBubXNwaW5uaW5naW52YWxpZCBydW50aW1lIHN5bWJvbCB0YWJsZWpzb246IFVubWFyc2hhbChub24tcG9pbnRlciBtaGVhcC5mcmVlU3BhbkxvY2tlZCAtIHNwYW4gbWlzc2luZyBzdGFjayBpbiBzaHJpbmtzdGFja21zcGFuLnN3ZWVwOiBtIGlzIG5vdCBsb2NrZWRuZWVkIHBhZGRpbmcgaW4gYnVja2V0IChrZXkpbmV3cHJvYzE6IG5ldyBnIGlzIG5vdCBHZGVhZG5ld3Bybd:T550,dmVudCB0eXBlIGZvdW5kcG90ZW50aWFsbHkgb3ZlcmxhcHBpbmcgaW4tdXNlIGFsbG9jYXRpb25zIGRldGVjdGVkcnVudGltZTogbmV0cG9sbDogUG9zdFF1ZXVlZENvbXBsZXRpb25TdGF0dXMgZmFpbGVkY2FzZnJvbV9Hc2NhbnN0YXR1czogZ3AtPnN0YXR1cyBpcyBub3QgaW4gc2NhbiBzdGF0ZW1hbGxvY2djIGNhbGxlZCB3aXRob3V0IGEgUCBvciBvdXRzaWRlIGJvb3RzdHJhcHBpbmdydW50aW1lLlNldEZpbmFsaXplcjogcG9pbnRlciBub3QgaW4gYWxsb2NhdGVkIGJsb2NrcnVudGltZTogR2V0UXVldWVkQ29tcGxldGlvblN0YXR1c0V4IGZhaWxlZCAoZXJybm89IHJ1bnRpbWU6IHVzZSBvZiBGaXhBbGxvY19BbGxvYyBiZWZvcmUgRml4QWxsb2NfSW5pdHNwYW4gc2V0IGJsb2NrIHdpdGggdW5wb3BwZWQgZWxlbWVudHMgZm91bmQgaW4gcmVzZXRjb21waWxlQ2FsbGJhY2s6IGFyZ3VtZW50IHNpemUgaXMgbGFyZ2VyIHRoYW4gdWludHB0cnJlZmxlY3QuVmFsdWUuU2xpY2U6IHN0cmluZyBzbGljZSBpbmRleCBvdXQgb2YgYm91bmRzcmVmbGVjdDogbm9uLWludGVyZmFjZSB0eXBlIHBhc3NlZCB0byBUeXBlLkltcGxlbWVudHNnb3JvdXRpbmUgcnVubmluZyBvbiBvdGhlciB0aHJlYWQ7IHN0YWNrIHVuYXZhaWxhYmxlYnl0ZXMuQnVmZmVyOiByZWFkZXIgcmV0dXJuZWQgbmVnYXRpdmUgY291bnQgZnJvbSBSZWFkZ2NDb250cm9sbGVyU3RhdGUuZmluZFJ1bm5hYmxlOiBibGFja2VuaW5nIG5vdCBlbmFibGVkaW50ZXJuYWwgZXJyb3I6IHBvbGxpbmcgb24gdW5zdXBwb3J0ZWQgZGVzY3JpcHRvciB0eXBlbm8gZ29yb3V0aW5lcyAobWFpbiBjYWxsZWQgcnVudGltZS5Hb2V4aXQpIC0gZGVhZGxvY2shcGFuaWMgY2FsbGluZyBTdHJpbmcgbWV0aG9kIG9uIHplcm8gJXYgZm9yIGZsYWcgJXM6ICV2cnVudGltZTogc2lnbmFsIHJlY2VpdmVkIG9uIHRocmVhZCBub3QgY3JlYXRlZCBieSBHby4gaXMgY3VycmVudGx5IG5vdCBzdXBwb3J0ZWQgZm9yIHVzZSBpbiBzeXN0ZW0gY2FsbGJhY2tzU08=be:T550,dmVudCB0eXBlIGZvdW5kcG90ZW50aWFsbHkgb3ZlcmxhcHBpbmcgaW4tdXNlIGFsbG9jYXRpb25zIGRldGVjdGVkcnVudGltZTogbmV0cG9sbDogUG9zdFF1ZXVlZENvbXBsZXRpb25TdGF0dXMgZmFpbGVkY2FzZnJvbV9Hc2NhbnN0YXR1czogZ3AtPnN0YXR1cyBpcyBub3QgaW4gc2NhbiBzdGF0ZW1hbGxvY2djIGNhbGxlZCB3aXRob3V0IGEgUCBvciBvdXRzaWRlIGJvb3RzdHJhcHBpbmdydW50aW1lLlNldEZpbmFsaXplcjogcG9pbnRlciBub3QgaW4gYWxsb2NhdGVkIGJsb2NrcnVudGltZTogR2V0UXVldWVkQ29tcGxldGlvblN0YXR1c0V4IGZhaWxlZCAoZXJybm89IHJ1bnRpbWU6IHVzZSBvZiBGaXhBbGxvY19BbGxvYyBiZWZvcmUgRml4QWxsb2NfSW5pdHNwYW4gc2V0IGJsb2NrIHdpdGggdW5wb3BwZWQgZWxlbWVudHMgZm91bmQgaW4gcmVzZXRjb21waWxlQ2FsbGJhY2s6IGFyZ3VtZW50IHNpemUgaXMgbGFyZ2VyIHRoYW4gdWludHB0cnJlZmxlY3QuVmFsdWUuU2xpY2U6IHN0cmluZyBzbGljZSBpbmRleCBvdXQgb2YgYm91bmRzcmVmbGVjdDogbm9uLWludGVyZmFjZSB0eXBlIHBhc3NlZCB0byBUeXBlLkltcGxlbWVudHNnb3JvdXRpbmUgcnVubmluZyBvbiBvdGhlciB0aHJlYWQ7IHN0YWNrIHVuYXZhaWxhYmxlYnl0ZXMuQnVmZmVyOiByZWFkZXIgcmV0dXJuZWQgbmVnYXRpdmUgY291bnQgZnJvbSBSZWFkZ2NDb250cm9sbGVyU3RhdGUuZmluZFJ1bm5hYmxlOiBibGFja2VuaW5nIG5vdCBlbmFibGVkaW50ZXJuYWwgZXJyb3I6IHBvbGxpbmcgb24gdW5zdXBwb3J0ZWQgZGVzY3JpcHRvciB0eXBlbm8gZ29yb3V0aW5lcyAobWFpbiBjYWxsZWQgcnVudGltZS5Hb2V4aXQpIC0gZGVhZGxvY2shcGFuaWMgY2FsbGluZyBTdHJpbmcgbWV0aG9kIG9uIHplcm8gJXYgZm9yIGZsYWcgJXM6ICV2cnVudGltZTogc2lnbmFsIHJlY2VpdmVkIG9uIHRocmVhZCBub3QgY3JlYXRlZCBieSBHby4gaXMgY3VycmVudGx5IG5vdCBzdXBwb3J0ZWQgZm9yIHVzZSBpbiBzeXN0ZW0gY2FsbGJhY2tzU09Gbf:T554,V2VzdCBBc2lhIFN0YW5kYXJkIFRpbWVXZXN0IEJhbmsgU3RhbmRhcmQgVGltZSIgbm90IGZvdW5kIGluIHJlZ2lzdHJ5IiwgbWlzc2luZyBDUFUgc3VwcG9ydGJ5dGVzLkJ1ZmZlcjogdG9vIGxhcmdlY2hhbiByZWNlaXZlIChuaWwgY2hhbiljbG9zZSBvZiBjbG9zZWQgY2hhbm5lbGRldmljZSBvciByZXNvdXJjZSBidXN5ZmF0YWw6IG1vcmVzdGFjayBvbiBnMGdhcmJhZ2UgY29sbGVjdGlvbiBzY2FuZ2NEcmFpbiBwaGFzZSBpbmNvcnJlY3RpbmRleCBvdXQgb2YgcmFuZ2UgWyV4XWludGVycnVwdGVkIHN5c3RlbSBjYWxsaW52YWxpZCBtLT5sb2NrZWRJbnQgPSBqc29uOiBjYW5ub3QgdW5tYXJzaGFsIGxlZnQgb3ZlciBtYXJrcm9vdCBqb2JzbWFrZWNoYW46IGJhZCBhbGlnbm1lbnRtaXNzaW5nIHR5cGUgaW4gcnVuZmlucW5hbm90aW1lIHJldHVybmluZyB6ZXJvbm8gc3BhY2UgbGVmdCBvbiBkZXZpY2VvcGVyYXRpb24gbm90IHBlcm1pdHRlZG9wZXJhdGlvbiBub3Qgc3VwcG9ydGVkcGFuaWMgZHVyaW5nIHByZWVtcHRvZmZwcm9jcmVzaXplOiBpbnZhbGlkIGFyZ3JlZmxlY3QuVmFsdWUuSW50ZXJmYWNlcmVmbGVjdC5WYWx1ZS5OdW1NZXRob2RyZWZsZWN0Lm1ldGhvZFZhbHVlQ2FsbHJ1bnRpbWU6IGludGVybmFsIGVycm9ycnVudGltZTogbmV0cG9sbCBmYWlsZWRydW50aW1lOiBzLmFsbG9jQ291bnQ9IHMuYWxsb2NDb3VudCA+IHMubmVsZW1zc2NoZWR1bGU6IGhvbGRpbmcgbG9ja3NzaHJpbmtzdGFjayBhdCBiYWQgdGltZXNwYW4gaGFzIG5vIGZyZWUgc3RhY2tzc3RhY2sgZ3Jvd3RoIGFmdGVyIGZvcmtzeW50YXggZXJyb3IgaW4gcGF0dGVybnN5c3RlbSBodWdlIHBhZ2Ugc2l6ZSAodW5leHBlY3RlZCBtYXAga2V5IHR5cGV3b3JrLm53YWl0ID4gd29yay5ucHJvYzExNjQxNTMyMTgyNjkzNDgxNDQ1MzEyNTU4MjA3NjYwOTEzNDY3NDA3MjI2NTYyNUF6ZXJiYWlqYW4gU3RhbmRhcmQgVGltZUJhbmdsYWRlc2ggU3RhbmRhcmQgVGltZUNhcGUgVmVyZGUgU3RhbmRhcmQgVGltZUNlcnRGcg==c0:T554,V2VzdCBBc2lhIFN0YW5kYXJkIFRpbWVXZXN0IEJhbmsgU3RhbmRhcmQgVGltZSIgbm90IGZvdW5kIGluIHJlZ2lzdHJ5IiwgbWlzc2luZyBDUFUgc3VwcG9ydGJ5dGVzLkJ1ZmZlcjogdG9vIGxhcmdlY2hhbiByZWNlaXZlIChuaWwgY2hhbiljbG9zZSBvZiBjbG9zZWQgY2hhbm5lbGRldmljZSBvciByZXNvdXJjZSBidXN5ZmF0YWw6IG1vcmVzdGFjayBvbiBnMGdhcmJhZ2UgY29sbGVjdGlvbiBzY2FuZ2NEcmFpbiBwaGFzZSBpbmNvcnJlY3RpbmRleCBvdXQgb2YgcmFuZ2UgWyV4XWludGVycnVwdGVkIHN5c3RlbSBjYWxsaW52YWxpZCBtLT5sb2NrZWRJbnQgPSBqc29uOiBjYW5ub3QgdW5tYXJzaGFsIGxlZnQgb3ZlciBtYXJrcm9vdCBqb2JzbWFrZWNoYW46IGJhZCBhbGlnbm1lbnRtaXNzaW5nIHR5cGUgaW4gcnVuZmlucW5hbm90aW1lIHJldHVybmluZyB6ZXJvbm8gc3BhY2UgbGVmdCBvbiBkZXZpY2VvcGVyYXRpb24gbm90IHBlcm1pdHRlZG9wZXJhdGlvbiBub3Qgc3VwcG9ydGVkcGFuaWMgZHVyaW5nIHByZWVtcHRvZmZwcm9jcmVzaXplOiBpbnZhbGlkIGFyZ3JlZmxlY3QuVmFsdWUuSW50ZXJmYWNlcmVmbGVjdC5WYWx1ZS5OdW1NZXRob2RyZWZsZWN0Lm1ldGhvZFZhbHVlQ2FsbHJ1bnRpbWU6IGludGVybmFsIGVycm9ycnVudGltZTogbmV0cG9sbCBmYWlsZWRydW50aW1lOiBzLmFsbG9jQ291bnQ9IHMuYWxsb2NDb3VudCA+IHMubmVsZW1zc2NoZWR1bGU6IGhvbGRpbmcgbG9ja3NzaHJpbmtzdGFjayBhdCBiYWQgdGltZXNwYW4gaGFzIG5vIGZyZWUgc3RhY2tzc3RhY2sgZ3Jvd3RoIGFmdGVyIGZvcmtzeW50YXggZXJyb3IgaW4gcGF0dGVybnN5c3RlbSBodWdlIHBhZ2Ugc2l6ZSAodW5leHBlY3RlZCBtYXAga2V5IHR5cGV3b3JrLm53YWl0ID4gd29yay5ucHJvYzExNjQxNTMyMTgyNjkzNDgxNDQ1MzEyNTU4MjA3NjYwOTEzNDY3NDA3MjI2NTYyNUF6ZXJiYWlqYW4gU3RhbmRhcmQgVGltZUJhbmdsYWRlc2ggU3RhbmRhcmQgVGltZUNhcGUgVmVyZGUgU3RhbmRhcmQgVGltZUNlcnRGcmU=c1:T554,eDoleTpdc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOiV4OiV5XXRvbyBtYW55IHJlZmVyZW5jZXM6IGNhbm5vdCBzcGxpY2V1bmV4cGVjdGVkIHJ1bnRpbWUubmV0cG9sbCBlcnJvcjogMTc3NjM1NjgzOTQwMDI1MDQ2NDY3NzgxMDY2ODk0NTMxMjUyMDA2LTAxLTAyVDE1OjA0OjA1Ljk5OTk5OTk5OVowNzowMDg4ODE3ODQxOTcwMDEyNTIzMjMzODkwNTMzNDQ3MjY1NjI1U3VwcHJlc3MgYWxsIFVJIGR1cmluZyBpbnN0YWxsYXRpb25hdHRlbXB0IHRvIGNsZWFyIG5vbi1lbXB0eSBzcGFuIHNldGZpbGUgdHlwZSBkb2VzIG5vdCBzdXBwb3J0IGRlYWRsaW5lZmluZHJ1bm5hYmxlOiBuZXRwb2xsIHdpdGggc3Bpbm5pbmdncmV5b2JqZWN0OiBvYmogbm90IHBvaW50ZXItYWxpZ25lZG1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBmcmVlbWlzbWF0Y2hlZCBiZWdpbi9lbmQgb2YgYWN0aXZlU3dlZXBuZXR3b3JrIGRyb3BwZWQgY29ubmVjdGlvbiBvbiByZXNldHBlcnNpc3RlbnRhbGxvYzogYWxpZ24gaXMgdG9vIGxhcmdlcGlkbGVwdXQ6IFAgaGFzIG5vbi1lbXB0eSBydW4gcXVldWVyZWZsZWN0Lk1ha2VTbGljZSBvZiBub24tc2xpY2UgdHlwZXJ1bnRpbWU6IGNsb3NlIHBvbGxkZXNjIHcvbyB1bmJsb2NrcnVudGltZTogY3JlYXRlZXZlbnQgZmFpbGVkOyBlcnJubz1yeXVGdG9hRml4ZWQzMiBjYWxsZWQgd2l0aCBwcmVjID4gOXRyYWNlYmFjayBkaWQgbm90IHVud2luZCBjb21wbGV0ZWx5dHJhbnNwb3J0IGVuZHBvaW50IGlzIG5vdCBjb25uZWN0ZWQpIGlzIGxhcmdlciB0aGFuIG1heGltdW0gcGFnZSBzaXplICgpIGlzIG5vdCBHcnVubmFibGUgb3IgR3NjYW5ydW5uYWJsZTAxMjM0NTY3ODlhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejQ0NDA4OTIwOTg1MDA2MjYxNjE2OTQ1MjY2NzIzNjMyODEyNUVycm9yIGNhbGxpbmcgTXNpSW5zdGFsbFByb2R1Y3RBOiAldkdvIHBvaW50ZXIgc3RvcmVkIGludG8gbm9uLUdvIG1lbW9yeVVuYWJsZSB0byBkZXRlcm1pbmUgc3lzdGVtIGRpcmVjdG8=c2:T554,eDoleTpdc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOiV4OiV5XXRvbyBtYW55IHJlZmVyZW5jZXM6IGNhbm5vdCBzcGxpY2V1bmV4cGVjdGVkIHJ1bnRpbWUubmV0cG9sbCBlcnJvcjogMTc3NjM1NjgzOTQwMDI1MDQ2NDY3NzgxMDY2ODk0NTMxMjUyMDA2LTAxLTAyVDE1OjA0OjA1Ljk5OTk5OTk5OVowNzowMDg4ODE3ODQxOTcwMDEyNTIzMjMzODkwNTMzNDQ3MjY1NjI1U3VwcHJlc3MgYWxsIFVJIGR1cmluZyBpbnN0YWxsYXRpb25hdHRlbXB0IHRvIGNsZWFyIG5vbi1lbXB0eSBzcGFuIHNldGZpbGUgdHlwZSBkb2VzIG5vdCBzdXBwb3J0IGRlYWRsaW5lZmluZHJ1bm5hYmxlOiBuZXRwb2xsIHdpdGggc3Bpbm5pbmdncmV5b2JqZWN0OiBvYmogbm90IHBvaW50ZXItYWxpZ25lZG1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBmcmVlbWlzbWF0Y2hlZCBiZWdpbi9lbmQgb2YgYWN0aXZlU3dlZXBuZXR3b3JrIGRyb3BwZWQgY29ubmVjdGlvbiBvbiByZXNldHBlcnNpc3RlbnRhbGxvYzogYWxpZ24gaXMgdG9vIGxhcmdlcGlkbGVwdXQ6IFAgaGFzIG5vbi1lbXB0eSBydW4gcXVldWVyZWZsZWN0Lk1ha2VTbGljZSBvZiBub24tc2xpY2UgdHlwZXJ1bnRpbWU6IGNsb3NlIHBvbGxkZXNjIHcvbyB1bmJsb2NrcnVudGltZTogY3JlYXRlZXZlbnQgZmFpbGVkOyBlcnJubz1yeXVGdG9hRml4ZWQzMiBjYWxsZWQgd2l0aCBwcmVjID4gOXRyYWNlYmFjayBkaWQgbm90IHVud2luZCBjb21wbGV0ZWx5dHJhbnNwb3J0IGVuZHBvaW50IGlzIG5vdCBjb25uZWN0ZWQpIGlzIGxhcmdlciB0aGFuIG1heGltdW0gcGFnZSBzaXplICgpIGlzIG5vdCBHcnVubmFibGUgb3IgR3NjYW5ydW5uYWJsZTAxMjM0NTY3ODlhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejQ0NDA4OTIwOTg1MDA2MjYxNjE2OTQ1MjY2NzIzNjMyODEyNUVycm9yIGNhbGxpbmcgTXNpSW5zdGFsbFByb2R1Y3RBOiAldkdvIHBvaW50ZXIgc3RvcmVkIGludG8gbm9uLUdvIG1lbW9yeVVuYWJsZSB0byBkZXRlcm1pbmUgc3lzdGVtIGRpcmVjdG9yc3:T554,eWFjY2Vzc2VkIGRhdGEgZnJvbSBmcmVlZCB1c2VyIGFyZW5hIGFjY2Vzc2luZyBhIGNvcnJ1cHRlZCBzaGFyZWQgbGlicmFyeWludmFsaWQgYm9vbGVhbiB2YWx1ZSAlcSBmb3IgLSVzOiAldmpzb246IGVuY29kaW5nIGVycm9yIGZvciB0eXBlICVxOiAlcWtleSBzaXplIG5vdCBhIG11bHRpcGxlIG9mIGtleSBhbGlnbmxmc3RhY2sgbm9kZSBhbGxvY2F0ZWQgZnJvbSB0aGUgaGVhcG1ldGhvZCBBQkkgYW5kIHZhbHVlIEFCSSBkb24ndCBhbGlnbnJlZmxlY3Q6IE51bUZpZWxkIG9mIG5vbi1zdHJ1Y3QgdHlwZXJ1bnRpbWU6IFZpcnR1YWxRdWVyeSBmYWlsZWQ7IGVycm5vPXJ1bnRpbWU6IGJhZCBub3RpZnlMaXN0IHNpemUgLSBzeW5jPXJ1bnRpbWU6IGludmFsaWQgcGMtZW5jb2RlZCB0YWJsZSBmPXJ1bnRpbWU6IGludmFsaWQgdHlwZUJpdHNCdWxrQmFycmllcnJ1bnRpbWU6IG1hcmtlZCBmcmVlIG9iamVjdCBpbiBzcGFuIHJ1bnRpbWU6IG1jYWxsIGNhbGxlZCBvbiBtLT5nMCBzdGFja3J1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCB3YWl0bGlua3J1bnRpbWU6IHVuYmxvY2sgb24gY2xvc2luZyBwb2xsZGVzY3J1bnRpbWU6IHdyb25nIGdvcm91dGluZSBpbiBuZXdzdGFja3J5dUZ0b2FGaXhlZDY0IGNhbGxlZCB3aXRoIHByZWMgPiAxOHN0YXJ0bTogUCByZXF1aXJlZCBmb3Igc3Bpbm5pbmc9dHJ1ZXN0cmluZ3MuQnVpbGRlci5Hcm93OiBuZWdhdGl2ZSBjb3VudHN5bnRheCBlcnJvciBzY2FubmluZyBjb21wbGV4IG51bWJlcnVuY2FjaGluZyBzcGFuIGJ1dCBzLmFsbG9jQ291bnQgPT0gMHVzZXIgYXJlbmEgc3BhbiBpcyBvbiB0aGUgd3JvbmcgbGlzdCkgaXMgc21hbGxlciB0aGFuIG1pbmltdW0gcGFnZSBzaXplICgyMjIwNDQ2MDQ5MjUwMzEzMDgwODQ3MjYzMzM2MTgxNjQwNjI1RXJyb3IgY2FsbGluZyBNc2lSZWNvcmRTZXRTdHJpbmdBOiAldl9jZ29fbm90aWZ5X3J1bnRpbWVfaW5pdF9kb25lIG1pc3NpbmdhbGwgZ29yb3V0aW5lcyBhcmUgYXNsZWVwIC0gZGVhZGxvY2shYnl0ZXMuQnVmc4:T558,eWFjY2Vzc2VkIGRhdGEgZnJvbSBmcmVlZCB1c2VyIGFyZW5hIGFjY2Vzc2luZyBhIGNvcnJ1cHRlZCBzaGFyZWQgbGlicmFyeWludmFsaWQgYm9vbGVhbiB2YWx1ZSAlcSBmb3IgLSVzOiAldmpzb246IGVuY29kaW5nIGVycm9yIGZvciB0eXBlICVxOiAlcWtleSBzaXplIG5vdCBhIG11bHRpcGxlIG9mIGtleSBhbGlnbmxmc3RhY2sgbm9kZSBhbGxvY2F0ZWQgZnJvbSB0aGUgaGVhcG1ldGhvZCBBQkkgYW5kIHZhbHVlIEFCSSBkb24ndCBhbGlnbnJlZmxlY3Q6IE51bUZpZWxkIG9mIG5vbi1zdHJ1Y3QgdHlwZXJ1bnRpbWU6IFZpcnR1YWxRdWVyeSBmYWlsZWQ7IGVycm5vPXJ1bnRpbWU6IGJhZCBub3RpZnlMaXN0IHNpemUgLSBzeW5jPXJ1bnRpbWU6IGludmFsaWQgcGMtZW5jb2RlZCB0YWJsZSBmPXJ1bnRpbWU6IGludmFsaWQgdHlwZUJpdHNCdWxrQmFycmllcnJ1bnRpbWU6IG1hcmtlZCBmcmVlIG9iamVjdCBpbiBzcGFuIHJ1bnRpbWU6IG1jYWxsIGNhbGxlZCBvbiBtLT5nMCBzdGFja3J1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCB3YWl0bGlua3J1bnRpbWU6IHVuYmxvY2sgb24gY2xvc2luZyBwb2xsZGVzY3J1bnRpbWU6IHdyb25nIGdvcm91dGluZSBpbiBuZXdzdGFja3J5dUZ0b2FGaXhlZDY0IGNhbGxlZCB3aXRoIHByZWMgPiAxOHN0YXJ0bTogUCByZXF1aXJlZCBmb3Igc3Bpbm5pbmc9dHJ1ZXN0cmluZ3MuQnVpbGRlci5Hcm93OiBuZWdhdGl2ZSBjb3VudHN5bnRheCBlcnJvciBzY2FubmluZyBjb21wbGV4IG51bWJlcnVuY2FjaGluZyBzcGFuIGJ1dCBzLmFsbG9jQ291bnQgPT0gMHVzZXIgYXJlbmEgc3BhbiBpcyBvbiB0aGUgd3JvbmcgbGlzdCkgaXMgc21hbGxlciB0aGFuIG1pbmltdW0gcGFnZSBzaXplICgyMjIwNDQ2MDQ5MjUwMzEzMDgwODQ3MjYzMzM2MTgxNjQwNjI1RXJyb3IgY2FsbGluZyBNc2lSZWNvcmRTZXRTdHJpbmdBOiAldl9jZ29fbm90aWZ5X3J1bnRpbWVfaW5pdF9kb25lIG1pc3NpbmdhbGwgZ29yb3V0aW5lcyBhcmUgYXNsZWVwIC0gZGVhZGxvY2shYnl0ZXMuQnVmZg==c5:T550,IT0gIDw9PSBhcyAgYXQgIGZwPSBpcyAgbHI6IG9mICBvbiAgcGM9IHNwOiBzcD0nXCcnKSA9ICkgbT0rSW5mLUluZi5sb2cubXNpLm1zdDMxMjU6IHA9QUNEVEFDU1RBRURUQUVTVEFLRFRBS1NUQVdTVEFob21DRVNUQ2hhbURhc2hFRVNUR09HQ0p1bHlKdW5lTEVBRkxpc3VNaWFvTW9kaU5aRFROWlNUTmV3YVNBU1RTdGF0VGhhaVx1MDBtPV0gPSBdIG49YWxsZ2FsbHBhdngyYmFzZWJpbmRibWkxYm1pMmJvb2xjYWxsY2FzMWNhczJjYXMzY2FzNGNhczVjYXM2Y2hhbmRlYWRlcm1zZmlsZWZ1bmNob3VyaWRsZWludDhpdGFianNvbmtpbmRudWxsb3BlbnBpcGVyZWFkcm9vdHNicmtzc2UzdHJ1ZXVpbnQgIC0lcyAuLi4gTUIsICBhbmQgIGdvdD0gbWF4PSBtcywgIHB0ciAgdGFiPSB0b3A9Ki5tc2krMDMzMCswNDMwKzA1MzArMDU0NSswNjMwKzA4NDUrMTAzMCsxMjQ1KzEzNDUsIGZwOi0wOTMwMTU2MjU3ODEyNTxuaWw+QWRsYW1BcHJpbEJhbXVtQmF0YWtCdWhpZERvZ3JhRXJyb3JHcmVla0tobWVyTGF0aW5MaW1idUxvY2FsTHN0YXRNYXJjaE51c2h1T2doYW1Pcml5YU9zYWdlUnVuaWNTVGVybVRha3JpVGFtaWxcdTIwMl0gPSAoYXJyYXljbG9zZWRlZmVyZXhlY1JleGVjV2ZhbHNlZmF1bHRmbG9hdGdjaW5nZ3NjYW5oY2hhbmluaXQgaW50MTZpbnQzMmludDY0bWhlYXBta2Rpcm1vbnRobnRvaHNwYW5pY3NjYXYgc2NoZWRzbGVlcHNsaWNlc3NlNDFzc2U0MnNzc2Uzc3Vkb2dzd2VlcHRlc3RSdGVzdFd0cmFjZXVpbnQ4dXNhZ2V2YWx1ZXdyaXRlIEIgLT4gIFZhbHVlIGFkZHI9IGFsbG9jIGJhc2UgIGNvZGU9IGN0eHQ6IGN1cmc9IGZyZWUgIGdvaWQgIGpvYnM9IGxpc3Q9IG0tPnA9IG1heD0gIG1pbj0gIG5leHQ9IHAtPm09IHByZXY9IHNwYW49JSB1dGlsKC4uLiksIGkgPSAsIG5vdCAzOTA2MjU8LWNoYW5BcmFiaWNBdWd1c3RCcmFobWlDYXJpYW5DaGFrbWFDb21tb25Db3B0aWNGb3JtYXRGcmlkYXlHZXRBQ1BHb3RoaWNIYW5ndWxIYXRyYW5IZWJyZXdIeXBoZW5LYWl0aGlLaG9qa2lMZQ==c6:T550,IT0gIDw9PSBhcyAgYXQgIGZwPSBpcyAgbHI6IG9mICBvbiAgcGM9IHNwOiBzcD0nXCcnKSA9ICkgbT0rSW5mLUluZi5sb2cubXNpLm1zdDMxMjU6IHA9QUNEVEFDU1RBRURUQUVTVEFLRFRBS1NUQVdTVEFob21DRVNUQ2hhbURhc2hFRVNUR09HQ0p1bHlKdW5lTEVBRkxpc3VNaWFvTW9kaU5aRFROWlNUTmV3YVNBU1RTdGF0VGhhaVx1MDBtPV0gPSBdIG49YWxsZ2FsbHBhdngyYmFzZWJpbmRibWkxYm1pMmJvb2xjYWxsY2FzMWNhczJjYXMzY2FzNGNhczVjYXM2Y2hhbmRlYWRlcm1zZmlsZWZ1bmNob3VyaWRsZWludDhpdGFianNvbmtpbmRudWxsb3BlbnBpcGVyZWFkcm9vdHNicmtzc2UzdHJ1ZXVpbnQgIC0lcyAuLi4gTUIsICBhbmQgIGdvdD0gbWF4PSBtcywgIHB0ciAgdGFiPSB0b3A9Ki5tc2krMDMzMCswNDMwKzA1MzArMDU0NSswNjMwKzA4NDUrMTAzMCsxMjQ1KzEzNDUsIGZwOi0wOTMwMTU2MjU3ODEyNTxuaWw+QWRsYW1BcHJpbEJhbXVtQmF0YWtCdWhpZERvZ3JhRXJyb3JHcmVla0tobWVyTGF0aW5MaW1idUxvY2FsTHN0YXRNYXJjaE51c2h1T2doYW1Pcml5YU9zYWdlUnVuaWNTVGVybVRha3JpVGFtaWxcdTIwMl0gPSAoYXJyYXljbG9zZWRlZmVyZXhlY1JleGVjV2ZhbHNlZmF1bHRmbG9hdGdjaW5nZ3NjYW5oY2hhbmluaXQgaW50MTZpbnQzMmludDY0bWhlYXBta2Rpcm1vbnRobnRvaHNwYW5pY3NjYXYgc2NoZWRzbGVlcHNsaWNlc3NlNDFzc2U0MnNzc2Uzc3Vkb2dzd2VlcHRlc3RSdGVzdFd0cmFjZXVpbnQ4dXNhZ2V2YWx1ZXdyaXRlIEIgLT4gIFZhbHVlIGFkZHI9IGFsbG9jIGJhc2UgIGNvZGU9IGN0eHQ6IGN1cmc9IGZyZWUgIGdvaWQgIGpvYnM9IGxpc3Q9IG0tPnA9IG1heD0gIG1pbj0gIG5leHQ9IHAtPm09IHByZXY9IHNwYW49JSB1dGlsKC4uLiksIGkgPSAsIG5vdCAzOTA2MjU8LWNoYW5BcmFiaWNBdWd1c3RCcmFobWlDYXJpYW5DaGFrbWFDb21tb25Db3B0aWNGb3JtYXRGcmlkYXlHZXRBQ1BHb3RoaWNIYW5ndWxIYXRyYW5IZWJyZXdIeXBoZW5LYWl0aGlLaG9qa2lMZXA=c7:T165c,MSwiZnVzaW9uIiwiR0FDIiwwMSwiV2luUlQiLCJOb3RBcHAiLDEzLCJTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiJVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtXGU0M2RkOWM3M2FiNTYxNWU0NjFiZjUxMDljM2ZhY2Q2XFN5c3RlbS5uaS5kbGwiLDAzLCJTeXN0ZW0uQ29yZSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzY0XFN5c3RlbS5Db3JlXDBkNTliMGUyMzdkNzUxOTQxN2RlMTBjZDg0YmRhNGU3XFN5c3RlbS5Db3JlLm5pLmRsbCIsMDMsIk1pY3Jvc29mdC5Qb3dlclNoZWxsLkNvbnNvbGVIb3N0LCBWZXJzaW9uPTMuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBiMzc4ZWMwNyNcYjViYTM3ZTE1NThjZWQxNzhhOTkwMTFhMWQ2NTliNTJcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29uc29sZUhvc3QubmkuZGxsIiwwMywiU3lzdGVtLk1hbmFnZW1lbnQuQXV0b21hdGlvbiwgVmVyc2lvbj0zLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzUiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzY0XFN5c3RlbS5NYW5hYTU3ZmM4Y2MjXDZkYTAxOTEwYzI1NjIzMWQxYzUwYWQwYWFjZWU1OTQxXFN5c3RlbS5NYW5hZ2VtZW50LkF1dG9tYXRpb24ubmkuZGxsIiwwMywiU3lzdGVtLk1hbmFnZW1lbnQsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhIiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxTeXN0ZW0uTWFuYWdlbWVudFxiMjIxYWY4MTI4NWMxMzA1MzI0NjEyZTZkYzljODhmZlxTeXN0ZW0uTWFuYWdlbWVudC5uaS5kbGwiLDAzLCJTeXN0ZW0uRGlyZWN0b3J5U2VydmljZXMsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhIiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxTeXN0ZW0uRGlyZWQxM2IxOGE5I1w4YWQ0YzBhZjViM2Q1MWEwZjNhNGRhYzBkNDRkODVkNFxTeXN0ZW0uRGlyZWN0b3J5U2VydmljZXMubmkuZGxsIiwwMywiU3lzdGVtLlhtbCwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzY0XFN5c3RlbS5YbWxcNWVlMzVkZWJmYzIyZjcyN2U3MGU0NDc5ZGRjYmMwNDVcU3lzdGVtLlhtbC5uaS5kbGwiLDAzLCJTeXN0ZW0uTnVtZXJpY3MsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxTeXN0ZW0uTnVtZXJpY3NcODZjZmQ2OWNlMTI2MWJhZjQ3NDBlNzYwNmNhZGUwMTRcU3lzdGVtLk51bWVyaWNzLm5pLmRsbCIsMDMsIlN5c3RlbS5EYXRhLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkRhdGFcN2JlZDQ5YzQ2ZGU5Mjk1YTg0NTNkYjIwNWM2MGEwMjhcU3lzdGVtLkRhdGEubmkuZGxsIiwwMywiTWljcm9zb2Z0LlBvd2VyU2hlbGwuU2VjdXJpdHksIFZlcnNpb249My4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj0zMWJmMzg1NmFkMzY0ZTM1IiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxNaWNyb3NvZnQuUDZmNzkyNjI2I1w3ZmY1MTk5ZTc1N2NiOGFmOWFkOTQ5NDUzZjY5OGQwOVxNaWNyb3NvZnQuUG93ZXJTaGVsbC5TZWN1cml0eS5uaS5kbGwiLDAzLCJTeXN0ZW0uQ29uZmlndXJhdGlvbiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzY0XFN5c3RlbS5Db25maWd1cmF0aW9uXDRiZWIxZWVjYTIwYjI3ZDRiZDFiYjk4ODBmMDNjYzJhXFN5c3RlbS5Db25maWd1cmF0aW9uLm5pLmRsbCIsMDMsIlN5c3RlbS5UcmFuc2FjdGlvbnMsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxTeXN0ZW0uVHJhbnNhY3Rpb25zXDYwNDI3MmIwZmFlYzJlMDlkNTNkMzhlMDNiYzg5YzZjXFN5c3RlbS5UcmFuc2FjdGlvbnMubmkuZGxsIiwwMiwiTWljcm9zb2Z0LkFwcFYuQXBwdkNsaWVudENvbUNvbnN1bWVyLCBWZXJzaW9uPTEwLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzUiLDAzLCJNaWNyb3NvZnQuUG93ZXJTaGVsbC5Db21tYW5kcy5VdGlsaXR5LCBWZXJzaW9uPTMuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlA1MjEyMjBlYSNcZGY3ZDk0N2E5OWNiY2ZhYTcyNmIxMjc3MjZmMDU0NzZcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29tbWFuZHMuVXRpbGl0eS5uaS5kbGwiLDAzLCJTeXN0ZW0uQ29uZmlndXJhdGlvbi5JbnN0YWxsLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvbmZlNjRhOTA1MSNcMTIwYTA1MzI1NzdmODcxYzI0MTU1MDJkOWVkYWNkZDZcU3lzdGVtLkNvbmZpZ3VyYXRpb24uSW5zdGFsbC5uaS5kbGwiLDAzLCJNaWNyb3NvZnQuUG93ZXJTaGVsbC5Db21tYW5kcy5NYW5hZ2VtZW50LCBWZXJzaW9uPTMuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBhZTM0OThkOSNcZDkyMjQ0NWE4MjhiMzA5MzhjNzJkMzc1YTNiMzRhNjBcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29tbWFuZHMuTWFuYWdlbWVudC5uaS5kbGwiLDAzLCJNaWNyb3NvZnQuSUlTLlBvd2Vyc2hlbGwuQ29tbWFuZHMsIFZlcnNpb249MTAuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LkliYWFlNWVkOSNcZTg2ZjdmODM2YTA3ZjY3M2NkZWY0YzlhNGQ0YjRkODBcTWljcm9zb2Z0LklJUy5Qb3dlcnNoZWxsLkNvbW1hbmRzLm5pLmRsbCIsMDMsIk1pY3Jvc29mdC5LZXlEaXN0cmlidXRpb25TZXJ2aWNlLkNtZGxldHMsIFZlcnNpb249MTAuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LktkNTg4MjBhNSNcMDBmOWU5ZmYzMjFkOGExNDFmM2Q3MTE2M2M3MGM5MDZcTWljcm9zb2Z0LktleURpc3RyaWJ1dGlvblNlcnZpY2UuQ21kbGV0cy5uaS5kbGwiLDAzLCJNaWNyb3NvZnQuTWFuYWdlbWVudC5JbmZyYXN0cnVjdHVyZS5OYXRpdmUsIFZlcnNpb249MS4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj0zMWJmMzg1NmFkMzY0ZTM1IiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxNaWNyb3NvZnQuTTg3MGQ1NThhI1w1ZjY0ODgwYzg2Yzk4ZTdkZGVjZGYyOGU2MTkxNzMwN1xNaWNyb3NvZnQuTWFuYWdlbWVudC5JbmZyYXN0cnVjdHVyZS5OYXRpdmUubmkuZGxsIiwwc8:T554,YWx1ZS5FbGVtIG9uIGFuIGludmFsaWQgbm90aW5oZWFwIHBvaW50ZXJzeW5jOiBXYWl0R3JvdXAgaXMgcmV1c2VkIGJlZm9yZSBwcmV2aW91cyBXYWl0IGhhcyByZXR1cm5lZGFkZHIgcmFuZ2UgYmFzZSBhbmQgbGltaXQgYXJlIG5vdCBpbiB0aGUgc2FtZSBtZW1vcnkgc2VnbWVudG1hbnVhbCBzcGFuIGFsbG9jYXRpb24gY2FsbGVkIHdpdGggbm9uLW1hbnVhbGx5LW1hbmFnZWQgdHlwZXJlZmxlY3Q6IGNhbGwgb2YgcmVmbGVjdC5WYWx1ZS5MZW4gb24gcHRyIHRvIG5vbi1hcnJheSBWYWx1ZXJ1bnRpbWU6IEdldFF1ZXVlZENvbXBsZXRpb25TdGF0dXNFeCByZXR1cm5lZCBpbnZhbGlkIG1vZGU9IHJ1bnRpbWU6IG5ldHBvbGw6IFBvc3RRdWV1ZWRDb21wbGV0aW9uU3RhdHVzIGZhaWxlZCAoZXJybm89IGFiaVJlZ0FyZ3NUeXBlIG5lZWRzIEdDIFByb2csIHVwZGF0ZSBtZXRob2RWYWx1ZUNhbGxGcmFtZU9ianNmb3VuZCBiYWQgcG9pbnRlciBpbiBHbyBoZWFwIChpbmNvcnJlY3QgdXNlIG9mIHVuc2FmZSBvciBjZ28/KWxpbWl0ZXJFdmVudC5zdG9wOiBmb3VuZCB3cm9uZyBldmVudCBpbiBwJ3MgbGltaXRlciBldmVudCBzbG90cmVmbGVjdDogcmVmbGVjdC5WYWx1ZS5Qb2ludGVyIG9uIGFuIGludmFsaWQgbm90aW5oZWFwIHBvaW50ZXJydW50aW1lOiBpbnRlcm5hbCBlcnJvcjogbWlzdXNlIG9mIGxvY2tPU1RocmVhZC91bmxvY2tPU1RocmVhZG1hbGZvcm1lZCBHT01FTUxJTUlUOyBzZWUgYGdvIGRvYyBydW50aW1lL2RlYnVnLlNldE1lbW9yeUxpbWl0YEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky9BQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OS1fRHVwbGljYXRlIGRlcGxveW1lbnQgSUQgZm91bmQgd2l0aCBJRDogJXYsIHNraXBwaW5nIGluc3RhbGxhdGlvbmNvbXBpbGVDYWxsYmFjazogZXhwZWN0ZWQgZnVuY3Rpb24gd2l0aCBvbmUgdWludHB0ci1zaXplZCByc9:T558,YWx1ZS5FbGVtIG9uIGFuIGludmFsaWQgbm90aW5oZWFwIHBvaW50ZXJzeW5jOiBXYWl0R3JvdXAgaXMgcmV1c2VkIGJlZm9yZSBwcmV2aW91cyBXYWl0IGhhcyByZXR1cm5lZGFkZHIgcmFuZ2UgYmFzZSBhbmQgbGltaXQgYXJlIG5vdCBpbiB0aGUgc2FtZSBtZW1vcnkgc2VnbWVudG1hbnVhbCBzcGFuIGFsbG9jYXRpb24gY2FsbGVkIHdpdGggbm9uLW1hbnVhbGx5LW1hbmFnZWQgdHlwZXJlZmxlY3Q6IGNhbGwgb2YgcmVmbGVjdC5WYWx1ZS5MZW4gb24gcHRyIHRvIG5vbi1hcnJheSBWYWx1ZXJ1bnRpbWU6IEdldFF1ZXVlZENvbXBsZXRpb25TdGF0dXNFeCByZXR1cm5lZCBpbnZhbGlkIG1vZGU9IHJ1bnRpbWU6IG5ldHBvbGw6IFBvc3RRdWV1ZWRDb21wbGV0aW9uU3RhdHVzIGZhaWxlZCAoZXJybm89IGFiaVJlZ0FyZ3NUeXBlIG5lZWRzIEdDIFByb2csIHVwZGF0ZSBtZXRob2RWYWx1ZUNhbGxGcmFtZU9ianNmb3VuZCBiYWQgcG9pbnRlciBpbiBHbyBoZWFwIChpbmNvcnJlY3QgdXNlIG9mIHVuc2FmZSBvciBjZ28/KWxpbWl0ZXJFdmVudC5zdG9wOiBmb3VuZCB3cm9uZyBldmVudCBpbiBwJ3MgbGltaXRlciBldmVudCBzbG90cmVmbGVjdDogcmVmbGVjdC5WYWx1ZS5Qb2ludGVyIG9uIGFuIGludmFsaWQgbm90aW5oZWFwIHBvaW50ZXJydW50aW1lOiBpbnRlcm5hbCBlcnJvcjogbWlzdXNlIG9mIGxvY2tPU1RocmVhZC91bmxvY2tPU1RocmVhZG1hbGZvcm1lZCBHT01FTUxJTUlUOyBzZWUgYGdvIGRvYyBydW50aW1lL2RlYnVnLlNldE1lbW9yeUxpbWl0YEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky9BQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OS1fRHVwbGljYXRlIGRlcGxveW1lbnQgSUQgZm91bmQgd2l0aCBJRDogJXYsIHNraXBwaW5nIGluc3RhbGxhdGlvbmNvbXBpbGVDYWxsYmFjazogZXhwZWN0ZWQgZnVuY3Rpb24gd2l0aCBvbmUgdWludHB0ci1zaXplZCByZQ==ca:T554,YXVzZWQgY29ubmVjdGlvbiBhYm9ydHN3ZWVwIGluY3JlYXNlZCBhbGxvY2F0aW9uIGNvdW50c3luYzogbmVnYXRpdmUgV2FpdEdyb3VwIGNvdW50ZXJ1c2Ugb2YgY2xvc2VkIG5ldHdvcmsgY29ubmVjdGlvbiBvZiBtZXRob2Qgb24gbmlsIGludGVyZmFjZSB2YWx1ZSB0byBwb2ludGVyIHRvIGFycmF5IHdpdGggbGVuZ3RoIDE0MjEwODU0NzE1MjAyMDAzNzE3NDIyNDg1MzUxNTYyNTcxMDU0MjczNTc2MDEwMDE4NTg3MTEyNDI2NzU3ODEyNUVycm9yIGNhbGxpbmcgTXNpT3BlbkRhdGFiYXNlOiAldkVycm9yIGNyZWF0aW5nIGxvZ2ZpbGUgZm9sZGVyOiAldkVycm9yIHJ1bm5pbmcgTXNpT3BlbkRhdGFiYXNlOiAldkdPREVCVUc6IG5vIHZhbHVlIHNwZWNpZmllZCBmb3IgIkluaXRpYWxpemVQcm9jVGhyZWFkQXR0cmlidXRlTGlzdGNvbmN1cnJlbnQgbWFwIHJlYWQgYW5kIG1hcCB3cml0ZWZpbmRydW5uYWJsZTogbmVnYXRpdmUgbm1zcGlubmluZ2ZyZWVpbmcgc3RhY2sgbm90IGluIGEgc3RhY2sgc3BhbmludmFsaWQgdmFsdWUgJXEgZm9yIGZsYWcgLSVzOiAldm1pbiBtdXN0IGJlIGEgbm9uLXplcm8gcG93ZXIgb2YgMm1pc3JvdW5kZWQgYWxsb2NhdGlvbiBpbiBzeXNBbGxvY3JlZmxlY3QubmFtZUZyb206IG5hbWUgdG9vIGxvbmc6IHJlZmxlY3Q6IEZpZWxkIGluZGV4IG91dCBvZiByYW5nZXJlZmxlY3Q6IE51bU91dCBvZiBub24tZnVuYyB0eXBlIHJlZmxlY3Q6IGFycmF5IGluZGV4IG91dCBvZiByYW5nZXJlZmxlY3Q6IHNsaWNlIGluZGV4IG91dCBvZiByYW5nZXJ1bnRpbWU6IGNhc3RvZ3NjYW5zdGF0dXMgb2xkdmFsPXJ1bnRpbWU6IGZhaWxlZCBtU3Bhbkxpc3QuaW5zZXJ0IHJ1bnRpbWU6IGZhaWxlZCB0byBkZWNvbW1pdCBwYWdlc3J1bnRpbWU6IGdvcm91dGluZSBzdGFjayBleGNlZWRzIHJ1bnRpbWU6IG1lbW9yeSBhbGxvY2F0ZWQgYnkgT1MgW3J1bnRpbWU6IG5hbWUgb2Zmc2V0IG91dCBvZiByYW5nZXJ1bnRpbWU6IHRleHQgb2Zmc2V0IG91dCBvZiByYW5nZXJ1bnRpbWU6IHR5cGU=cb:T558,YXVzZWQgY29ubmVjdGlvbiBhYm9ydHN3ZWVwIGluY3JlYXNlZCBhbGxvY2F0aW9uIGNvdW50c3luYzogbmVnYXRpdmUgV2FpdEdyb3VwIGNvdW50ZXJ1c2Ugb2YgY2xvc2VkIG5ldHdvcmsgY29ubmVjdGlvbiBvZiBtZXRob2Qgb24gbmlsIGludGVyZmFjZSB2YWx1ZSB0byBwb2ludGVyIHRvIGFycmF5IHdpdGggbGVuZ3RoIDE0MjEwODU0NzE1MjAyMDAzNzE3NDIyNDg1MzUxNTYyNTcxMDU0MjczNTc2MDEwMDE4NTg3MTEyNDI2NzU3ODEyNUVycm9yIGNhbGxpbmcgTXNpT3BlbkRhdGFiYXNlOiAldkVycm9yIGNyZWF0aW5nIGxvZ2ZpbGUgZm9sZGVyOiAldkVycm9yIHJ1bm5pbmcgTXNpT3BlbkRhdGFiYXNlOiAldkdPREVCVUc6IG5vIHZhbHVlIHNwZWNpZmllZCBmb3IgIkluaXRpYWxpemVQcm9jVGhyZWFkQXR0cmlidXRlTGlzdGNvbmN1cnJlbnQgbWFwIHJlYWQgYW5kIG1hcCB3cml0ZWZpbmRydW5uYWJsZTogbmVnYXRpdmUgbm1zcGlubmluZ2ZyZWVpbmcgc3RhY2sgbm90IGluIGEgc3RhY2sgc3BhbmludmFsaWQgdmFsdWUgJXEgZm9yIGZsYWcgLSVzOiAldm1pbiBtdXN0IGJlIGEgbm9uLXplcm8gcG93ZXIgb2YgMm1pc3JvdW5kZWQgYWxsb2NhdGlvbiBpbiBzeXNBbGxvY3JlZmxlY3QubmFtZUZyb206IG5hbWUgdG9vIGxvbmc6IHJlZmxlY3Q6IEZpZWxkIGluZGV4IG91dCBvZiByYW5nZXJlZmxlY3Q6IE51bU91dCBvZiBub24tZnVuYyB0eXBlIHJlZmxlY3Q6IGFycmF5IGluZGV4IG91dCBvZiByYW5nZXJlZmxlY3Q6IHNsaWNlIGluZGV4IG91dCBvZiByYW5nZXJ1bnRpbWU6IGNhc3RvZ3NjYW5zdGF0dXMgb2xkdmFsPXJ1bnRpbWU6IGZhaWxlZCBtU3Bhbkxpc3QuaW5zZXJ0IHJ1bnRpbWU6IGZhaWxlZCB0byBkZWNvbW1pdCBwYWdlc3J1bnRpbWU6IGdvcm91dGluZSBzdGFjayBleGNlZWRzIHJ1bnRpbWU6IG1lbW9yeSBhbGxvY2F0ZWQgYnkgT1MgW3J1bnRpbWU6IG5hbWUgb2Zmc2V0IG91dCBvZiByYW5nZXJ1bnRpbWU6IHRleHQgb2Zmc2V0IG91dCBvZiByYW5nZXJ1bnRpbWU6IHR5cGUgbw==cc:T444,Q2VydEVudW1DZXJ0aWZpY2F0ZXNJblN0b3JlRWFzdGVyIElzbGFuZCBTdGFuZGFyZCBUaW1lRyB3YWl0aW5nIGxpc3QgaXMgY29ycnVwdGVkYWRkcmVzcyBub3QgYSBzdGFjayBhZGRyZXNzYWZ0ZXIgb2JqZWN0IGtleTp2YWx1ZSBwYWlyY2hhbm5lbCBudW1iZXIgb3V0IG9mIHJhbmdlY29tbXVuaWNhdGlvbiBlcnJvciBvbiBzZW5kY291bGQgbm90IGZpbmQgUVBDIHN5c2NhbGxzZmFpbGVkIHRvIHNldCBzd2VlcCBiYXJyaWVyZmxhZyBuZWVkcyBhbiBhcmd1bWVudDogLSVzZ2NzdG9wbTogbm90IHdhaXRpbmcgZm9yIGdjZ3Jvd3NsaWNlOiBsZW4gb3V0IG9mIHJhbmdlaW50ZXJuYWwgbG9ja09TVGhyZWFkIGVycm9yaW52YWxpZCBib29sZWFuIGZsYWcgJXM6ICV2aW52YWxpZCBwcm9maWxlIGJ1Y2tldCB0eXBla2V5IHdhcyByZWplY3RlZCBieSBzZXJ2aWNlbWFrZWNoYW46IHNpemUgb3V0IG9mIHJhbmdlbWFrZXNsaWNlOiBjYXAgb3V0IG9mIHJhbmdlbWFrZXNsaWNlOiBsZW4gb3V0IG9mIHJhbmdlbXNwYW4uc3dlZXA6IGJhZCBzcGFuIHN0YXRlbm90IGEgWEVOSVggbmFtZWQgdHlwZSBmaWxlcHJvZ1RvUG9pbnRlck1hc2s6IG92ZXJmbG93cmVmbGVjdC5WYWx1ZS5VbnNhZmVQb2ludGVycnVubG9jayBvZiB1bmxvY2tlZCByd211dGV4cnVudGltZTogYXN5bmNQcmVlbXB0U3RhY2s9cnVudGltZTogY2hlY2tkZWFkOiBmaW5kIGcgcnVudGltZTogY2hlY2tkZWFkOiBubWlkbGU9cnVudGltZTogY29ycnVwdGVkIHBvbGxkZXNjcnVudGltZTogbmV0cG9sbGluaXQgZmFpbGVkcnVudGltZTogdGhyZWFkIElEIG92ZXJmbG93cnVudGltZQ==cd:T468,Q3JlYXRlRGlyZWN0b3J5V0Ruc05hbWVDb21wYXJlX1dEdXBsaWNhdGVUb2tlbkV4Rmx1c2hGaWxlQnVmZmVyc0dDIHNjYXZlbmdlIHdhaXRHQyB3b3JrZXIgKGlkbGUpR09ERUJVRzogdmFsdWUgIkdldENvbXB1dGVyTmFtZVdHZXRDdXJyZW50VGhyZWFkR2V0RnVsbFBhdGhOYW1lV0dldExvbmdQYXRoTmFtZVdJbXBlcmlhbF9BcmFtYWljTWVyb2l0aWNfQ3Vyc2l2ZU1zaU9wZW5EYXRhYmFzZUFNc2lTZXRJbnRlcm5hbFVJTmV0QXBpQnVmZmVyRnJlZU9wZW5Qcm9jZXNzVG9rZW5PdGhlcl9BbHBoYWJldGljUmVnUXVlcnlJbmZvS2V5V1JlZ1F1ZXJ5VmFsdWVFeFdSZW1vdmVEaXJlY3RvcnlXU2V0RmlsZVBvaW50ZXJFeFRlcm1pbmF0ZVByb2Nlc3NaYW5hYmF6YXJfU3F1YXJlcnVudGltZSBzdGFjazphZnRlciBvYmplY3Qga2V5YmFkIGcgdHJhbnNpdGlvbmJhZCBzcGVjaWFsIGtpbmRiYWQgc3VtbWFyeSBkYXRhYmFkIHN5bWJvbCB0YWJsZWNhc3RvZ3NjYW5zdGF0dXNnYzogdW5zd2VwdCBzcGFuZ2NzaHJpbmtzdGFja29mZmludGVnZXIgb3ZlcmZsb3dpbnZhbGlkIGFyZ3VtZW50aW52YWxpZCBleGNoYW5nZWludmFsaWQgZyBzdGF0dXNtU3Bhbkxpc3QuaW5zZXJ0bVNwYW5MaXN0LnJlbW92ZW1lc3NhZ2UgdG9vIGxvbmdtaXNzaW5nIHN0YWNrbWFwbm8gcm91dGUgdG8gaG9zdG5vbi1HbyBmdW5jdGlvbm9iamVjdCBpcyByZW1vdGVyZWZsZWN0IG1pc21hdGNocmVtb3RlIEkvTyBlcnJvcnJ1bnRpbWU6IGFkZHIgPSBydW50aW1lOiBiYXNlID0gcnVudGltZTogaGVhZCA9IHJ1bnRpbWU6IG5lbGVtcz1zY2hlZHVsZTogaW4gY2dvdGltZTogYmFkIFswLTldKnRpbWVCZWdpblBlcmlvZA==ce:T554,ZCBpbmRpcmNoYW4gc2VuZGNvbXBsZXg2NGNvcHlzdGFja2N0eHQgIT0gMGZ1bmNhcmdzKGhjaGFuTGVhZmluaXR0cmFjZWludGVyZmFjZWludmFsaWQgbm1TcGFuRGVhZG50ZGxsLmRsbG9taXRlbXB0eXBhbmljd2FpdHBjbG11bHFkcXByZWVtcHRlZHByb2ZCbG9ja3BzYXBpLmRsbHJlY292ZXI6IHJlZmxlY3Q6IHJ3eHJ3eHJ3eHNjYXZ0cmFjZXN0YWNrcG9vbHRyYWNlYmFja3didWZTcGFuc30gc3RhY2s9WyBNQiBnb2FsLCAgZmx1c2hHZW4gIGZvciB0eXBlICBnZnJlZWNudD0gaGVhcEdvYWw9IHBhZ2VzIGF0ICBwdHJTaXplPSAgcnVucXNpemU9IHJ1bnF1ZXVlPSBzLmJhc2UoKT0gc3Bpbm5pbmc9IHN0b3B3YWl0PSBzd2VlcGdlbiAgc3dlZXBnZW49IHRhcmdldHBjPSB0aHJvd2luZz0gdW50aWwgcGM9JSEoTk9WRVJCKSUhV2Vla2RheSgoQkFESU5ERVgpLCBib3VuZCA9ICwgbGltaXQgPSAvZGV2L3N0ZGluMTIyMDcwMzEyNTYxMDM1MTU2MjU6IHBhcnNpbmcgQVNLRk9STkFNRUJhZCB2YXJpbnRDYW5jZWxJb0V4Q2hvcmFzbWlhbkNyZWF0ZUZpbGVDcmVhdGVQaXBlRGVwcmVjYXRlZERldmFuYWdhcmlEbnNRdWVyeV9XRXhjZXB0aW9uIEdDIGZvcmNlZEdPTUFYUFJPQ1NHT01FTUxJTUlUR2V0SWZFbnRyeUdldFZlcnNpb25HbGFnb2xpdGljS2hhcm9zaHRoaUxvY2tGaWxlRXhNYW5pY2hhZWFuT2xkX0l0YWxpY09sZF9QZXJtaWNPbGRfVHVya2ljT3RoZXJfTWF0aFBhcnNlRmxvYXRQaG9lbmljaWFuU2F1cmFzaHRyYVVzZXIzMi5kbGxXU0FDbGVhbnVwV1NBU29ja2V0V1dTQVN0YXJ0dXBhdG9taWNhbmQ4Y29tcGxleDEyOGNyZWF0ZXRlbXBkZWJ1ZyBjYWxsZG5zYXBpLmRsbGV4aXRUaHJlYWRmbG9hdDMybmFuZmxvYXQ2NG5hbmdldHNvY2tvcHRnb3JvdXRpbmUgaW52YWxpZHB0cm1TcGFuSW5Vc2Vub3RpZnlMaXN0b3duZXIgZGllZHByb2ZJbnNlcnRydW50aW1lOiBncy5zdGF0ZSA9IHNjaGVkdHJhY2VzZW1hY3F1aXJlc2V0c29ja29wdHN0YWNrTGFyZ2V0LktpbmQgPT0gdGltZS5EYXRlKHQ=cf:T554,ZCBpbmRpcmNoYW4gc2VuZGNvbXBsZXg2NGNvcHlzdGFja2N0eHQgIT0gMGZ1bmNhcmdzKGhjaGFuTGVhZmluaXR0cmFjZWludGVyZmFjZWludmFsaWQgbm1TcGFuRGVhZG50ZGxsLmRsbG9taXRlbXB0eXBhbmljd2FpdHBjbG11bHFkcXByZWVtcHRlZHByb2ZCbG9ja3BzYXBpLmRsbHJlY292ZXI6IHJlZmxlY3Q6IHJ3eHJ3eHJ3eHNjYXZ0cmFjZXN0YWNrcG9vbHRyYWNlYmFja3didWZTcGFuc30gc3RhY2s9WyBNQiBnb2FsLCAgZmx1c2hHZW4gIGZvciB0eXBlICBnZnJlZWNudD0gaGVhcEdvYWw9IHBhZ2VzIGF0ICBwdHJTaXplPSAgcnVucXNpemU9IHJ1bnF1ZXVlPSBzLmJhc2UoKT0gc3Bpbm5pbmc9IHN0b3B3YWl0PSBzd2VlcGdlbiAgc3dlZXBnZW49IHRhcmdldHBjPSB0aHJvd2luZz0gdW50aWwgcGM9JSEoTk9WRVJCKSUhV2Vla2RheSgoQkFESU5ERVgpLCBib3VuZCA9ICwgbGltaXQgPSAvZGV2L3N0ZGluMTIyMDcwMzEyNTYxMDM1MTU2MjU6IHBhcnNpbmcgQVNLRk9STkFNRUJhZCB2YXJpbnRDYW5jZWxJb0V4Q2hvcmFzbWlhbkNyZWF0ZUZpbGVDcmVhdGVQaXBlRGVwcmVjYXRlZERldmFuYWdhcmlEbnNRdWVyeV9XRXhjZXB0aW9uIEdDIGZvcmNlZEdPTUFYUFJPQ1NHT01FTUxJTUlUR2V0SWZFbnRyeUdldFZlcnNpb25HbGFnb2xpdGljS2hhcm9zaHRoaUxvY2tGaWxlRXhNYW5pY2hhZWFuT2xkX0l0YWxpY09sZF9QZXJtaWNPbGRfVHVya2ljT3RoZXJfTWF0aFBhcnNlRmxvYXRQaG9lbmljaWFuU2F1cmFzaHRyYVVzZXIzMi5kbGxXU0FDbGVhbnVwV1NBU29ja2V0V1dTQVN0YXJ0dXBhdG9taWNhbmQ4Y29tcGxleDEyOGNyZWF0ZXRlbXBkZWJ1ZyBjYWxsZG5zYXBpLmRsbGV4aXRUaHJlYWRmbG9hdDMybmFuZmxvYXQ2NG5hbmdldHNvY2tvcHRnb3JvdXRpbmUgaW52YWxpZHB0cm1TcGFuSW5Vc2Vub3RpZnlMaXN0b3duZXIgZGllZHByb2ZJbnNlcnRydW50aW1lOiBncy5zdGF0ZSA9IHNjaGVkdHJhY2VzZW1hY3F1aXJlc2V0c29ja29wdHN0YWNrTGFyZ2V0LktpbmQgPT0gdGltZS5EYXRlKHRpd0:T51c,RUJVRzogY2FuIG5vdCBlbmFibGUgIkdldEZpbmFsUGF0aE5hbWVCeUhhbmRsZVdHZXRRdWV1ZWRDb21wbGV0aW9uU3RhdHVzS2FsaW5pbmdyYWQgU3RhbmRhcmQgVGltZU1pZGRsZSBFYXN0IFN0YW5kYXJkIFRpbWVOZXcgWmVhbGFuZCBTdGFuZGFyZCBUaW1lTm9ydGggS29yZWEgU3RhbmRhcmQgVGltZVNvdXRoIFN1ZGFuIFN0YW5kYXJkIFRpbWVUcmFuc2JhaWthbCBTdGFuZGFyZCBUaW1lVVMgTW91bnRhaW4gU3RhbmRhcmQgVGltZVVsYWFuYmFhdGFyIFN0YW5kYXJkIFRpbWVVcGRhdGVQcm9jVGhyZWFkQXR0cmlidXRlVmxhZGl2b3N0b2sgU3RhbmRhcmQgVGltZVcuIE1vbmdvbGlhIFN0YW5kYXJkIFRpbWVfY2dvX3RocmVhZF9zdGFydCBtaXNzaW5nYWxsZ2FkZDogYmFkIHN0YXR1cyBHaWRsZWFyZW5hIGFscmVhZHkgaW5pdGlhbGl6ZWRiYWQgc3RhdHVzIGluIHNocmlua3N0YWNrYmFkIHN5c3RlbSBodWdlIHBhZ2Ugc2l6ZWNoYW5zZW5kOiBzcHVyaW91cyB3YWtldXBjaGVja2RlYWQ6IG5vIG0gZm9yIHRpbWVyY2hlY2tkZWFkOiBubyBwIGZvciB0aW1lcmluY29uc2lzdGVudCBwb2xsLmZkTXV0ZXhpbnZhbGlkIGNyb3NzLWRldmljZSBsaW5ranNvbjogVW5leHBlY3RlZCBrZXkgdHlwZWpzb246IHVuc3VwcG9ydGVkIHZhbHVlOiBtaXNzaW5nIHN0YWNrIGluIG5ld3N0YWNrbWlzc2luZyB0cmFjZUdDU3dlZXBTdGFydG5vIGJ1ZmZlciBzcGFjZSBhdmFpbGFibGVubyBzdWNoIGRldmljZSBvciBhZGRyZXNzb3BlcmF0aW9uIG5vdyBpbiBwcm9ncmVzc3JlZmxlY3QuVmFsdWUuT3ZlcmZsb3dJbnRyZWZsZWN0LlZhbHVlLlNldE1hcEluZGV4cmVmbGVjdDogQml0cyBvZiBuaWwgVHlwZXJlbGVhc2VwOiBpbnZhbGlkIHAgc3RhdGVyZW1haW5pbmcgcG9pbnRlciBidWZmZXJzcmVzb3VyY2UgZGVhZGxvY2sgYXZvaWRlZHJ1bnRpbWU6IFZpcnR1YWxBbGxvYyBvZiBydW50aW1lOiBwcm9ncmFtIGV4Y2VlZHMgcnVudGltZQ==d1:T554,ZXI6IHRydW5jYXRpb24gb3V0IG9mIHJhbmdlY2Fubm90IGV4ZWMgYSBzaGFyZWQgbGlicmFyeSBkaXJlY3RseWZhaWxlZCB0byByZXNlcnZlIHBhZ2Ugc3VtbWFyeSBtZW1vcnlpbnRlcm5hbCBlcnJvcjogdW5rbm93biBuZXR3b3JrIHR5cGUgbWV0aG9kIEFCSSBhbmQgdmFsdWUgQUJJIGRvIG5vdCBhbGlnbnJlZmxlY3QuVmFsdWUuQnl0ZXMgb2Ygbm9uLWJ5dGUgYXJyYXlyZWZsZWN0LlZhbHVlLkJ5dGVzIG9mIG5vbi1ieXRlIHNsaWNlcmVmbGVjdC5WYWx1ZS5CeXRlcyBvZiBub24tcnVuZSBzbGljZXJlZmxlY3QuVmFsdWUuQ29udmVydDogdmFsdWUgb2YgdHlwZSByZWZsZWN0OiBCaXRzIG9mIG5vbi1hcml0aG1ldGljIFR5cGUgcmVmbGVjdDogTnVtRmllbGQgb2Ygbm9uLXN0cnVjdCB0eXBlIHJlZmxlY3Q6IGZ1bmNMYXlvdXQgb2Ygbm9uLWZ1bmMgdHlwZSBydW50aW1lLm1pbml0OiBkdXBsaWNhdGVoYW5kbGUgZmFpbGVkcnVudGltZTogYWxsb2NhdGlvbiBzaXplIG91dCBvZiByYW5nZXJ1bnRpbWU6IHVuZXhwZWN0ZWQgU1BXUklURSBmdW5jdGlvbiBzZXRwcm9maWxlYnVja2V0OiBwcm9maWxlIGFscmVhZHkgc2V0c3RhcnRUaGVXb3JsZDogaW5jb25zaXN0ZW50IG1wLT5uZXh0cHRpbWV6b25lIGhvdXIgb3V0c2lkZSBvZiByYW5nZSBbMCwyM112YWx1ZSB0b28gbGFyZ2UgZm9yIGRlZmluZWQgZGF0YSB0eXBlMTExMDIyMzAyNDYyNTE1NjU0MDQyMzYzMTY2ODA5MDgyMDMxMjU1NTUxMTE1MTIzMTI1NzgyNzAyMTE4MTU4MzQwNDU0MTAxNTYyNUVycm9yIGNhbGxpbmcgTXNpQ29uZmlndXJlUHJvZHVjdEE6ICV2RXJyb3IgY2FsbGluZyBNc2lEYXRhYmFzZU9wZW5WaWV3QTogJXZJbnN0YWxsZWQgQWdlbnQgd2l0aCBkZXBsb3ltZW50IElEOiAldlVuYWJsZSB0byBkZXRlcm1pbmUgc3lzdGVtIGRpcmVjdG9yeTogYWZ0ZXIgZGVjaW1hbCBwb2ludCBpbiBudW1lcmljIGxpdGVyYWxhcmcgc2l6ZSB0byByZWZsZWN0LmNhbGwgbW9yZSB0aGFuIDFHQmNhbiBub3QgYWNjZXNzIGEgbmVlZGVkIHNod2:T558,ZXI6IHRydW5jYXRpb24gb3V0IG9mIHJhbmdlY2Fubm90IGV4ZWMgYSBzaGFyZWQgbGlicmFyeSBkaXJlY3RseWZhaWxlZCB0byByZXNlcnZlIHBhZ2Ugc3VtbWFyeSBtZW1vcnlpbnRlcm5hbCBlcnJvcjogdW5rbm93biBuZXR3b3JrIHR5cGUgbWV0aG9kIEFCSSBhbmQgdmFsdWUgQUJJIGRvIG5vdCBhbGlnbnJlZmxlY3QuVmFsdWUuQnl0ZXMgb2Ygbm9uLWJ5dGUgYXJyYXlyZWZsZWN0LlZhbHVlLkJ5dGVzIG9mIG5vbi1ieXRlIHNsaWNlcmVmbGVjdC5WYWx1ZS5CeXRlcyBvZiBub24tcnVuZSBzbGljZXJlZmxlY3QuVmFsdWUuQ29udmVydDogdmFsdWUgb2YgdHlwZSByZWZsZWN0OiBCaXRzIG9mIG5vbi1hcml0aG1ldGljIFR5cGUgcmVmbGVjdDogTnVtRmllbGQgb2Ygbm9uLXN0cnVjdCB0eXBlIHJlZmxlY3Q6IGZ1bmNMYXlvdXQgb2Ygbm9uLWZ1bmMgdHlwZSBydW50aW1lLm1pbml0OiBkdXBsaWNhdGVoYW5kbGUgZmFpbGVkcnVudGltZTogYWxsb2NhdGlvbiBzaXplIG91dCBvZiByYW5nZXJ1bnRpbWU6IHVuZXhwZWN0ZWQgU1BXUklURSBmdW5jdGlvbiBzZXRwcm9maWxlYnVja2V0OiBwcm9maWxlIGFscmVhZHkgc2V0c3RhcnRUaGVXb3JsZDogaW5jb25zaXN0ZW50IG1wLT5uZXh0cHRpbWV6b25lIGhvdXIgb3V0c2lkZSBvZiByYW5nZSBbMCwyM112YWx1ZSB0b28gbGFyZ2UgZm9yIGRlZmluZWQgZGF0YSB0eXBlMTExMDIyMzAyNDYyNTE1NjU0MDQyMzYzMTY2ODA5MDgyMDMxMjU1NTUxMTE1MTIzMTI1NzgyNzAyMTE4MTU4MzQwNDU0MTAxNTYyNUVycm9yIGNhbGxpbmcgTXNpQ29uZmlndXJlUHJvZHVjdEE6ICV2RXJyb3IgY2FsbGluZyBNc2lEYXRhYmFzZU9wZW5WaWV3QTogJXZJbnN0YWxsZWQgQWdlbnQgd2l0aCBkZXBsb3ltZW50IElEOiAldlVuYWJsZSB0byBkZXRlcm1pbmUgc3lzdGVtIGRpcmVjdG9yeTogYWZ0ZXIgZGVjaW1hbCBwb2ludCBpbiBudW1lcmljIGxpdGVyYWxhcmcgc2l6ZSB0byByZWZsZWN0LmNhbGwgbW9yZSB0aGFuIDFHQmNhbiBub3QgYWNjZXNzIGEgbmVlZGVkIHNoYQ==d3:T554,ZmZzZXQgb3V0IG9mIHJhbmdlc2tpcCBldmVyeXRoaW5nIGFuZCBzdG9wIHRoZSB3YWxrc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbJXg6JXldc3RhY2thbGxvYyBub3Qgb24gc2NoZWR1bGVyIHN0YWNrc3RvcGxvY2tlZG06IGluY29uc2lzdGVudCBsb2NraW5ndGltZXIgcGVyaW9kIG11c3QgYmUgbm9uLW5lZ2F0aXZldG9vIG1hbnkgbGV2ZWxzIG9mIHN5bWJvbGljIGxpbmtzdW5hbGlnbmVkIDY0LWJpdCBhdG9taWMgb3BlcmF0aW9ud2FpdGluZyBmb3IgdW5zdXBwb3J0ZWQgZmlsZSB0eXBlMzU1MjcxMzY3ODgwMDUwMDkyOTM1NTYyMTMzNzg5MDYyNTogZGF5LW9mLXllYXIgZG9lcyBub3QgbWF0Y2ggbW9udGhFcnJvciBjYWxsaW5nIE1zaVNldEludGVybmFsVUk6ICV2RXJyb3IgcnVubmluZyBNc2lTZXRJbnRlcm5hbFVJOiAldk90aGVyX0RlZmF1bHRfSWdub3JhYmxlX0NvZGVfUG9pbnRTZXRGaWxlQ29tcGxldGlvbk5vdGlmaWNhdGlvbk1vZGVzVmlydHVhbFF1ZXJ5IGZvciBzdGFjayBiYXNlIGZhaWxlZGRvYWRkdGltZXI6IFAgYWxyZWFkeSBzZXQgaW4gdGltZXJmbGFnIHByb3ZpZGVkIGJ1dCBub3QgZGVmaW5lZDogLSVzZm9yRWFjaFA6IHNjaGVkLnNhZmVQb2ludFdhaXQgIT0gMGlsbGVnYWwgYmFzZTY0IGRhdGEgYXQgaW5wdXQgYnl0ZSBpbiBcdSBoZXhhZGVjaW1hbCBjaGFyYWN0ZXIgZXNjYXBlbXNwYW4uZW5zdXJlU3dlcHQ6IG0gaXMgbm90IGxvY2tlZG91dCBvZiBtZW1vcnkgYWxsb2NhdGluZyBhbGxBcmVuYXNyZWZsZWN0OiBDaGFuRGlyIG9mIG5vbi1jaGFuIHR5cGUgcmVmbGVjdDogRmllbGQgaW5kZXggb3V0IG9mIGJvdW5kc3JlZmxlY3Q6IEZpZWxkIG9mIG5vbi1zdHJ1Y3QgdHlwZSByZWZsZWN0OiBzdHJpbmcgaW5kZXggb3V0IG9mIHJhbmdlcnVudGltZS5TZXRGaW5hbGl6ZXI6IGNhbm5vdCBwYXNzIHJ1bnRpbWU6IGcgaXMgcnVubmluZyBidXQgcCBpcyBub3RzY2hlZHVsZTogc3Bpbm5pbmcgd2l0aCBsb2NhbCB3b3Jrc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbd4:T558,ZmZzZXQgb3V0IG9mIHJhbmdlc2tpcCBldmVyeXRoaW5nIGFuZCBzdG9wIHRoZSB3YWxrc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbJXg6JXldc3RhY2thbGxvYyBub3Qgb24gc2NoZWR1bGVyIHN0YWNrc3RvcGxvY2tlZG06IGluY29uc2lzdGVudCBsb2NraW5ndGltZXIgcGVyaW9kIG11c3QgYmUgbm9uLW5lZ2F0aXZldG9vIG1hbnkgbGV2ZWxzIG9mIHN5bWJvbGljIGxpbmtzdW5hbGlnbmVkIDY0LWJpdCBhdG9taWMgb3BlcmF0aW9ud2FpdGluZyBmb3IgdW5zdXBwb3J0ZWQgZmlsZSB0eXBlMzU1MjcxMzY3ODgwMDUwMDkyOTM1NTYyMTMzNzg5MDYyNTogZGF5LW9mLXllYXIgZG9lcyBub3QgbWF0Y2ggbW9udGhFcnJvciBjYWxsaW5nIE1zaVNldEludGVybmFsVUk6ICV2RXJyb3IgcnVubmluZyBNc2lTZXRJbnRlcm5hbFVJOiAldk90aGVyX0RlZmF1bHRfSWdub3JhYmxlX0NvZGVfUG9pbnRTZXRGaWxlQ29tcGxldGlvbk5vdGlmaWNhdGlvbk1vZGVzVmlydHVhbFF1ZXJ5IGZvciBzdGFjayBiYXNlIGZhaWxlZGRvYWRkdGltZXI6IFAgYWxyZWFkeSBzZXQgaW4gdGltZXJmbGFnIHByb3ZpZGVkIGJ1dCBub3QgZGVmaW5lZDogLSVzZm9yRWFjaFA6IHNjaGVkLnNhZmVQb2ludFdhaXQgIT0gMGlsbGVnYWwgYmFzZTY0IGRhdGEgYXQgaW5wdXQgYnl0ZSBpbiBcdSBoZXhhZGVjaW1hbCBjaGFyYWN0ZXIgZXNjYXBlbXNwYW4uZW5zdXJlU3dlcHQ6IG0gaXMgbm90IGxvY2tlZG91dCBvZiBtZW1vcnkgYWxsb2NhdGluZyBhbGxBcmVuYXNyZWZsZWN0OiBDaGFuRGlyIG9mIG5vbi1jaGFuIHR5cGUgcmVmbGVjdDogRmllbGQgaW5kZXggb3V0IG9mIGJvdW5kc3JlZmxlY3Q6IEZpZWxkIG9mIG5vbi1zdHJ1Y3QgdHlwZSByZWZsZWN0OiBzdHJpbmcgaW5kZXggb3V0IG9mIHJhbmdlcnVudGltZS5TZXRGaW5hbGl6ZXI6IGNhbm5vdCBwYXNzIHJ1bnRpbWU6IGcgaXMgcnVubmluZyBidXQgcCBpcyBub3RzY2hlZHVsZTogc3Bpbm5pbmcgd2l0aCBsb2NhbCB3b3Jrc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbJQ==d5:T554,Z2luZXNlQ2FuY2VsSW9DaGVyb2tlZUN5cmlsbGljRGVjZW1iZXJEdXBsb3lhbkV0aGlvcGljRXh0ZW5kZXJGZWJydWFyeUZ1bGxQYXRoR2VvcmdpYW5Hb1N0cmluZ0d1amFyYXRpR3VybXVraGlIaXJhZ2FuYUphdmFuZXNlS2F0YWthbmFLYXlhaF9MaUxpbmVhcl9BTGluZWFyX0JNYWhhamFuaU5vdmVtYmVyT2xfQ2hpa2lQYXJzZUludFBoYWdzX1BhUmVhZEZpbGVTYXR1cmRheVRhZ2JhbndhVGFpX1RoYW1UYWlfVmlldFRodXJzZGF5VGlmaW5hZ2hVZ2FyaXRpY1dTQUlvY3RsW3NpZ25hbCBzdGFjaz1bY2dvY2hlY2tjcyAgICAgIGRlYWRsb2NrZHVyYXRpb25lYXggICAgIGVicCAgICAgZWJ4ICAgICBlY3ggICAgIGVkaSAgICAgZWR4ICAgICBlZmxhZ3MgIGVpcCAgICAgZXNpICAgICBlc3AgICAgIGZzICAgICAgZ3MgICAgICBpbmZpbml0eW5vIGFub2RlcG9sbERlc2NyZWZsZWN0LnJ1bm5hYmxlcnVudGltZS5zY2F2ZW5nZXNodXRkb3duc3RyY29udi50cmFjZUJ1ZnRyaWdnZXI9dW5rbm93bih3c2Fpb2N0bCAoZm9yY2VkKSBCIGV4cC4pICBCIHdvcmsgKCBibG9ja2VkPSBpbiB1c2UpIGxvY2tlZGc9IGxvY2tlZG09IG0tPmN1cmc9IG1hcmtlZCAgIG1ldGhvZDogIG1zIGNwdSwgIG5vdCBpbiBbIG9mIHR5cGUgIHJ1bnRpbWU9IHMubGltaXQ9IHMuc3RhdGU9IHRocmVhZHM9IHVubWFya2VkIHdidWYxLm49IHdidWYyLm49JSEoRVhUUkEgKE1JU1NJTkcpKHVua25vd24pLCBuZXd2YWw9LCBvbGR2YWw9LCBzaXplID0gLCB0YWlsID0gLTA3OjAwOjAwMjQ0MTQwNjI1OiBzdGF0dXM9QmFzc2FfVmFoQmhhaWtzdWtpQ3VuZWlmb3JtRGlhY3JpdGljRmluZENsb3NlRmxlZXREZWNrSGV4X0RpZ2l0SW5oZXJpdGVkSW50ZXJmYWNlS2h1ZGF3YWRpTG9jYWxGcmVlTWFsYXlhbGFtTW9uZ29saWFuTW92ZUZpbGVXTmFiYXRhZWFuUGFsbXlyZW5lUGFyc2VCb29sUGFyc2VVaW50U2FtYXJpdGFuU2VwdGVtYmVyU3VuZGFuZXNlV1NBU2VuZFRvV2VkbmVzZGF5V3JpdGVGaWxlWjA3OjAwOjAwYXRvbWljb3I4Yg==d6:T554,Z2luZXNlQ2FuY2VsSW9DaGVyb2tlZUN5cmlsbGljRGVjZW1iZXJEdXBsb3lhbkV0aGlvcGljRXh0ZW5kZXJGZWJydWFyeUZ1bGxQYXRoR2VvcmdpYW5Hb1N0cmluZ0d1amFyYXRpR3VybXVraGlIaXJhZ2FuYUphdmFuZXNlS2F0YWthbmFLYXlhaF9MaUxpbmVhcl9BTGluZWFyX0JNYWhhamFuaU5vdmVtYmVyT2xfQ2hpa2lQYXJzZUludFBoYWdzX1BhUmVhZEZpbGVTYXR1cmRheVRhZ2JhbndhVGFpX1RoYW1UYWlfVmlldFRodXJzZGF5VGlmaW5hZ2hVZ2FyaXRpY1dTQUlvY3RsW3NpZ25hbCBzdGFjaz1bY2dvY2hlY2tjcyAgICAgIGRlYWRsb2NrZHVyYXRpb25lYXggICAgIGVicCAgICAgZWJ4ICAgICBlY3ggICAgIGVkaSAgICAgZWR4ICAgICBlZmxhZ3MgIGVpcCAgICAgZXNpICAgICBlc3AgICAgIGZzICAgICAgZ3MgICAgICBpbmZpbml0eW5vIGFub2RlcG9sbERlc2NyZWZsZWN0LnJ1bm5hYmxlcnVudGltZS5zY2F2ZW5nZXNodXRkb3duc3RyY29udi50cmFjZUJ1ZnRyaWdnZXI9dW5rbm93bih3c2Fpb2N0bCAoZm9yY2VkKSBCIGV4cC4pICBCIHdvcmsgKCBibG9ja2VkPSBpbiB1c2UpIGxvY2tlZGc9IGxvY2tlZG09IG0tPmN1cmc9IG1hcmtlZCAgIG1ldGhvZDogIG1zIGNwdSwgIG5vdCBpbiBbIG9mIHR5cGUgIHJ1bnRpbWU9IHMubGltaXQ9IHMuc3RhdGU9IHRocmVhZHM9IHVubWFya2VkIHdidWYxLm49IHdidWYyLm49JSEoRVhUUkEgKE1JU1NJTkcpKHVua25vd24pLCBuZXd2YWw9LCBvbGR2YWw9LCBzaXplID0gLCB0YWlsID0gLTA3OjAwOjAwMjQ0MTQwNjI1OiBzdGF0dXM9QmFzc2FfVmFoQmhhaWtzdWtpQ3VuZWlmb3JtRGlhY3JpdGljRmluZENsb3NlRmxlZXREZWNrSGV4X0RpZ2l0SW5oZXJpdGVkSW50ZXJmYWNlS2h1ZGF3YWRpTG9jYWxGcmVlTWFsYXlhbGFtTW9uZ29saWFuTW92ZUZpbGVXTmFiYXRhZWFuUGFsbXlyZW5lUGFyc2VCb29sUGFyc2VVaW50U2FtYXJpdGFuU2VwdGVtYmVyU3VuZGFuZXNlV1NBU2VuZFRvV2VkbmVzZGF5V3JpdGVGaWxlWjA3OjAwOjAwYXRvbWljb3I4YmE=d7:T550,Z29hbCAgS2lCIHRvdGFsLCAgTUIgc3RhY2tzLCAgW3JlY292ZXJlZF0gYWxsb2NDb3VudCAgZm91bmQgYXQgKiggZ2NzY2FuZG9uZSAgbS0+Z3NpZ25hbD0gbWF4VHJpZ2dlcj0gbkRhdGFSb290cz0gblNwYW5Sb290cz0gcGFnZXMvYnl0ZSBwcmVlbXB0b2ZmPSBzLmVsZW1zaXplPSBzLnN3ZWVwZ2VuPSBzcGFuLmxpbWl0PSBzcGFuLnN0YXRlPSBzeXNtb253YWl0PSB3YnVmMT08bmlsPiB3YnVmMj08bmlsPiUhKEJBRFdJRFRIKSkgcC0+c3RhdHVzPSwgY29ucy9tYXJrIC1ieXRlIGxpbWl0MTUyNTg3ODkwNjI1NzYyOTM5NDUzMTI1QmlkaV9Db250cm9sREVQTE9ZTUVOVElER2V0QWRkckluZm9XR2V0Q29uc29sZUNQR2V0TGFzdEVycm9yR2V0TGVuZ3RoU2lkR2V0U3RkSGFuZGxlR2V0VGVtcFBhdGhXSm9pbl9Db250cm9sTG9hZExpYnJhcnlXTWVldGVpX01heWVrTXNpVmlld0Nsb3NlTXNpVmlld0ZldGNoUGFoYXdoX0htb25nUmVhZENvbnNvbGVXUmV2ZXJ0VG9TZWxmU2V0RW5kT2ZGaWxlU29yYV9Tb21wZW5nU3lsb3RpX05hZ3JpVHJhbnNtaXRGaWxlVW5sb2NrRmlsZUV4VmlydHVhbFF1ZXJ5YWJpIG1pc21hdGNoYWR2YXBpMzIuZGxsYmFkIGZsdXNoR2VuYmFkIGcgc3RhdHVzYmFkIGcwIHN0YWNrYmFkIHJlY292ZXJ5Y2FuJ3QgaGFwcGVuY2FzNjQgZmFpbGVkY2hhbiByZWNlaXZlZHVtcGluZyBoZWFwZW5kIHRyYWNlZ2NlbnRlcnN5c2NhbGxnY0JpdHNBcmVuYXNnY3BhY2VydHJhY2VoYXJkZGVjb21taXRob3N0IGlzIGRvd25pbGxlZ2FsIHNlZWtpbnZhbGlkIHBhdGhpbnZhbGlkIHNsb3RpcGhscGFwaS5kbGxrZXJuZWwzMi5kbGxtYWR2ZG9udG5lZWRtaGVhcFNwZWNpYWxtc3BhblNwZWNpYWxuZXRhcGkzMi5kbGxub3QgcG9sbGFibGVyZWZsZWN0LkNvcHlyZWxlYXNlcDogbT1ydW50aW1lOiBncD1ydW50aW1lOiBzcD1zZWxmLXByZWVtcHRzaG9ydCBidWZmZXJzcGFuU2V0U3BpbmVzd2VlcFdhaXRlcnN0cmFjZVN0cmluZ3N3aXJlcDogcC0+bT13b3JrZXIgbW9kZSAgIT0gc3dlZXBnd8:T554,Z29hbCAgS2lCIHRvdGFsLCAgTUIgc3RhY2tzLCAgW3JlY292ZXJlZF0gYWxsb2NDb3VudCAgZm91bmQgYXQgKiggZ2NzY2FuZG9uZSAgbS0+Z3NpZ25hbD0gbWF4VHJpZ2dlcj0gbkRhdGFSb290cz0gblNwYW5Sb290cz0gcGFnZXMvYnl0ZSBwcmVlbXB0b2ZmPSBzLmVsZW1zaXplPSBzLnN3ZWVwZ2VuPSBzcGFuLmxpbWl0PSBzcGFuLnN0YXRlPSBzeXNtb253YWl0PSB3YnVmMT08bmlsPiB3YnVmMj08bmlsPiUhKEJBRFdJRFRIKSkgcC0+c3RhdHVzPSwgY29ucy9tYXJrIC1ieXRlIGxpbWl0MTUyNTg3ODkwNjI1NzYyOTM5NDUzMTI1QmlkaV9Db250cm9sREVQTE9ZTUVOVElER2V0QWRkckluZm9XR2V0Q29uc29sZUNQR2V0TGFzdEVycm9yR2V0TGVuZ3RoU2lkR2V0U3RkSGFuZGxlR2V0VGVtcFBhdGhXSm9pbl9Db250cm9sTG9hZExpYnJhcnlXTWVldGVpX01heWVrTXNpVmlld0Nsb3NlTXNpVmlld0ZldGNoUGFoYXdoX0htb25nUmVhZENvbnNvbGVXUmV2ZXJ0VG9TZWxmU2V0RW5kT2ZGaWxlU29yYV9Tb21wZW5nU3lsb3RpX05hZ3JpVHJhbnNtaXRGaWxlVW5sb2NrRmlsZUV4VmlydHVhbFF1ZXJ5YWJpIG1pc21hdGNoYWR2YXBpMzIuZGxsYmFkIGZsdXNoR2VuYmFkIGcgc3RhdHVzYmFkIGcwIHN0YWNrYmFkIHJlY292ZXJ5Y2FuJ3QgaGFwcGVuY2FzNjQgZmFpbGVkY2hhbiByZWNlaXZlZHVtcGluZyBoZWFwZW5kIHRyYWNlZ2NlbnRlcnN5c2NhbGxnY0JpdHNBcmVuYXNnY3BhY2VydHJhY2VoYXJkZGVjb21taXRob3N0IGlzIGRvd25pbGxlZ2FsIHNlZWtpbnZhbGlkIHBhdGhpbnZhbGlkIHNsb3RpcGhscGFwaS5kbGxrZXJuZWwzMi5kbGxtYWR2ZG9udG5lZWRtaGVhcFNwZWNpYWxtc3BhblNwZWNpYWxuZXRhcGkzMi5kbGxub3QgcG9sbGFibGVyZWZsZWN0LkNvcHlyZWxlYXNlcDogbT1ydW50aW1lOiBncD1ydW50aW1lOiBzcD1zZWxmLXByZWVtcHRzaG9ydCBidWZmZXJzcGFuU2V0U3BpbmVzd2VlcFdhaXRlcnN0cmFjZVN0cmluZ3N3aXJlcDogcC0+bT13b3JrZXIgbW9kZSAgIT0gc3dlZXBnZQ==d9:T554,aGFiZXRwcm90b2NvbCBmYW1pbHkgbm90IHN1cHBvcnRlZHJlZmxlY3Q6IEVsZW0gb2YgaW52YWxpZCB0eXBlcmVmbGVjdDogSW4gb2Ygbm9uLWZ1bmMgdHlwZSByZWZsZWN0OiBLZXkgb2Ygbm9uLW1hcCB0eXBlIHJ1bnRpbWUuc2VtYXNsZWVwIHdhaXRfZmFpbGVkcnVudGltZTogaW1wb3NzaWJsZSB0eXBlIGtpbmRydW50aW1lOiBsZXZlbFNoaWZ0W2xldmVsXSA9IHJ1bnRpbWU6IG1hcmtpbmcgZnJlZSBvYmplY3QgcnVudGltZTogcC5nY01hcmtXb3JrZXJNb2RlPSBydW50aW1lOiBzcGxpdCBzdGFjayBvdmVyZmxvd3J1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCBjcnVudGltZTogc3VtbWFyeSBtYXggcGFnZXMgPSBydW50aW1lOiB0cmFjZWJhY2sgc3R1Y2suIHBjPXNjYW5vYmplY3Qgb2YgYSBub3NjYW4gb2JqZWN0c2VtYWNxdWlyZSBub3Qgb24gdGhlIEcgc3RhY2tzdHJpbmcgY29uY2F0ZW5hdGlvbiB0b28gbG9uZ3N5bnRheCBlcnJvciBzY2FubmluZyBib29sZWFudGltZUJlZ2luL0VuZFBlcmlvZCBub3QgZm91bmR0b28gbWFueSBvcGVuIGZpbGVzIGluIHN5c3RlbSAodHlwZXMgZnJvbSBkaWZmZXJlbnQgc2NvcGVzKSBpbiBwcmVwYXJlRm9yU3dlZXA7IHN3ZWVwZ2VuICBsb2NhbHMgc3RhY2sgbWFwIGVudHJpZXMgZm9yIDIyNzM3MzY3NTQ0MzIzMjA1OTQ3ODc1OTc2NTYyNUNlbnRyYWwgRXVyb3BlYW4gU3RhbmRhcmQgVGltZUNlbnRyYWwgU3RhbmRhcmQgVGltZSAoTWV4aWNvKUUuIFNvdXRoIEFtZXJpY2EgU3RhbmRhcmQgVGltZUVhc3Rlcm4gU3RhbmRhcmQgVGltZSAoTWV4aWNvKUVycm9yIGNhbGxpbmcgTXNpVmlld0Nsb3NlOiAldkVycm9yIGNhbGxpbmcgTXNpVmlld0ZldGNoOiAldkVycm9yIHJ1bm5pbmcgTW9kaWZ5UmVjb3JkOiAldkdPREVCVUc6IHVua25vd24gY3B1IGZlYXR1cmUgIk1hcEl0ZXIuS2V5IGNhbGxlZCBiZWZvcmUgTmV4dE1zaUNyZWF0ZVRyYW5zZm9ybVN1bW1hcnlJbmZvQVBhY2lmaWMgU3RhbmRhcmQgVGltZSAoTWV4aWNvKVR1cmtzIEFuZCBDYWljb3M=da:T558,aGFiZXRwcm90b2NvbCBmYW1pbHkgbm90IHN1cHBvcnRlZHJlZmxlY3Q6IEVsZW0gb2YgaW52YWxpZCB0eXBlcmVmbGVjdDogSW4gb2Ygbm9uLWZ1bmMgdHlwZSByZWZsZWN0OiBLZXkgb2Ygbm9uLW1hcCB0eXBlIHJ1bnRpbWUuc2VtYXNsZWVwIHdhaXRfZmFpbGVkcnVudGltZTogaW1wb3NzaWJsZSB0eXBlIGtpbmRydW50aW1lOiBsZXZlbFNoaWZ0W2xldmVsXSA9IHJ1bnRpbWU6IG1hcmtpbmcgZnJlZSBvYmplY3QgcnVudGltZTogcC5nY01hcmtXb3JrZXJNb2RlPSBydW50aW1lOiBzcGxpdCBzdGFjayBvdmVyZmxvd3J1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCBjcnVudGltZTogc3VtbWFyeSBtYXggcGFnZXMgPSBydW50aW1lOiB0cmFjZWJhY2sgc3R1Y2suIHBjPXNjYW5vYmplY3Qgb2YgYSBub3NjYW4gb2JqZWN0c2VtYWNxdWlyZSBub3Qgb24gdGhlIEcgc3RhY2tzdHJpbmcgY29uY2F0ZW5hdGlvbiB0b28gbG9uZ3N5bnRheCBlcnJvciBzY2FubmluZyBib29sZWFudGltZUJlZ2luL0VuZFBlcmlvZCBub3QgZm91bmR0b28gbWFueSBvcGVuIGZpbGVzIGluIHN5c3RlbSAodHlwZXMgZnJvbSBkaWZmZXJlbnQgc2NvcGVzKSBpbiBwcmVwYXJlRm9yU3dlZXA7IHN3ZWVwZ2VuICBsb2NhbHMgc3RhY2sgbWFwIGVudHJpZXMgZm9yIDIyNzM3MzY3NTQ0MzIzMjA1OTQ3ODc1OTc2NTYyNUNlbnRyYWwgRXVyb3BlYW4gU3RhbmRhcmQgVGltZUNlbnRyYWwgU3RhbmRhcmQgVGltZSAoTWV4aWNvKUUuIFNvdXRoIEFtZXJpY2EgU3RhbmRhcmQgVGltZUVhc3Rlcm4gU3RhbmRhcmQgVGltZSAoTWV4aWNvKUVycm9yIGNhbGxpbmcgTXNpVmlld0Nsb3NlOiAldkVycm9yIGNhbGxpbmcgTXNpVmlld0ZldGNoOiAldkVycm9yIHJ1bm5pbmcgTW9kaWZ5UmVjb3JkOiAldkdPREVCVUc6IHVua25vd24gY3B1IGZlYXR1cmUgIk1hcEl0ZXIuS2V5IGNhbGxlZCBiZWZvcmUgTmV4dE1zaUNyZWF0ZVRyYW5zZm9ybVN1bW1hcnlJbmZvQVBhY2lmaWMgU3RhbmRhcmQgVGltZSAoTWV4aWNvKVR1cmtzIEFuZCBDYWljb3MgUw==db:T554,aWNhIFN0YW5kYXJkIFRpbWViYWQgd3JpdGUgYmFycmllciBidWZmZXIgYm91bmRzY2Fubm90IGFzc2lnbiByZXF1ZXN0ZWQgYWRkcmVzc2Nhc2dzdGF0dXM6IGJhZCBpbmNvbWluZyB2YWx1ZXNjaGVja21hcmsgZm91bmQgdW5tYXJrZWQgb2JqZWN0ZW50ZXJzeXNjYWxsYmxvY2sgaW5jb25zaXN0ZW50IGZtdDogdW5rbm93biBiYXNlOyBjYW4ndCBoYXBwZW5pbiBsaXRlcmFsIG51bGwgKGV4cGVjdGluZyAnbCcpaW4gbGl0ZXJhbCBudWxsIChleHBlY3RpbmcgJ3UnKWluIGxpdGVyYWwgdHJ1ZSAoZXhwZWN0aW5nICdlJylpbiBsaXRlcmFsIHRydWUgKGV4cGVjdGluZyAncicpaW4gbGl0ZXJhbCB0cnVlIChleHBlY3RpbmcgJ3UnKWludGVybmFsIGVycm9yIC0gbWlzdXNlIG9mIGl0YWJqc29uOiBpbnZhbGlkIG51bWJlciBsaXRlcmFsICVxbWFsZm9ybWVkIHRpbWUgem9uZSBpbmZvcm1hdGlvbm5vbiBpbi11c2Ugc3BhbiBpbiB1bnN3ZXB0IGxpc3RwYWNlcjogc3dlZXAgZG9uZSBhdCBoZWFwIHNpemUgcGF0dGVybiBjb250YWlucyBwYXRoIHNlcGFyYXRvcnJlZmxlY3QuTWFrZVNsaWNlOiBuZWdhdGl2ZSBjYXByZWZsZWN0Lk1ha2VTbGljZTogbmVnYXRpdmUgbGVucmVmbGVjdDogTGVuIG9mIG5vbi1hcnJheSB0eXBlIHJlc2V0c3Bpbm5pbmc6IG5vdCBhIHNwaW5uaW5nIG1ydW50aW1lOiBjYW5ub3QgYWxsb2NhdGUgbWVtb3J5cnVudGltZTogZmFpbGVkIHRvIGNvbW1pdCBwYWdlc3J1bnRpbWU6IHNwbGl0IHN0YWNrIG92ZXJmbG93OiBzbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFsleDpdc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOiV4XXVuc2FmZS5TdHJpbmc6IGxlbiBvdXQgb2YgcmFuZ2UgKHR5cGVzIGZyb20gZGlmZmVyZW50IHBhY2thZ2VzKTI4NDIxNzA5NDMwNDA0MDA3NDM0ODQ0OTcwNzAzMTI1OiBkYXktb2YteWVhciBkb2VzIG5vdCBtYXRjaCBkYXlDZXJ0QWRkQ2VydGlmaWNhdGVDb250ZXh0VG9TdG9yZUNlcnRWZXJpZnlDZXJ0aWZpY2F0ZUNoYWluUG9saWN5RXJyb3IgY2Fsdc:T558,aWNhIFN0YW5kYXJkIFRpbWViYWQgd3JpdGUgYmFycmllciBidWZmZXIgYm91bmRzY2Fubm90IGFzc2lnbiByZXF1ZXN0ZWQgYWRkcmVzc2Nhc2dzdGF0dXM6IGJhZCBpbmNvbWluZyB2YWx1ZXNjaGVja21hcmsgZm91bmQgdW5tYXJrZWQgb2JqZWN0ZW50ZXJzeXNjYWxsYmxvY2sgaW5jb25zaXN0ZW50IGZtdDogdW5rbm93biBiYXNlOyBjYW4ndCBoYXBwZW5pbiBsaXRlcmFsIG51bGwgKGV4cGVjdGluZyAnbCcpaW4gbGl0ZXJhbCBudWxsIChleHBlY3RpbmcgJ3UnKWluIGxpdGVyYWwgdHJ1ZSAoZXhwZWN0aW5nICdlJylpbiBsaXRlcmFsIHRydWUgKGV4cGVjdGluZyAncicpaW4gbGl0ZXJhbCB0cnVlIChleHBlY3RpbmcgJ3UnKWludGVybmFsIGVycm9yIC0gbWlzdXNlIG9mIGl0YWJqc29uOiBpbnZhbGlkIG51bWJlciBsaXRlcmFsICVxbWFsZm9ybWVkIHRpbWUgem9uZSBpbmZvcm1hdGlvbm5vbiBpbi11c2Ugc3BhbiBpbiB1bnN3ZXB0IGxpc3RwYWNlcjogc3dlZXAgZG9uZSBhdCBoZWFwIHNpemUgcGF0dGVybiBjb250YWlucyBwYXRoIHNlcGFyYXRvcnJlZmxlY3QuTWFrZVNsaWNlOiBuZWdhdGl2ZSBjYXByZWZsZWN0Lk1ha2VTbGljZTogbmVnYXRpdmUgbGVucmVmbGVjdDogTGVuIG9mIG5vbi1hcnJheSB0eXBlIHJlc2V0c3Bpbm5pbmc6IG5vdCBhIHNwaW5uaW5nIG1ydW50aW1lOiBjYW5ub3QgYWxsb2NhdGUgbWVtb3J5cnVudGltZTogZmFpbGVkIHRvIGNvbW1pdCBwYWdlc3J1bnRpbWU6IHNwbGl0IHN0YWNrIG92ZXJmbG93OiBzbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFsleDpdc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOiV4XXVuc2FmZS5TdHJpbmc6IGxlbiBvdXQgb2YgcmFuZ2UgKHR5cGVzIGZyb20gZGlmZmVyZW50IHBhY2thZ2VzKTI4NDIxNzA5NDMwNDA0MDA3NDM0ODQ0OTcwNzAzMTI1OiBkYXktb2YteWVhciBkb2VzIG5vdCBtYXRjaCBkYXlDZXJ0QWRkQ2VydGlmaWNhdGVDb250ZXh0VG9TdG9yZUNlcnRWZXJpZnlDZXJ0aWZpY2F0ZUNoYWluUG9saWN5RXJyb3IgY2FsbA==dd:T554,aW5nIE1zaUNsb3NlSGFuZGxlOiAldkVycm9yIGNhbGxpbmcgTXNpVmlld0V4ZWN1dGU6ICV2TWFwSXRlci5WYWx1ZSBjYWxsZWQgYmVmb3JlIE5leHRXU0FHZXRPdmVybGFwcGVkUmVzdWx0IG5vdCBmb3VuZCIgbm90IHN1cHBvcnRlZCBmb3IgY3B1IG9wdGlvbiAiaW4gbGl0ZXJhbCBmYWxzZSAoZXhwZWN0aW5nICdhJylpbiBsaXRlcmFsIGZhbHNlIChleHBlY3RpbmcgJ2UnKWluIGxpdGVyYWwgZmFsc2UgKGV4cGVjdGluZyAnbCcpaW4gbGl0ZXJhbCBmYWxzZSAoZXhwZWN0aW5nICdzJylpbnZhbGlkIGxpbWl0ZXIgZXZlbnQgdHlwZSBmb3VuZG51bWVyaWNhbCBhcmd1bWVudCBvdXQgb2YgZG9tYWlucGFuaWMgd2hpbGUgcHJpbnRpbmcgcGFuaWMgdmFsdWVyZWZsZWN0Lm5hbWVGcm9tOiB0YWcgdG9vIGxvbmc6IHJlZmxlY3Q6IE51bUluIG9mIG5vbi1mdW5jIHR5cGUgcmVtb3Zlc3BlY2lhbCBvbiBpbnZhbGlkIHBvaW50ZXJyZXNvdXJjZSB0ZW1wb3JhcmlseSB1bmF2YWlsYWJsZXJ1bnRpbWUuc2VtYXNsZWVwIHdhaXRfYWJhbmRvbmVkcnVudGltZTogZmFpbGVkIHRvIHJlbGVhc2UgcGFnZXNydW50aW1lOiBmaXhhbGxvYyBzaXplIHRvbyBsYXJnZXJ1bnRpbWU6IG1jYWxsIGZ1bmN0aW9uIHJldHVybmVkcnVudGltZTogbmV3c3RhY2sgY2FsbGVkIGZyb20gZz1ydW50aW1lOiByb290IGxldmVsIG1heCBwYWdlcyA9IHJ1bnRpbWU6IHNldGV2ZW50IGZhaWxlZDsgZXJybm89cnVudGltZTogc3RhY2sgc3BsaXQgYXQgYmFkIHRpbWVydW50aW1lOiBzdWRvZyB3aXRoIG5vbi1uaWwgZWxlbXJ1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCBuZXh0cnVudGltZTogc3Vkb2cgd2l0aCBub24tbmlsIHByZXZzY2Fuc3RhY2s6IGdvcm91dGluZSBub3Qgc3RvcHBlZHNjYXZlbmdlciBzdGF0ZSBpcyBhbHJlYWR5IHdpcmVkc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbJXg6Ol1zbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFs6JXg6XXNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzo6JXhdc29mdHdhcmU=de:T558,aW5nIE1zaUNsb3NlSGFuZGxlOiAldkVycm9yIGNhbGxpbmcgTXNpVmlld0V4ZWN1dGU6ICV2TWFwSXRlci5WYWx1ZSBjYWxsZWQgYmVmb3JlIE5leHRXU0FHZXRPdmVybGFwcGVkUmVzdWx0IG5vdCBmb3VuZCIgbm90IHN1cHBvcnRlZCBmb3IgY3B1IG9wdGlvbiAiaW4gbGl0ZXJhbCBmYWxzZSAoZXhwZWN0aW5nICdhJylpbiBsaXRlcmFsIGZhbHNlIChleHBlY3RpbmcgJ2UnKWluIGxpdGVyYWwgZmFsc2UgKGV4cGVjdGluZyAnbCcpaW4gbGl0ZXJhbCBmYWxzZSAoZXhwZWN0aW5nICdzJylpbnZhbGlkIGxpbWl0ZXIgZXZlbnQgdHlwZSBmb3VuZG51bWVyaWNhbCBhcmd1bWVudCBvdXQgb2YgZG9tYWlucGFuaWMgd2hpbGUgcHJpbnRpbmcgcGFuaWMgdmFsdWVyZWZsZWN0Lm5hbWVGcm9tOiB0YWcgdG9vIGxvbmc6IHJlZmxlY3Q6IE51bUluIG9mIG5vbi1mdW5jIHR5cGUgcmVtb3Zlc3BlY2lhbCBvbiBpbnZhbGlkIHBvaW50ZXJyZXNvdXJjZSB0ZW1wb3JhcmlseSB1bmF2YWlsYWJsZXJ1bnRpbWUuc2VtYXNsZWVwIHdhaXRfYWJhbmRvbmVkcnVudGltZTogZmFpbGVkIHRvIHJlbGVhc2UgcGFnZXNydW50aW1lOiBmaXhhbGxvYyBzaXplIHRvbyBsYXJnZXJ1bnRpbWU6IG1jYWxsIGZ1bmN0aW9uIHJldHVybmVkcnVudGltZTogbmV3c3RhY2sgY2FsbGVkIGZyb20gZz1ydW50aW1lOiByb290IGxldmVsIG1heCBwYWdlcyA9IHJ1bnRpbWU6IHNldGV2ZW50IGZhaWxlZDsgZXJybm89cnVudGltZTogc3RhY2sgc3BsaXQgYXQgYmFkIHRpbWVydW50aW1lOiBzdWRvZyB3aXRoIG5vbi1uaWwgZWxlbXJ1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCBuZXh0cnVudGltZTogc3Vkb2cgd2l0aCBub24tbmlsIHByZXZzY2Fuc3RhY2s6IGdvcm91dGluZSBub3Qgc3RvcHBlZHNjYXZlbmdlciBzdGF0ZSBpcyBhbHJlYWR5IHdpcmVkc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbJXg6Ol1zbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFs6JXg6XXNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzo6JXhdc29mdHdhcmUgYw==df:T554,aW50ZXJuYWwgZXJyb3I6IGV4aXQgaG9vayBpbnZva2VkIHBhbmljbWlzbWF0Y2hlZCBjb3VudCBkdXJpbmcgaXRhYiB0YWJsZSBjb3B5bXNwYW4uc3dlZXA6IGJhZCBzcGFuIHN0YXRlIGFmdGVyIHN3ZWVwb3V0IG9mIG1lbW9yeSBhbGxvY2F0aW5nIGhlYXAgYXJlbmEgbWFwcmVmbGVjdC5NYWtlTWFwV2l0aFNpemUgb2Ygbm9uLW1hcCB0eXBlcnVudGltZTogYmxvY2tlZCB3cml0ZSBvbiBmcmVlIHBvbGxkZXNjcnVudGltZTogY2FzZnJvbV9Hc2NhbnN0YXR1cyBmYWlsZWQgZ3A9c3RhY2sgZ3Jvd3RoIG5vdCBhbGxvd2VkIGluIHN5c3RlbSBjYWxsc3VzcGVuZEcgZnJvbSBub24tcHJlZW1wdGlibGUgZ29yb3V0aW5ldHJhY2ViYWNrOiB1bmV4cGVjdGVkIFNQV1JJVEUgZnVuY3Rpb24gdHJhbnNwb3J0IGVuZHBvaW50IGlzIGFscmVhZHkgY29ubmVjdGVkMTM4Nzc3ODc4MDc4MTQ0NTY3NTUyOTUzOTU4NTExMzUyNTM5MDYyNTY5Mzg4OTM5MDM5MDcyMjgzNzc2NDc2OTc5MjU1Njc2MjY5NTMxMjVFcnJvciB3aGVuIHJ1bm5pbmcgTXNpSW5zdGFsbFByb2R1Y3Q6ICV2TWFwSXRlci5LZXkgY2FsbGVkIG9uIGV4aGF1c3RlZCBpdGVyYXRvclVuaW5zdGFsbGVkIEFnZW50IHdpdGggZGVwbG95bWVudCBJRDogJXZhZGRyZXNzIGZhbWlseSBub3Qgc3VwcG9ydGVkIGJ5IHByb3RvY29sYnVsa0JhcnJpZXJQcmVXcml0ZTogdW5hbGlnbmVkIGFyZ3VtZW50c2Nhbm5vdCBmcmVlIHdvcmtidWZzIHdoZW4gd29yay5mdWxsICE9IDBmYWlsZWQgdG8gYWNxdWlyZSBsb2NrIHRvIHJlc2V0IGNhcGFjaXR5aW52YWxpZCBzcGFuIGluIGhlYXBBcmVuYSBmb3IgdXNlciBhcmVuYW1hcmtXb3JrZXJTdG9wOiB1bmtub3duIG1hcmsgd29ya2VyIG1vZGVtdXN0IGJlIGFibGUgdG8gdHJhY2sgaWRsZSBsaW1pdGVyIGV2ZW50cmVmaWxsIG9mIHNwYW4gd2l0aCBmcmVlIHNwYWNlIHJlbWFpbmluZ3JlZmxlY3QuVmFsdWUuU2V0Qnl0ZXMgb2Ygbm9uLWJ5dGUgc2xpY2VyZWZsZWN0LlZhbHVlLnNldFJ1bmVzIG9mIG5vbi1ydW5le0:T554,bGF5ZWQgemVyb2luZyBvbiBkYXRhIHRoYXQgbWF5IGNvbnRhaW4gcG9pbnRlcnNmdWxseSBlbXB0eSB1bmZyZWVkIHNwYW4gc2V0IGJsb2NrIGZvdW5kIGluIHJlc2V0aW52YWxpZCBtZW1vcnkgYWRkcmVzcyBvciBuaWwgcG9pbnRlciBkZXJlZmVyZW5jZWludmFsaWQgb3IgaW5jb21wbGV0ZSBtdWx0aWJ5dGUgb3Igd2lkZSBjaGFyYWN0ZXJub3QgZW5vdWdoIHNpZ25pZmljYW50IGJpdHMgYWZ0ZXIgbXVsdDEyOGJpdFBvdzEwcGFuaWN3cmFwOiB1bmV4cGVjdGVkIHN0cmluZyBhZnRlciBwYWNrYWdlIG5hbWU6IHJlZmxlY3QuVmFsdWUuU2xpY2U6IHNsaWNlIG9mIHVuYWRkcmVzc2FibGUgYXJyYXlydW50aW1lLnJlZmxlY3RfbWFrZW1hcDogdW5zdXBwb3J0ZWQgbWFwIGtleSB0eXBlcnVudGltZTogdW5leHBlY3RlZCB3YWl0bSAtIHNlbWFwaG9yZSBvdXQgb2Ygc3luY3MuYWxsb2NDb3VudCAhPSBzLm5lbGVtcyAmJiBmcmVlSW5kZXggPT0gcy5uZWxlbXNzbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFs6OiV4XSB3aXRoIGNhcGFjaXR5ICV5c3dlZXBlciBsZWZ0IG91dHN0YW5kaW5nIGFjcm9zcyBzd2VlcCBnZW5lcmF0aW9uc2F0dGVtcHQgdG8gZXhlY3V0ZSBzeXN0ZW0gc3RhY2sgY29kZSBvbiB1c2VyIHN0YWNrY29tcGlsZUNhbGxiYWNrOiBmdW5jdGlvbiBhcmd1bWVudCBmcmFtZSB0b28gbGFyZ2VtYWxsb2NnYyBjYWxsZWQgd2l0aCBnY3BoYXNlID09IF9HQ21hcmt0ZXJtaW5hdGlvbnJlY3Vyc2l2ZSBjYWxsIGR1cmluZyBpbml0aWFsaXphdGlvbiAtIGxpbmtlciBza2V3cnVudGltZTogdW5hYmxlIHRvIGFjcXVpcmUgLSBzZW1hcGhvcmUgb3V0IG9mIHN5bmNzeXNjYWxsOiBzdHJpbmcgd2l0aCBOVUwgcGFzc2VkIHRvIFN0cmluZ0J5dGVTbGljZUpTT04gZGVjb2RlciBvdXQgb2Ygc3luYyAtIGRhdGEgY2hhbmdpbmcgdW5kZXJmb290P2ZhdGFsOiBzeXN0ZW1zdGFjayBjYWxsZWQgZnJvbSB1bmV4cGVjdGVkIGdvcm91dGluZWxpbWl0ZXJFdmVudC5zdG9wOiBpbnZhbGlkIGxpbWl0ZXI=e1:T558,bGF5ZWQgemVyb2luZyBvbiBkYXRhIHRoYXQgbWF5IGNvbnRhaW4gcG9pbnRlcnNmdWxseSBlbXB0eSB1bmZyZWVkIHNwYW4gc2V0IGJsb2NrIGZvdW5kIGluIHJlc2V0aW52YWxpZCBtZW1vcnkgYWRkcmVzcyBvciBuaWwgcG9pbnRlciBkZXJlZmVyZW5jZWludmFsaWQgb3IgaW5jb21wbGV0ZSBtdWx0aWJ5dGUgb3Igd2lkZSBjaGFyYWN0ZXJub3QgZW5vdWdoIHNpZ25pZmljYW50IGJpdHMgYWZ0ZXIgbXVsdDEyOGJpdFBvdzEwcGFuaWN3cmFwOiB1bmV4cGVjdGVkIHN0cmluZyBhZnRlciBwYWNrYWdlIG5hbWU6IHJlZmxlY3QuVmFsdWUuU2xpY2U6IHNsaWNlIG9mIHVuYWRkcmVzc2FibGUgYXJyYXlydW50aW1lLnJlZmxlY3RfbWFrZW1hcDogdW5zdXBwb3J0ZWQgbWFwIGtleSB0eXBlcnVudGltZTogdW5leHBlY3RlZCB3YWl0bSAtIHNlbWFwaG9yZSBvdXQgb2Ygc3luY3MuYWxsb2NDb3VudCAhPSBzLm5lbGVtcyAmJiBmcmVlSW5kZXggPT0gcy5uZWxlbXNzbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFs6OiV4XSB3aXRoIGNhcGFjaXR5ICV5c3dlZXBlciBsZWZ0IG91dHN0YW5kaW5nIGFjcm9zcyBzd2VlcCBnZW5lcmF0aW9uc2F0dGVtcHQgdG8gZXhlY3V0ZSBzeXN0ZW0gc3RhY2sgY29kZSBvbiB1c2VyIHN0YWNrY29tcGlsZUNhbGxiYWNrOiBmdW5jdGlvbiBhcmd1bWVudCBmcmFtZSB0b28gbGFyZ2VtYWxsb2NnYyBjYWxsZWQgd2l0aCBnY3BoYXNlID09IF9HQ21hcmt0ZXJtaW5hdGlvbnJlY3Vyc2l2ZSBjYWxsIGR1cmluZyBpbml0aWFsaXphdGlvbiAtIGxpbmtlciBza2V3cnVudGltZTogdW5hYmxlIHRvIGFjcXVpcmUgLSBzZW1hcGhvcmUgb3V0IG9mIHN5bmNzeXNjYWxsOiBzdHJpbmcgd2l0aCBOVUwgcGFzc2VkIHRvIFN0cmluZ0J5dGVTbGljZUpTT04gZGVjb2RlciBvdXQgb2Ygc3luYyAtIGRhdGEgY2hhbmdpbmcgdW5kZXJmb290P2ZhdGFsOiBzeXN0ZW1zdGFjayBjYWxsZWQgZnJvbSB1bmV4cGVjdGVkIGdvcm91dGluZWxpbWl0ZXJFdmVudC5zdG9wOiBpbnZhbGlkIGxpbWl0ZXIgZQ==e2:T554,bWUuTG9jYWx0cmFjZWZyZWUodHJhY2VnYygpdW5peHBhY2tldHVua25vd24gcGN3czJfMzIuZGxsICBvZiBzaXplICAgKHRhcmdldHBjPSAsIHBsdWdpbjogIEtpQiB3b3JrLCAgZXhwLikgZm9yICBmcmVlaW5kZXg9IGdjd2FpdGluZz0gaWRsZXByb2NzPSBpbiBzdGF0dXMgIG1hbGxvY2luZz0gbXMgY2xvY2ssICBuQlNTUm9vdHM9IHAtPnN0YXR1cz0gcy5uZWxlbXM9ICBzY2hlZHRpY2s9IHNwYW4ubGlzdD0gdGltZXJzbGVuPSUhKEJBRFBSRUMpKSBhdCBlbnRyeSssIGVsZW1zaXplPSwgbnBhZ2VzID0gL2Rldi9zdGRlcnIvZGV2L3N0ZG91dDMwNTE3NTc4MTI1OiBmcmFtZS5zcD1DbG9zZUhhbmRsZUNyZWF0ZUZpbGVXRGVsZXRlRmlsZVdEaXZlc19Ba3VydUV4aXRQcm9jZXNzRnJlZUxpYnJhcnlHT01FTUxJTUlUPUdPVFJBQ0VCQUNLR2V0RmlsZVR5cGVJZGVvZ3JhcGhpY01hcnNoYWxKU09OTWFyc2hhbFRleHRNZWRlZmFpZHJpbk1lc3NhZ2VCb3hBTW92ZUZpbGVFeFdOYW5kaW5hZ2FyaU5ldFNoYXJlQWRkTmV0U2hhcmVEZWxOZXdfVGFpX0x1ZU9sZF9QZXJzaWFuT2xkX1NvZ2RpYW5PcGVuUHJvY2Vzc1BhdV9DaW5fSGF1UmVnQ2xvc2VLZXlTZXRGaWxlVGltZVNpZ25Xcml0aW5nU29mdF9Eb3R0ZWRWaXJ0dWFsTG9ja1dTQVJlY3ZGcm9tV2FyYW5nX0NpdGlXaGl0ZV9TcGFjZWFzc2lzdFF1ZXVlYmFkIGFkZHJlc3NiYWQgYXJnU2l6ZWJhZCBtIHZhbHVlYmFkIG1lc3NhZ2ViYWQgdGltZWRpdmJyb2tlbiBwaXBlY2dvY2FsbCBuaWxjbG9iYmVyZnJlZWNsb3Nlc29ja2V0Y3JlYXRlZCBieSBjcnlwdDMyLmRsbGZpbGUgZXhpc3RzZmxvYXQzMm5hbjJmbG9hdDY0bmFuMWZsb2F0NjRuYW4yZmxvYXQ2NG5hbjNnY2NoZWNrbWFya2dldHBlZXJuYW1lZ2V0c29ja25hbWVnbG9iYWxBbGxvY2kvbyB0aW1lb3V0bVNwYW5NYW51YWxtZXRob2RhcmdzKG1pblRyaWdnZXI9bXN3c29jay5kbGxuZXRwb2xsSW5pdHBhcnNlIGVycm9ycmVmbGVjdC5TZXRyZWZsZWN0T2Zmc3J1bnRpbWU6IFAgcnVudGltZTo=e3:T554,bXN0YXJ0YmFkIHNlcXVlbmNlIG51bWJlcmJhZCB2YWx1ZSBmb3IgZmllbGRkZXZpY2Ugbm90IGEgc3RyZWFtZGlyZWN0b3J5IG5vdCBlbXB0eWRpc2sgcXVvdGEgZXhjZWVkZWRkb2RlbHRpbWVyOiB3cm9uZyBQZmlsZSBhbHJlYWR5IGNsb3NlZGZpbGUgYWxyZWFkeSBleGlzdHNmaWxlIGRvZXMgbm90IGV4aXN0bSBub3QgZm91bmQgaW4gYWxsbW1hcmtpbmcgZnJlZSBvYmplY3RtYXJrcm9vdDogYmFkIGluZGV4bWlzc2luZyBkZWZlcnJldHVybm1zcGFuLnN3ZWVwOiBzdGF0ZT1ub3Rlc2xlZXAgbm90IG9uIGcwbnRkbGwuZGxsIG5vdCBmb3VuZG53YWl0ID4gd29yay5ucHJvY3NwYW5pYyBkdXJpbmcgbWFsbG9jcGFuaWMgZHVyaW5nIHBhbmljcGFuaWMgaG9sZGluZyBsb2Nrc3Bhbmljd3JhcDogbm8gKCBpbiBwYW5pY3dyYXA6IG5vICkgaW4gcmVmbGVjdC5WYWx1ZS5CeXRlc3JlZmxlY3QuVmFsdWUuRmllbGRyZWZsZWN0LlZhbHVlLkZsb2F0cmVmbGVjdC5WYWx1ZS5JbmRleHJlZmxlY3QuVmFsdWUuSXNOaWxyZWZsZWN0LlZhbHVlLlNsaWNlcnVudGltZTogZzAgc3RhY2sgW3J1bnRpbWU6IHBjZGF0YSBpcyBydW50aW1lOiBwcmVlbXB0IGcwc2VtYVJvb3Qgcm90YXRlTGVmdHNraXAgdGhpcyBkaXJlY3RvcnlzdG9wbSBob2xkaW5nIGxvY2tzc3lzTWVtU3RhdCBvdmVyZmxvd3RvbyBtYW55IG9wZW4gZmlsZXN1bmV4cGVjdGVkIGcgc3RhdHVzdW5rbm93biB3YWl0IHJlYXNvbndpbm1tLmRsbCBub3QgZm91bmQgbWFya3Jvb3Qgam9icyBkb25lIHRvIHVuYWxsb2NhdGVkIHNwYW4zNzI1MjkwMjk4NDYxOTE0MDYyNUFyYWJpYyBTdGFuZGFyZCBUaW1lQXpvcmVzIFN0YW5kYXJkIFRpbWVDZXJ0T3BlblN5c3RlbVN0b3JlV0NyZWF0ZVByb2Nlc3NBc1VzZXJXQ3J5cHRBY3F1aXJlQ29udGV4dFdFZ3lwdGlhbl9IaWVyb2dseXBoc0dldEFjY2VwdEV4U29ja2FkZHJzR2V0QWRhcHRlcnNBZGRyZXNzZXNHZXRDdXJyZW50RGlyZWN0b3J5V0dldEZpbGVBdHRyaWJ1dGVzRXhXR2V0UHJvY2Vzc01lbW9yeQ==e4:T554,bXN0YXJ0YmFkIHNlcXVlbmNlIG51bWJlcmJhZCB2YWx1ZSBmb3IgZmllbGRkZXZpY2Ugbm90IGEgc3RyZWFtZGlyZWN0b3J5IG5vdCBlbXB0eWRpc2sgcXVvdGEgZXhjZWVkZWRkb2RlbHRpbWVyOiB3cm9uZyBQZmlsZSBhbHJlYWR5IGNsb3NlZGZpbGUgYWxyZWFkeSBleGlzdHNmaWxlIGRvZXMgbm90IGV4aXN0bSBub3QgZm91bmQgaW4gYWxsbW1hcmtpbmcgZnJlZSBvYmplY3RtYXJrcm9vdDogYmFkIGluZGV4bWlzc2luZyBkZWZlcnJldHVybm1zcGFuLnN3ZWVwOiBzdGF0ZT1ub3Rlc2xlZXAgbm90IG9uIGcwbnRkbGwuZGxsIG5vdCBmb3VuZG53YWl0ID4gd29yay5ucHJvY3NwYW5pYyBkdXJpbmcgbWFsbG9jcGFuaWMgZHVyaW5nIHBhbmljcGFuaWMgaG9sZGluZyBsb2Nrc3Bhbmljd3JhcDogbm8gKCBpbiBwYW5pY3dyYXA6IG5vICkgaW4gcmVmbGVjdC5WYWx1ZS5CeXRlc3JlZmxlY3QuVmFsdWUuRmllbGRyZWZsZWN0LlZhbHVlLkZsb2F0cmVmbGVjdC5WYWx1ZS5JbmRleHJlZmxlY3QuVmFsdWUuSXNOaWxyZWZsZWN0LlZhbHVlLlNsaWNlcnVudGltZTogZzAgc3RhY2sgW3J1bnRpbWU6IHBjZGF0YSBpcyBydW50aW1lOiBwcmVlbXB0IGcwc2VtYVJvb3Qgcm90YXRlTGVmdHNraXAgdGhpcyBkaXJlY3RvcnlzdG9wbSBob2xkaW5nIGxvY2tzc3lzTWVtU3RhdCBvdmVyZmxvd3RvbyBtYW55IG9wZW4gZmlsZXN1bmV4cGVjdGVkIGcgc3RhdHVzdW5rbm93biB3YWl0IHJlYXNvbndpbm1tLmRsbCBub3QgZm91bmQgbWFya3Jvb3Qgam9icyBkb25lIHRvIHVuYWxsb2NhdGVkIHNwYW4zNzI1MjkwMjk4NDYxOTE0MDYyNUFyYWJpYyBTdGFuZGFyZCBUaW1lQXpvcmVzIFN0YW5kYXJkIFRpbWVDZXJ0T3BlblN5c3RlbVN0b3JlV0NyZWF0ZVByb2Nlc3NBc1VzZXJXQ3J5cHRBY3F1aXJlQ29udGV4dFdFZ3lwdGlhbl9IaWVyb2dseXBoc0dldEFjY2VwdEV4U29ja2FkZHJzR2V0QWRhcHRlcnNBZGRyZXNzZXNHZXRDdXJyZW50RGlyZWN0b3J5V0dldEZpbGVBdHRyaWJ1dGVzRXhXR2V0UHJvY2Vzc01lbW9yeUk=e5:T554,bmZvSURTX1RyaW5hcnlfT3BlcmF0b3JJc3JhZWwgU3RhbmRhcmQgVGltZUpvcmRhbiBTdGFuZGFyZCBUaW1lTWVyb2l0aWNfSGllcm9nbHlwaHNNc2lDb25maWd1cmVQcm9kdWN0QU1zaURhdGFiYXNlT3BlblZpZXdBU2VlazogaW52YWxpZCBvZmZzZXRTZWVrOiBpbnZhbGlkIHdoZW5jZVNldEN1cnJlbnREaXJlY3RvcnlXU2V0SGFuZGxlSW5mb3JtYXRpb25UYWlwZWkgU3RhbmRhcmQgVGltZVRlcm1pbmFsX1B1bmN0dWF0aW9uVHVya2V5IFN0YW5kYXJkIFRpbWViYWQgZm9udCBmaWxlIGZvcm1hdGJhZCBzeXN0ZW0gcGFnZSBzaXplYmFkIHVzZSBvZiBidWNrZXQuYnBiYWQgdXNlIG9mIGJ1Y2tldC5tcGNoYW4gc2VuZCAobmlsIGNoYW4pY2xvc2Ugb2YgbmlsIGNoYW5uZWxjb25uZWN0aW9uIHRpbWVkIG91dGRvZGVsdGltZXIwOiB3cm9uZyBQZmxhZzogaGVscCByZXF1ZXN0ZWRmbG9hdGluZyBwb2ludCBlcnJvcmZvcmNlZ2M6IHBoYXNlIGVycm9yZ28gb2YgbmlsIGZ1bmMgdmFsdWVnb3Bhcms6IGJhZCBnIHN0YXR1c2ludmFsaWQgcmVxdWVzdCBjb2RlaW52YWxpZCB3cml0ZSByZXN1bHRpcyBhIG5hbWVkIHR5cGUgZmlsZWpzb246IFVubWFyc2hhbChuaWwganNvbjogVW5tYXJzaGFsKG5pbClqc29uOiBlcnJvciBjYWxsaW5nIGtleSBoYXMgYmVlbiByZXZva2VkbWFsbG9jIGR1cmluZyBzaWduYWxub3RldHNsZWVwIG5vdCBvbiBnMHAgbWNhY2hlIG5vdCBmbHVzaGVkcGFjZXI6IGFzc2lzdCByYXRpbz1wcmVlbXB0IG9mZiByZWFzb246IHJlZmxlY3QuVmFsdWUuU2V0SW50cmVmbGVjdC5tYWtlRnVuY1N0dWJydW50aW1lOiBkb3VibGUgd2FpdHNlbWFSb290IHJvdGF0ZVJpZ2h0dGltZTogaW52YWxpZCBudW1iZXJ0cmFjZTogb3V0IG9mIG1lbW9yeXdpcmVwOiBhbHJlYWR5IGluIGdvd29ya2J1ZiBpcyBub3QgZW1wdHl3cml0ZSBvZiBHbyBwb2ludGVyIHdzMl8zMi5kbGwgbm90IGZvdW5kIG9mIHVuZXhwb3J0ZWQgbWV0aG9kIHBjSGVhZGVyLnRleHRTdGFydD0gIHByZXZpb3VzIGFsbG9jQ291e6:T558,bmZvSURTX1RyaW5hcnlfT3BlcmF0b3JJc3JhZWwgU3RhbmRhcmQgVGltZUpvcmRhbiBTdGFuZGFyZCBUaW1lTWVyb2l0aWNfSGllcm9nbHlwaHNNc2lDb25maWd1cmVQcm9kdWN0QU1zaURhdGFiYXNlT3BlblZpZXdBU2VlazogaW52YWxpZCBvZmZzZXRTZWVrOiBpbnZhbGlkIHdoZW5jZVNldEN1cnJlbnREaXJlY3RvcnlXU2V0SGFuZGxlSW5mb3JtYXRpb25UYWlwZWkgU3RhbmRhcmQgVGltZVRlcm1pbmFsX1B1bmN0dWF0aW9uVHVya2V5IFN0YW5kYXJkIFRpbWViYWQgZm9udCBmaWxlIGZvcm1hdGJhZCBzeXN0ZW0gcGFnZSBzaXplYmFkIHVzZSBvZiBidWNrZXQuYnBiYWQgdXNlIG9mIGJ1Y2tldC5tcGNoYW4gc2VuZCAobmlsIGNoYW4pY2xvc2Ugb2YgbmlsIGNoYW5uZWxjb25uZWN0aW9uIHRpbWVkIG91dGRvZGVsdGltZXIwOiB3cm9uZyBQZmxhZzogaGVscCByZXF1ZXN0ZWRmbG9hdGluZyBwb2ludCBlcnJvcmZvcmNlZ2M6IHBoYXNlIGVycm9yZ28gb2YgbmlsIGZ1bmMgdmFsdWVnb3Bhcms6IGJhZCBnIHN0YXR1c2ludmFsaWQgcmVxdWVzdCBjb2RlaW52YWxpZCB3cml0ZSByZXN1bHRpcyBhIG5hbWVkIHR5cGUgZmlsZWpzb246IFVubWFyc2hhbChuaWwganNvbjogVW5tYXJzaGFsKG5pbClqc29uOiBlcnJvciBjYWxsaW5nIGtleSBoYXMgYmVlbiByZXZva2VkbWFsbG9jIGR1cmluZyBzaWduYWxub3RldHNsZWVwIG5vdCBvbiBnMHAgbWNhY2hlIG5vdCBmbHVzaGVkcGFjZXI6IGFzc2lzdCByYXRpbz1wcmVlbXB0IG9mZiByZWFzb246IHJlZmxlY3QuVmFsdWUuU2V0SW50cmVmbGVjdC5tYWtlRnVuY1N0dWJydW50aW1lOiBkb3VibGUgd2FpdHNlbWFSb290IHJvdGF0ZVJpZ2h0dGltZTogaW52YWxpZCBudW1iZXJ0cmFjZTogb3V0IG9mIG1lbW9yeXdpcmVwOiBhbHJlYWR5IGluIGdvd29ya2J1ZiBpcyBub3QgZW1wdHl3cml0ZSBvZiBHbyBwb2ludGVyIHdzMl8zMi5kbGwgbm90IGZvdW5kIG9mIHVuZXhwb3J0ZWQgbWV0aG9kIHBjSGVhZGVyLnRleHRTdGFydD0gIHByZXZpb3VzIGFsbG9jQ291bg==e7:T554,TnlpYWtlbmdfUHVhY2h1ZV9IbW9uZ1Bha2lzdGFuIFN0YW5kYXJkIFRpbWVQYW5pY2tlZDogJXZTdGFjazogJXZQYXJhZ3VheSBTdGFuZGFyZCBUaW1lUnRsR2V0TnRWZXJzaW9uTnVtYmVyc1Nha2hhbGluIFN0YW5kYXJkIFRpbWVTYW8gVG9tZSBTdGFuZGFyZCBUaW1lVGFzbWFuaWEgU3RhbmRhcmQgVGltZWFkZHJlc3MgYWxyZWFkeSBpbiB1c2VhZHZhcGkzMi5kbGwgbm90IGZvdW5kYXJndW1lbnQgbGlzdCB0b28gbG9uZ2Fzc2VtYmx5IGNoZWNrcyBmYWlsZWRiYWQgZy0+c3RhdHVzIGluIHJlYWR5YmFkIHN3ZWVwZ2VuIGluIHJlZmlsbGNhbm5vdCBhbGxvY2F0ZSBtZW1vcnljb21waWxlQ2FsbGFiY2s6IHR5cGUgZHVwbGljYXRlZCBkZWZlciBlbnRyeWZyZWVJbmRleCBpcyBub3QgdmFsaWRnZXRlbnYgYmVmb3JlIGVudiBpbml0aGVhZFRhaWxJbmRleCBvdmVyZmxvd2ludGVnZXIgZGl2aWRlIGJ5IHplcm9pbnRlcmZhY2UgY29udmVyc2lvbjoganNvbjogdW5rbm93biBmaWVsZCAlcWtlcm5lbDMyLmRsbCBub3QgZm91bmRtaW5wYyBvciBtYXhwYyBpbnZhbGlkbmV0d29yayBpcyB1bnJlYWNoYWJsZW5vbi1HbyBmdW5jdGlvbiBhdCBwYz1vbGRvdmVyZmxvdyBpcyBub3QgbmlscHJvdG9jb2wgbm90IGF2YWlsYWJsZXByb3RvY29sIG5vdCBzdXBwb3J0ZWRyZWZsZWN0LlZhbHVlLlNldEZsb2F0cmVtb3RlIGFkZHJlc3MgY2hhbmdlZHJ1bnRpbWUubWFpbiBub3Qgb24gbTBydW50aW1lOiB3b3JrLm53YWl0ID0gcnVudGltZTpzY2Fuc3RhY2s6IGdwPXMuZnJlZWluZGV4ID4gcy5uZWxlbXNzY2Fuc3RhY2sgLSBiYWQgc3RhdHVzc2VuZCBvbiBjbG9zZWQgY2hhbm5lbHNwYW4gaGFzIG5vIGZyZWUgc3BhY2VzdGFjayBub3QgYSBwb3dlciBvZiAydHJhY2UgcmVhZGVyIChibG9ja2VkKXRyYWNlOiBhbGxvYyB0b28gbGFyZ2V1bmV4cGVjdGVkIG1ldGhvZCBzdGVwd2lyZXA6IGludmFsaWQgcCBzdGF0ZSBpbnRvIEdvIHZhbHVlIG9mIHR5cGUgKSBtdXN0IGJlIGEgcG93ZXIgb2YgMjIzMjgzMDY0Mw==e8:T554,TnlpYWtlbmdfUHVhY2h1ZV9IbW9uZ1Bha2lzdGFuIFN0YW5kYXJkIFRpbWVQYW5pY2tlZDogJXZTdGFjazogJXZQYXJhZ3VheSBTdGFuZGFyZCBUaW1lUnRsR2V0TnRWZXJzaW9uTnVtYmVyc1Nha2hhbGluIFN0YW5kYXJkIFRpbWVTYW8gVG9tZSBTdGFuZGFyZCBUaW1lVGFzbWFuaWEgU3RhbmRhcmQgVGltZWFkZHJlc3MgYWxyZWFkeSBpbiB1c2VhZHZhcGkzMi5kbGwgbm90IGZvdW5kYXJndW1lbnQgbGlzdCB0b28gbG9uZ2Fzc2VtYmx5IGNoZWNrcyBmYWlsZWRiYWQgZy0+c3RhdHVzIGluIHJlYWR5YmFkIHN3ZWVwZ2VuIGluIHJlZmlsbGNhbm5vdCBhbGxvY2F0ZSBtZW1vcnljb21waWxlQ2FsbGFiY2s6IHR5cGUgZHVwbGljYXRlZCBkZWZlciBlbnRyeWZyZWVJbmRleCBpcyBub3QgdmFsaWRnZXRlbnYgYmVmb3JlIGVudiBpbml0aGVhZFRhaWxJbmRleCBvdmVyZmxvd2ludGVnZXIgZGl2aWRlIGJ5IHplcm9pbnRlcmZhY2UgY29udmVyc2lvbjoganNvbjogdW5rbm93biBmaWVsZCAlcWtlcm5lbDMyLmRsbCBub3QgZm91bmRtaW5wYyBvciBtYXhwYyBpbnZhbGlkbmV0d29yayBpcyB1bnJlYWNoYWJsZW5vbi1HbyBmdW5jdGlvbiBhdCBwYz1vbGRvdmVyZmxvdyBpcyBub3QgbmlscHJvdG9jb2wgbm90IGF2YWlsYWJsZXByb3RvY29sIG5vdCBzdXBwb3J0ZWRyZWZsZWN0LlZhbHVlLlNldEZsb2F0cmVtb3RlIGFkZHJlc3MgY2hhbmdlZHJ1bnRpbWUubWFpbiBub3Qgb24gbTBydW50aW1lOiB3b3JrLm53YWl0ID0gcnVudGltZTpzY2Fuc3RhY2s6IGdwPXMuZnJlZWluZGV4ID4gcy5uZWxlbXNzY2Fuc3RhY2sgLSBiYWQgc3RhdHVzc2VuZCBvbiBjbG9zZWQgY2hhbm5lbHNwYW4gaGFzIG5vIGZyZWUgc3BhY2VzdGFjayBub3QgYSBwb3dlciBvZiAydHJhY2UgcmVhZGVyIChibG9ja2VkKXRyYWNlOiBhbGxvYyB0b28gbGFyZ2V1bmV4cGVjdGVkIG1ldGhvZCBzdGVwd2lyZXA6IGludmFsaWQgcCBzdGF0ZSBpbnRvIEdvIHZhbHVlIG9mIHR5cGUgKSBtdXN0IGJlIGEgcG93ZXIgb2YgMjIzMjgzMDY0MzY=e9:T554,b2MxOiBuZXdnIG1pc3Npbmcgc3RhY2tvczogcHJvY2VzcyBhbHJlYWR5IGZpbmlzaGVkcHJvdG9jb2wgZHJpdmVyIG5vdCBhdHRhY2hlZHJlZmxlY3QuTWFrZVNsaWNlOiBsZW4gPiBjYXByZWdpb24gZXhjZWVkcyB1aW50cHRyIHJhbmdlcnVudGltZS5zZW1hc2xlZXAgdW5leHBlY3RlZHJ1bnRpbWU6IGNhc2dzdGF0dXM6IG9sZHZhbD1ydW50aW1lOiBubyBtb2R1bGUgZGF0YSBmb3Igc2F2ZSBvbiBzeXN0ZW0gZyBub3QgYWxsb3dlZHVuZXhwZWN0ZWQgZW5kIG9mIEpTT04gaW5wdXQgY2Fubm90IGJlIGNvbnZlcnRlZCB0byB0eXBlIDQ1NDc0NzM1MDg4NjQ2NDExODk1NzUxOTUzMTI1Q2VudHJhbCBBbWVyaWNhIFN0YW5kYXJkIFRpbWVDZW50cmFsIFBhY2lmaWMgU3RhbmRhcmQgVGltZUNoYXRoYW0gSXNsYW5kcyBTdGFuZGFyZCBUaW1lREVQTE9ZTUVOVElEPSV2IEFTS0ZPUk5BTUU9JXZEZWxldGVQcm9jVGhyZWFkQXR0cmlidXRlTGlzdExvY2tPU1RocmVhZCBuZXN0aW5nIG92ZXJmbG93TXNpRGF0YWJhc2VHZW5lcmF0ZVRyYW5zZm9ybUFOLiBDZW50cmFsIEFzaWEgU3RhbmRhcmQgVGltZU5vcnRoIEFzaWEgRWFzdCBTdGFuZGFyZCBUaW1lV293NjRSZXZlcnRXb3c2NEZzUmVkaXJlY3Rpb25hZGRzcGVjaWFsIG9uIGludmFsaWQgcG9pbnRlcmRvUmVjb3JkR29yb3V0aW5lUHJvZmlsZSBncDE9Z2MgZG9uZSBidXQgZ2NwaGFzZSAhPSBfR0NvZmZnZnB1dDogYmFkIHN0YXR1cyAobm90IEdkZWFkKWludmFsaWQgZnVuY3Rpb24gc3ltYm9sIHRhYmxlaW52YWxpZCBsZW5ndGggb2YgdHJhY2UgZXZlbnRpbzogcmVhZC93cml0ZSBvbiBjbG9zZWQgcGlwZW1hY2hpbmUgaXMgbm90IG9uIHRoZSBuZXR3b3JrbmVlZCBwYWRkaW5nIGluIGJ1Y2tldCAoZWxlbSlubyBYRU5JWCBzZW1hcGhvcmVzIGF2YWlsYWJsZW5vdGVzbGVlcCAtIHdhaXRtIG91dCBvZiBzeW5jbnVtZXJpY2FsIHJlc3VsdCBvdXQgb2YgcmFuZ2VvcGVyYXRpb24gYWxyZWFkeSBpbiBwcm9ncmVzc3BhZGRpbmcgY29udGFpbmVkIGluIGFsea:T558,b2MxOiBuZXdnIG1pc3Npbmcgc3RhY2tvczogcHJvY2VzcyBhbHJlYWR5IGZpbmlzaGVkcHJvdG9jb2wgZHJpdmVyIG5vdCBhdHRhY2hlZHJlZmxlY3QuTWFrZVNsaWNlOiBsZW4gPiBjYXByZWdpb24gZXhjZWVkcyB1aW50cHRyIHJhbmdlcnVudGltZS5zZW1hc2xlZXAgdW5leHBlY3RlZHJ1bnRpbWU6IGNhc2dzdGF0dXM6IG9sZHZhbD1ydW50aW1lOiBubyBtb2R1bGUgZGF0YSBmb3Igc2F2ZSBvbiBzeXN0ZW0gZyBub3QgYWxsb3dlZHVuZXhwZWN0ZWQgZW5kIG9mIEpTT04gaW5wdXQgY2Fubm90IGJlIGNvbnZlcnRlZCB0byB0eXBlIDQ1NDc0NzM1MDg4NjQ2NDExODk1NzUxOTUzMTI1Q2VudHJhbCBBbWVyaWNhIFN0YW5kYXJkIFRpbWVDZW50cmFsIFBhY2lmaWMgU3RhbmRhcmQgVGltZUNoYXRoYW0gSXNsYW5kcyBTdGFuZGFyZCBUaW1lREVQTE9ZTUVOVElEPSV2IEFTS0ZPUk5BTUU9JXZEZWxldGVQcm9jVGhyZWFkQXR0cmlidXRlTGlzdExvY2tPU1RocmVhZCBuZXN0aW5nIG92ZXJmbG93TXNpRGF0YWJhc2VHZW5lcmF0ZVRyYW5zZm9ybUFOLiBDZW50cmFsIEFzaWEgU3RhbmRhcmQgVGltZU5vcnRoIEFzaWEgRWFzdCBTdGFuZGFyZCBUaW1lV293NjRSZXZlcnRXb3c2NEZzUmVkaXJlY3Rpb25hZGRzcGVjaWFsIG9uIGludmFsaWQgcG9pbnRlcmRvUmVjb3JkR29yb3V0aW5lUHJvZmlsZSBncDE9Z2MgZG9uZSBidXQgZ2NwaGFzZSAhPSBfR0NvZmZnZnB1dDogYmFkIHN0YXR1cyAobm90IEdkZWFkKWludmFsaWQgZnVuY3Rpb24gc3ltYm9sIHRhYmxlaW52YWxpZCBsZW5ndGggb2YgdHJhY2UgZXZlbnRpbzogcmVhZC93cml0ZSBvbiBjbG9zZWQgcGlwZW1hY2hpbmUgaXMgbm90IG9uIHRoZSBuZXR3b3JrbmVlZCBwYWRkaW5nIGluIGJ1Y2tldCAoZWxlbSlubyBYRU5JWCBzZW1hcGhvcmVzIGF2YWlsYWJsZW5vdGVzbGVlcCAtIHdhaXRtIG91dCBvZiBzeW5jbnVtZXJpY2FsIHJlc3VsdCBvdXQgb2YgcmFuZ2VvcGVyYXRpb24gYWxyZWFkeSBpbiBwcm9ncmVzc3BhZGRpbmcgY29udGFpbmVkIGluIGFscA==eb:T550,b25pbmcgR0MgdG8gdGhlIHNhbWUgc3RhdGUgYXMgYmVmb3JlP3RyaWVkIHRvIHJ1biBzY2F2ZW5nZXIgZnJvbSBhbm90aGVyIGdvcm91dGluZXVuc2FmZS5TdHJpbmc6IHB0ciBpcyBuaWwgYW5kIGxlbiBpcyBub3QgemVybyAoYmFkIHVzZSBvZiB1bnNhZmUuUG9pbnRlcj8gdHJ5IC1kPWNoZWNrcHRyKUFnZW50IGFscmVhZHkgaW5zdGFsbGVkLCBza2lwcGluZyBpbnN0YWxsYXRpb25FcnJvciBydW5uaW5nIE1zaURhdGFiYXNlR2VuZXJhdGVUcmFuc2Zvcm06ICV2U0VMRUNUIFZhbHVlIEZST00gUHJvcGVydHkgV0hFUkUgUHJvcGVydHk9JyV2J1RpbWUuVW5tYXJzaGFsSlNPTjogaW5wdXQgaXMgbm90IGEgSlNPTiBzdHJpbmdtZW1vcnkgcmVzZXJ2YXRpb24gZXhjZWVkcyBhZGRyZXNzIHNwYWNlIGxpbWl0cGFuaWN3cmFwOiB1bmV4cGVjdGVkIHN0cmluZyBhZnRlciB0eXBlIG5hbWU6IHJlZmxlY3QuVmFsdWUuU2xpY2U6IHNsaWNlIGluZGV4IG91dCBvZiBib3VuZHNyZWxlYXNlZCBsZXNzIHRoYW4gb25lIHBoeXNpY2FsIHBhZ2Ugb2YgbWVtb3J5cnVudGltZTogZmFpbGVkIHRvIGNyZWF0ZSBuZXcgT1MgdGhyZWFkIChoYXZlIHJ1bnRpbWU6IG5hbWUgb2Zmc2V0IGJhc2UgcG9pbnRlciBvdXQgb2YgcmFuZ2VydW50aW1lOiBwYW5pYyBiZWZvcmUgbWFsbG9jIGhlYXAgaW5pdGlhbGl6ZWRydW50aW1lOiB0ZXh0IG9mZnNldCBiYXNlIHBvaW50ZXIgb3V0IG9mIHJhbmdlcnVudGltZTogdHlwZSBvZmZzZXQgYmFzZSBwb2ludGVyIG91dCBvZiByYW5nZXNpZ25hbCBhcnJpdmVkIGR1cmluZyBleHRlcm5hbCBjb2RlIGV4ZWN1dGlvbnNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzoleF0gd2l0aCBsZW5ndGggJXlzdG9wVGhlV29ybGQ6IG5vdCBzdG9wcGVkIChzdGF0dXMgIT0gX1BnY3N0b3Apc3lzR3JvdyBib3VuZHMgbm90IGFsaWduZWQgdG8gcGFsbG9jQ2h1bmtCeXRlc3RyaWVkIHRvIHBhcmsgc2NhdmVuZ2VyIGZyb20gYW5vdGhlciBnb3JvdXRpbmVFcnJvciBjYWxsaW5nIE1zaURhdGFiec:T554,b25pbmcgR0MgdG8gdGhlIHNhbWUgc3RhdGUgYXMgYmVmb3JlP3RyaWVkIHRvIHJ1biBzY2F2ZW5nZXIgZnJvbSBhbm90aGVyIGdvcm91dGluZXVuc2FmZS5TdHJpbmc6IHB0ciBpcyBuaWwgYW5kIGxlbiBpcyBub3QgemVybyAoYmFkIHVzZSBvZiB1bnNhZmUuUG9pbnRlcj8gdHJ5IC1kPWNoZWNrcHRyKUFnZW50IGFscmVhZHkgaW5zdGFsbGVkLCBza2lwcGluZyBpbnN0YWxsYXRpb25FcnJvciBydW5uaW5nIE1zaURhdGFiYXNlR2VuZXJhdGVUcmFuc2Zvcm06ICV2U0VMRUNUIFZhbHVlIEZST00gUHJvcGVydHkgV0hFUkUgUHJvcGVydHk9JyV2J1RpbWUuVW5tYXJzaGFsSlNPTjogaW5wdXQgaXMgbm90IGEgSlNPTiBzdHJpbmdtZW1vcnkgcmVzZXJ2YXRpb24gZXhjZWVkcyBhZGRyZXNzIHNwYWNlIGxpbWl0cGFuaWN3cmFwOiB1bmV4cGVjdGVkIHN0cmluZyBhZnRlciB0eXBlIG5hbWU6IHJlZmxlY3QuVmFsdWUuU2xpY2U6IHNsaWNlIGluZGV4IG91dCBvZiBib3VuZHNyZWxlYXNlZCBsZXNzIHRoYW4gb25lIHBoeXNpY2FsIHBhZ2Ugb2YgbWVtb3J5cnVudGltZTogZmFpbGVkIHRvIGNyZWF0ZSBuZXcgT1MgdGhyZWFkIChoYXZlIHJ1bnRpbWU6IG5hbWUgb2Zmc2V0IGJhc2UgcG9pbnRlciBvdXQgb2YgcmFuZ2VydW50aW1lOiBwYW5pYyBiZWZvcmUgbWFsbG9jIGhlYXAgaW5pdGlhbGl6ZWRydW50aW1lOiB0ZXh0IG9mZnNldCBiYXNlIHBvaW50ZXIgb3V0IG9mIHJhbmdlcnVudGltZTogdHlwZSBvZmZzZXQgYmFzZSBwb2ludGVyIG91dCBvZiByYW5nZXNpZ25hbCBhcnJpdmVkIGR1cmluZyBleHRlcm5hbCBjb2RlIGV4ZWN1dGlvbnNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzoleF0gd2l0aCBsZW5ndGggJXlzdG9wVGhlV29ybGQ6IG5vdCBzdG9wcGVkIChzdGF0dXMgIT0gX1BnY3N0b3Apc3lzR3JvdyBib3VuZHMgbm90IGFsaWduZWQgdG8gcGFsbG9jQ2h1bmtCeXRlc3RyaWVkIHRvIHBhcmsgc2NhdmVuZ2VyIGZyb20gYW5vdGhlciBnb3JvdXRpbmVFcnJvciBjYWxsaW5nIE1zaURhdGFiYQ==ed:T550,cHJvZk1lbUFjdGl2ZXByb2ZNZW1GdXR1cmVydW50aW1lOiBzZXE9cnVudGltZTogdmFsPXNybW91bnQgZXJyb3J0ZXN0UkludGVybmFsdGltZXIgZXhwaXJlZHRyYWNlU3RhY2tUYWJ1bmltcGxlbWVudGVkdmFsdWUgbWV0aG9kIHhhZGQ2NCBmYWlsZWR4Y2hnNjQgZmFpbGVkfXNjaGVkPXtwYzogbmVlZHNwaW5uaW5nPSBubWlkbGVsb2NrZWQ9IG9uIHplcm8gVmFsdWUgb3V0IG9mIHJhbmdlICBwcm9jZWR1cmUgaW4gIHRvIGZpbmFsaXplciAgdW50eXBlZCBhcmdzIC10aHJlYWQgbGltaXQxOTA3MzQ4NjMyODEyNTk1MzY3NDMxNjQwNjI1OiBleHRyYSB0ZXh0OiBDZXJ0Q2xvc2VTdG9yZUNyZWF0ZVByb2Nlc3NXQ3J5cHRHZW5SYW5kb21GaW5kRmlyc3RGaWxlV0Zvcm1hdE1lc3NhZ2VXR0MgYXNzaXN0IHdhaXRHQyB3b3JrZXIgaW5pdEdldENvbnNvbGVNb2RlR2V0UHJvY0FkZHJlc3NHZXRVc2VyTmFtZUV4V0lzV293NjRQcm9jZXNzTUI7IGFsbG9jYXRlZCBNb2R1bGUzMkZpcnN0V01zaUNsb3NlSGFuZGxlTXNpVmlld0V4ZWN1dGVOZXRVc2VyR2V0SW5mb090aGVyX0lEX1N0YXJ0UGF0dGVybl9TeW50YXhQcm9jZXNzMzJOZXh0V1F1b3RhdGlvbl9NYXJrUmVnU2V0VmFsdWVFeFdTZXRGaWxlUG9pbnRlclRyYW5zbGF0ZU5hbWVXYWxsb2NmcmVldHJhY2ViYWQgYWxsb2NDb3VudGJhZCByZXN0YXJ0IFBDYmFkIHNwYW4gc3RhdGVmaWxlIHRvbyBsYXJnZWZpbmFsaXplciB3YWl0Z2NzdG9wdGhld29ybGRnZXRwcm90b2J5bmFtZWludmFsaWQgc3ludGF4aXMgYSBkaXJlY3RvcnlrZXkgc2l6ZSB3cm9uZ2xldmVsIDIgaGFsdGVkbGV2ZWwgMyBoYWx0ZWRtZW1wcm9maWxlcmF0ZW5pbCBlbGVtIHR5cGUhbm8gbW9kdWxlIGRhdGFubyBzdWNoIGRldmljZXByb3RvY29sIGVycm9ycmVmbGVjdC5WYWx1ZS5ydW50aW1lOiBmdWxsPXJ1bnRpbWU6IHdhbnQ9cy5hbGxvY0NvdW50PSBzZW1hUm9vdCBxdWV1ZXN0YWNrIG92ZXJmbG93c3RvcG0gc3Bpbm5pbmdzdG9yZTY0IGZhaWxlZHN5bmMuQ29uZC5XYWl0ee:T554,cHJvZk1lbUFjdGl2ZXByb2ZNZW1GdXR1cmVydW50aW1lOiBzZXE9cnVudGltZTogdmFsPXNybW91bnQgZXJyb3J0ZXN0UkludGVybmFsdGltZXIgZXhwaXJlZHRyYWNlU3RhY2tUYWJ1bmltcGxlbWVudGVkdmFsdWUgbWV0aG9kIHhhZGQ2NCBmYWlsZWR4Y2hnNjQgZmFpbGVkfXNjaGVkPXtwYzogbmVlZHNwaW5uaW5nPSBubWlkbGVsb2NrZWQ9IG9uIHplcm8gVmFsdWUgb3V0IG9mIHJhbmdlICBwcm9jZWR1cmUgaW4gIHRvIGZpbmFsaXplciAgdW50eXBlZCBhcmdzIC10aHJlYWQgbGltaXQxOTA3MzQ4NjMyODEyNTk1MzY3NDMxNjQwNjI1OiBleHRyYSB0ZXh0OiBDZXJ0Q2xvc2VTdG9yZUNyZWF0ZVByb2Nlc3NXQ3J5cHRHZW5SYW5kb21GaW5kRmlyc3RGaWxlV0Zvcm1hdE1lc3NhZ2VXR0MgYXNzaXN0IHdhaXRHQyB3b3JrZXIgaW5pdEdldENvbnNvbGVNb2RlR2V0UHJvY0FkZHJlc3NHZXRVc2VyTmFtZUV4V0lzV293NjRQcm9jZXNzTUI7IGFsbG9jYXRlZCBNb2R1bGUzMkZpcnN0V01zaUNsb3NlSGFuZGxlTXNpVmlld0V4ZWN1dGVOZXRVc2VyR2V0SW5mb090aGVyX0lEX1N0YXJ0UGF0dGVybl9TeW50YXhQcm9jZXNzMzJOZXh0V1F1b3RhdGlvbl9NYXJrUmVnU2V0VmFsdWVFeFdTZXRGaWxlUG9pbnRlclRyYW5zbGF0ZU5hbWVXYWxsb2NmcmVldHJhY2ViYWQgYWxsb2NDb3VudGJhZCByZXN0YXJ0IFBDYmFkIHNwYW4gc3RhdGVmaWxlIHRvbyBsYXJnZWZpbmFsaXplciB3YWl0Z2NzdG9wdGhld29ybGRnZXRwcm90b2J5bmFtZWludmFsaWQgc3ludGF4aXMgYSBkaXJlY3RvcnlrZXkgc2l6ZSB3cm9uZ2xldmVsIDIgaGFsdGVkbGV2ZWwgMyBoYWx0ZWRtZW1wcm9maWxlcmF0ZW5pbCBlbGVtIHR5cGUhbm8gbW9kdWxlIGRhdGFubyBzdWNoIGRldmljZXByb3RvY29sIGVycm9ycmVmbGVjdC5WYWx1ZS5ydW50aW1lOiBmdWxsPXJ1bnRpbWU6IHdhbnQ9cy5hbGxvY0NvdW50PSBzZW1hUm9vdCBxdWV1ZXN0YWNrIG92ZXJmbG93c3RvcG0gc3Bpbm5pbmdzdG9yZTY0IGZhaWxlZHN5bmMuQ29uZC5XYWl0dA==ef:T554,cnVudGltZTpzdG9wbG9ja2VkbTogbG9ja2VkZyAoYXRvbWljc3RhdHVzPXVuZmluaXNoZWQgb3Blbi1jb2RlZCBkZWZlcnMgaW4gZGVmZXJyZXR1cm51bmtub3duIHJ1bm5hYmxlIGdvcm91dGluZSBkdXJpbmcgYm9vdHN0cmFwIHVzaW5nIHZhbHVlIG9idGFpbmVkIHVzaW5nIHVuZXhwb3J0ZWQgZmllbGRDcmVhdGUgYW4gTVNJIGFuZCBNU1QgZmlsZSBmb3IgQUQgZGVwbG95bWVudGFjdGl2ZSBzd2VlcGVycyBmb3VuZCBhdCBzdGFydCBvZiBtYXJrIHBoYXNlY29tcGlsZUNhbGxiYWNrOiBmbG9hdCByZXN1bHRzIG5vdCBzdXBwb3J0ZWRlbmNvZGluZyBhbHBoYWJldCBjb250YWlucyBuZXdsaW5lIGNoYXJhY3RlcmdjbWFya25ld29iamVjdCBjYWxsZWQgd2hpbGUgZG9pbmcgY2hlY2ttYXJrbXVsdDEyOGJpdFBvdzEwOiBwb3dlciBvZiAxMCBpcyBvdXQgb2YgcmFuZ2VubyBQIGF2YWlsYWJsZSwgd3JpdGUgYmFycmllcnMgYXJlIGZvcmJpZGRlbm91dCBvZiBtZW1vcnkgYWxsb2NhdGluZyBoZWFwIGFyZW5hIG1ldGFkYXRhcmVmbGVjdDogZnVuY0xheW91dCB3aXRoIGludGVyZmFjZSByZWNlaXZlciByZWZsZWN0OiBzbGljZSBsZW5ndGggb3V0IG9mIHJhbmdlIGluIFNldExlbnNwYW4gb24gdXNlckFyZW5hLmZhdWx0TGlzdCBoYXMgaW52YWxpZCBzaXpldW5zYWZlLlNsaWNlOiBwdHIgaXMgbmlsIGFuZCBsZW4gaXMgbm90IHplcm9jYW5ub3Qgc2VuZCBhZnRlciB0cmFuc3BvcnQgZW5kcG9pbnQgc2h1dGRvd25leGl0c3lzY2FsbDogc3lzY2FsbCBmcmFtZSBpcyBubyBsb25nZXIgdmFsaWRwcm9kdWNlZCBhIHRyaWdnZXIgZ3JlYXRlciB0aGFuIHRoZSBoZWFwIGdvYWxyZWZsZWN0OiBpbnRlcm5hbCBlcnJvcjogaW52YWxpZCBtZXRob2QgaW5kZXhydW50aW1lLm1pbml0OiBkdXBsaWNhdGVoYW5kbGUgZmFpbGVkOyBlcnJubz1ydW50aW1lOiBDcmVhdGVXYWl0YWJsZVRpbWVyRXggZmFpbGVkOyBlcnJubz1ydW50aW1lOiBmYWlsZWQgbVNwYW5MaXN0LnJlbW92ZSBzcGFuLm5wYWdlcz10cmFuc2l0f0:T558,cnVudGltZTpzdG9wbG9ja2VkbTogbG9ja2VkZyAoYXRvbWljc3RhdHVzPXVuZmluaXNoZWQgb3Blbi1jb2RlZCBkZWZlcnMgaW4gZGVmZXJyZXR1cm51bmtub3duIHJ1bm5hYmxlIGdvcm91dGluZSBkdXJpbmcgYm9vdHN0cmFwIHVzaW5nIHZhbHVlIG9idGFpbmVkIHVzaW5nIHVuZXhwb3J0ZWQgZmllbGRDcmVhdGUgYW4gTVNJIGFuZCBNU1QgZmlsZSBmb3IgQUQgZGVwbG95bWVudGFjdGl2ZSBzd2VlcGVycyBmb3VuZCBhdCBzdGFydCBvZiBtYXJrIHBoYXNlY29tcGlsZUNhbGxiYWNrOiBmbG9hdCByZXN1bHRzIG5vdCBzdXBwb3J0ZWRlbmNvZGluZyBhbHBoYWJldCBjb250YWlucyBuZXdsaW5lIGNoYXJhY3RlcmdjbWFya25ld29iamVjdCBjYWxsZWQgd2hpbGUgZG9pbmcgY2hlY2ttYXJrbXVsdDEyOGJpdFBvdzEwOiBwb3dlciBvZiAxMCBpcyBvdXQgb2YgcmFuZ2VubyBQIGF2YWlsYWJsZSwgd3JpdGUgYmFycmllcnMgYXJlIGZvcmJpZGRlbm91dCBvZiBtZW1vcnkgYWxsb2NhdGluZyBoZWFwIGFyZW5hIG1ldGFkYXRhcmVmbGVjdDogZnVuY0xheW91dCB3aXRoIGludGVyZmFjZSByZWNlaXZlciByZWZsZWN0OiBzbGljZSBsZW5ndGggb3V0IG9mIHJhbmdlIGluIFNldExlbnNwYW4gb24gdXNlckFyZW5hLmZhdWx0TGlzdCBoYXMgaW52YWxpZCBzaXpldW5zYWZlLlNsaWNlOiBwdHIgaXMgbmlsIGFuZCBsZW4gaXMgbm90IHplcm9jYW5ub3Qgc2VuZCBhZnRlciB0cmFuc3BvcnQgZW5kcG9pbnQgc2h1dGRvd25leGl0c3lzY2FsbDogc3lzY2FsbCBmcmFtZSBpcyBubyBsb25nZXIgdmFsaWRwcm9kdWNlZCBhIHRyaWdnZXIgZ3JlYXRlciB0aGFuIHRoZSBoZWFwIGdvYWxyZWZsZWN0OiBpbnRlcm5hbCBlcnJvcjogaW52YWxpZCBtZXRob2QgaW5kZXhydW50aW1lLm1pbml0OiBkdXBsaWNhdGVoYW5kbGUgZmFpbGVkOyBlcnJubz1ydW50aW1lOiBDcmVhdGVXYWl0YWJsZVRpbWVyRXggZmFpbGVkOyBlcnJubz1ydW50aW1lOiBmYWlsZWQgbVNwYW5MaXN0LnJlbW92ZSBzcGFuLm5wYWdlcz10cmFuc2l0aQ==f1:T554,U0EgRWFzdGVybiBTdGFuZGFyZCBUaW1lU0EgUGFjaWZpYyBTdGFuZGFyZCBUaW1lU0EgV2VzdGVybiBTdGFuZGFyZCBUaW1lVVMgRWFzdGVybiBTdGFuZGFyZCBUaW1lYmFkIGRlZmVyIGVudHJ5IGluIHBhbmljYnlwYXNzZWQgcmVjb3ZlcnkgZmFpbGVkY2FuJ3Qgc2NhbiBvdXIgb3duIHN0YWNrY29ubmVjdGlvbiByZXNldCBieSBwZWVyZG91YmxlIHRyYWNlR0NTd2VlcFN0YXJ0ZnVuY3Rpb24gbm90IGltcGxlbWVudGVkZ2NEcmFpbk4gcGhhc2UgaW5jb3JyZWN0aGFzaCBvZiB1bmhhc2hhYmxlIHR5cGUganNvbjogdW5zdXBwb3J0ZWQgdHlwZTogbGV2ZWwgMiBub3Qgc3luY2hyb25pemVkbGluayBudW1iZXIgb3V0IG9mIHJhbmdlbm90IHN1cHBvcnRlZCBieSB3aW5kb3dzb3V0IG9mIHN0cmVhbXMgcmVzb3VyY2VzcGFnZUFsbG9jOiBvdXQgb2YgbWVtb3J5cXVldWVmaW5hbGl6ZXIgZHVyaW5nIEdDcmFuZ2UgcGFydGlhbGx5IG92ZXJsYXBzcnVucXN0ZWFsOiBydW5xIG92ZXJmbG93cnVudGltZTogVmlydHVhbEZyZWUgb2YgcnVudGltZTogZm91bmQgb2JqIGF0ICoocnVudGltZTogbWFya3Jvb3QgaW5kZXggcnVudGltZTogcC5zZWFyY2hBZGRyID0gc3BhbiBoYXMgbm8gZnJlZSBvYmplY3Rzc3RhY2sgdHJhY2UgdW5hdmFpbGFibGVzdHJ1Y3R1cmUgbmVlZHMgY2xlYW5pbmd1cGRhdGUgZHVyaW5nIHRyYW5zaXRpb24gYnl0ZXMgZmFpbGVkIHdpdGggZXJybm89IHRvIHVudXNlZCByZWdpb24gb2Ygc3BhbjIwMDYtMDEtMDJUMTU6MDQ6MDVaMDc6MDAyOTEwMzgzMDQ1NjczMzcwMzYxMzI4MTI1QVVTIENlbnRyYWwgU3RhbmRhcmQgVGltZUFVUyBFYXN0ZXJuIFN0YW5kYXJkIFRpbWVBZmdoYW5pc3RhbiBTdGFuZGFyZCBUaW1lRXJyb3IgY2xvc2luZyB0bXBGaWxlOiAldkVycm9yIGdldHRpbmcgZXhlUGF0aDogJXZFcnJvciBvcGVuaW5nIGxvZ2ZpbGU6ICV2RXJyb3Igd3JpdGluZyB0bXBGaWxlOiAldkV4cGFuZEVudmlyb25tZW50U3RyaW5nc1dGbGVldERlY2sgQWdlbnQgSW5zdGFsbGVyR08=f2:T554,U0EgRWFzdGVybiBTdGFuZGFyZCBUaW1lU0EgUGFjaWZpYyBTdGFuZGFyZCBUaW1lU0EgV2VzdGVybiBTdGFuZGFyZCBUaW1lVVMgRWFzdGVybiBTdGFuZGFyZCBUaW1lYmFkIGRlZmVyIGVudHJ5IGluIHBhbmljYnlwYXNzZWQgcmVjb3ZlcnkgZmFpbGVkY2FuJ3Qgc2NhbiBvdXIgb3duIHN0YWNrY29ubmVjdGlvbiByZXNldCBieSBwZWVyZG91YmxlIHRyYWNlR0NTd2VlcFN0YXJ0ZnVuY3Rpb24gbm90IGltcGxlbWVudGVkZ2NEcmFpbk4gcGhhc2UgaW5jb3JyZWN0aGFzaCBvZiB1bmhhc2hhYmxlIHR5cGUganNvbjogdW5zdXBwb3J0ZWQgdHlwZTogbGV2ZWwgMiBub3Qgc3luY2hyb25pemVkbGluayBudW1iZXIgb3V0IG9mIHJhbmdlbm90IHN1cHBvcnRlZCBieSB3aW5kb3dzb3V0IG9mIHN0cmVhbXMgcmVzb3VyY2VzcGFnZUFsbG9jOiBvdXQgb2YgbWVtb3J5cXVldWVmaW5hbGl6ZXIgZHVyaW5nIEdDcmFuZ2UgcGFydGlhbGx5IG92ZXJsYXBzcnVucXN0ZWFsOiBydW5xIG92ZXJmbG93cnVudGltZTogVmlydHVhbEZyZWUgb2YgcnVudGltZTogZm91bmQgb2JqIGF0ICoocnVudGltZTogbWFya3Jvb3QgaW5kZXggcnVudGltZTogcC5zZWFyY2hBZGRyID0gc3BhbiBoYXMgbm8gZnJlZSBvYmplY3Rzc3RhY2sgdHJhY2UgdW5hdmFpbGFibGVzdHJ1Y3R1cmUgbmVlZHMgY2xlYW5pbmd1cGRhdGUgZHVyaW5nIHRyYW5zaXRpb24gYnl0ZXMgZmFpbGVkIHdpdGggZXJybm89IHRvIHVudXNlZCByZWdpb24gb2Ygc3BhbjIwMDYtMDEtMDJUMTU6MDQ6MDVaMDc6MDAyOTEwMzgzMDQ1NjczMzcwMzYxMzI4MTI1QVVTIENlbnRyYWwgU3RhbmRhcmQgVGltZUFVUyBFYXN0ZXJuIFN0YW5kYXJkIFRpbWVBZmdoYW5pc3RhbiBTdGFuZGFyZCBUaW1lRXJyb3IgY2xvc2luZyB0bXBGaWxlOiAldkVycm9yIGdldHRpbmcgZXhlUGF0aDogJXZFcnJvciBvcGVuaW5nIGxvZ2ZpbGU6ICV2RXJyb3Igd3JpdGluZyB0bXBGaWxlOiAldkV4cGFuZEVudmlyb25tZW50U3RyaW5nc1dGbGVldERlY2sgQWdlbnQgSW5zdGFsbGVyR09Ef3:T45c,U2FpbnQgUGllcnJlIFN0YW5kYXJkIFRpbWVTZXRGaWxlSW5mb3JtYXRpb25CeUhhbmRsZVNvdXRoIEFmcmljYSBTdGFuZGFyZCBUaW1lVy4gQXVzdHJhbGlhIFN0YW5kYXJkIFRpbWVXZXN0IFBhY2lmaWMgU3RhbmRhcmQgVGltZWNvcnJ1cHRlZCBzZW1hcGhvcmUgdGlja2V0ZW5jb3VudGVyZWQgYSBjeWNsZSB2aWEgJXNlbnRlcnN5c2NhbGwgaW5jb25zaXN0ZW50IGZvckVhY2hQOiBQIGRpZCBub3QgcnVuIGZuZnJlZWRlZmVyIHdpdGggZC5mbiAhPSBuaWxpbnZhbGlkIHJlcXVlc3QgZGVzY3JpcHRvcm5hbWUgbm90IHVuaXF1ZSBvbiBuZXR3b3JrbmVnYXRpdmUgaWRsZSBtYXJrIHdvcmtlcnNubyBDU0kgc3RydWN0dXJlIGF2YWlsYWJsZW5vIG1lc3NhZ2Ugb2YgZGVzaXJlZCB0eXBlbm90ZXdha2V1cCAtIGRvdWJsZSB3YWtldXBvdXQgb2YgbWVtb3J5IChzdGFja2FsbG9jKXBlcnNpc3RlbnRhbGxvYzogc2l6ZSA9PSAwcmVmbGVjdC5WYWx1ZS5PdmVyZmxvd1VpbnRyZXF1aXJlZCBrZXkgbm90IGF2YWlsYWJsZXJ1bnRpbWU6IGJhZCBzcGFuIHMuc3RhdGU9cnVudGltZTogcGNIZWFkZXI6IG1hZ2ljPSBzaHJpbmtpbmcgc3RhY2sgaW4gbGliY2FsbHN0YXJ0bG9ja2VkbTogbG9ja2VkIHRvIG1ldW5rbm93biBBQkkgcGFyYW1ldGVyIGtpbmR1c2Ugb2YgaW52YWxpZCBzd2VlcExvY2tlcndha2VwOiBuZWdhdGl2ZSBubXNwaW5uaW5nIGlzIG5vdCBhc3NpZ25hYmxlIHRvIHR5cGUgIG5vdCBpbiBzdGFjayByb290cyByYW5nZSBbMzYzNzk3ODgwNzA5MTcxMjk1MTY2MDE1NjI1OiB1bmV4cGVjdGVkIHJldHVybiBwYyBmb3IgQWRkVmVjdG9yZWRDb250aW51ZUhhbmRsZXI=f4:T554,c2VHZW5lcmF0ZVRyYW5zZm9ybUE6ICV2RXJyb3IgcnVubmluZyBNc2lDcmVhdGVUcmFuc2Zvcm1TdW1tYXJ5SW5mbzogJXZQIGhhcyBjYWNoZWQgR0Mgd29yayBhdCBlbmQgb2YgbWFyayB0ZXJtaW5hdGlvbmF0dGVtcHRpbmcgdG8gbGluayBpbiB0b28gbWFueSBzaGFyZWQgbGlicmFyaWVzZmFpbGVkIHRvIGFjcXVpcmUgbG9jayB0byBzdGFydCBhIEdDIHRyYW5zaXRpb25maW5pc2hHQ1RyYW5zaXRpb24gY2FsbGVkIHdpdGhvdXQgc3RhcnRpbmcgb25lP2Z1bmN0aW9uIHN5bWJvbCB0YWJsZSBub3Qgc29ydGVkIGJ5IFBDIG9mZnNldDogcmFjeSBzdWRvZyBhZGp1c3RtZW50IGR1ZSB0byBwYXJraW5nIG9uIGNoYW5uZWxyZWZsZWN0LlZhbHVlLkJ5dGVzIG9mIHVuYWRkcmVzc2FibGUgYnl0ZSBhcnJheXJ1bnRpbWU6IENyZWF0ZUlvQ29tcGxldGlvblBvcnQgZmFpbGVkIChlcnJubz0gc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOjoleF0gd2l0aCBsZW5ndGggJXl0cmllZCB0byBzbGVlcCBzY2F2ZW5nZXIgZnJvbSBhbm90aGVyIGdvcm91dGluZUNyZWF0ZVdhaXRhYmxlVGltZXJFeCB3aGVuIGNyZWF0aW5nIHRpbWVyIGZhaWxlZEVycm9yIGNhbGxpbmcgTXNpQ3JlYXRlVHJhbnNmb3JtU3VtbWFyeUluZm9BOiAldmNvdWxkIG5vdCBmaW5kIEdldFN5c3RlbVRpbWVBc0ZpbGVUaW1lKCkgc3lzY2FsbG5vdCBlbm91Z2ggc2lnbmlmaWNhbnQgYml0cyBhZnRlciBtdWx0NjRiaXRQb3cxMHJ1bnRpbWUucHJlZW1wdE06IGR1cGxpY2F0ZWhhbmRsZSBmYWlsZWQ7IGVycm5vPXJ1bnRpbWU6IHdhaXRmb3JzaW5nbGVvYmplY3QgdW5leHBlY3RlZDsgcmVzdWx0PXJ1bnRpbWU6IHdhaXRmb3JzaW5nbGVvYmplY3Qgd2FpdF9mYWlsZWQ7IGVycm5vPXNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzoleF0gd2l0aCBjYXBhY2l0eSAleXN0cmNvbnY6IGlsbGVnYWwgQXBwZW5kRmxvYXQvRm9ybWF0RmxvYXQgYml0U2l6ZWNhc2dzdGF0dXM6IHdhaXRpbmcgZm9yIEd3YWl0aW5nIGJ1dCBpcyBHcnVubmFibGVkf5:T558,c2VHZW5lcmF0ZVRyYW5zZm9ybUE6ICV2RXJyb3IgcnVubmluZyBNc2lDcmVhdGVUcmFuc2Zvcm1TdW1tYXJ5SW5mbzogJXZQIGhhcyBjYWNoZWQgR0Mgd29yayBhdCBlbmQgb2YgbWFyayB0ZXJtaW5hdGlvbmF0dGVtcHRpbmcgdG8gbGluayBpbiB0b28gbWFueSBzaGFyZWQgbGlicmFyaWVzZmFpbGVkIHRvIGFjcXVpcmUgbG9jayB0byBzdGFydCBhIEdDIHRyYW5zaXRpb25maW5pc2hHQ1RyYW5zaXRpb24gY2FsbGVkIHdpdGhvdXQgc3RhcnRpbmcgb25lP2Z1bmN0aW9uIHN5bWJvbCB0YWJsZSBub3Qgc29ydGVkIGJ5IFBDIG9mZnNldDogcmFjeSBzdWRvZyBhZGp1c3RtZW50IGR1ZSB0byBwYXJraW5nIG9uIGNoYW5uZWxyZWZsZWN0LlZhbHVlLkJ5dGVzIG9mIHVuYWRkcmVzc2FibGUgYnl0ZSBhcnJheXJ1bnRpbWU6IENyZWF0ZUlvQ29tcGxldGlvblBvcnQgZmFpbGVkIChlcnJubz0gc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOjoleF0gd2l0aCBsZW5ndGggJXl0cmllZCB0byBzbGVlcCBzY2F2ZW5nZXIgZnJvbSBhbm90aGVyIGdvcm91dGluZUNyZWF0ZVdhaXRhYmxlVGltZXJFeCB3aGVuIGNyZWF0aW5nIHRpbWVyIGZhaWxlZEVycm9yIGNhbGxpbmcgTXNpQ3JlYXRlVHJhbnNmb3JtU3VtbWFyeUluZm9BOiAldmNvdWxkIG5vdCBmaW5kIEdldFN5c3RlbVRpbWVBc0ZpbGVUaW1lKCkgc3lzY2FsbG5vdCBlbm91Z2ggc2lnbmlmaWNhbnQgYml0cyBhZnRlciBtdWx0NjRiaXRQb3cxMHJ1bnRpbWUucHJlZW1wdE06IGR1cGxpY2F0ZWhhbmRsZSBmYWlsZWQ7IGVycm5vPXJ1bnRpbWU6IHdhaXRmb3JzaW5nbGVvYmplY3QgdW5leHBlY3RlZDsgcmVzdWx0PXJ1bnRpbWU6IHdhaXRmb3JzaW5nbGVvYmplY3Qgd2FpdF9mYWlsZWQ7IGVycm5vPXNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzoleF0gd2l0aCBjYXBhY2l0eSAleXN0cmNvbnY6IGlsbGVnYWwgQXBwZW5kRmxvYXQvRm9ybWF0RmxvYXQgYml0U2l6ZWNhc2dzdGF0dXM6IHdhaXRpbmcgZm9yIEd3YWl0aW5nIGJ1dCBpcyBHcnVubmFibGVkZQ==f6:T554,c2xpY2VydW50aW1lLlNldEZpbmFsaXplcjogZmlyc3QgYXJndW1lbnQgaXMgcnVudGltZS5wcmVlbXB0TTogZHVwbGljYXRlaGFuZGxlIGZhaWxlZHJ1bnRpbWU6IFN5c2NhbGxOIGhhcyB0b28gbWFueSBhcmd1bWVudHNydW50aW1lOiBvdXQgb2YgbWVtb3J5OiBjYW5ub3QgYWxsb2NhdGUgcnVudGltZTogdHlwZUJpdHNCdWxrQmFycmllciB3aXRoIHR5cGUgIHJ5dUZ0b2FGaXhlZDMyIGNhbGxlZCB3aXRoIG5lZ2F0aXZlIHByZWMzNDY5NDQ2OTUxOTUzNjE0MTg4ODIzODQ4OTYyNzgzODEzNDc2NTYyNU1hcEl0ZXIuTmV4dCBjYWxsZWQgb24gZXhoYXVzdGVkIGl0ZXJhdG9yYXR0ZW1wdGVkIHRvIGFkZCB6ZXJvLXNpemVkIGFkZHJlc3MgcmFuZ2ViaW5hcnk6IHZhcmludCBvdmVyZmxvd3MgYSA2NC1iaXQgaW50ZWdlcmNhbid0IGNhbGwgcG9pbnRlciBvbiBhIG5vbi1wb2ludGVyIFZhbHVlZ2NTd2VlcCBiZWluZyBkb25lIGJ1dCBwaGFzZSBpcyBub3QgR0NvZmZtaGVhcC5mcmVlU3BhbkxvY2tlZCAtIGludmFsaWQgc3BhbiBzdGF0ZW1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBzdGFjayBmcmVlb2JqZWN0cyBhZGRlZCBvdXQgb2Ygb3JkZXIgb3Igb3ZlcmxhcHBpbmdyZWZsZWN0LlZhbHVlLkFkZHIgb2YgdW5hZGRyZXNzYWJsZSB2YWx1ZXJ1bnRpbWUuU2V0RmluYWxpemVyOiBzZWNvbmQgYXJndW1lbnQgaXMgcnVudGltZTogYmxvY2tlZCByZWFkIG9uIGNsb3NpbmcgcG9sbGRlc2NydW50aW1lOiB0eXBlQml0c0J1bGtCYXJyaWVyIHdpdGhvdXQgdHlwZXN0b3BUaGVXb3JsZDogbm90IHN0b3BwZWQgKHN0b3B3YWl0ICE9IDApc3RyY29udjogaWxsZWdhbCBBcHBlbmRJbnQvRm9ybWF0SW50IGJhc2V1bmV4cGVjdGVkIGNhbGwgdG8gb3MuRXhpdCgwKSBkdXJpbmcgdGVzdDE3MzQ3MjM0NzU5NzY4MDcwOTQ0MTE5MjQ0ODEzOTE5MDY3MzgyODEyNTg2NzM2MTczNzk4ODQwMzU0NzIwNTk2MjI0MDY5NTk1MzM2OTE0MDYyNU1hcEl0ZXIuVmFsdWUgY2FsbGVkIG9uIGV4aGF1c3RlZCBpdGVyf7:T558,c2xpY2VydW50aW1lLlNldEZpbmFsaXplcjogZmlyc3QgYXJndW1lbnQgaXMgcnVudGltZS5wcmVlbXB0TTogZHVwbGljYXRlaGFuZGxlIGZhaWxlZHJ1bnRpbWU6IFN5c2NhbGxOIGhhcyB0b28gbWFueSBhcmd1bWVudHNydW50aW1lOiBvdXQgb2YgbWVtb3J5OiBjYW5ub3QgYWxsb2NhdGUgcnVudGltZTogdHlwZUJpdHNCdWxrQmFycmllciB3aXRoIHR5cGUgIHJ5dUZ0b2FGaXhlZDMyIGNhbGxlZCB3aXRoIG5lZ2F0aXZlIHByZWMzNDY5NDQ2OTUxOTUzNjE0MTg4ODIzODQ4OTYyNzgzODEzNDc2NTYyNU1hcEl0ZXIuTmV4dCBjYWxsZWQgb24gZXhoYXVzdGVkIGl0ZXJhdG9yYXR0ZW1wdGVkIHRvIGFkZCB6ZXJvLXNpemVkIGFkZHJlc3MgcmFuZ2ViaW5hcnk6IHZhcmludCBvdmVyZmxvd3MgYSA2NC1iaXQgaW50ZWdlcmNhbid0IGNhbGwgcG9pbnRlciBvbiBhIG5vbi1wb2ludGVyIFZhbHVlZ2NTd2VlcCBiZWluZyBkb25lIGJ1dCBwaGFzZSBpcyBub3QgR0NvZmZtaGVhcC5mcmVlU3BhbkxvY2tlZCAtIGludmFsaWQgc3BhbiBzdGF0ZW1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBzdGFjayBmcmVlb2JqZWN0cyBhZGRlZCBvdXQgb2Ygb3JkZXIgb3Igb3ZlcmxhcHBpbmdyZWZsZWN0LlZhbHVlLkFkZHIgb2YgdW5hZGRyZXNzYWJsZSB2YWx1ZXJ1bnRpbWUuU2V0RmluYWxpemVyOiBzZWNvbmQgYXJndW1lbnQgaXMgcnVudGltZTogYmxvY2tlZCByZWFkIG9uIGNsb3NpbmcgcG9sbGRlc2NydW50aW1lOiB0eXBlQml0c0J1bGtCYXJyaWVyIHdpdGhvdXQgdHlwZXN0b3BUaGVXb3JsZDogbm90IHN0b3BwZWQgKHN0b3B3YWl0ICE9IDApc3RyY29udjogaWxsZWdhbCBBcHBlbmRJbnQvRm9ybWF0SW50IGJhc2V1bmV4cGVjdGVkIGNhbGwgdG8gb3MuRXhpdCgwKSBkdXJpbmcgdGVzdDE3MzQ3MjM0NzU5NzY4MDcwOTQ0MTE5MjQ0ODEzOTE5MDY3MzgyODEyNTg2NzM2MTczNzk4ODQwMzU0NzIwNTk2MjI0MDY5NTk1MzM2OTE0MDYyNU1hcEl0ZXIuVmFsdWUgY2FsbGVkIG9uIGV4aGF1c3RlZCBpdGVyYQ==f8:T558,c3VsdGpzb246IGludmFsaWQgbnVtYmVyIGxpdGVyYWwsIHRyeWluZyB0byB1bm1hcnNoYWwgJXEgaW50byBOdW1iZXJydW50aW1lLlNldEZpbmFsaXplcjogZmlyc3QgYXJndW1lbnQgd2FzIGFsbG9jYXRlZCBpbnRvIGFuIGFyZW5hcnVudGltZS5TZXRGaW5hbGl6ZXI6IHBvaW50ZXIgbm90IGF0IGJlZ2lubmluZyBvZiBhbGxvY2F0ZWQgYmxvY2t1c2VyIGFyZW5hIGNodW5rIHNpemUgaXMgbm90IGEgbXV0bGlwbGUgb2YgdGhlIHBoeXNpY2FsIHBhZ2Ugc2l6ZXJlZmxlY3Q6IHJlZmxlY3QuVmFsdWUuVW5zYWZlUG9pbnRlciBvbiBhbiBpbnZhbGlkIG5vdGluaGVhcCBwb2ludGVyYnl0ZXMuQnVmZmVyOiBVbnJlYWRCeXRlOiBwcmV2aW91cyBvcGVyYXRpb24gd2FzIG5vdCBhIHN1Y2Nlc3NmdWwgcmVhZGpzb246IGludmFsaWQgdXNlIG9mICxzdHJpbmcgc3RydWN0IHRhZywgdHJ5aW5nIHRvIHVubWFyc2hhbCAlcSBpbnRvICV2dG9vIG1hbnkgY29uY3VycmVudCBvcGVyYXRpb25zIG9uIGEgc2luZ2xlIGZpbGUgb3Igc29ja2V0IChtYXggMTA0ODU3NSlNYXBJdGVyLk5leHQgY2FsbGVkIG9uIGFuIGl0ZXJhdG9yIHRoYXQgZG9lcyBub3QgaGF2ZSBhbiBhc3NvY2lhdGVkIG1hcCBWYWx1ZWNhbm5vdCBjb252ZXJ0IHNsaWNlIHdpdGggbGVuZ3RoICV5IHRvIGFycmF5IG9yIHBvaW50ZXIgdG8gYXJyYXkgd2l0aCBsZW5ndGggJXhRdWVyeVBlcmZvcm1hbmNlRnJlcXVlbmN5IHN5c2NhbGwgcmV0dXJuZWQgemVybywgcnVubmluZyBvbiB1bnN1cHBvcnRlZCBoYXJkd2FyZWpzb246IGludmFsaWQgdXNlIG9mICxzdHJpbmcgc3RydWN0IHRhZywgdHJ5aW5nIHRvIHVubWFyc2hhbCB1bnF1b3RlZCB2YWx1ZSBpbnRvICV2cmVmbGVjdC5WYWx1ZS5JbnRlcmZhY2U6IGNhbm5vdCByZXR1cm4gdmFsdWUgb2J0YWluZWQgZnJvbSB1bmV4cG9ydGVkIGZpZWxkIG9yIG1ldGhvZFF1ZXJ5UGVyZm9ybWFuY2VGcmVxdWVuY3kgb3ZlcmZsb3cgMzIgYml0IGRpdmlkZXIsIGNoZWNrIG5vc3BsaXQgZGlzY3Vzc2lvbiB0bw==f9:T554,dD0lcyBmbGFnIHJlZGVmaW5lZDogJXMsIGxldmVsQml0c1tsZXZlbF0gPSAxODYyNjQ1MTQ5MjMwOTU3MDMxMjU5MzEzMjI1NzQ2MTU0Nzg1MTU2MjVBZGp1c3RUb2tlblByaXZpbGVnZXNBbGFza2FuIFN0YW5kYXJkIFRpbWVBbmF0b2xpYW5fSGllcm9nbHlwaHNBcmFiaWFuIFN0YW5kYXJkIFRpbWVCZWxhcnVzIFN0YW5kYXJkIFRpbWVDZW50cmFsIFN0YW5kYXJkIFRpbWVFYXN0ZXJuIFN0YW5kYXJkIFRpbWVFcnJvciByZWFkaW5nIGV4ZTogJXZFcnJvciB3cml0aW5nIG1zaTogJXZHZXRQcm9maWxlc0RpcmVjdG9yeVdJbnNjcmlwdGlvbmFsX1BhaGxhdmlMb29rdXBQcml2aWxlZ2VWYWx1ZVdNYWdhZGFuIFN0YW5kYXJkIFRpbWVNb3JvY2NvIFN0YW5kYXJkIFRpbWVNeWFubWFyIFN0YW5kYXJkIFRpbWVOYW1pYmlhIFN0YW5kYXJkIFRpbWVOZXRHZXRKb2luSW5mb3JtYXRpb25OZXRVc2VyR2V0TG9jYWxHcm91cHNOb3Jmb2xrIFN0YW5kYXJkIFRpbWVPdGhlcl9HcmFwaGVtZV9FeHRlbmRQYWNpZmljIFN0YW5kYXJkIFRpbWVSZWFkRGlyZWN0b3J5Q2hhbmdlc1dSb21hbmNlIFN0YW5kYXJkIFRpbWVSdXNzaWFuIFN0YW5kYXJkIFRpbWVTRSBBc2lhIFN0YW5kYXJkIFRpbWVTYXJhdG92IFN0YW5kYXJkIFRpbWVZYWt1dHNrIFN0YW5kYXJkIFRpbWVhZnRlciB0b3AtbGV2ZWwgdmFsdWVhc3luYyBzdGFjayB0b28gbGFyZ2ViYWQgdHlwZSBpbiBjb21wYXJlOiBibG9jayBkZXZpY2UgcmVxdWlyZWRjaGVja2RlYWQ6IHJ1bm5hYmxlIGdjb25jdXJyZW50IG1hcCB3cml0ZXNkZWZlciBvbiBzeXN0ZW0gc3RhY2tmaW5kcnVubmFibGU6IHdyb25nIHBmbGFnICVxIGJlZ2lucyB3aXRoIC1pbiBzdHJpbmcgZXNjYXBlIGNvZGVsaW5rIGhhcyBiZWVuIHNldmVyZWRuZWdhdGl2ZSBzaGlmdCBhbW91bnRwYWNrYWdlIG5vdCBpbnN0YWxsZWRwYW5pYyBvbiBzeXN0ZW0gc3RhY2twcmVlbXB0IGF0IHVua25vd24gcGNyZWFkLW9ubHkgZmlsZSBzeXN0ZW1yZWZsZWN0LlZhbHVlLkNvbXBsZXhyZWZsZWN0LlZhbHVlfa:T558,dD0lcyBmbGFnIHJlZGVmaW5lZDogJXMsIGxldmVsQml0c1tsZXZlbF0gPSAxODYyNjQ1MTQ5MjMwOTU3MDMxMjU5MzEzMjI1NzQ2MTU0Nzg1MTU2MjVBZGp1c3RUb2tlblByaXZpbGVnZXNBbGFza2FuIFN0YW5kYXJkIFRpbWVBbmF0b2xpYW5fSGllcm9nbHlwaHNBcmFiaWFuIFN0YW5kYXJkIFRpbWVCZWxhcnVzIFN0YW5kYXJkIFRpbWVDZW50cmFsIFN0YW5kYXJkIFRpbWVFYXN0ZXJuIFN0YW5kYXJkIFRpbWVFcnJvciByZWFkaW5nIGV4ZTogJXZFcnJvciB3cml0aW5nIG1zaTogJXZHZXRQcm9maWxlc0RpcmVjdG9yeVdJbnNjcmlwdGlvbmFsX1BhaGxhdmlMb29rdXBQcml2aWxlZ2VWYWx1ZVdNYWdhZGFuIFN0YW5kYXJkIFRpbWVNb3JvY2NvIFN0YW5kYXJkIFRpbWVNeWFubWFyIFN0YW5kYXJkIFRpbWVOYW1pYmlhIFN0YW5kYXJkIFRpbWVOZXRHZXRKb2luSW5mb3JtYXRpb25OZXRVc2VyR2V0TG9jYWxHcm91cHNOb3Jmb2xrIFN0YW5kYXJkIFRpbWVPdGhlcl9HcmFwaGVtZV9FeHRlbmRQYWNpZmljIFN0YW5kYXJkIFRpbWVSZWFkRGlyZWN0b3J5Q2hhbmdlc1dSb21hbmNlIFN0YW5kYXJkIFRpbWVSdXNzaWFuIFN0YW5kYXJkIFRpbWVTRSBBc2lhIFN0YW5kYXJkIFRpbWVTYXJhdG92IFN0YW5kYXJkIFRpbWVZYWt1dHNrIFN0YW5kYXJkIFRpbWVhZnRlciB0b3AtbGV2ZWwgdmFsdWVhc3luYyBzdGFjayB0b28gbGFyZ2ViYWQgdHlwZSBpbiBjb21wYXJlOiBibG9jayBkZXZpY2UgcmVxdWlyZWRjaGVja2RlYWQ6IHJ1bm5hYmxlIGdjb25jdXJyZW50IG1hcCB3cml0ZXNkZWZlciBvbiBzeXN0ZW0gc3RhY2tmaW5kcnVubmFibGU6IHdyb25nIHBmbGFnICVxIGJlZ2lucyB3aXRoIC1pbiBzdHJpbmcgZXNjYXBlIGNvZGVsaW5rIGhhcyBiZWVuIHNldmVyZWRuZWdhdGl2ZSBzaGlmdCBhbW91bnRwYWNrYWdlIG5vdCBpbnN0YWxsZWRwYW5pYyBvbiBzeXN0ZW0gc3RhY2twcmVlbXB0IGF0IHVua25vd24gcGNyZWFkLW9ubHkgZmlsZSBzeXN0ZW1yZWZsZWN0LlZhbHVlLkNvbXBsZXhyZWZsZWN0LlZhbHVlLg==fb:T554,dGFuZGFyZCBUaW1lV293NjREaXNhYmxlV293NjRGc1JlZGlyZWN0aW9uYWJpIG1pc21hdGNoIGRldGVjdGVkIGJldHdlZW4gYXNzaWdubWVudCB0byBlbnRyeSBpbiBuaWwgbWFwY2hlY2tkZWFkOiBpbmNvbnNpc3RlbnQgY291bnRzZmFpbGVkIHRvIGdldCBzeXN0ZW0gcGFnZSBzaXplZnJlZWRlZmVyIHdpdGggZC5fcGFuaWMgIT0gbmlsaW4gZXhwb25lbnQgb2YgbnVtZXJpYyBsaXRlcmFsaW5hcHByb3ByaWF0ZSBpb2N0bCBmb3IgZGV2aWNlaW52YWxpZCBwb2ludGVyIGZvdW5kIG9uIHN0YWNrbG9va2luZyBmb3IgYmVnaW5uaW5nIG9mIHZhbHVlbm90ZXRzbGVlcCAtIHdhaXRtIG91dCBvZiBzeW5jcHJvdG9jb2wgd3JvbmcgdHlwZSBmb3Igc29ja2V0cmVmbGVjdDogRWxlbSBvZiBpbnZhbGlkIHR5cGUgcmVmbGVjdDogTGVuIG9mIG5vbi1hcnJheSB0eXBlcmVmbGVjdDogT3V0IG9mIG5vbi1mdW5jIHR5cGUgcnVucXB1dHNsb3c6IHF1ZXVlIGlzIG5vdCBmdWxscnVudGltZTogYmFkIGcgaW4gY2dvY2FsbGJhY2tydW50aW1lOiBiYWQgcG9pbnRlciBpbiBmcmFtZSBydW50aW1lOiBmb3VuZCBpbiBvYmplY3QgYXQgKihydW50aW1lOiBpbXBvc3NpYmxlIHR5cGUga2luZCBzb2NrZXQgb3BlcmF0aW9uIG9uIG5vbi1zb2NrZXRzeW5jOiBpbmNvbnNpc3RlbnQgbXV0ZXggc3RhdGVzeW5jOiB1bmxvY2sgb2YgdW5sb2NrZWQgbXV0ZXh1bnNhZmUuU2xpY2U6IGxlbiBvdXQgb2YgcmFuZ2V5ZWFyIG91dHNpZGUgb2YgcmFuZ2UgWzAsOTk5OV0pIG5vdCBpbiB1c2FibGUgYWRkcmVzcyBzcGFjZTogLi4uYWRkaXRpb25hbCBmcmFtZXMgZWxpZGVkLi4uLmxpYiBzZWN0aW9uIGluIGEub3V0IGNvcnJ1cHRlZDExMzY4NjgzNzcyMTYxNjAyOTczOTM3OTg4MjgxMjU1Njg0MzQxODg2MDgwODAxNDg2OTY4OTk0MTQwNjI1Q2VudHJhbCBCcmF6aWxpYW4gU3RhbmRhcmQgVGltZUVycm9yIGNhbGxpbmcgTXNpVmlld01vZGlmeTogJXZNb3VudGFpbiBTdGFuZGFyZCBUaW1lIChNZXhpY28pVy4gQ2VudHJhbCBBZg==fc:T554,dGFuZGFyZCBUaW1lV293NjREaXNhYmxlV293NjRGc1JlZGlyZWN0aW9uYWJpIG1pc21hdGNoIGRldGVjdGVkIGJldHdlZW4gYXNzaWdubWVudCB0byBlbnRyeSBpbiBuaWwgbWFwY2hlY2tkZWFkOiBpbmNvbnNpc3RlbnQgY291bnRzZmFpbGVkIHRvIGdldCBzeXN0ZW0gcGFnZSBzaXplZnJlZWRlZmVyIHdpdGggZC5fcGFuaWMgIT0gbmlsaW4gZXhwb25lbnQgb2YgbnVtZXJpYyBsaXRlcmFsaW5hcHByb3ByaWF0ZSBpb2N0bCBmb3IgZGV2aWNlaW52YWxpZCBwb2ludGVyIGZvdW5kIG9uIHN0YWNrbG9va2luZyBmb3IgYmVnaW5uaW5nIG9mIHZhbHVlbm90ZXRzbGVlcCAtIHdhaXRtIG91dCBvZiBzeW5jcHJvdG9jb2wgd3JvbmcgdHlwZSBmb3Igc29ja2V0cmVmbGVjdDogRWxlbSBvZiBpbnZhbGlkIHR5cGUgcmVmbGVjdDogTGVuIG9mIG5vbi1hcnJheSB0eXBlcmVmbGVjdDogT3V0IG9mIG5vbi1mdW5jIHR5cGUgcnVucXB1dHNsb3c6IHF1ZXVlIGlzIG5vdCBmdWxscnVudGltZTogYmFkIGcgaW4gY2dvY2FsbGJhY2tydW50aW1lOiBiYWQgcG9pbnRlciBpbiBmcmFtZSBydW50aW1lOiBmb3VuZCBpbiBvYmplY3QgYXQgKihydW50aW1lOiBpbXBvc3NpYmxlIHR5cGUga2luZCBzb2NrZXQgb3BlcmF0aW9uIG9uIG5vbi1zb2NrZXRzeW5jOiBpbmNvbnNpc3RlbnQgbXV0ZXggc3RhdGVzeW5jOiB1bmxvY2sgb2YgdW5sb2NrZWQgbXV0ZXh1bnNhZmUuU2xpY2U6IGxlbiBvdXQgb2YgcmFuZ2V5ZWFyIG91dHNpZGUgb2YgcmFuZ2UgWzAsOTk5OV0pIG5vdCBpbiB1c2FibGUgYWRkcmVzcyBzcGFjZTogLi4uYWRkaXRpb25hbCBmcmFtZXMgZWxpZGVkLi4uLmxpYiBzZWN0aW9uIGluIGEub3V0IGNvcnJ1cHRlZDExMzY4NjgzNzcyMTYxNjAyOTczOTM3OTg4MjgxMjU1Njg0MzQxODg2MDgwODAxNDg2OTY4OTk0MTQwNjI1Q2VudHJhbCBCcmF6aWxpYW4gU3RhbmRhcmQgVGltZUVycm9yIGNhbGxpbmcgTXNpVmlld01vZGlmeTogJXZNb3VudGFpbiBTdGFuZGFyZCBUaW1lIChNZXhpY28pVy4gQ2VudHJhbCBBZnI=fd:T554,VGltZS5NYXJzaGFsSlNPTjogVGltZS5NYXJzaGFsVGV4dDogVmFyaWF0aW9uX1NlbGVjdG9yYWRhcHRpdmVzdGFja3N0YXJ0YmFkIG1hbnVhbEZyZWVMaXN0Y29ubmVjdGlvbiByZWZ1c2VkZWxlbSBhbGlnbiB0b28gYmlnZXhjZWVkZWQgbWF4IGRlcHRoZmlsZSBuYW1lIHRvbyBsb25nZmxhZyAlcSBjb250YWlucyA9ZmxhZyByZWRlZmluZWQ6ICVzZm9yRWFjaFA6IG5vdCBkb25lZ2FyYmFnZSBjb2xsZWN0aW9uaWRlbnRpZmllciByZW1vdmVkaW4gbnVtZXJpYyBsaXRlcmFsaW5kZXggb3V0IG9mIHJhbmdlaW5wdXQvb3V0cHV0IGVycm9yaW52YWxpZCBjaGFyYWN0ZXIgbXVsdGlob3AgYXR0ZW1wdGVkbm8gY2hpbGQgcHJvY2Vzc2Vzbm8gbG9ja3MgYXZhaWxhYmxlb3BlcmF0aW9uIGNhbmNlbGVkcmVmbGVjdC5WYWx1ZS5FbGVtcmVmbGVjdC5WYWx1ZS5UeXBlcmVmbGVjdC5WYWx1ZS5VaW50cmVmbGVjdDogWmVybyhuaWwpcnVudGltZS5zZW1hY3JlYXRlcnVudGltZS5zZW1hd2FrZXVwcnVudGltZTogICBncDogZ3A9cnVudGltZTogZ2V0ZzogIGc9cnVudGltZTogbnBhZ2VzID0gcnVudGltZTogcmFuZ2UgPSB7cnVudGltZTogdGV4dEFkZHIgc3RvcHBpbmcgdGhlIHdvcmxkc3RyZWFtcyBwaXBlIGVycm9yc3luYy5SV011dGV4LlJMb2Nrc3lzdGVtIHBhZ2Ugc2l6ZSAodHJhY2ViYWNrYW5jZXN0b3JzdXNlIG9mIGNsb3NlZCBmaWxldmFsdWUgb3V0IG9mIHJhbmdlIFtjb250cm9sbGVyIHJlc2V0XSBjYWxsZWQgdXNpbmcgbmlsICosICBnLT5hdG9taWNzdGF0dXM9LCBncC0+YXRvbWljc3RhdHVzPTE0OTAxMTYxMTkzODQ3NjU2MjU3NDUwNTgwNTk2OTIzODI4MTI1QWx0YWkgU3RhbmRhcmQgVGltZUJhaGlhIFN0YW5kYXJkIFRpbWVDYW5hZGlhbl9BYm9yaWdpbmFsQ2hpbmEgU3RhbmRhcmQgVGltZUNyZWF0ZVN5bWJvbGljTGlua1dDcnlwdFJlbGVhc2VDb250ZXh0RWd5cHQgU3RhbmRhcmQgVGltZUdDIG1hcmsgdGVybWluYXRpb25HQyB3b3JrIG5vdCBmbHVzaGVkR2V0Q3VycmVudFByb2Nlc3NJfe:T558,VGltZS5NYXJzaGFsSlNPTjogVGltZS5NYXJzaGFsVGV4dDogVmFyaWF0aW9uX1NlbGVjdG9yYWRhcHRpdmVzdGFja3N0YXJ0YmFkIG1hbnVhbEZyZWVMaXN0Y29ubmVjdGlvbiByZWZ1c2VkZWxlbSBhbGlnbiB0b28gYmlnZXhjZWVkZWQgbWF4IGRlcHRoZmlsZSBuYW1lIHRvbyBsb25nZmxhZyAlcSBjb250YWlucyA9ZmxhZyByZWRlZmluZWQ6ICVzZm9yRWFjaFA6IG5vdCBkb25lZ2FyYmFnZSBjb2xsZWN0aW9uaWRlbnRpZmllciByZW1vdmVkaW4gbnVtZXJpYyBsaXRlcmFsaW5kZXggb3V0IG9mIHJhbmdlaW5wdXQvb3V0cHV0IGVycm9yaW52YWxpZCBjaGFyYWN0ZXIgbXVsdGlob3AgYXR0ZW1wdGVkbm8gY2hpbGQgcHJvY2Vzc2Vzbm8gbG9ja3MgYXZhaWxhYmxlb3BlcmF0aW9uIGNhbmNlbGVkcmVmbGVjdC5WYWx1ZS5FbGVtcmVmbGVjdC5WYWx1ZS5UeXBlcmVmbGVjdC5WYWx1ZS5VaW50cmVmbGVjdDogWmVybyhuaWwpcnVudGltZS5zZW1hY3JlYXRlcnVudGltZS5zZW1hd2FrZXVwcnVudGltZTogICBncDogZ3A9cnVudGltZTogZ2V0ZzogIGc9cnVudGltZTogbnBhZ2VzID0gcnVudGltZTogcmFuZ2UgPSB7cnVudGltZTogdGV4dEFkZHIgc3RvcHBpbmcgdGhlIHdvcmxkc3RyZWFtcyBwaXBlIGVycm9yc3luYy5SV011dGV4LlJMb2Nrc3lzdGVtIHBhZ2Ugc2l6ZSAodHJhY2ViYWNrYW5jZXN0b3JzdXNlIG9mIGNsb3NlZCBmaWxldmFsdWUgb3V0IG9mIHJhbmdlIFtjb250cm9sbGVyIHJlc2V0XSBjYWxsZWQgdXNpbmcgbmlsICosICBnLT5hdG9taWNzdGF0dXM9LCBncC0+YXRvbWljc3RhdHVzPTE0OTAxMTYxMTkzODQ3NjU2MjU3NDUwNTgwNTk2OTIzODI4MTI1QWx0YWkgU3RhbmRhcmQgVGltZUJhaGlhIFN0YW5kYXJkIFRpbWVDYW5hZGlhbl9BYm9yaWdpbmFsQ2hpbmEgU3RhbmRhcmQgVGltZUNyZWF0ZVN5bWJvbGljTGlua1dDcnlwdFJlbGVhc2VDb250ZXh0RWd5cHQgU3RhbmRhcmQgVGltZUdDIG1hcmsgdGVybWluYXRpb25HQyB3b3JrIG5vdCBmbHVzaGVkR2V0Q3VycmVudFByb2Nlc3NJZA==ff:T554,dG9yYWNxdWlyZVN1ZG9nOiBmb3VuZCBzLmVsZW0gIT0gbmlsIGluIGNhY2hlZmF0YWwgZXJyb3I6IGNnbyBjYWxsYmFjayBiZWZvcmUgY2dvIGNhbGxsb29raW5nIGZvciBiZWdpbm5pbmcgb2Ygb2JqZWN0IGtleSBzdHJpbmdub24tZW1wdHkgbWFyayBxdWV1ZSBhZnRlciBjb25jdXJyZW50IG1hcmtvbiBhIGxvY2tlZCB0aHJlYWQgd2l0aCBubyB0ZW1wbGF0ZSB0aHJlYWRvdXQgb2YgbWVtb3J5IGFsbG9jYXRpbmcgY2hlY2ttYXJrcyBiaXRtYXBwZXJzaXN0ZW50YWxsb2M6IGFsaWduIGlzIG5vdCBhIHBvd2VyIG9mIDJyZWZsZWN0OiBjYW5ub3QgY29udmVydCBzbGljZSB3aXRoIGxlbmd0aCBydW50aW1lOiBibG9ja2VkIHdyaXRlIG9uIGNsb3NpbmcgcG9sbGRlc2Nzd2VlcDogdHJpZWQgdG8gcHJlc2VydmUgYSB1c2VyIGFyZW5hIHNwYW51bmV4cGVjdGVkIHNpZ25hbCBkdXJpbmcgcnVudGltZSBleGVjdXRpb25nY0JnTWFya1dvcmtlcjogdW5leHBlY3RlZCBnY01hcmtXb3JrZXJNb2RlZ3JldyBoZWFwLCBidXQgbm8gYWRlcXVhdGUgZnJlZSBzcGFjZSBmb3VuZGludGVycnVwdGVkIHN5c3RlbSBjYWxsIHNob3VsZCBiZSByZXN0YXJ0ZWRtZXRob2RWYWx1ZUNhbGxGcmFtZU9ianMgaXMgbm90IGluIGEgbW9kdWxlbXVsdDY0Yml0UG93MTA6IHBvd2VyIG9mIDEwIGlzIG91dCBvZiByYW5nZW11bHRpcGxlIFJlYWQgY2FsbHMgcmV0dXJuIG5vIGRhdGEgb3IgZXJyb3Jub24gaW4tdXNlIHNwYW4gZm91bmQgd2l0aCBzcGVjaWFscyBiaXQgc2V0cmVmbGVjdDogbmlsIHR5cGUgcGFzc2VkIHRvIFR5cGUuSW1wbGVtZW50c3Jvb3QgbGV2ZWwgbWF4IHBhZ2VzIGRvZXNuJ3QgZml0IGluIHN1bW1hcnlydW50aW1lLlNldEZpbmFsaXplcjogZmluYWxpemVyIGFscmVhZHkgc2V0cnVudGltZS5TZXRGaW5hbGl6ZXI6IGZpcnN0IGFyZ3VtZW50IGlzIG5pbHJ1bnRpbWU6IGNhc2Zyb21fR3NjYW5zdGF0dXMgYmFkIG9sZHZhbCBncD1ydW50aW1lOiByZWxlYXNlU3Vkb2cgd2l0aCBub24tbmlsIGdwLnBhcmE=100:T554,dG9yYWNxdWlyZVN1ZG9nOiBmb3VuZCBzLmVsZW0gIT0gbmlsIGluIGNhY2hlZmF0YWwgZXJyb3I6IGNnbyBjYWxsYmFjayBiZWZvcmUgY2dvIGNhbGxsb29raW5nIGZvciBiZWdpbm5pbmcgb2Ygb2JqZWN0IGtleSBzdHJpbmdub24tZW1wdHkgbWFyayBxdWV1ZSBhZnRlciBjb25jdXJyZW50IG1hcmtvbiBhIGxvY2tlZCB0aHJlYWQgd2l0aCBubyB0ZW1wbGF0ZSB0aHJlYWRvdXQgb2YgbWVtb3J5IGFsbG9jYXRpbmcgY2hlY2ttYXJrcyBiaXRtYXBwZXJzaXN0ZW50YWxsb2M6IGFsaWduIGlzIG5vdCBhIHBvd2VyIG9mIDJyZWZsZWN0OiBjYW5ub3QgY29udmVydCBzbGljZSB3aXRoIGxlbmd0aCBydW50aW1lOiBibG9ja2VkIHdyaXRlIG9uIGNsb3NpbmcgcG9sbGRlc2Nzd2VlcDogdHJpZWQgdG8gcHJlc2VydmUgYSB1c2VyIGFyZW5hIHNwYW51bmV4cGVjdGVkIHNpZ25hbCBkdXJpbmcgcnVudGltZSBleGVjdXRpb25nY0JnTWFya1dvcmtlcjogdW5leHBlY3RlZCBnY01hcmtXb3JrZXJNb2RlZ3JldyBoZWFwLCBidXQgbm8gYWRlcXVhdGUgZnJlZSBzcGFjZSBmb3VuZGludGVycnVwdGVkIHN5c3RlbSBjYWxsIHNob3VsZCBiZSByZXN0YXJ0ZWRtZXRob2RWYWx1ZUNhbGxGcmFtZU9ianMgaXMgbm90IGluIGEgbW9kdWxlbXVsdDY0Yml0UG93MTA6IHBvd2VyIG9mIDEwIGlzIG91dCBvZiByYW5nZW11bHRpcGxlIFJlYWQgY2FsbHMgcmV0dXJuIG5vIGRhdGEgb3IgZXJyb3Jub24gaW4tdXNlIHNwYW4gZm91bmQgd2l0aCBzcGVjaWFscyBiaXQgc2V0cmVmbGVjdDogbmlsIHR5cGUgcGFzc2VkIHRvIFR5cGUuSW1wbGVtZW50c3Jvb3QgbGV2ZWwgbWF4IHBhZ2VzIGRvZXNuJ3QgZml0IGluIHN1bW1hcnlydW50aW1lLlNldEZpbmFsaXplcjogZmluYWxpemVyIGFscmVhZHkgc2V0cnVudGltZS5TZXRGaW5hbGl6ZXI6IGZpcnN0IGFyZ3VtZW50IGlzIG5pbHJ1bnRpbWU6IGNhc2Zyb21fR3NjYW5zdGF0dXMgYmFkIG9sZHZhbCBncD1ydW50aW1lOiByZWxlYXNlU3Vkb2cgd2l0aCBub24tbmlsIGdwLnBhcmFt101:T554,VFdBUkVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cVGltZSBab25lc1VuZXhwZWN0ZWQgcmV0dXJuIHZhbHVlIGZyb20gTXNpTG9jYXRlQ29tcG9uZW50OiAldi4gJXZjYXNmcm9tX0dzY2Fuc3RhdHVzOnRvcCBncC0+c3RhdHVzIGlzIG5vdCBpbiBzY2FuIHN0YXRlZ2VudHJhY2ViYWNrIGNhbGxiYWNrIGNhbm5vdCBiZSB1c2VkIHdpdGggbm9uLXplcm8gc2tpcG1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBmcmVlIG9mIHVzZXIgYXJlbmEgY2h1bmtvczogaW52YWxpZCB1c2Ugb2YgV3JpdGVBdCBvbiBmaWxlIG9wZW5lZCB3aXRoIE9fQVBQRU5EcmVmbGVjdDogaW50ZXJuYWwgZXJyb3I6IGludmFsaWQgdXNlIG9mIG1ha2VNZXRob2RWYWx1ZWZhaWxlZCB0byBhbGxvY2F0ZSBhbGlnbmVkIGhlYXAgbWVtb3J5OyB0b28gbWFueSByZXRyaWVzaW4gZ2NNYXJrIGV4cGVjdGluZyB0byBzZWUgZ2NwaGFzZSBhcyBfR0NtYXJrdGVybWluYXRpb25ub24tZW1wdHkgcG9pbnRlciBtYXAgcGFzc2VkIGZvciBub24tcG9pbnRlci1zaXplIHZhbHVlc3Byb2ZpbGVhbGxvYyBjYWxsZWQgd2l0aG91dCBhIFAgb3Igb3V0c2lkZSBib290c3RyYXBwaW5ncHRyRW5jb2Rlci5lbmNvZGUgc2hvdWxkIGhhdmUgZW1wdGllZCBwdHJTZWVuIHZpYSBkZWZlcnNzdHJpbmdzOiBpbGxlZ2FsIHVzZSBvZiBub24temVybyBCdWlsZGVyIGNvcGllZCBieSB2YWx1ZWdlbnRyYWNlYmFjayBjYW5ub3QgdHJhY2UgdXNlciBnb3JvdXRpbmUgb24gaXRzIG93biBzdGFja3J1bnRpbWU6IGNoZWNrbWFya3MgZm91bmQgdW5leHBlY3RlZCB1bm1hcmtlZCBvYmplY3Qgb2JqPXN5bmM6IFdhaXRHcm91cCBtaXN1c2U6IEFkZCBjYWxsZWQgY29uY3VycmVudGx5IHdpdGggV2FpdGpzb246IGNhbm5vdCBzZXQgZW1iZWRkZWQgcG9pbnRlciB0byB1bmV4cG9ydGVkIHN0cnVjdDogJXZFcnJvciB3aGVuIHF1ZXJ5aW5nIGZvciBwcmV2aW91c2x5IGluc3RhbGxlZCBkZXBsb3ltZW50OiAldnJlZmxlY3Q6IHJlZmxlY3Qu102:T558,VFdBUkVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cVGltZSBab25lc1VuZXhwZWN0ZWQgcmV0dXJuIHZhbHVlIGZyb20gTXNpTG9jYXRlQ29tcG9uZW50OiAldi4gJXZjYXNmcm9tX0dzY2Fuc3RhdHVzOnRvcCBncC0+c3RhdHVzIGlzIG5vdCBpbiBzY2FuIHN0YXRlZ2VudHJhY2ViYWNrIGNhbGxiYWNrIGNhbm5vdCBiZSB1c2VkIHdpdGggbm9uLXplcm8gc2tpcG1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBmcmVlIG9mIHVzZXIgYXJlbmEgY2h1bmtvczogaW52YWxpZCB1c2Ugb2YgV3JpdGVBdCBvbiBmaWxlIG9wZW5lZCB3aXRoIE9fQVBQRU5EcmVmbGVjdDogaW50ZXJuYWwgZXJyb3I6IGludmFsaWQgdXNlIG9mIG1ha2VNZXRob2RWYWx1ZWZhaWxlZCB0byBhbGxvY2F0ZSBhbGlnbmVkIGhlYXAgbWVtb3J5OyB0b28gbWFueSByZXRyaWVzaW4gZ2NNYXJrIGV4cGVjdGluZyB0byBzZWUgZ2NwaGFzZSBhcyBfR0NtYXJrdGVybWluYXRpb25ub24tZW1wdHkgcG9pbnRlciBtYXAgcGFzc2VkIGZvciBub24tcG9pbnRlci1zaXplIHZhbHVlc3Byb2ZpbGVhbGxvYyBjYWxsZWQgd2l0aG91dCBhIFAgb3Igb3V0c2lkZSBib290c3RyYXBwaW5ncHRyRW5jb2Rlci5lbmNvZGUgc2hvdWxkIGhhdmUgZW1wdGllZCBwdHJTZWVuIHZpYSBkZWZlcnNzdHJpbmdzOiBpbGxlZ2FsIHVzZSBvZiBub24temVybyBCdWlsZGVyIGNvcGllZCBieSB2YWx1ZWdlbnRyYWNlYmFjayBjYW5ub3QgdHJhY2UgdXNlciBnb3JvdXRpbmUgb24gaXRzIG93biBzdGFja3J1bnRpbWU6IGNoZWNrbWFya3MgZm91bmQgdW5leHBlY3RlZCB1bm1hcmtlZCBvYmplY3Qgb2JqPXN5bmM6IFdhaXRHcm91cCBtaXN1c2U6IEFkZCBjYWxsZWQgY29uY3VycmVudGx5IHdpdGggV2FpdGpzb246IGNhbm5vdCBzZXQgZW1iZWRkZWQgcG9pbnRlciB0byB1bmV4cG9ydGVkIHN0cnVjdDogJXZFcnJvciB3aGVuIHF1ZXJ5aW5nIGZvciBwcmV2aW91c2x5IGluc3RhbGxlZCBkZXBsb3ltZW50OiAldnJlZmxlY3Q6IHJlZmxlY3QuVg==103:T554,dW5sb2NrOiBsb2NrIGNvdW50c2lnc2VuZDogaW5jb25zaXN0ZW50IHN0YXRlc3RhY2sgc2l6ZSBub3QgYSBwb3dlciBvZiAyc3RvcFRoZVdvcmxkOiBob2xkaW5nIGxvY2tzdGltZTogaW52YWxpZCBsb2NhdGlvbiBuYW1ldGltZXIgd2hlbiBtdXN0IGJlIHBvc2l0aXZldG9vIG1hbnkgY2FsbGJhY2sgZnVuY3Rpb25zd29yay5ud2FpdCB3YXMgPiB3b3JrLm5wcm9jIGFyZ3Mgc3RhY2sgbWFwIGVudHJpZXMgZm9yICEjJCUmKCkqKy0uLzo7PD0+P0BbXV5fe3x9fiAxODE4OTg5NDAzNTQ1ODU2NDc1ODMwMDc4MTI1OTA5NDk0NzAxNzcyOTI4MjM3OTE1MDM5MDYyNUF1cyBDZW50cmFsIFcuIFN0YW5kYXJkIFRpbWVDYW5hZGEgQ2VudHJhbCBTdGFuZGFyZCBUaW1lQ2VuLiBBdXN0cmFsaWEgU3RhbmRhcmQgVGltZUNlbnRyYWwgRXVyb3BlIFN0YW5kYXJkIFRpbWVDZXJ0Q3JlYXRlQ2VydGlmaWNhdGVDb250ZXh0RW5nbGlzaCBuYW1lIGZvciB0aW1lIHpvbmUgIkZpeGVkU3RhY2sgaXMgbm90IHBvd2VyLW9mLTJHZXRGaWxlSW5mb3JtYXRpb25CeUhhbmRsZUV4UHJlcGVuZGVkX0NvbmNhdGVuYXRpb25fTWFya1tvcmlnaW5hdGluZyBmcm9tIGdvcm91dGluZSBjb21wYXJpbmcgdW5jb21wYXJhYmxlIHR5cGUgZGVzdGluYXRpb24gYWRkcmVzcyByZXF1aXJlZGZhdGFsOiBtb3Jlc3RhY2sgb24gZ3NpZ25hbGZpbGUgZGVzY3JpcHRvciBpbiBiYWQgc3RhdGVmaW5kcnVubmFibGU6IG5ldHBvbGwgd2l0aCBwZm91bmQgcG9pbnRlciB0byBmcmVlIG9iamVjdGdjQmdNYXJrV29ya2VyOiBtb2RlIG5vdCBzZXRnY3N0b3BtOiBuZWdhdGl2ZSBubXNwaW5uaW5naW52YWxpZCBydW50aW1lIHN5bWJvbCB0YWJsZWpzb246IFVubWFyc2hhbChub24tcG9pbnRlciBtaGVhcC5mcmVlU3BhbkxvY2tlZCAtIHNwYW4gbWlzc2luZyBzdGFjayBpbiBzaHJpbmtzdGFja21zcGFuLnN3ZWVwOiBtIGlzIG5vdCBsb2NrZWRuZWVkIHBhZGRpbmcgaW4gYnVja2V0IChrZXkpbmV3cHJvYzE6IG5ldyBnIGlzIG5vdCBHZGVhZG5ld3A=104:T554,dW5sb2NrOiBsb2NrIGNvdW50c2lnc2VuZDogaW5jb25zaXN0ZW50IHN0YXRlc3RhY2sgc2l6ZSBub3QgYSBwb3dlciBvZiAyc3RvcFRoZVdvcmxkOiBob2xkaW5nIGxvY2tzdGltZTogaW52YWxpZCBsb2NhdGlvbiBuYW1ldGltZXIgd2hlbiBtdXN0IGJlIHBvc2l0aXZldG9vIG1hbnkgY2FsbGJhY2sgZnVuY3Rpb25zd29yay5ud2FpdCB3YXMgPiB3b3JrLm5wcm9jIGFyZ3Mgc3RhY2sgbWFwIGVudHJpZXMgZm9yICEjJCUmKCkqKy0uLzo7PD0+P0BbXV5fe3x9fiAxODE4OTg5NDAzNTQ1ODU2NDc1ODMwMDc4MTI1OTA5NDk0NzAxNzcyOTI4MjM3OTE1MDM5MDYyNUF1cyBDZW50cmFsIFcuIFN0YW5kYXJkIFRpbWVDYW5hZGEgQ2VudHJhbCBTdGFuZGFyZCBUaW1lQ2VuLiBBdXN0cmFsaWEgU3RhbmRhcmQgVGltZUNlbnRyYWwgRXVyb3BlIFN0YW5kYXJkIFRpbWVDZXJ0Q3JlYXRlQ2VydGlmaWNhdGVDb250ZXh0RW5nbGlzaCBuYW1lIGZvciB0aW1lIHpvbmUgIkZpeGVkU3RhY2sgaXMgbm90IHBvd2VyLW9mLTJHZXRGaWxlSW5mb3JtYXRpb25CeUhhbmRsZUV4UHJlcGVuZGVkX0NvbmNhdGVuYXRpb25fTWFya1tvcmlnaW5hdGluZyBmcm9tIGdvcm91dGluZSBjb21wYXJpbmcgdW5jb21wYXJhYmxlIHR5cGUgZGVzdGluYXRpb24gYWRkcmVzcyByZXF1aXJlZGZhdGFsOiBtb3Jlc3RhY2sgb24gZ3NpZ25hbGZpbGUgZGVzY3JpcHRvciBpbiBiYWQgc3RhdGVmaW5kcnVubmFibGU6IG5ldHBvbGwgd2l0aCBwZm91bmQgcG9pbnRlciB0byBmcmVlIG9iamVjdGdjQmdNYXJrV29ya2VyOiBtb2RlIG5vdCBzZXRnY3N0b3BtOiBuZWdhdGl2ZSBubXNwaW5uaW5naW52YWxpZCBydW50aW1lIHN5bWJvbCB0YWJsZWpzb246IFVubWFyc2hhbChub24tcG9pbnRlciBtaGVhcC5mcmVlU3BhbkxvY2tlZCAtIHNwYW4gbWlzc2luZyBzdGFjayBpbiBzaHJpbmtzdGFja21zcGFuLnN3ZWVwOiBtIGlzIG5vdCBsb2NrZWRuZWVkIHBhZGRpbmcgaW4gYnVja2V0IChrZXkpbmV3cHJvYzE6IG5ldyBnIGlzIG5vdCBHZGVhZG5ld3By105:T550,dmVudCB0eXBlIGZvdW5kcG90ZW50aWFsbHkgb3ZlcmxhcHBpbmcgaW4tdXNlIGFsbG9jYXRpb25zIGRldGVjdGVkcnVudGltZTogbmV0cG9sbDogUG9zdFF1ZXVlZENvbXBsZXRpb25TdGF0dXMgZmFpbGVkY2FzZnJvbV9Hc2NhbnN0YXR1czogZ3AtPnN0YXR1cyBpcyBub3QgaW4gc2NhbiBzdGF0ZW1hbGxvY2djIGNhbGxlZCB3aXRob3V0IGEgUCBvciBvdXRzaWRlIGJvb3RzdHJhcHBpbmdydW50aW1lLlNldEZpbmFsaXplcjogcG9pbnRlciBub3QgaW4gYWxsb2NhdGVkIGJsb2NrcnVudGltZTogR2V0UXVldWVkQ29tcGxldGlvblN0YXR1c0V4IGZhaWxlZCAoZXJybm89IHJ1bnRpbWU6IHVzZSBvZiBGaXhBbGxvY19BbGxvYyBiZWZvcmUgRml4QWxsb2NfSW5pdHNwYW4gc2V0IGJsb2NrIHdpdGggdW5wb3BwZWQgZWxlbWVudHMgZm91bmQgaW4gcmVzZXRjb21waWxlQ2FsbGJhY2s6IGFyZ3VtZW50IHNpemUgaXMgbGFyZ2VyIHRoYW4gdWludHB0cnJlZmxlY3QuVmFsdWUuU2xpY2U6IHN0cmluZyBzbGljZSBpbmRleCBvdXQgb2YgYm91bmRzcmVmbGVjdDogbm9uLWludGVyZmFjZSB0eXBlIHBhc3NlZCB0byBUeXBlLkltcGxlbWVudHNnb3JvdXRpbmUgcnVubmluZyBvbiBvdGhlciB0aHJlYWQ7IHN0YWNrIHVuYXZhaWxhYmxlYnl0ZXMuQnVmZmVyOiByZWFkZXIgcmV0dXJuZWQgbmVnYXRpdmUgY291bnQgZnJvbSBSZWFkZ2NDb250cm9sbGVyU3RhdGUuZmluZFJ1bm5hYmxlOiBibGFja2VuaW5nIG5vdCBlbmFibGVkaW50ZXJuYWwgZXJyb3I6IHBvbGxpbmcgb24gdW5zdXBwb3J0ZWQgZGVzY3JpcHRvciB0eXBlbm8gZ29yb3V0aW5lcyAobWFpbiBjYWxsZWQgcnVudGltZS5Hb2V4aXQpIC0gZGVhZGxvY2shcGFuaWMgY2FsbGluZyBTdHJpbmcgbWV0aG9kIG9uIHplcm8gJXYgZm9yIGZsYWcgJXM6ICV2cnVudGltZTogc2lnbmFsIHJlY2VpdmVkIG9uIHRocmVhZCBub3QgY3JlYXRlZCBieSBHby4gaXMgY3VycmVudGx5IG5vdCBzdXBwb3J0ZWQgZm9yIHVzZSBpbiBzeXN0ZW0gY2FsbGJhY2tzU08=106:T550,dmVudCB0eXBlIGZvdW5kcG90ZW50aWFsbHkgb3ZlcmxhcHBpbmcgaW4tdXNlIGFsbG9jYXRpb25zIGRldGVjdGVkcnVudGltZTogbmV0cG9sbDogUG9zdFF1ZXVlZENvbXBsZXRpb25TdGF0dXMgZmFpbGVkY2FzZnJvbV9Hc2NhbnN0YXR1czogZ3AtPnN0YXR1cyBpcyBub3QgaW4gc2NhbiBzdGF0ZW1hbGxvY2djIGNhbGxlZCB3aXRob3V0IGEgUCBvciBvdXRzaWRlIGJvb3RzdHJhcHBpbmdydW50aW1lLlNldEZpbmFsaXplcjogcG9pbnRlciBub3QgaW4gYWxsb2NhdGVkIGJsb2NrcnVudGltZTogR2V0UXVldWVkQ29tcGxldGlvblN0YXR1c0V4IGZhaWxlZCAoZXJybm89IHJ1bnRpbWU6IHVzZSBvZiBGaXhBbGxvY19BbGxvYyBiZWZvcmUgRml4QWxsb2NfSW5pdHNwYW4gc2V0IGJsb2NrIHdpdGggdW5wb3BwZWQgZWxlbWVudHMgZm91bmQgaW4gcmVzZXRjb21waWxlQ2FsbGJhY2s6IGFyZ3VtZW50IHNpemUgaXMgbGFyZ2VyIHRoYW4gdWludHB0cnJlZmxlY3QuVmFsdWUuU2xpY2U6IHN0cmluZyBzbGljZSBpbmRleCBvdXQgb2YgYm91bmRzcmVmbGVjdDogbm9uLWludGVyZmFjZSB0eXBlIHBhc3NlZCB0byBUeXBlLkltcGxlbWVudHNnb3JvdXRpbmUgcnVubmluZyBvbiBvdGhlciB0aHJlYWQ7IHN0YWNrIHVuYXZhaWxhYmxlYnl0ZXMuQnVmZmVyOiByZWFkZXIgcmV0dXJuZWQgbmVnYXRpdmUgY291bnQgZnJvbSBSZWFkZ2NDb250cm9sbGVyU3RhdGUuZmluZFJ1bm5hYmxlOiBibGFja2VuaW5nIG5vdCBlbmFibGVkaW50ZXJuYWwgZXJyb3I6IHBvbGxpbmcgb24gdW5zdXBwb3J0ZWQgZGVzY3JpcHRvciB0eXBlbm8gZ29yb3V0aW5lcyAobWFpbiBjYWxsZWQgcnVudGltZS5Hb2V4aXQpIC0gZGVhZGxvY2shcGFuaWMgY2FsbGluZyBTdHJpbmcgbWV0aG9kIG9uIHplcm8gJXYgZm9yIGZsYWcgJXM6ICV2cnVudGltZTogc2lnbmFsIHJlY2VpdmVkIG9uIHRocmVhZCBub3QgY3JlYXRlZCBieSBHby4gaXMgY3VycmVudGx5IG5vdCBzdXBwb3J0ZWQgZm9yIHVzZSBpbiBzeXN0ZW0gY2FsbGJhY2tzU09G107:T554,V2VzdCBBc2lhIFN0YW5kYXJkIFRpbWVXZXN0IEJhbmsgU3RhbmRhcmQgVGltZSIgbm90IGZvdW5kIGluIHJlZ2lzdHJ5IiwgbWlzc2luZyBDUFUgc3VwcG9ydGJ5dGVzLkJ1ZmZlcjogdG9vIGxhcmdlY2hhbiByZWNlaXZlIChuaWwgY2hhbiljbG9zZSBvZiBjbG9zZWQgY2hhbm5lbGRldmljZSBvciByZXNvdXJjZSBidXN5ZmF0YWw6IG1vcmVzdGFjayBvbiBnMGdhcmJhZ2UgY29sbGVjdGlvbiBzY2FuZ2NEcmFpbiBwaGFzZSBpbmNvcnJlY3RpbmRleCBvdXQgb2YgcmFuZ2UgWyV4XWludGVycnVwdGVkIHN5c3RlbSBjYWxsaW52YWxpZCBtLT5sb2NrZWRJbnQgPSBqc29uOiBjYW5ub3QgdW5tYXJzaGFsIGxlZnQgb3ZlciBtYXJrcm9vdCBqb2JzbWFrZWNoYW46IGJhZCBhbGlnbm1lbnRtaXNzaW5nIHR5cGUgaW4gcnVuZmlucW5hbm90aW1lIHJldHVybmluZyB6ZXJvbm8gc3BhY2UgbGVmdCBvbiBkZXZpY2VvcGVyYXRpb24gbm90IHBlcm1pdHRlZG9wZXJhdGlvbiBub3Qgc3VwcG9ydGVkcGFuaWMgZHVyaW5nIHByZWVtcHRvZmZwcm9jcmVzaXplOiBpbnZhbGlkIGFyZ3JlZmxlY3QuVmFsdWUuSW50ZXJmYWNlcmVmbGVjdC5WYWx1ZS5OdW1NZXRob2RyZWZsZWN0Lm1ldGhvZFZhbHVlQ2FsbHJ1bnRpbWU6IGludGVybmFsIGVycm9ycnVudGltZTogbmV0cG9sbCBmYWlsZWRydW50aW1lOiBzLmFsbG9jQ291bnQ9IHMuYWxsb2NDb3VudCA+IHMubmVsZW1zc2NoZWR1bGU6IGhvbGRpbmcgbG9ja3NzaHJpbmtzdGFjayBhdCBiYWQgdGltZXNwYW4gaGFzIG5vIGZyZWUgc3RhY2tzc3RhY2sgZ3Jvd3RoIGFmdGVyIGZvcmtzeW50YXggZXJyb3IgaW4gcGF0dGVybnN5c3RlbSBodWdlIHBhZ2Ugc2l6ZSAodW5leHBlY3RlZCBtYXAga2V5IHR5cGV3b3JrLm53YWl0ID4gd29yay5ucHJvYzExNjQxNTMyMTgyNjkzNDgxNDQ1MzEyNTU4MjA3NjYwOTEzNDY3NDA3MjI2NTYyNUF6ZXJiYWlqYW4gU3RhbmRhcmQgVGltZUJhbmdsYWRlc2ggU3RhbmRhcmQgVGltZUNhcGUgVmVyZGUgU3RhbmRhcmQgVGltZUNlcnRGcg==108:T554,V2VzdCBBc2lhIFN0YW5kYXJkIFRpbWVXZXN0IEJhbmsgU3RhbmRhcmQgVGltZSIgbm90IGZvdW5kIGluIHJlZ2lzdHJ5IiwgbWlzc2luZyBDUFUgc3VwcG9ydGJ5dGVzLkJ1ZmZlcjogdG9vIGxhcmdlY2hhbiByZWNlaXZlIChuaWwgY2hhbiljbG9zZSBvZiBjbG9zZWQgY2hhbm5lbGRldmljZSBvciByZXNvdXJjZSBidXN5ZmF0YWw6IG1vcmVzdGFjayBvbiBnMGdhcmJhZ2UgY29sbGVjdGlvbiBzY2FuZ2NEcmFpbiBwaGFzZSBpbmNvcnJlY3RpbmRleCBvdXQgb2YgcmFuZ2UgWyV4XWludGVycnVwdGVkIHN5c3RlbSBjYWxsaW52YWxpZCBtLT5sb2NrZWRJbnQgPSBqc29uOiBjYW5ub3QgdW5tYXJzaGFsIGxlZnQgb3ZlciBtYXJrcm9vdCBqb2JzbWFrZWNoYW46IGJhZCBhbGlnbm1lbnRtaXNzaW5nIHR5cGUgaW4gcnVuZmlucW5hbm90aW1lIHJldHVybmluZyB6ZXJvbm8gc3BhY2UgbGVmdCBvbiBkZXZpY2VvcGVyYXRpb24gbm90IHBlcm1pdHRlZG9wZXJhdGlvbiBub3Qgc3VwcG9ydGVkcGFuaWMgZHVyaW5nIHByZWVtcHRvZmZwcm9jcmVzaXplOiBpbnZhbGlkIGFyZ3JlZmxlY3QuVmFsdWUuSW50ZXJmYWNlcmVmbGVjdC5WYWx1ZS5OdW1NZXRob2RyZWZsZWN0Lm1ldGhvZFZhbHVlQ2FsbHJ1bnRpbWU6IGludGVybmFsIGVycm9ycnVudGltZTogbmV0cG9sbCBmYWlsZWRydW50aW1lOiBzLmFsbG9jQ291bnQ9IHMuYWxsb2NDb3VudCA+IHMubmVsZW1zc2NoZWR1bGU6IGhvbGRpbmcgbG9ja3NzaHJpbmtzdGFjayBhdCBiYWQgdGltZXNwYW4gaGFzIG5vIGZyZWUgc3RhY2tzc3RhY2sgZ3Jvd3RoIGFmdGVyIGZvcmtzeW50YXggZXJyb3IgaW4gcGF0dGVybnN5c3RlbSBodWdlIHBhZ2Ugc2l6ZSAodW5leHBlY3RlZCBtYXAga2V5IHR5cGV3b3JrLm53YWl0ID4gd29yay5ucHJvYzExNjQxNTMyMTgyNjkzNDgxNDQ1MzEyNTU4MjA3NjYwOTEzNDY3NDA3MjI2NTYyNUF6ZXJiYWlqYW4gU3RhbmRhcmQgVGltZUJhbmdsYWRlc2ggU3RhbmRhcmQgVGltZUNhcGUgVmVyZGUgU3RhbmRhcmQgVGltZUNlcnRGcmU=109:T554,eDoleTpdc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOiV4OiV5XXRvbyBtYW55IHJlZmVyZW5jZXM6IGNhbm5vdCBzcGxpY2V1bmV4cGVjdGVkIHJ1bnRpbWUubmV0cG9sbCBlcnJvcjogMTc3NjM1NjgzOTQwMDI1MDQ2NDY3NzgxMDY2ODk0NTMxMjUyMDA2LTAxLTAyVDE1OjA0OjA1Ljk5OTk5OTk5OVowNzowMDg4ODE3ODQxOTcwMDEyNTIzMjMzODkwNTMzNDQ3MjY1NjI1U3VwcHJlc3MgYWxsIFVJIGR1cmluZyBpbnN0YWxsYXRpb25hdHRlbXB0IHRvIGNsZWFyIG5vbi1lbXB0eSBzcGFuIHNldGZpbGUgdHlwZSBkb2VzIG5vdCBzdXBwb3J0IGRlYWRsaW5lZmluZHJ1bm5hYmxlOiBuZXRwb2xsIHdpdGggc3Bpbm5pbmdncmV5b2JqZWN0OiBvYmogbm90IHBvaW50ZXItYWxpZ25lZG1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBmcmVlbWlzbWF0Y2hlZCBiZWdpbi9lbmQgb2YgYWN0aXZlU3dlZXBuZXR3b3JrIGRyb3BwZWQgY29ubmVjdGlvbiBvbiByZXNldHBlcnNpc3RlbnRhbGxvYzogYWxpZ24gaXMgdG9vIGxhcmdlcGlkbGVwdXQ6IFAgaGFzIG5vbi1lbXB0eSBydW4gcXVldWVyZWZsZWN0Lk1ha2VTbGljZSBvZiBub24tc2xpY2UgdHlwZXJ1bnRpbWU6IGNsb3NlIHBvbGxkZXNjIHcvbyB1bmJsb2NrcnVudGltZTogY3JlYXRlZXZlbnQgZmFpbGVkOyBlcnJubz1yeXVGdG9hRml4ZWQzMiBjYWxsZWQgd2l0aCBwcmVjID4gOXRyYWNlYmFjayBkaWQgbm90IHVud2luZCBjb21wbGV0ZWx5dHJhbnNwb3J0IGVuZHBvaW50IGlzIG5vdCBjb25uZWN0ZWQpIGlzIGxhcmdlciB0aGFuIG1heGltdW0gcGFnZSBzaXplICgpIGlzIG5vdCBHcnVubmFibGUgb3IgR3NjYW5ydW5uYWJsZTAxMjM0NTY3ODlhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejQ0NDA4OTIwOTg1MDA2MjYxNjE2OTQ1MjY2NzIzNjMyODEyNUVycm9yIGNhbGxpbmcgTXNpSW5zdGFsbFByb2R1Y3RBOiAldkdvIHBvaW50ZXIgc3RvcmVkIGludG8gbm9uLUdvIG1lbW9yeVVuYWJsZSB0byBkZXRlcm1pbmUgc3lzdGVtIGRpcmVjdG8=10a:T554,eDoleTpdc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOiV4OiV5XXRvbyBtYW55IHJlZmVyZW5jZXM6IGNhbm5vdCBzcGxpY2V1bmV4cGVjdGVkIHJ1bnRpbWUubmV0cG9sbCBlcnJvcjogMTc3NjM1NjgzOTQwMDI1MDQ2NDY3NzgxMDY2ODk0NTMxMjUyMDA2LTAxLTAyVDE1OjA0OjA1Ljk5OTk5OTk5OVowNzowMDg4ODE3ODQxOTcwMDEyNTIzMjMzODkwNTMzNDQ3MjY1NjI1U3VwcHJlc3MgYWxsIFVJIGR1cmluZyBpbnN0YWxsYXRpb25hdHRlbXB0IHRvIGNsZWFyIG5vbi1lbXB0eSBzcGFuIHNldGZpbGUgdHlwZSBkb2VzIG5vdCBzdXBwb3J0IGRlYWRsaW5lZmluZHJ1bm5hYmxlOiBuZXRwb2xsIHdpdGggc3Bpbm5pbmdncmV5b2JqZWN0OiBvYmogbm90IHBvaW50ZXItYWxpZ25lZG1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBmcmVlbWlzbWF0Y2hlZCBiZWdpbi9lbmQgb2YgYWN0aXZlU3dlZXBuZXR3b3JrIGRyb3BwZWQgY29ubmVjdGlvbiBvbiByZXNldHBlcnNpc3RlbnRhbGxvYzogYWxpZ24gaXMgdG9vIGxhcmdlcGlkbGVwdXQ6IFAgaGFzIG5vbi1lbXB0eSBydW4gcXVldWVyZWZsZWN0Lk1ha2VTbGljZSBvZiBub24tc2xpY2UgdHlwZXJ1bnRpbWU6IGNsb3NlIHBvbGxkZXNjIHcvbyB1bmJsb2NrcnVudGltZTogY3JlYXRlZXZlbnQgZmFpbGVkOyBlcnJubz1yeXVGdG9hRml4ZWQzMiBjYWxsZWQgd2l0aCBwcmVjID4gOXRyYWNlYmFjayBkaWQgbm90IHVud2luZCBjb21wbGV0ZWx5dHJhbnNwb3J0IGVuZHBvaW50IGlzIG5vdCBjb25uZWN0ZWQpIGlzIGxhcmdlciB0aGFuIG1heGltdW0gcGFnZSBzaXplICgpIGlzIG5vdCBHcnVubmFibGUgb3IgR3NjYW5ydW5uYWJsZTAxMjM0NTY3ODlhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejQ0NDA4OTIwOTg1MDA2MjYxNjE2OTQ1MjY2NzIzNjMyODEyNUVycm9yIGNhbGxpbmcgTXNpSW5zdGFsbFByb2R1Y3RBOiAldkdvIHBvaW50ZXIgc3RvcmVkIGludG8gbm9uLUdvIG1lbW9yeVVuYWJsZSB0byBkZXRlcm1pbmUgc3lzdGVtIGRpcmVjdG9y10b:T554,eWFjY2Vzc2VkIGRhdGEgZnJvbSBmcmVlZCB1c2VyIGFyZW5hIGFjY2Vzc2luZyBhIGNvcnJ1cHRlZCBzaGFyZWQgbGlicmFyeWludmFsaWQgYm9vbGVhbiB2YWx1ZSAlcSBmb3IgLSVzOiAldmpzb246IGVuY29kaW5nIGVycm9yIGZvciB0eXBlICVxOiAlcWtleSBzaXplIG5vdCBhIG11bHRpcGxlIG9mIGtleSBhbGlnbmxmc3RhY2sgbm9kZSBhbGxvY2F0ZWQgZnJvbSB0aGUgaGVhcG1ldGhvZCBBQkkgYW5kIHZhbHVlIEFCSSBkb24ndCBhbGlnbnJlZmxlY3Q6IE51bUZpZWxkIG9mIG5vbi1zdHJ1Y3QgdHlwZXJ1bnRpbWU6IFZpcnR1YWxRdWVyeSBmYWlsZWQ7IGVycm5vPXJ1bnRpbWU6IGJhZCBub3RpZnlMaXN0IHNpemUgLSBzeW5jPXJ1bnRpbWU6IGludmFsaWQgcGMtZW5jb2RlZCB0YWJsZSBmPXJ1bnRpbWU6IGludmFsaWQgdHlwZUJpdHNCdWxrQmFycmllcnJ1bnRpbWU6IG1hcmtlZCBmcmVlIG9iamVjdCBpbiBzcGFuIHJ1bnRpbWU6IG1jYWxsIGNhbGxlZCBvbiBtLT5nMCBzdGFja3J1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCB3YWl0bGlua3J1bnRpbWU6IHVuYmxvY2sgb24gY2xvc2luZyBwb2xsZGVzY3J1bnRpbWU6IHdyb25nIGdvcm91dGluZSBpbiBuZXdzdGFja3J5dUZ0b2FGaXhlZDY0IGNhbGxlZCB3aXRoIHByZWMgPiAxOHN0YXJ0bTogUCByZXF1aXJlZCBmb3Igc3Bpbm5pbmc9dHJ1ZXN0cmluZ3MuQnVpbGRlci5Hcm93OiBuZWdhdGl2ZSBjb3VudHN5bnRheCBlcnJvciBzY2FubmluZyBjb21wbGV4IG51bWJlcnVuY2FjaGluZyBzcGFuIGJ1dCBzLmFsbG9jQ291bnQgPT0gMHVzZXIgYXJlbmEgc3BhbiBpcyBvbiB0aGUgd3JvbmcgbGlzdCkgaXMgc21hbGxlciB0aGFuIG1pbmltdW0gcGFnZSBzaXplICgyMjIwNDQ2MDQ5MjUwMzEzMDgwODQ3MjYzMzM2MTgxNjQwNjI1RXJyb3IgY2FsbGluZyBNc2lSZWNvcmRTZXRTdHJpbmdBOiAldl9jZ29fbm90aWZ5X3J1bnRpbWVfaW5pdF9kb25lIG1pc3NpbmdhbGwgZ29yb3V0aW5lcyBhcmUgYXNsZWVwIC0gZGVhZGxvY2shYnl0ZXMuQnVm10c:T558,eWFjY2Vzc2VkIGRhdGEgZnJvbSBmcmVlZCB1c2VyIGFyZW5hIGFjY2Vzc2luZyBhIGNvcnJ1cHRlZCBzaGFyZWQgbGlicmFyeWludmFsaWQgYm9vbGVhbiB2YWx1ZSAlcSBmb3IgLSVzOiAldmpzb246IGVuY29kaW5nIGVycm9yIGZvciB0eXBlICVxOiAlcWtleSBzaXplIG5vdCBhIG11bHRpcGxlIG9mIGtleSBhbGlnbmxmc3RhY2sgbm9kZSBhbGxvY2F0ZWQgZnJvbSB0aGUgaGVhcG1ldGhvZCBBQkkgYW5kIHZhbHVlIEFCSSBkb24ndCBhbGlnbnJlZmxlY3Q6IE51bUZpZWxkIG9mIG5vbi1zdHJ1Y3QgdHlwZXJ1bnRpbWU6IFZpcnR1YWxRdWVyeSBmYWlsZWQ7IGVycm5vPXJ1bnRpbWU6IGJhZCBub3RpZnlMaXN0IHNpemUgLSBzeW5jPXJ1bnRpbWU6IGludmFsaWQgcGMtZW5jb2RlZCB0YWJsZSBmPXJ1bnRpbWU6IGludmFsaWQgdHlwZUJpdHNCdWxrQmFycmllcnJ1bnRpbWU6IG1hcmtlZCBmcmVlIG9iamVjdCBpbiBzcGFuIHJ1bnRpbWU6IG1jYWxsIGNhbGxlZCBvbiBtLT5nMCBzdGFja3J1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCB3YWl0bGlua3J1bnRpbWU6IHVuYmxvY2sgb24gY2xvc2luZyBwb2xsZGVzY3J1bnRpbWU6IHdyb25nIGdvcm91dGluZSBpbiBuZXdzdGFja3J5dUZ0b2FGaXhlZDY0IGNhbGxlZCB3aXRoIHByZWMgPiAxOHN0YXJ0bTogUCByZXF1aXJlZCBmb3Igc3Bpbm5pbmc9dHJ1ZXN0cmluZ3MuQnVpbGRlci5Hcm93OiBuZWdhdGl2ZSBjb3VudHN5bnRheCBlcnJvciBzY2FubmluZyBjb21wbGV4IG51bWJlcnVuY2FjaGluZyBzcGFuIGJ1dCBzLmFsbG9jQ291bnQgPT0gMHVzZXIgYXJlbmEgc3BhbiBpcyBvbiB0aGUgd3JvbmcgbGlzdCkgaXMgc21hbGxlciB0aGFuIG1pbmltdW0gcGFnZSBzaXplICgyMjIwNDQ2MDQ5MjUwMzEzMDgwODQ3MjYzMzM2MTgxNjQwNjI1RXJyb3IgY2FsbGluZyBNc2lSZWNvcmRTZXRTdHJpbmdBOiAldl9jZ29fbm90aWZ5X3J1bnRpbWVfaW5pdF9kb25lIG1pc3NpbmdhbGwgZ29yb3V0aW5lcyBhcmUgYXNsZWVwIC0gZGVhZGxvY2shYnl0ZXMuQnVmZg==10d:T550,IT0gIDw9PSBhcyAgYXQgIGZwPSBpcyAgbHI6IG9mICBvbiAgcGM9IHNwOiBzcD0nXCcnKSA9ICkgbT0rSW5mLUluZi5sb2cubXNpLm1zdDMxMjU6IHA9QUNEVEFDU1RBRURUQUVTVEFLRFRBS1NUQVdTVEFob21DRVNUQ2hhbURhc2hFRVNUR09HQ0p1bHlKdW5lTEVBRkxpc3VNaWFvTW9kaU5aRFROWlNUTmV3YVNBU1RTdGF0VGhhaVx1MDBtPV0gPSBdIG49YWxsZ2FsbHBhdngyYmFzZWJpbmRibWkxYm1pMmJvb2xjYWxsY2FzMWNhczJjYXMzY2FzNGNhczVjYXM2Y2hhbmRlYWRlcm1zZmlsZWZ1bmNob3VyaWRsZWludDhpdGFianNvbmtpbmRudWxsb3BlbnBpcGVyZWFkcm9vdHNicmtzc2UzdHJ1ZXVpbnQgIC0lcyAuLi4gTUIsICBhbmQgIGdvdD0gbWF4PSBtcywgIHB0ciAgdGFiPSB0b3A9Ki5tc2krMDMzMCswNDMwKzA1MzArMDU0NSswNjMwKzA4NDUrMTAzMCsxMjQ1KzEzNDUsIGZwOi0wOTMwMTU2MjU3ODEyNTxuaWw+QWRsYW1BcHJpbEJhbXVtQmF0YWtCdWhpZERvZ3JhRXJyb3JHcmVla0tobWVyTGF0aW5MaW1idUxvY2FsTHN0YXRNYXJjaE51c2h1T2doYW1Pcml5YU9zYWdlUnVuaWNTVGVybVRha3JpVGFtaWxcdTIwMl0gPSAoYXJyYXljbG9zZWRlZmVyZXhlY1JleGVjV2ZhbHNlZmF1bHRmbG9hdGdjaW5nZ3NjYW5oY2hhbmluaXQgaW50MTZpbnQzMmludDY0bWhlYXBta2Rpcm1vbnRobnRvaHNwYW5pY3NjYXYgc2NoZWRzbGVlcHNsaWNlc3NlNDFzc2U0MnNzc2Uzc3Vkb2dzd2VlcHRlc3RSdGVzdFd0cmFjZXVpbnQ4dXNhZ2V2YWx1ZXdyaXRlIEIgLT4gIFZhbHVlIGFkZHI9IGFsbG9jIGJhc2UgIGNvZGU9IGN0eHQ6IGN1cmc9IGZyZWUgIGdvaWQgIGpvYnM9IGxpc3Q9IG0tPnA9IG1heD0gIG1pbj0gIG5leHQ9IHAtPm09IHByZXY9IHNwYW49JSB1dGlsKC4uLiksIGkgPSAsIG5vdCAzOTA2MjU8LWNoYW5BcmFiaWNBdWd1c3RCcmFobWlDYXJpYW5DaGFrbWFDb21tb25Db3B0aWNGb3JtYXRGcmlkYXlHZXRBQ1BHb3RoaWNIYW5ndWxIYXRyYW5IZWJyZXdIeXBoZW5LYWl0aGlLaG9qa2lMZQ==10e:T550,IT0gIDw9PSBhcyAgYXQgIGZwPSBpcyAgbHI6IG9mICBvbiAgcGM9IHNwOiBzcD0nXCcnKSA9ICkgbT0rSW5mLUluZi5sb2cubXNpLm1zdDMxMjU6IHA9QUNEVEFDU1RBRURUQUVTVEFLRFRBS1NUQVdTVEFob21DRVNUQ2hhbURhc2hFRVNUR09HQ0p1bHlKdW5lTEVBRkxpc3VNaWFvTW9kaU5aRFROWlNUTmV3YVNBU1RTdGF0VGhhaVx1MDBtPV0gPSBdIG49YWxsZ2FsbHBhdngyYmFzZWJpbmRibWkxYm1pMmJvb2xjYWxsY2FzMWNhczJjYXMzY2FzNGNhczVjYXM2Y2hhbmRlYWRlcm1zZmlsZWZ1bmNob3VyaWRsZWludDhpdGFianNvbmtpbmRudWxsb3BlbnBpcGVyZWFkcm9vdHNicmtzc2UzdHJ1ZXVpbnQgIC0lcyAuLi4gTUIsICBhbmQgIGdvdD0gbWF4PSBtcywgIHB0ciAgdGFiPSB0b3A9Ki5tc2krMDMzMCswNDMwKzA1MzArMDU0NSswNjMwKzA4NDUrMTAzMCsxMjQ1KzEzNDUsIGZwOi0wOTMwMTU2MjU3ODEyNTxuaWw+QWRsYW1BcHJpbEJhbXVtQmF0YWtCdWhpZERvZ3JhRXJyb3JHcmVla0tobWVyTGF0aW5MaW1idUxvY2FsTHN0YXRNYXJjaE51c2h1T2doYW1Pcml5YU9zYWdlUnVuaWNTVGVybVRha3JpVGFtaWxcdTIwMl0gPSAoYXJyYXljbG9zZWRlZmVyZXhlY1JleGVjV2ZhbHNlZmF1bHRmbG9hdGdjaW5nZ3NjYW5oY2hhbmluaXQgaW50MTZpbnQzMmludDY0bWhlYXBta2Rpcm1vbnRobnRvaHNwYW5pY3NjYXYgc2NoZWRzbGVlcHNsaWNlc3NlNDFzc2U0MnNzc2Uzc3Vkb2dzd2VlcHRlc3RSdGVzdFd0cmFjZXVpbnQ4dXNhZ2V2YWx1ZXdyaXRlIEIgLT4gIFZhbHVlIGFkZHI9IGFsbG9jIGJhc2UgIGNvZGU9IGN0eHQ6IGN1cmc9IGZyZWUgIGdvaWQgIGpvYnM9IGxpc3Q9IG0tPnA9IG1heD0gIG1pbj0gIG5leHQ9IHAtPm09IHByZXY9IHNwYW49JSB1dGlsKC4uLiksIGkgPSAsIG5vdCAzOTA2MjU8LWNoYW5BcmFiaWNBdWd1c3RCcmFobWlDYXJpYW5DaGFrbWFDb21tb25Db3B0aWNGb3JtYXRGcmlkYXlHZXRBQ1BHb3RoaWNIYW5ndWxIYXRyYW5IZWJyZXdIeXBoZW5LYWl0aGlLaG9qa2lMZXA=10f:T554,YWx1ZS5FbGVtIG9uIGFuIGludmFsaWQgbm90aW5oZWFwIHBvaW50ZXJzeW5jOiBXYWl0R3JvdXAgaXMgcmV1c2VkIGJlZm9yZSBwcmV2aW91cyBXYWl0IGhhcyByZXR1cm5lZGFkZHIgcmFuZ2UgYmFzZSBhbmQgbGltaXQgYXJlIG5vdCBpbiB0aGUgc2FtZSBtZW1vcnkgc2VnbWVudG1hbnVhbCBzcGFuIGFsbG9jYXRpb24gY2FsbGVkIHdpdGggbm9uLW1hbnVhbGx5LW1hbmFnZWQgdHlwZXJlZmxlY3Q6IGNhbGwgb2YgcmVmbGVjdC5WYWx1ZS5MZW4gb24gcHRyIHRvIG5vbi1hcnJheSBWYWx1ZXJ1bnRpbWU6IEdldFF1ZXVlZENvbXBsZXRpb25TdGF0dXNFeCByZXR1cm5lZCBpbnZhbGlkIG1vZGU9IHJ1bnRpbWU6IG5ldHBvbGw6IFBvc3RRdWV1ZWRDb21wbGV0aW9uU3RhdHVzIGZhaWxlZCAoZXJybm89IGFiaVJlZ0FyZ3NUeXBlIG5lZWRzIEdDIFByb2csIHVwZGF0ZSBtZXRob2RWYWx1ZUNhbGxGcmFtZU9ianNmb3VuZCBiYWQgcG9pbnRlciBpbiBHbyBoZWFwIChpbmNvcnJlY3QgdXNlIG9mIHVuc2FmZSBvciBjZ28/KWxpbWl0ZXJFdmVudC5zdG9wOiBmb3VuZCB3cm9uZyBldmVudCBpbiBwJ3MgbGltaXRlciBldmVudCBzbG90cmVmbGVjdDogcmVmbGVjdC5WYWx1ZS5Qb2ludGVyIG9uIGFuIGludmFsaWQgbm90aW5oZWFwIHBvaW50ZXJydW50aW1lOiBpbnRlcm5hbCBlcnJvcjogbWlzdXNlIG9mIGxvY2tPU1RocmVhZC91bmxvY2tPU1RocmVhZG1hbGZvcm1lZCBHT01FTUxJTUlUOyBzZWUgYGdvIGRvYyBydW50aW1lL2RlYnVnLlNldE1lbW9yeUxpbWl0YEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky9BQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OS1fRHVwbGljYXRlIGRlcGxveW1lbnQgSUQgZm91bmQgd2l0aCBJRDogJXYsIHNraXBwaW5nIGluc3RhbGxhdGlvbmNvbXBpbGVDYWxsYmFjazogZXhwZWN0ZWQgZnVuY3Rpb24gd2l0aCBvbmUgdWludHB0ci1zaXplZCBy110:T558,YWx1ZS5FbGVtIG9uIGFuIGludmFsaWQgbm90aW5oZWFwIHBvaW50ZXJzeW5jOiBXYWl0R3JvdXAgaXMgcmV1c2VkIGJlZm9yZSBwcmV2aW91cyBXYWl0IGhhcyByZXR1cm5lZGFkZHIgcmFuZ2UgYmFzZSBhbmQgbGltaXQgYXJlIG5vdCBpbiB0aGUgc2FtZSBtZW1vcnkgc2VnbWVudG1hbnVhbCBzcGFuIGFsbG9jYXRpb24gY2FsbGVkIHdpdGggbm9uLW1hbnVhbGx5LW1hbmFnZWQgdHlwZXJlZmxlY3Q6IGNhbGwgb2YgcmVmbGVjdC5WYWx1ZS5MZW4gb24gcHRyIHRvIG5vbi1hcnJheSBWYWx1ZXJ1bnRpbWU6IEdldFF1ZXVlZENvbXBsZXRpb25TdGF0dXNFeCByZXR1cm5lZCBpbnZhbGlkIG1vZGU9IHJ1bnRpbWU6IG5ldHBvbGw6IFBvc3RRdWV1ZWRDb21wbGV0aW9uU3RhdHVzIGZhaWxlZCAoZXJybm89IGFiaVJlZ0FyZ3NUeXBlIG5lZWRzIEdDIFByb2csIHVwZGF0ZSBtZXRob2RWYWx1ZUNhbGxGcmFtZU9ianNmb3VuZCBiYWQgcG9pbnRlciBpbiBHbyBoZWFwIChpbmNvcnJlY3QgdXNlIG9mIHVuc2FmZSBvciBjZ28/KWxpbWl0ZXJFdmVudC5zdG9wOiBmb3VuZCB3cm9uZyBldmVudCBpbiBwJ3MgbGltaXRlciBldmVudCBzbG90cmVmbGVjdDogcmVmbGVjdC5WYWx1ZS5Qb2ludGVyIG9uIGFuIGludmFsaWQgbm90aW5oZWFwIHBvaW50ZXJydW50aW1lOiBpbnRlcm5hbCBlcnJvcjogbWlzdXNlIG9mIGxvY2tPU1RocmVhZC91bmxvY2tPU1RocmVhZG1hbGZvcm1lZCBHT01FTUxJTUlUOyBzZWUgYGdvIGRvYyBydW50aW1lL2RlYnVnLlNldE1lbW9yeUxpbWl0YEFCQ0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2Nzg5Ky9BQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OS1fRHVwbGljYXRlIGRlcGxveW1lbnQgSUQgZm91bmQgd2l0aCBJRDogJXYsIHNraXBwaW5nIGluc3RhbGxhdGlvbmNvbXBpbGVDYWxsYmFjazogZXhwZWN0ZWQgZnVuY3Rpb24gd2l0aCBvbmUgdWludHB0ci1zaXplZCByZQ==111:T554,YXVzZWQgY29ubmVjdGlvbiBhYm9ydHN3ZWVwIGluY3JlYXNlZCBhbGxvY2F0aW9uIGNvdW50c3luYzogbmVnYXRpdmUgV2FpdEdyb3VwIGNvdW50ZXJ1c2Ugb2YgY2xvc2VkIG5ldHdvcmsgY29ubmVjdGlvbiBvZiBtZXRob2Qgb24gbmlsIGludGVyZmFjZSB2YWx1ZSB0byBwb2ludGVyIHRvIGFycmF5IHdpdGggbGVuZ3RoIDE0MjEwODU0NzE1MjAyMDAzNzE3NDIyNDg1MzUxNTYyNTcxMDU0MjczNTc2MDEwMDE4NTg3MTEyNDI2NzU3ODEyNUVycm9yIGNhbGxpbmcgTXNpT3BlbkRhdGFiYXNlOiAldkVycm9yIGNyZWF0aW5nIGxvZ2ZpbGUgZm9sZGVyOiAldkVycm9yIHJ1bm5pbmcgTXNpT3BlbkRhdGFiYXNlOiAldkdPREVCVUc6IG5vIHZhbHVlIHNwZWNpZmllZCBmb3IgIkluaXRpYWxpemVQcm9jVGhyZWFkQXR0cmlidXRlTGlzdGNvbmN1cnJlbnQgbWFwIHJlYWQgYW5kIG1hcCB3cml0ZWZpbmRydW5uYWJsZTogbmVnYXRpdmUgbm1zcGlubmluZ2ZyZWVpbmcgc3RhY2sgbm90IGluIGEgc3RhY2sgc3BhbmludmFsaWQgdmFsdWUgJXEgZm9yIGZsYWcgLSVzOiAldm1pbiBtdXN0IGJlIGEgbm9uLXplcm8gcG93ZXIgb2YgMm1pc3JvdW5kZWQgYWxsb2NhdGlvbiBpbiBzeXNBbGxvY3JlZmxlY3QubmFtZUZyb206IG5hbWUgdG9vIGxvbmc6IHJlZmxlY3Q6IEZpZWxkIGluZGV4IG91dCBvZiByYW5nZXJlZmxlY3Q6IE51bU91dCBvZiBub24tZnVuYyB0eXBlIHJlZmxlY3Q6IGFycmF5IGluZGV4IG91dCBvZiByYW5nZXJlZmxlY3Q6IHNsaWNlIGluZGV4IG91dCBvZiByYW5nZXJ1bnRpbWU6IGNhc3RvZ3NjYW5zdGF0dXMgb2xkdmFsPXJ1bnRpbWU6IGZhaWxlZCBtU3Bhbkxpc3QuaW5zZXJ0IHJ1bnRpbWU6IGZhaWxlZCB0byBkZWNvbW1pdCBwYWdlc3J1bnRpbWU6IGdvcm91dGluZSBzdGFjayBleGNlZWRzIHJ1bnRpbWU6IG1lbW9yeSBhbGxvY2F0ZWQgYnkgT1MgW3J1bnRpbWU6IG5hbWUgb2Zmc2V0IG91dCBvZiByYW5nZXJ1bnRpbWU6IHRleHQgb2Zmc2V0IG91dCBvZiByYW5nZXJ1bnRpbWU6IHR5cGU=112:T558,YXVzZWQgY29ubmVjdGlvbiBhYm9ydHN3ZWVwIGluY3JlYXNlZCBhbGxvY2F0aW9uIGNvdW50c3luYzogbmVnYXRpdmUgV2FpdEdyb3VwIGNvdW50ZXJ1c2Ugb2YgY2xvc2VkIG5ldHdvcmsgY29ubmVjdGlvbiBvZiBtZXRob2Qgb24gbmlsIGludGVyZmFjZSB2YWx1ZSB0byBwb2ludGVyIHRvIGFycmF5IHdpdGggbGVuZ3RoIDE0MjEwODU0NzE1MjAyMDAzNzE3NDIyNDg1MzUxNTYyNTcxMDU0MjczNTc2MDEwMDE4NTg3MTEyNDI2NzU3ODEyNUVycm9yIGNhbGxpbmcgTXNpT3BlbkRhdGFiYXNlOiAldkVycm9yIGNyZWF0aW5nIGxvZ2ZpbGUgZm9sZGVyOiAldkVycm9yIHJ1bm5pbmcgTXNpT3BlbkRhdGFiYXNlOiAldkdPREVCVUc6IG5vIHZhbHVlIHNwZWNpZmllZCBmb3IgIkluaXRpYWxpemVQcm9jVGhyZWFkQXR0cmlidXRlTGlzdGNvbmN1cnJlbnQgbWFwIHJlYWQgYW5kIG1hcCB3cml0ZWZpbmRydW5uYWJsZTogbmVnYXRpdmUgbm1zcGlubmluZ2ZyZWVpbmcgc3RhY2sgbm90IGluIGEgc3RhY2sgc3BhbmludmFsaWQgdmFsdWUgJXEgZm9yIGZsYWcgLSVzOiAldm1pbiBtdXN0IGJlIGEgbm9uLXplcm8gcG93ZXIgb2YgMm1pc3JvdW5kZWQgYWxsb2NhdGlvbiBpbiBzeXNBbGxvY3JlZmxlY3QubmFtZUZyb206IG5hbWUgdG9vIGxvbmc6IHJlZmxlY3Q6IEZpZWxkIGluZGV4IG91dCBvZiByYW5nZXJlZmxlY3Q6IE51bU91dCBvZiBub24tZnVuYyB0eXBlIHJlZmxlY3Q6IGFycmF5IGluZGV4IG91dCBvZiByYW5nZXJlZmxlY3Q6IHNsaWNlIGluZGV4IG91dCBvZiByYW5nZXJ1bnRpbWU6IGNhc3RvZ3NjYW5zdGF0dXMgb2xkdmFsPXJ1bnRpbWU6IGZhaWxlZCBtU3Bhbkxpc3QuaW5zZXJ0IHJ1bnRpbWU6IGZhaWxlZCB0byBkZWNvbW1pdCBwYWdlc3J1bnRpbWU6IGdvcm91dGluZSBzdGFjayBleGNlZWRzIHJ1bnRpbWU6IG1lbW9yeSBhbGxvY2F0ZWQgYnkgT1MgW3J1bnRpbWU6IG5hbWUgb2Zmc2V0IG91dCBvZiByYW5nZXJ1bnRpbWU6IHRleHQgb2Zmc2V0IG91dCBvZiByYW5nZXJ1bnRpbWU6IHR5cGUgbw==113:T444,Q2VydEVudW1DZXJ0aWZpY2F0ZXNJblN0b3JlRWFzdGVyIElzbGFuZCBTdGFuZGFyZCBUaW1lRyB3YWl0aW5nIGxpc3QgaXMgY29ycnVwdGVkYWRkcmVzcyBub3QgYSBzdGFjayBhZGRyZXNzYWZ0ZXIgb2JqZWN0IGtleTp2YWx1ZSBwYWlyY2hhbm5lbCBudW1iZXIgb3V0IG9mIHJhbmdlY29tbXVuaWNhdGlvbiBlcnJvciBvbiBzZW5kY291bGQgbm90IGZpbmQgUVBDIHN5c2NhbGxzZmFpbGVkIHRvIHNldCBzd2VlcCBiYXJyaWVyZmxhZyBuZWVkcyBhbiBhcmd1bWVudDogLSVzZ2NzdG9wbTogbm90IHdhaXRpbmcgZm9yIGdjZ3Jvd3NsaWNlOiBsZW4gb3V0IG9mIHJhbmdlaW50ZXJuYWwgbG9ja09TVGhyZWFkIGVycm9yaW52YWxpZCBib29sZWFuIGZsYWcgJXM6ICV2aW52YWxpZCBwcm9maWxlIGJ1Y2tldCB0eXBla2V5IHdhcyByZWplY3RlZCBieSBzZXJ2aWNlbWFrZWNoYW46IHNpemUgb3V0IG9mIHJhbmdlbWFrZXNsaWNlOiBjYXAgb3V0IG9mIHJhbmdlbWFrZXNsaWNlOiBsZW4gb3V0IG9mIHJhbmdlbXNwYW4uc3dlZXA6IGJhZCBzcGFuIHN0YXRlbm90IGEgWEVOSVggbmFtZWQgdHlwZSBmaWxlcHJvZ1RvUG9pbnRlck1hc2s6IG92ZXJmbG93cmVmbGVjdC5WYWx1ZS5VbnNhZmVQb2ludGVycnVubG9jayBvZiB1bmxvY2tlZCByd211dGV4cnVudGltZTogYXN5bmNQcmVlbXB0U3RhY2s9cnVudGltZTogY2hlY2tkZWFkOiBmaW5kIGcgcnVudGltZTogY2hlY2tkZWFkOiBubWlkbGU9cnVudGltZTogY29ycnVwdGVkIHBvbGxkZXNjcnVudGltZTogbmV0cG9sbGluaXQgZmFpbGVkcnVudGltZTogdGhyZWFkIElEIG92ZXJmbG93cnVudGltZQ==114:T468,Q3JlYXRlRGlyZWN0b3J5V0Ruc05hbWVDb21wYXJlX1dEdXBsaWNhdGVUb2tlbkV4Rmx1c2hGaWxlQnVmZmVyc0dDIHNjYXZlbmdlIHdhaXRHQyB3b3JrZXIgKGlkbGUpR09ERUJVRzogdmFsdWUgIkdldENvbXB1dGVyTmFtZVdHZXRDdXJyZW50VGhyZWFkR2V0RnVsbFBhdGhOYW1lV0dldExvbmdQYXRoTmFtZVdJbXBlcmlhbF9BcmFtYWljTWVyb2l0aWNfQ3Vyc2l2ZU1zaU9wZW5EYXRhYmFzZUFNc2lTZXRJbnRlcm5hbFVJTmV0QXBpQnVmZmVyRnJlZU9wZW5Qcm9jZXNzVG9rZW5PdGhlcl9BbHBoYWJldGljUmVnUXVlcnlJbmZvS2V5V1JlZ1F1ZXJ5VmFsdWVFeFdSZW1vdmVEaXJlY3RvcnlXU2V0RmlsZVBvaW50ZXJFeFRlcm1pbmF0ZVByb2Nlc3NaYW5hYmF6YXJfU3F1YXJlcnVudGltZSBzdGFjazphZnRlciBvYmplY3Qga2V5YmFkIGcgdHJhbnNpdGlvbmJhZCBzcGVjaWFsIGtpbmRiYWQgc3VtbWFyeSBkYXRhYmFkIHN5bWJvbCB0YWJsZWNhc3RvZ3NjYW5zdGF0dXNnYzogdW5zd2VwdCBzcGFuZ2NzaHJpbmtzdGFja29mZmludGVnZXIgb3ZlcmZsb3dpbnZhbGlkIGFyZ3VtZW50aW52YWxpZCBleGNoYW5nZWludmFsaWQgZyBzdGF0dXNtU3Bhbkxpc3QuaW5zZXJ0bVNwYW5MaXN0LnJlbW92ZW1lc3NhZ2UgdG9vIGxvbmdtaXNzaW5nIHN0YWNrbWFwbm8gcm91dGUgdG8gaG9zdG5vbi1HbyBmdW5jdGlvbm9iamVjdCBpcyByZW1vdGVyZWZsZWN0IG1pc21hdGNocmVtb3RlIEkvTyBlcnJvcnJ1bnRpbWU6IGFkZHIgPSBydW50aW1lOiBiYXNlID0gcnVudGltZTogaGVhZCA9IHJ1bnRpbWU6IG5lbGVtcz1zY2hlZHVsZTogaW4gY2dvdGltZTogYmFkIFswLTldKnRpbWVCZWdpblBlcmlvZA==115:T554,ZCBpbmRpcmNoYW4gc2VuZGNvbXBsZXg2NGNvcHlzdGFja2N0eHQgIT0gMGZ1bmNhcmdzKGhjaGFuTGVhZmluaXR0cmFjZWludGVyZmFjZWludmFsaWQgbm1TcGFuRGVhZG50ZGxsLmRsbG9taXRlbXB0eXBhbmljd2FpdHBjbG11bHFkcXByZWVtcHRlZHByb2ZCbG9ja3BzYXBpLmRsbHJlY292ZXI6IHJlZmxlY3Q6IHJ3eHJ3eHJ3eHNjYXZ0cmFjZXN0YWNrcG9vbHRyYWNlYmFja3didWZTcGFuc30gc3RhY2s9WyBNQiBnb2FsLCAgZmx1c2hHZW4gIGZvciB0eXBlICBnZnJlZWNudD0gaGVhcEdvYWw9IHBhZ2VzIGF0ICBwdHJTaXplPSAgcnVucXNpemU9IHJ1bnF1ZXVlPSBzLmJhc2UoKT0gc3Bpbm5pbmc9IHN0b3B3YWl0PSBzd2VlcGdlbiAgc3dlZXBnZW49IHRhcmdldHBjPSB0aHJvd2luZz0gdW50aWwgcGM9JSEoTk9WRVJCKSUhV2Vla2RheSgoQkFESU5ERVgpLCBib3VuZCA9ICwgbGltaXQgPSAvZGV2L3N0ZGluMTIyMDcwMzEyNTYxMDM1MTU2MjU6IHBhcnNpbmcgQVNLRk9STkFNRUJhZCB2YXJpbnRDYW5jZWxJb0V4Q2hvcmFzbWlhbkNyZWF0ZUZpbGVDcmVhdGVQaXBlRGVwcmVjYXRlZERldmFuYWdhcmlEbnNRdWVyeV9XRXhjZXB0aW9uIEdDIGZvcmNlZEdPTUFYUFJPQ1NHT01FTUxJTUlUR2V0SWZFbnRyeUdldFZlcnNpb25HbGFnb2xpdGljS2hhcm9zaHRoaUxvY2tGaWxlRXhNYW5pY2hhZWFuT2xkX0l0YWxpY09sZF9QZXJtaWNPbGRfVHVya2ljT3RoZXJfTWF0aFBhcnNlRmxvYXRQaG9lbmljaWFuU2F1cmFzaHRyYVVzZXIzMi5kbGxXU0FDbGVhbnVwV1NBU29ja2V0V1dTQVN0YXJ0dXBhdG9taWNhbmQ4Y29tcGxleDEyOGNyZWF0ZXRlbXBkZWJ1ZyBjYWxsZG5zYXBpLmRsbGV4aXRUaHJlYWRmbG9hdDMybmFuZmxvYXQ2NG5hbmdldHNvY2tvcHRnb3JvdXRpbmUgaW52YWxpZHB0cm1TcGFuSW5Vc2Vub3RpZnlMaXN0b3duZXIgZGllZHByb2ZJbnNlcnRydW50aW1lOiBncy5zdGF0ZSA9IHNjaGVkdHJhY2VzZW1hY3F1aXJlc2V0c29ja29wdHN0YWNrTGFyZ2V0LktpbmQgPT0gdGltZS5EYXRlKHQ=116:T554,ZCBpbmRpcmNoYW4gc2VuZGNvbXBsZXg2NGNvcHlzdGFja2N0eHQgIT0gMGZ1bmNhcmdzKGhjaGFuTGVhZmluaXR0cmFjZWludGVyZmFjZWludmFsaWQgbm1TcGFuRGVhZG50ZGxsLmRsbG9taXRlbXB0eXBhbmljd2FpdHBjbG11bHFkcXByZWVtcHRlZHByb2ZCbG9ja3BzYXBpLmRsbHJlY292ZXI6IHJlZmxlY3Q6IHJ3eHJ3eHJ3eHNjYXZ0cmFjZXN0YWNrcG9vbHRyYWNlYmFja3didWZTcGFuc30gc3RhY2s9WyBNQiBnb2FsLCAgZmx1c2hHZW4gIGZvciB0eXBlICBnZnJlZWNudD0gaGVhcEdvYWw9IHBhZ2VzIGF0ICBwdHJTaXplPSAgcnVucXNpemU9IHJ1bnF1ZXVlPSBzLmJhc2UoKT0gc3Bpbm5pbmc9IHN0b3B3YWl0PSBzd2VlcGdlbiAgc3dlZXBnZW49IHRhcmdldHBjPSB0aHJvd2luZz0gdW50aWwgcGM9JSEoTk9WRVJCKSUhV2Vla2RheSgoQkFESU5ERVgpLCBib3VuZCA9ICwgbGltaXQgPSAvZGV2L3N0ZGluMTIyMDcwMzEyNTYxMDM1MTU2MjU6IHBhcnNpbmcgQVNLRk9STkFNRUJhZCB2YXJpbnRDYW5jZWxJb0V4Q2hvcmFzbWlhbkNyZWF0ZUZpbGVDcmVhdGVQaXBlRGVwcmVjYXRlZERldmFuYWdhcmlEbnNRdWVyeV9XRXhjZXB0aW9uIEdDIGZvcmNlZEdPTUFYUFJPQ1NHT01FTUxJTUlUR2V0SWZFbnRyeUdldFZlcnNpb25HbGFnb2xpdGljS2hhcm9zaHRoaUxvY2tGaWxlRXhNYW5pY2hhZWFuT2xkX0l0YWxpY09sZF9QZXJtaWNPbGRfVHVya2ljT3RoZXJfTWF0aFBhcnNlRmxvYXRQaG9lbmljaWFuU2F1cmFzaHRyYVVzZXIzMi5kbGxXU0FDbGVhbnVwV1NBU29ja2V0V1dTQVN0YXJ0dXBhdG9taWNhbmQ4Y29tcGxleDEyOGNyZWF0ZXRlbXBkZWJ1ZyBjYWxsZG5zYXBpLmRsbGV4aXRUaHJlYWRmbG9hdDMybmFuZmxvYXQ2NG5hbmdldHNvY2tvcHRnb3JvdXRpbmUgaW52YWxpZHB0cm1TcGFuSW5Vc2Vub3RpZnlMaXN0b3duZXIgZGllZHByb2ZJbnNlcnRydW50aW1lOiBncy5zdGF0ZSA9IHNjaGVkdHJhY2VzZW1hY3F1aXJlc2V0c29ja29wdHN0YWNrTGFyZ2V0LktpbmQgPT0gdGltZS5EYXRlKHRp117:T51c,RUJVRzogY2FuIG5vdCBlbmFibGUgIkdldEZpbmFsUGF0aE5hbWVCeUhhbmRsZVdHZXRRdWV1ZWRDb21wbGV0aW9uU3RhdHVzS2FsaW5pbmdyYWQgU3RhbmRhcmQgVGltZU1pZGRsZSBFYXN0IFN0YW5kYXJkIFRpbWVOZXcgWmVhbGFuZCBTdGFuZGFyZCBUaW1lTm9ydGggS29yZWEgU3RhbmRhcmQgVGltZVNvdXRoIFN1ZGFuIFN0YW5kYXJkIFRpbWVUcmFuc2JhaWthbCBTdGFuZGFyZCBUaW1lVVMgTW91bnRhaW4gU3RhbmRhcmQgVGltZVVsYWFuYmFhdGFyIFN0YW5kYXJkIFRpbWVVcGRhdGVQcm9jVGhyZWFkQXR0cmlidXRlVmxhZGl2b3N0b2sgU3RhbmRhcmQgVGltZVcuIE1vbmdvbGlhIFN0YW5kYXJkIFRpbWVfY2dvX3RocmVhZF9zdGFydCBtaXNzaW5nYWxsZ2FkZDogYmFkIHN0YXR1cyBHaWRsZWFyZW5hIGFscmVhZHkgaW5pdGlhbGl6ZWRiYWQgc3RhdHVzIGluIHNocmlua3N0YWNrYmFkIHN5c3RlbSBodWdlIHBhZ2Ugc2l6ZWNoYW5zZW5kOiBzcHVyaW91cyB3YWtldXBjaGVja2RlYWQ6IG5vIG0gZm9yIHRpbWVyY2hlY2tkZWFkOiBubyBwIGZvciB0aW1lcmluY29uc2lzdGVudCBwb2xsLmZkTXV0ZXhpbnZhbGlkIGNyb3NzLWRldmljZSBsaW5ranNvbjogVW5leHBlY3RlZCBrZXkgdHlwZWpzb246IHVuc3VwcG9ydGVkIHZhbHVlOiBtaXNzaW5nIHN0YWNrIGluIG5ld3N0YWNrbWlzc2luZyB0cmFjZUdDU3dlZXBTdGFydG5vIGJ1ZmZlciBzcGFjZSBhdmFpbGFibGVubyBzdWNoIGRldmljZSBvciBhZGRyZXNzb3BlcmF0aW9uIG5vdyBpbiBwcm9ncmVzc3JlZmxlY3QuVmFsdWUuT3ZlcmZsb3dJbnRyZWZsZWN0LlZhbHVlLlNldE1hcEluZGV4cmVmbGVjdDogQml0cyBvZiBuaWwgVHlwZXJlbGVhc2VwOiBpbnZhbGlkIHAgc3RhdGVyZW1haW5pbmcgcG9pbnRlciBidWZmZXJzcmVzb3VyY2UgZGVhZGxvY2sgYXZvaWRlZHJ1bnRpbWU6IFZpcnR1YWxBbGxvYyBvZiBydW50aW1lOiBwcm9ncmFtIGV4Y2VlZHMgcnVudGltZQ==118:T554,ZXI6IHRydW5jYXRpb24gb3V0IG9mIHJhbmdlY2Fubm90IGV4ZWMgYSBzaGFyZWQgbGlicmFyeSBkaXJlY3RseWZhaWxlZCB0byByZXNlcnZlIHBhZ2Ugc3VtbWFyeSBtZW1vcnlpbnRlcm5hbCBlcnJvcjogdW5rbm93biBuZXR3b3JrIHR5cGUgbWV0aG9kIEFCSSBhbmQgdmFsdWUgQUJJIGRvIG5vdCBhbGlnbnJlZmxlY3QuVmFsdWUuQnl0ZXMgb2Ygbm9uLWJ5dGUgYXJyYXlyZWZsZWN0LlZhbHVlLkJ5dGVzIG9mIG5vbi1ieXRlIHNsaWNlcmVmbGVjdC5WYWx1ZS5CeXRlcyBvZiBub24tcnVuZSBzbGljZXJlZmxlY3QuVmFsdWUuQ29udmVydDogdmFsdWUgb2YgdHlwZSByZWZsZWN0OiBCaXRzIG9mIG5vbi1hcml0aG1ldGljIFR5cGUgcmVmbGVjdDogTnVtRmllbGQgb2Ygbm9uLXN0cnVjdCB0eXBlIHJlZmxlY3Q6IGZ1bmNMYXlvdXQgb2Ygbm9uLWZ1bmMgdHlwZSBydW50aW1lLm1pbml0OiBkdXBsaWNhdGVoYW5kbGUgZmFpbGVkcnVudGltZTogYWxsb2NhdGlvbiBzaXplIG91dCBvZiByYW5nZXJ1bnRpbWU6IHVuZXhwZWN0ZWQgU1BXUklURSBmdW5jdGlvbiBzZXRwcm9maWxlYnVja2V0OiBwcm9maWxlIGFscmVhZHkgc2V0c3RhcnRUaGVXb3JsZDogaW5jb25zaXN0ZW50IG1wLT5uZXh0cHRpbWV6b25lIGhvdXIgb3V0c2lkZSBvZiByYW5nZSBbMCwyM112YWx1ZSB0b28gbGFyZ2UgZm9yIGRlZmluZWQgZGF0YSB0eXBlMTExMDIyMzAyNDYyNTE1NjU0MDQyMzYzMTY2ODA5MDgyMDMxMjU1NTUxMTE1MTIzMTI1NzgyNzAyMTE4MTU4MzQwNDU0MTAxNTYyNUVycm9yIGNhbGxpbmcgTXNpQ29uZmlndXJlUHJvZHVjdEE6ICV2RXJyb3IgY2FsbGluZyBNc2lEYXRhYmFzZU9wZW5WaWV3QTogJXZJbnN0YWxsZWQgQWdlbnQgd2l0aCBkZXBsb3ltZW50IElEOiAldlVuYWJsZSB0byBkZXRlcm1pbmUgc3lzdGVtIGRpcmVjdG9yeTogYWZ0ZXIgZGVjaW1hbCBwb2ludCBpbiBudW1lcmljIGxpdGVyYWxhcmcgc2l6ZSB0byByZWZsZWN0LmNhbGwgbW9yZSB0aGFuIDFHQmNhbiBub3QgYWNjZXNzIGEgbmVlZGVkIHNo119:T558,ZXI6IHRydW5jYXRpb24gb3V0IG9mIHJhbmdlY2Fubm90IGV4ZWMgYSBzaGFyZWQgbGlicmFyeSBkaXJlY3RseWZhaWxlZCB0byByZXNlcnZlIHBhZ2Ugc3VtbWFyeSBtZW1vcnlpbnRlcm5hbCBlcnJvcjogdW5rbm93biBuZXR3b3JrIHR5cGUgbWV0aG9kIEFCSSBhbmQgdmFsdWUgQUJJIGRvIG5vdCBhbGlnbnJlZmxlY3QuVmFsdWUuQnl0ZXMgb2Ygbm9uLWJ5dGUgYXJyYXlyZWZsZWN0LlZhbHVlLkJ5dGVzIG9mIG5vbi1ieXRlIHNsaWNlcmVmbGVjdC5WYWx1ZS5CeXRlcyBvZiBub24tcnVuZSBzbGljZXJlZmxlY3QuVmFsdWUuQ29udmVydDogdmFsdWUgb2YgdHlwZSByZWZsZWN0OiBCaXRzIG9mIG5vbi1hcml0aG1ldGljIFR5cGUgcmVmbGVjdDogTnVtRmllbGQgb2Ygbm9uLXN0cnVjdCB0eXBlIHJlZmxlY3Q6IGZ1bmNMYXlvdXQgb2Ygbm9uLWZ1bmMgdHlwZSBydW50aW1lLm1pbml0OiBkdXBsaWNhdGVoYW5kbGUgZmFpbGVkcnVudGltZTogYWxsb2NhdGlvbiBzaXplIG91dCBvZiByYW5nZXJ1bnRpbWU6IHVuZXhwZWN0ZWQgU1BXUklURSBmdW5jdGlvbiBzZXRwcm9maWxlYnVja2V0OiBwcm9maWxlIGFscmVhZHkgc2V0c3RhcnRUaGVXb3JsZDogaW5jb25zaXN0ZW50IG1wLT5uZXh0cHRpbWV6b25lIGhvdXIgb3V0c2lkZSBvZiByYW5nZSBbMCwyM112YWx1ZSB0b28gbGFyZ2UgZm9yIGRlZmluZWQgZGF0YSB0eXBlMTExMDIyMzAyNDYyNTE1NjU0MDQyMzYzMTY2ODA5MDgyMDMxMjU1NTUxMTE1MTIzMTI1NzgyNzAyMTE4MTU4MzQwNDU0MTAxNTYyNUVycm9yIGNhbGxpbmcgTXNpQ29uZmlndXJlUHJvZHVjdEE6ICV2RXJyb3IgY2FsbGluZyBNc2lEYXRhYmFzZU9wZW5WaWV3QTogJXZJbnN0YWxsZWQgQWdlbnQgd2l0aCBkZXBsb3ltZW50IElEOiAldlVuYWJsZSB0byBkZXRlcm1pbmUgc3lzdGVtIGRpcmVjdG9yeTogYWZ0ZXIgZGVjaW1hbCBwb2ludCBpbiBudW1lcmljIGxpdGVyYWxhcmcgc2l6ZSB0byByZWZsZWN0LmNhbGwgbW9yZSB0aGFuIDFHQmNhbiBub3QgYWNjZXNzIGEgbmVlZGVkIHNoYQ==11a:T554,ZmZzZXQgb3V0IG9mIHJhbmdlc2tpcCBldmVyeXRoaW5nIGFuZCBzdG9wIHRoZSB3YWxrc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbJXg6JXldc3RhY2thbGxvYyBub3Qgb24gc2NoZWR1bGVyIHN0YWNrc3RvcGxvY2tlZG06IGluY29uc2lzdGVudCBsb2NraW5ndGltZXIgcGVyaW9kIG11c3QgYmUgbm9uLW5lZ2F0aXZldG9vIG1hbnkgbGV2ZWxzIG9mIHN5bWJvbGljIGxpbmtzdW5hbGlnbmVkIDY0LWJpdCBhdG9taWMgb3BlcmF0aW9ud2FpdGluZyBmb3IgdW5zdXBwb3J0ZWQgZmlsZSB0eXBlMzU1MjcxMzY3ODgwMDUwMDkyOTM1NTYyMTMzNzg5MDYyNTogZGF5LW9mLXllYXIgZG9lcyBub3QgbWF0Y2ggbW9udGhFcnJvciBjYWxsaW5nIE1zaVNldEludGVybmFsVUk6ICV2RXJyb3IgcnVubmluZyBNc2lTZXRJbnRlcm5hbFVJOiAldk90aGVyX0RlZmF1bHRfSWdub3JhYmxlX0NvZGVfUG9pbnRTZXRGaWxlQ29tcGxldGlvbk5vdGlmaWNhdGlvbk1vZGVzVmlydHVhbFF1ZXJ5IGZvciBzdGFjayBiYXNlIGZhaWxlZGRvYWRkdGltZXI6IFAgYWxyZWFkeSBzZXQgaW4gdGltZXJmbGFnIHByb3ZpZGVkIGJ1dCBub3QgZGVmaW5lZDogLSVzZm9yRWFjaFA6IHNjaGVkLnNhZmVQb2ludFdhaXQgIT0gMGlsbGVnYWwgYmFzZTY0IGRhdGEgYXQgaW5wdXQgYnl0ZSBpbiBcdSBoZXhhZGVjaW1hbCBjaGFyYWN0ZXIgZXNjYXBlbXNwYW4uZW5zdXJlU3dlcHQ6IG0gaXMgbm90IGxvY2tlZG91dCBvZiBtZW1vcnkgYWxsb2NhdGluZyBhbGxBcmVuYXNyZWZsZWN0OiBDaGFuRGlyIG9mIG5vbi1jaGFuIHR5cGUgcmVmbGVjdDogRmllbGQgaW5kZXggb3V0IG9mIGJvdW5kc3JlZmxlY3Q6IEZpZWxkIG9mIG5vbi1zdHJ1Y3QgdHlwZSByZWZsZWN0OiBzdHJpbmcgaW5kZXggb3V0IG9mIHJhbmdlcnVudGltZS5TZXRGaW5hbGl6ZXI6IGNhbm5vdCBwYXNzIHJ1bnRpbWU6IGcgaXMgcnVubmluZyBidXQgcCBpcyBub3RzY2hlZHVsZTogc3Bpbm5pbmcgd2l0aCBsb2NhbCB3b3Jrc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBb11b:T558,ZmZzZXQgb3V0IG9mIHJhbmdlc2tpcCBldmVyeXRoaW5nIGFuZCBzdG9wIHRoZSB3YWxrc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbJXg6JXldc3RhY2thbGxvYyBub3Qgb24gc2NoZWR1bGVyIHN0YWNrc3RvcGxvY2tlZG06IGluY29uc2lzdGVudCBsb2NraW5ndGltZXIgcGVyaW9kIG11c3QgYmUgbm9uLW5lZ2F0aXZldG9vIG1hbnkgbGV2ZWxzIG9mIHN5bWJvbGljIGxpbmtzdW5hbGlnbmVkIDY0LWJpdCBhdG9taWMgb3BlcmF0aW9ud2FpdGluZyBmb3IgdW5zdXBwb3J0ZWQgZmlsZSB0eXBlMzU1MjcxMzY3ODgwMDUwMDkyOTM1NTYyMTMzNzg5MDYyNTogZGF5LW9mLXllYXIgZG9lcyBub3QgbWF0Y2ggbW9udGhFcnJvciBjYWxsaW5nIE1zaVNldEludGVybmFsVUk6ICV2RXJyb3IgcnVubmluZyBNc2lTZXRJbnRlcm5hbFVJOiAldk90aGVyX0RlZmF1bHRfSWdub3JhYmxlX0NvZGVfUG9pbnRTZXRGaWxlQ29tcGxldGlvbk5vdGlmaWNhdGlvbk1vZGVzVmlydHVhbFF1ZXJ5IGZvciBzdGFjayBiYXNlIGZhaWxlZGRvYWRkdGltZXI6IFAgYWxyZWFkeSBzZXQgaW4gdGltZXJmbGFnIHByb3ZpZGVkIGJ1dCBub3QgZGVmaW5lZDogLSVzZm9yRWFjaFA6IHNjaGVkLnNhZmVQb2ludFdhaXQgIT0gMGlsbGVnYWwgYmFzZTY0IGRhdGEgYXQgaW5wdXQgYnl0ZSBpbiBcdSBoZXhhZGVjaW1hbCBjaGFyYWN0ZXIgZXNjYXBlbXNwYW4uZW5zdXJlU3dlcHQ6IG0gaXMgbm90IGxvY2tlZG91dCBvZiBtZW1vcnkgYWxsb2NhdGluZyBhbGxBcmVuYXNyZWZsZWN0OiBDaGFuRGlyIG9mIG5vbi1jaGFuIHR5cGUgcmVmbGVjdDogRmllbGQgaW5kZXggb3V0IG9mIGJvdW5kc3JlZmxlY3Q6IEZpZWxkIG9mIG5vbi1zdHJ1Y3QgdHlwZSByZWZsZWN0OiBzdHJpbmcgaW5kZXggb3V0IG9mIHJhbmdlcnVudGltZS5TZXRGaW5hbGl6ZXI6IGNhbm5vdCBwYXNzIHJ1bnRpbWU6IGcgaXMgcnVubmluZyBidXQgcCBpcyBub3RzY2hlZHVsZTogc3Bpbm5pbmcgd2l0aCBsb2NhbCB3b3Jrc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbJQ==11c:T554,Z2luZXNlQ2FuY2VsSW9DaGVyb2tlZUN5cmlsbGljRGVjZW1iZXJEdXBsb3lhbkV0aGlvcGljRXh0ZW5kZXJGZWJydWFyeUZ1bGxQYXRoR2VvcmdpYW5Hb1N0cmluZ0d1amFyYXRpR3VybXVraGlIaXJhZ2FuYUphdmFuZXNlS2F0YWthbmFLYXlhaF9MaUxpbmVhcl9BTGluZWFyX0JNYWhhamFuaU5vdmVtYmVyT2xfQ2hpa2lQYXJzZUludFBoYWdzX1BhUmVhZEZpbGVTYXR1cmRheVRhZ2JhbndhVGFpX1RoYW1UYWlfVmlldFRodXJzZGF5VGlmaW5hZ2hVZ2FyaXRpY1dTQUlvY3RsW3NpZ25hbCBzdGFjaz1bY2dvY2hlY2tjcyAgICAgIGRlYWRsb2NrZHVyYXRpb25lYXggICAgIGVicCAgICAgZWJ4ICAgICBlY3ggICAgIGVkaSAgICAgZWR4ICAgICBlZmxhZ3MgIGVpcCAgICAgZXNpICAgICBlc3AgICAgIGZzICAgICAgZ3MgICAgICBpbmZpbml0eW5vIGFub2RlcG9sbERlc2NyZWZsZWN0LnJ1bm5hYmxlcnVudGltZS5zY2F2ZW5nZXNodXRkb3duc3RyY29udi50cmFjZUJ1ZnRyaWdnZXI9dW5rbm93bih3c2Fpb2N0bCAoZm9yY2VkKSBCIGV4cC4pICBCIHdvcmsgKCBibG9ja2VkPSBpbiB1c2UpIGxvY2tlZGc9IGxvY2tlZG09IG0tPmN1cmc9IG1hcmtlZCAgIG1ldGhvZDogIG1zIGNwdSwgIG5vdCBpbiBbIG9mIHR5cGUgIHJ1bnRpbWU9IHMubGltaXQ9IHMuc3RhdGU9IHRocmVhZHM9IHVubWFya2VkIHdidWYxLm49IHdidWYyLm49JSEoRVhUUkEgKE1JU1NJTkcpKHVua25vd24pLCBuZXd2YWw9LCBvbGR2YWw9LCBzaXplID0gLCB0YWlsID0gLTA3OjAwOjAwMjQ0MTQwNjI1OiBzdGF0dXM9QmFzc2FfVmFoQmhhaWtzdWtpQ3VuZWlmb3JtRGlhY3JpdGljRmluZENsb3NlRmxlZXREZWNrSGV4X0RpZ2l0SW5oZXJpdGVkSW50ZXJmYWNlS2h1ZGF3YWRpTG9jYWxGcmVlTWFsYXlhbGFtTW9uZ29saWFuTW92ZUZpbGVXTmFiYXRhZWFuUGFsbXlyZW5lUGFyc2VCb29sUGFyc2VVaW50U2FtYXJpdGFuU2VwdGVtYmVyU3VuZGFuZXNlV1NBU2VuZFRvV2VkbmVzZGF5V3JpdGVGaWxlWjA3OjAwOjAwYXRvbWljb3I4Yg==11d:T554,Z2luZXNlQ2FuY2VsSW9DaGVyb2tlZUN5cmlsbGljRGVjZW1iZXJEdXBsb3lhbkV0aGlvcGljRXh0ZW5kZXJGZWJydWFyeUZ1bGxQYXRoR2VvcmdpYW5Hb1N0cmluZ0d1amFyYXRpR3VybXVraGlIaXJhZ2FuYUphdmFuZXNlS2F0YWthbmFLYXlhaF9MaUxpbmVhcl9BTGluZWFyX0JNYWhhamFuaU5vdmVtYmVyT2xfQ2hpa2lQYXJzZUludFBoYWdzX1BhUmVhZEZpbGVTYXR1cmRheVRhZ2JhbndhVGFpX1RoYW1UYWlfVmlldFRodXJzZGF5VGlmaW5hZ2hVZ2FyaXRpY1dTQUlvY3RsW3NpZ25hbCBzdGFjaz1bY2dvY2hlY2tjcyAgICAgIGRlYWRsb2NrZHVyYXRpb25lYXggICAgIGVicCAgICAgZWJ4ICAgICBlY3ggICAgIGVkaSAgICAgZWR4ICAgICBlZmxhZ3MgIGVpcCAgICAgZXNpICAgICBlc3AgICAgIGZzICAgICAgZ3MgICAgICBpbmZpbml0eW5vIGFub2RlcG9sbERlc2NyZWZsZWN0LnJ1bm5hYmxlcnVudGltZS5zY2F2ZW5nZXNodXRkb3duc3RyY29udi50cmFjZUJ1ZnRyaWdnZXI9dW5rbm93bih3c2Fpb2N0bCAoZm9yY2VkKSBCIGV4cC4pICBCIHdvcmsgKCBibG9ja2VkPSBpbiB1c2UpIGxvY2tlZGc9IGxvY2tlZG09IG0tPmN1cmc9IG1hcmtlZCAgIG1ldGhvZDogIG1zIGNwdSwgIG5vdCBpbiBbIG9mIHR5cGUgIHJ1bnRpbWU9IHMubGltaXQ9IHMuc3RhdGU9IHRocmVhZHM9IHVubWFya2VkIHdidWYxLm49IHdidWYyLm49JSEoRVhUUkEgKE1JU1NJTkcpKHVua25vd24pLCBuZXd2YWw9LCBvbGR2YWw9LCBzaXplID0gLCB0YWlsID0gLTA3OjAwOjAwMjQ0MTQwNjI1OiBzdGF0dXM9QmFzc2FfVmFoQmhhaWtzdWtpQ3VuZWlmb3JtRGlhY3JpdGljRmluZENsb3NlRmxlZXREZWNrSGV4X0RpZ2l0SW5oZXJpdGVkSW50ZXJmYWNlS2h1ZGF3YWRpTG9jYWxGcmVlTWFsYXlhbGFtTW9uZ29saWFuTW92ZUZpbGVXTmFiYXRhZWFuUGFsbXlyZW5lUGFyc2VCb29sUGFyc2VVaW50U2FtYXJpdGFuU2VwdGVtYmVyU3VuZGFuZXNlV1NBU2VuZFRvV2VkbmVzZGF5V3JpdGVGaWxlWjA3OjAwOjAwYXRvbWljb3I4YmE=11e:T550,Z29hbCAgS2lCIHRvdGFsLCAgTUIgc3RhY2tzLCAgW3JlY292ZXJlZF0gYWxsb2NDb3VudCAgZm91bmQgYXQgKiggZ2NzY2FuZG9uZSAgbS0+Z3NpZ25hbD0gbWF4VHJpZ2dlcj0gbkRhdGFSb290cz0gblNwYW5Sb290cz0gcGFnZXMvYnl0ZSBwcmVlbXB0b2ZmPSBzLmVsZW1zaXplPSBzLnN3ZWVwZ2VuPSBzcGFuLmxpbWl0PSBzcGFuLnN0YXRlPSBzeXNtb253YWl0PSB3YnVmMT08bmlsPiB3YnVmMj08bmlsPiUhKEJBRFdJRFRIKSkgcC0+c3RhdHVzPSwgY29ucy9tYXJrIC1ieXRlIGxpbWl0MTUyNTg3ODkwNjI1NzYyOTM5NDUzMTI1QmlkaV9Db250cm9sREVQTE9ZTUVOVElER2V0QWRkckluZm9XR2V0Q29uc29sZUNQR2V0TGFzdEVycm9yR2V0TGVuZ3RoU2lkR2V0U3RkSGFuZGxlR2V0VGVtcFBhdGhXSm9pbl9Db250cm9sTG9hZExpYnJhcnlXTWVldGVpX01heWVrTXNpVmlld0Nsb3NlTXNpVmlld0ZldGNoUGFoYXdoX0htb25nUmVhZENvbnNvbGVXUmV2ZXJ0VG9TZWxmU2V0RW5kT2ZGaWxlU29yYV9Tb21wZW5nU3lsb3RpX05hZ3JpVHJhbnNtaXRGaWxlVW5sb2NrRmlsZUV4VmlydHVhbFF1ZXJ5YWJpIG1pc21hdGNoYWR2YXBpMzIuZGxsYmFkIGZsdXNoR2VuYmFkIGcgc3RhdHVzYmFkIGcwIHN0YWNrYmFkIHJlY292ZXJ5Y2FuJ3QgaGFwcGVuY2FzNjQgZmFpbGVkY2hhbiByZWNlaXZlZHVtcGluZyBoZWFwZW5kIHRyYWNlZ2NlbnRlcnN5c2NhbGxnY0JpdHNBcmVuYXNnY3BhY2VydHJhY2VoYXJkZGVjb21taXRob3N0IGlzIGRvd25pbGxlZ2FsIHNlZWtpbnZhbGlkIHBhdGhpbnZhbGlkIHNsb3RpcGhscGFwaS5kbGxrZXJuZWwzMi5kbGxtYWR2ZG9udG5lZWRtaGVhcFNwZWNpYWxtc3BhblNwZWNpYWxuZXRhcGkzMi5kbGxub3QgcG9sbGFibGVyZWZsZWN0LkNvcHlyZWxlYXNlcDogbT1ydW50aW1lOiBncD1ydW50aW1lOiBzcD1zZWxmLXByZWVtcHRzaG9ydCBidWZmZXJzcGFuU2V0U3BpbmVzd2VlcFdhaXRlcnN0cmFjZVN0cmluZ3N3aXJlcDogcC0+bT13b3JrZXIgbW9kZSAgIT0gc3dlZXBn11f:T554,Z29hbCAgS2lCIHRvdGFsLCAgTUIgc3RhY2tzLCAgW3JlY292ZXJlZF0gYWxsb2NDb3VudCAgZm91bmQgYXQgKiggZ2NzY2FuZG9uZSAgbS0+Z3NpZ25hbD0gbWF4VHJpZ2dlcj0gbkRhdGFSb290cz0gblNwYW5Sb290cz0gcGFnZXMvYnl0ZSBwcmVlbXB0b2ZmPSBzLmVsZW1zaXplPSBzLnN3ZWVwZ2VuPSBzcGFuLmxpbWl0PSBzcGFuLnN0YXRlPSBzeXNtb253YWl0PSB3YnVmMT08bmlsPiB3YnVmMj08bmlsPiUhKEJBRFdJRFRIKSkgcC0+c3RhdHVzPSwgY29ucy9tYXJrIC1ieXRlIGxpbWl0MTUyNTg3ODkwNjI1NzYyOTM5NDUzMTI1QmlkaV9Db250cm9sREVQTE9ZTUVOVElER2V0QWRkckluZm9XR2V0Q29uc29sZUNQR2V0TGFzdEVycm9yR2V0TGVuZ3RoU2lkR2V0U3RkSGFuZGxlR2V0VGVtcFBhdGhXSm9pbl9Db250cm9sTG9hZExpYnJhcnlXTWVldGVpX01heWVrTXNpVmlld0Nsb3NlTXNpVmlld0ZldGNoUGFoYXdoX0htb25nUmVhZENvbnNvbGVXUmV2ZXJ0VG9TZWxmU2V0RW5kT2ZGaWxlU29yYV9Tb21wZW5nU3lsb3RpX05hZ3JpVHJhbnNtaXRGaWxlVW5sb2NrRmlsZUV4VmlydHVhbFF1ZXJ5YWJpIG1pc21hdGNoYWR2YXBpMzIuZGxsYmFkIGZsdXNoR2VuYmFkIGcgc3RhdHVzYmFkIGcwIHN0YWNrYmFkIHJlY292ZXJ5Y2FuJ3QgaGFwcGVuY2FzNjQgZmFpbGVkY2hhbiByZWNlaXZlZHVtcGluZyBoZWFwZW5kIHRyYWNlZ2NlbnRlcnN5c2NhbGxnY0JpdHNBcmVuYXNnY3BhY2VydHJhY2VoYXJkZGVjb21taXRob3N0IGlzIGRvd25pbGxlZ2FsIHNlZWtpbnZhbGlkIHBhdGhpbnZhbGlkIHNsb3RpcGhscGFwaS5kbGxrZXJuZWwzMi5kbGxtYWR2ZG9udG5lZWRtaGVhcFNwZWNpYWxtc3BhblNwZWNpYWxuZXRhcGkzMi5kbGxub3QgcG9sbGFibGVyZWZsZWN0LkNvcHlyZWxlYXNlcDogbT1ydW50aW1lOiBncD1ydW50aW1lOiBzcD1zZWxmLXByZWVtcHRzaG9ydCBidWZmZXJzcGFuU2V0U3BpbmVzd2VlcFdhaXRlcnN0cmFjZVN0cmluZ3N3aXJlcDogcC0+bT13b3JrZXIgbW9kZSAgIT0gc3dlZXBnZQ==120:T554,aGFiZXRwcm90b2NvbCBmYW1pbHkgbm90IHN1cHBvcnRlZHJlZmxlY3Q6IEVsZW0gb2YgaW52YWxpZCB0eXBlcmVmbGVjdDogSW4gb2Ygbm9uLWZ1bmMgdHlwZSByZWZsZWN0OiBLZXkgb2Ygbm9uLW1hcCB0eXBlIHJ1bnRpbWUuc2VtYXNsZWVwIHdhaXRfZmFpbGVkcnVudGltZTogaW1wb3NzaWJsZSB0eXBlIGtpbmRydW50aW1lOiBsZXZlbFNoaWZ0W2xldmVsXSA9IHJ1bnRpbWU6IG1hcmtpbmcgZnJlZSBvYmplY3QgcnVudGltZTogcC5nY01hcmtXb3JrZXJNb2RlPSBydW50aW1lOiBzcGxpdCBzdGFjayBvdmVyZmxvd3J1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCBjcnVudGltZTogc3VtbWFyeSBtYXggcGFnZXMgPSBydW50aW1lOiB0cmFjZWJhY2sgc3R1Y2suIHBjPXNjYW5vYmplY3Qgb2YgYSBub3NjYW4gb2JqZWN0c2VtYWNxdWlyZSBub3Qgb24gdGhlIEcgc3RhY2tzdHJpbmcgY29uY2F0ZW5hdGlvbiB0b28gbG9uZ3N5bnRheCBlcnJvciBzY2FubmluZyBib29sZWFudGltZUJlZ2luL0VuZFBlcmlvZCBub3QgZm91bmR0b28gbWFueSBvcGVuIGZpbGVzIGluIHN5c3RlbSAodHlwZXMgZnJvbSBkaWZmZXJlbnQgc2NvcGVzKSBpbiBwcmVwYXJlRm9yU3dlZXA7IHN3ZWVwZ2VuICBsb2NhbHMgc3RhY2sgbWFwIGVudHJpZXMgZm9yIDIyNzM3MzY3NTQ0MzIzMjA1OTQ3ODc1OTc2NTYyNUNlbnRyYWwgRXVyb3BlYW4gU3RhbmRhcmQgVGltZUNlbnRyYWwgU3RhbmRhcmQgVGltZSAoTWV4aWNvKUUuIFNvdXRoIEFtZXJpY2EgU3RhbmRhcmQgVGltZUVhc3Rlcm4gU3RhbmRhcmQgVGltZSAoTWV4aWNvKUVycm9yIGNhbGxpbmcgTXNpVmlld0Nsb3NlOiAldkVycm9yIGNhbGxpbmcgTXNpVmlld0ZldGNoOiAldkVycm9yIHJ1bm5pbmcgTW9kaWZ5UmVjb3JkOiAldkdPREVCVUc6IHVua25vd24gY3B1IGZlYXR1cmUgIk1hcEl0ZXIuS2V5IGNhbGxlZCBiZWZvcmUgTmV4dE1zaUNyZWF0ZVRyYW5zZm9ybVN1bW1hcnlJbmZvQVBhY2lmaWMgU3RhbmRhcmQgVGltZSAoTWV4aWNvKVR1cmtzIEFuZCBDYWljb3M=121:T558,aGFiZXRwcm90b2NvbCBmYW1pbHkgbm90IHN1cHBvcnRlZHJlZmxlY3Q6IEVsZW0gb2YgaW52YWxpZCB0eXBlcmVmbGVjdDogSW4gb2Ygbm9uLWZ1bmMgdHlwZSByZWZsZWN0OiBLZXkgb2Ygbm9uLW1hcCB0eXBlIHJ1bnRpbWUuc2VtYXNsZWVwIHdhaXRfZmFpbGVkcnVudGltZTogaW1wb3NzaWJsZSB0eXBlIGtpbmRydW50aW1lOiBsZXZlbFNoaWZ0W2xldmVsXSA9IHJ1bnRpbWU6IG1hcmtpbmcgZnJlZSBvYmplY3QgcnVudGltZTogcC5nY01hcmtXb3JrZXJNb2RlPSBydW50aW1lOiBzcGxpdCBzdGFjayBvdmVyZmxvd3J1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCBjcnVudGltZTogc3VtbWFyeSBtYXggcGFnZXMgPSBydW50aW1lOiB0cmFjZWJhY2sgc3R1Y2suIHBjPXNjYW5vYmplY3Qgb2YgYSBub3NjYW4gb2JqZWN0c2VtYWNxdWlyZSBub3Qgb24gdGhlIEcgc3RhY2tzdHJpbmcgY29uY2F0ZW5hdGlvbiB0b28gbG9uZ3N5bnRheCBlcnJvciBzY2FubmluZyBib29sZWFudGltZUJlZ2luL0VuZFBlcmlvZCBub3QgZm91bmR0b28gbWFueSBvcGVuIGZpbGVzIGluIHN5c3RlbSAodHlwZXMgZnJvbSBkaWZmZXJlbnQgc2NvcGVzKSBpbiBwcmVwYXJlRm9yU3dlZXA7IHN3ZWVwZ2VuICBsb2NhbHMgc3RhY2sgbWFwIGVudHJpZXMgZm9yIDIyNzM3MzY3NTQ0MzIzMjA1OTQ3ODc1OTc2NTYyNUNlbnRyYWwgRXVyb3BlYW4gU3RhbmRhcmQgVGltZUNlbnRyYWwgU3RhbmRhcmQgVGltZSAoTWV4aWNvKUUuIFNvdXRoIEFtZXJpY2EgU3RhbmRhcmQgVGltZUVhc3Rlcm4gU3RhbmRhcmQgVGltZSAoTWV4aWNvKUVycm9yIGNhbGxpbmcgTXNpVmlld0Nsb3NlOiAldkVycm9yIGNhbGxpbmcgTXNpVmlld0ZldGNoOiAldkVycm9yIHJ1bm5pbmcgTW9kaWZ5UmVjb3JkOiAldkdPREVCVUc6IHVua25vd24gY3B1IGZlYXR1cmUgIk1hcEl0ZXIuS2V5IGNhbGxlZCBiZWZvcmUgTmV4dE1zaUNyZWF0ZVRyYW5zZm9ybVN1bW1hcnlJbmZvQVBhY2lmaWMgU3RhbmRhcmQgVGltZSAoTWV4aWNvKVR1cmtzIEFuZCBDYWljb3MgUw==122:T554,aWNhIFN0YW5kYXJkIFRpbWViYWQgd3JpdGUgYmFycmllciBidWZmZXIgYm91bmRzY2Fubm90IGFzc2lnbiByZXF1ZXN0ZWQgYWRkcmVzc2Nhc2dzdGF0dXM6IGJhZCBpbmNvbWluZyB2YWx1ZXNjaGVja21hcmsgZm91bmQgdW5tYXJrZWQgb2JqZWN0ZW50ZXJzeXNjYWxsYmxvY2sgaW5jb25zaXN0ZW50IGZtdDogdW5rbm93biBiYXNlOyBjYW4ndCBoYXBwZW5pbiBsaXRlcmFsIG51bGwgKGV4cGVjdGluZyAnbCcpaW4gbGl0ZXJhbCBudWxsIChleHBlY3RpbmcgJ3UnKWluIGxpdGVyYWwgdHJ1ZSAoZXhwZWN0aW5nICdlJylpbiBsaXRlcmFsIHRydWUgKGV4cGVjdGluZyAncicpaW4gbGl0ZXJhbCB0cnVlIChleHBlY3RpbmcgJ3UnKWludGVybmFsIGVycm9yIC0gbWlzdXNlIG9mIGl0YWJqc29uOiBpbnZhbGlkIG51bWJlciBsaXRlcmFsICVxbWFsZm9ybWVkIHRpbWUgem9uZSBpbmZvcm1hdGlvbm5vbiBpbi11c2Ugc3BhbiBpbiB1bnN3ZXB0IGxpc3RwYWNlcjogc3dlZXAgZG9uZSBhdCBoZWFwIHNpemUgcGF0dGVybiBjb250YWlucyBwYXRoIHNlcGFyYXRvcnJlZmxlY3QuTWFrZVNsaWNlOiBuZWdhdGl2ZSBjYXByZWZsZWN0Lk1ha2VTbGljZTogbmVnYXRpdmUgbGVucmVmbGVjdDogTGVuIG9mIG5vbi1hcnJheSB0eXBlIHJlc2V0c3Bpbm5pbmc6IG5vdCBhIHNwaW5uaW5nIG1ydW50aW1lOiBjYW5ub3QgYWxsb2NhdGUgbWVtb3J5cnVudGltZTogZmFpbGVkIHRvIGNvbW1pdCBwYWdlc3J1bnRpbWU6IHNwbGl0IHN0YWNrIG92ZXJmbG93OiBzbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFsleDpdc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOiV4XXVuc2FmZS5TdHJpbmc6IGxlbiBvdXQgb2YgcmFuZ2UgKHR5cGVzIGZyb20gZGlmZmVyZW50IHBhY2thZ2VzKTI4NDIxNzA5NDMwNDA0MDA3NDM0ODQ0OTcwNzAzMTI1OiBkYXktb2YteWVhciBkb2VzIG5vdCBtYXRjaCBkYXlDZXJ0QWRkQ2VydGlmaWNhdGVDb250ZXh0VG9TdG9yZUNlcnRWZXJpZnlDZXJ0aWZpY2F0ZUNoYWluUG9saWN5RXJyb3IgY2Fs123:T558,aWNhIFN0YW5kYXJkIFRpbWViYWQgd3JpdGUgYmFycmllciBidWZmZXIgYm91bmRzY2Fubm90IGFzc2lnbiByZXF1ZXN0ZWQgYWRkcmVzc2Nhc2dzdGF0dXM6IGJhZCBpbmNvbWluZyB2YWx1ZXNjaGVja21hcmsgZm91bmQgdW5tYXJrZWQgb2JqZWN0ZW50ZXJzeXNjYWxsYmxvY2sgaW5jb25zaXN0ZW50IGZtdDogdW5rbm93biBiYXNlOyBjYW4ndCBoYXBwZW5pbiBsaXRlcmFsIG51bGwgKGV4cGVjdGluZyAnbCcpaW4gbGl0ZXJhbCBudWxsIChleHBlY3RpbmcgJ3UnKWluIGxpdGVyYWwgdHJ1ZSAoZXhwZWN0aW5nICdlJylpbiBsaXRlcmFsIHRydWUgKGV4cGVjdGluZyAncicpaW4gbGl0ZXJhbCB0cnVlIChleHBlY3RpbmcgJ3UnKWludGVybmFsIGVycm9yIC0gbWlzdXNlIG9mIGl0YWJqc29uOiBpbnZhbGlkIG51bWJlciBsaXRlcmFsICVxbWFsZm9ybWVkIHRpbWUgem9uZSBpbmZvcm1hdGlvbm5vbiBpbi11c2Ugc3BhbiBpbiB1bnN3ZXB0IGxpc3RwYWNlcjogc3dlZXAgZG9uZSBhdCBoZWFwIHNpemUgcGF0dGVybiBjb250YWlucyBwYXRoIHNlcGFyYXRvcnJlZmxlY3QuTWFrZVNsaWNlOiBuZWdhdGl2ZSBjYXByZWZsZWN0Lk1ha2VTbGljZTogbmVnYXRpdmUgbGVucmVmbGVjdDogTGVuIG9mIG5vbi1hcnJheSB0eXBlIHJlc2V0c3Bpbm5pbmc6IG5vdCBhIHNwaW5uaW5nIG1ydW50aW1lOiBjYW5ub3QgYWxsb2NhdGUgbWVtb3J5cnVudGltZTogZmFpbGVkIHRvIGNvbW1pdCBwYWdlc3J1bnRpbWU6IHNwbGl0IHN0YWNrIG92ZXJmbG93OiBzbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFsleDpdc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOiV4XXVuc2FmZS5TdHJpbmc6IGxlbiBvdXQgb2YgcmFuZ2UgKHR5cGVzIGZyb20gZGlmZmVyZW50IHBhY2thZ2VzKTI4NDIxNzA5NDMwNDA0MDA3NDM0ODQ0OTcwNzAzMTI1OiBkYXktb2YteWVhciBkb2VzIG5vdCBtYXRjaCBkYXlDZXJ0QWRkQ2VydGlmaWNhdGVDb250ZXh0VG9TdG9yZUNlcnRWZXJpZnlDZXJ0aWZpY2F0ZUNoYWluUG9saWN5RXJyb3IgY2FsbA==124:T554,aW5nIE1zaUNsb3NlSGFuZGxlOiAldkVycm9yIGNhbGxpbmcgTXNpVmlld0V4ZWN1dGU6ICV2TWFwSXRlci5WYWx1ZSBjYWxsZWQgYmVmb3JlIE5leHRXU0FHZXRPdmVybGFwcGVkUmVzdWx0IG5vdCBmb3VuZCIgbm90IHN1cHBvcnRlZCBmb3IgY3B1IG9wdGlvbiAiaW4gbGl0ZXJhbCBmYWxzZSAoZXhwZWN0aW5nICdhJylpbiBsaXRlcmFsIGZhbHNlIChleHBlY3RpbmcgJ2UnKWluIGxpdGVyYWwgZmFsc2UgKGV4cGVjdGluZyAnbCcpaW4gbGl0ZXJhbCBmYWxzZSAoZXhwZWN0aW5nICdzJylpbnZhbGlkIGxpbWl0ZXIgZXZlbnQgdHlwZSBmb3VuZG51bWVyaWNhbCBhcmd1bWVudCBvdXQgb2YgZG9tYWlucGFuaWMgd2hpbGUgcHJpbnRpbmcgcGFuaWMgdmFsdWVyZWZsZWN0Lm5hbWVGcm9tOiB0YWcgdG9vIGxvbmc6IHJlZmxlY3Q6IE51bUluIG9mIG5vbi1mdW5jIHR5cGUgcmVtb3Zlc3BlY2lhbCBvbiBpbnZhbGlkIHBvaW50ZXJyZXNvdXJjZSB0ZW1wb3JhcmlseSB1bmF2YWlsYWJsZXJ1bnRpbWUuc2VtYXNsZWVwIHdhaXRfYWJhbmRvbmVkcnVudGltZTogZmFpbGVkIHRvIHJlbGVhc2UgcGFnZXNydW50aW1lOiBmaXhhbGxvYyBzaXplIHRvbyBsYXJnZXJ1bnRpbWU6IG1jYWxsIGZ1bmN0aW9uIHJldHVybmVkcnVudGltZTogbmV3c3RhY2sgY2FsbGVkIGZyb20gZz1ydW50aW1lOiByb290IGxldmVsIG1heCBwYWdlcyA9IHJ1bnRpbWU6IHNldGV2ZW50IGZhaWxlZDsgZXJybm89cnVudGltZTogc3RhY2sgc3BsaXQgYXQgYmFkIHRpbWVydW50aW1lOiBzdWRvZyB3aXRoIG5vbi1uaWwgZWxlbXJ1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCBuZXh0cnVudGltZTogc3Vkb2cgd2l0aCBub24tbmlsIHByZXZzY2Fuc3RhY2s6IGdvcm91dGluZSBub3Qgc3RvcHBlZHNjYXZlbmdlciBzdGF0ZSBpcyBhbHJlYWR5IHdpcmVkc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbJXg6Ol1zbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFs6JXg6XXNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzo6JXhdc29mdHdhcmU=125:T558,aW5nIE1zaUNsb3NlSGFuZGxlOiAldkVycm9yIGNhbGxpbmcgTXNpVmlld0V4ZWN1dGU6ICV2TWFwSXRlci5WYWx1ZSBjYWxsZWQgYmVmb3JlIE5leHRXU0FHZXRPdmVybGFwcGVkUmVzdWx0IG5vdCBmb3VuZCIgbm90IHN1cHBvcnRlZCBmb3IgY3B1IG9wdGlvbiAiaW4gbGl0ZXJhbCBmYWxzZSAoZXhwZWN0aW5nICdhJylpbiBsaXRlcmFsIGZhbHNlIChleHBlY3RpbmcgJ2UnKWluIGxpdGVyYWwgZmFsc2UgKGV4cGVjdGluZyAnbCcpaW4gbGl0ZXJhbCBmYWxzZSAoZXhwZWN0aW5nICdzJylpbnZhbGlkIGxpbWl0ZXIgZXZlbnQgdHlwZSBmb3VuZG51bWVyaWNhbCBhcmd1bWVudCBvdXQgb2YgZG9tYWlucGFuaWMgd2hpbGUgcHJpbnRpbmcgcGFuaWMgdmFsdWVyZWZsZWN0Lm5hbWVGcm9tOiB0YWcgdG9vIGxvbmc6IHJlZmxlY3Q6IE51bUluIG9mIG5vbi1mdW5jIHR5cGUgcmVtb3Zlc3BlY2lhbCBvbiBpbnZhbGlkIHBvaW50ZXJyZXNvdXJjZSB0ZW1wb3JhcmlseSB1bmF2YWlsYWJsZXJ1bnRpbWUuc2VtYXNsZWVwIHdhaXRfYWJhbmRvbmVkcnVudGltZTogZmFpbGVkIHRvIHJlbGVhc2UgcGFnZXNydW50aW1lOiBmaXhhbGxvYyBzaXplIHRvbyBsYXJnZXJ1bnRpbWU6IG1jYWxsIGZ1bmN0aW9uIHJldHVybmVkcnVudGltZTogbmV3c3RhY2sgY2FsbGVkIGZyb20gZz1ydW50aW1lOiByb290IGxldmVsIG1heCBwYWdlcyA9IHJ1bnRpbWU6IHNldGV2ZW50IGZhaWxlZDsgZXJybm89cnVudGltZTogc3RhY2sgc3BsaXQgYXQgYmFkIHRpbWVydW50aW1lOiBzdWRvZyB3aXRoIG5vbi1uaWwgZWxlbXJ1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCBuZXh0cnVudGltZTogc3Vkb2cgd2l0aCBub24tbmlsIHByZXZzY2Fuc3RhY2s6IGdvcm91dGluZSBub3Qgc3RvcHBlZHNjYXZlbmdlciBzdGF0ZSBpcyBhbHJlYWR5IHdpcmVkc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbJXg6Ol1zbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFs6JXg6XXNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzo6JXhdc29mdHdhcmUgYw==126:T554,aW50ZXJuYWwgZXJyb3I6IGV4aXQgaG9vayBpbnZva2VkIHBhbmljbWlzbWF0Y2hlZCBjb3VudCBkdXJpbmcgaXRhYiB0YWJsZSBjb3B5bXNwYW4uc3dlZXA6IGJhZCBzcGFuIHN0YXRlIGFmdGVyIHN3ZWVwb3V0IG9mIG1lbW9yeSBhbGxvY2F0aW5nIGhlYXAgYXJlbmEgbWFwcmVmbGVjdC5NYWtlTWFwV2l0aFNpemUgb2Ygbm9uLW1hcCB0eXBlcnVudGltZTogYmxvY2tlZCB3cml0ZSBvbiBmcmVlIHBvbGxkZXNjcnVudGltZTogY2FzZnJvbV9Hc2NhbnN0YXR1cyBmYWlsZWQgZ3A9c3RhY2sgZ3Jvd3RoIG5vdCBhbGxvd2VkIGluIHN5c3RlbSBjYWxsc3VzcGVuZEcgZnJvbSBub24tcHJlZW1wdGlibGUgZ29yb3V0aW5ldHJhY2ViYWNrOiB1bmV4cGVjdGVkIFNQV1JJVEUgZnVuY3Rpb24gdHJhbnNwb3J0IGVuZHBvaW50IGlzIGFscmVhZHkgY29ubmVjdGVkMTM4Nzc3ODc4MDc4MTQ0NTY3NTUyOTUzOTU4NTExMzUyNTM5MDYyNTY5Mzg4OTM5MDM5MDcyMjgzNzc2NDc2OTc5MjU1Njc2MjY5NTMxMjVFcnJvciB3aGVuIHJ1bm5pbmcgTXNpSW5zdGFsbFByb2R1Y3Q6ICV2TWFwSXRlci5LZXkgY2FsbGVkIG9uIGV4aGF1c3RlZCBpdGVyYXRvclVuaW5zdGFsbGVkIEFnZW50IHdpdGggZGVwbG95bWVudCBJRDogJXZhZGRyZXNzIGZhbWlseSBub3Qgc3VwcG9ydGVkIGJ5IHByb3RvY29sYnVsa0JhcnJpZXJQcmVXcml0ZTogdW5hbGlnbmVkIGFyZ3VtZW50c2Nhbm5vdCBmcmVlIHdvcmtidWZzIHdoZW4gd29yay5mdWxsICE9IDBmYWlsZWQgdG8gYWNxdWlyZSBsb2NrIHRvIHJlc2V0IGNhcGFjaXR5aW52YWxpZCBzcGFuIGluIGhlYXBBcmVuYSBmb3IgdXNlciBhcmVuYW1hcmtXb3JrZXJTdG9wOiB1bmtub3duIG1hcmsgd29ya2VyIG1vZGVtdXN0IGJlIGFibGUgdG8gdHJhY2sgaWRsZSBsaW1pdGVyIGV2ZW50cmVmaWxsIG9mIHNwYW4gd2l0aCBmcmVlIHNwYWNlIHJlbWFpbmluZ3JlZmxlY3QuVmFsdWUuU2V0Qnl0ZXMgb2Ygbm9uLWJ5dGUgc2xpY2VyZWZsZWN0LlZhbHVlLnNldFJ1bmVzIG9mIG5vbi1ydW5l127:T554,bGF5ZWQgemVyb2luZyBvbiBkYXRhIHRoYXQgbWF5IGNvbnRhaW4gcG9pbnRlcnNmdWxseSBlbXB0eSB1bmZyZWVkIHNwYW4gc2V0IGJsb2NrIGZvdW5kIGluIHJlc2V0aW52YWxpZCBtZW1vcnkgYWRkcmVzcyBvciBuaWwgcG9pbnRlciBkZXJlZmVyZW5jZWludmFsaWQgb3IgaW5jb21wbGV0ZSBtdWx0aWJ5dGUgb3Igd2lkZSBjaGFyYWN0ZXJub3QgZW5vdWdoIHNpZ25pZmljYW50IGJpdHMgYWZ0ZXIgbXVsdDEyOGJpdFBvdzEwcGFuaWN3cmFwOiB1bmV4cGVjdGVkIHN0cmluZyBhZnRlciBwYWNrYWdlIG5hbWU6IHJlZmxlY3QuVmFsdWUuU2xpY2U6IHNsaWNlIG9mIHVuYWRkcmVzc2FibGUgYXJyYXlydW50aW1lLnJlZmxlY3RfbWFrZW1hcDogdW5zdXBwb3J0ZWQgbWFwIGtleSB0eXBlcnVudGltZTogdW5leHBlY3RlZCB3YWl0bSAtIHNlbWFwaG9yZSBvdXQgb2Ygc3luY3MuYWxsb2NDb3VudCAhPSBzLm5lbGVtcyAmJiBmcmVlSW5kZXggPT0gcy5uZWxlbXNzbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFs6OiV4XSB3aXRoIGNhcGFjaXR5ICV5c3dlZXBlciBsZWZ0IG91dHN0YW5kaW5nIGFjcm9zcyBzd2VlcCBnZW5lcmF0aW9uc2F0dGVtcHQgdG8gZXhlY3V0ZSBzeXN0ZW0gc3RhY2sgY29kZSBvbiB1c2VyIHN0YWNrY29tcGlsZUNhbGxiYWNrOiBmdW5jdGlvbiBhcmd1bWVudCBmcmFtZSB0b28gbGFyZ2VtYWxsb2NnYyBjYWxsZWQgd2l0aCBnY3BoYXNlID09IF9HQ21hcmt0ZXJtaW5hdGlvbnJlY3Vyc2l2ZSBjYWxsIGR1cmluZyBpbml0aWFsaXphdGlvbiAtIGxpbmtlciBza2V3cnVudGltZTogdW5hYmxlIHRvIGFjcXVpcmUgLSBzZW1hcGhvcmUgb3V0IG9mIHN5bmNzeXNjYWxsOiBzdHJpbmcgd2l0aCBOVUwgcGFzc2VkIHRvIFN0cmluZ0J5dGVTbGljZUpTT04gZGVjb2RlciBvdXQgb2Ygc3luYyAtIGRhdGEgY2hhbmdpbmcgdW5kZXJmb290P2ZhdGFsOiBzeXN0ZW1zdGFjayBjYWxsZWQgZnJvbSB1bmV4cGVjdGVkIGdvcm91dGluZWxpbWl0ZXJFdmVudC5zdG9wOiBpbnZhbGlkIGxpbWl0ZXI=128:T558,bGF5ZWQgemVyb2luZyBvbiBkYXRhIHRoYXQgbWF5IGNvbnRhaW4gcG9pbnRlcnNmdWxseSBlbXB0eSB1bmZyZWVkIHNwYW4gc2V0IGJsb2NrIGZvdW5kIGluIHJlc2V0aW52YWxpZCBtZW1vcnkgYWRkcmVzcyBvciBuaWwgcG9pbnRlciBkZXJlZmVyZW5jZWludmFsaWQgb3IgaW5jb21wbGV0ZSBtdWx0aWJ5dGUgb3Igd2lkZSBjaGFyYWN0ZXJub3QgZW5vdWdoIHNpZ25pZmljYW50IGJpdHMgYWZ0ZXIgbXVsdDEyOGJpdFBvdzEwcGFuaWN3cmFwOiB1bmV4cGVjdGVkIHN0cmluZyBhZnRlciBwYWNrYWdlIG5hbWU6IHJlZmxlY3QuVmFsdWUuU2xpY2U6IHNsaWNlIG9mIHVuYWRkcmVzc2FibGUgYXJyYXlydW50aW1lLnJlZmxlY3RfbWFrZW1hcDogdW5zdXBwb3J0ZWQgbWFwIGtleSB0eXBlcnVudGltZTogdW5leHBlY3RlZCB3YWl0bSAtIHNlbWFwaG9yZSBvdXQgb2Ygc3luY3MuYWxsb2NDb3VudCAhPSBzLm5lbGVtcyAmJiBmcmVlSW5kZXggPT0gcy5uZWxlbXNzbGljZSBib3VuZHMgb3V0IG9mIHJhbmdlIFs6OiV4XSB3aXRoIGNhcGFjaXR5ICV5c3dlZXBlciBsZWZ0IG91dHN0YW5kaW5nIGFjcm9zcyBzd2VlcCBnZW5lcmF0aW9uc2F0dGVtcHQgdG8gZXhlY3V0ZSBzeXN0ZW0gc3RhY2sgY29kZSBvbiB1c2VyIHN0YWNrY29tcGlsZUNhbGxiYWNrOiBmdW5jdGlvbiBhcmd1bWVudCBmcmFtZSB0b28gbGFyZ2VtYWxsb2NnYyBjYWxsZWQgd2l0aCBnY3BoYXNlID09IF9HQ21hcmt0ZXJtaW5hdGlvbnJlY3Vyc2l2ZSBjYWxsIGR1cmluZyBpbml0aWFsaXphdGlvbiAtIGxpbmtlciBza2V3cnVudGltZTogdW5hYmxlIHRvIGFjcXVpcmUgLSBzZW1hcGhvcmUgb3V0IG9mIHN5bmNzeXNjYWxsOiBzdHJpbmcgd2l0aCBOVUwgcGFzc2VkIHRvIFN0cmluZ0J5dGVTbGljZUpTT04gZGVjb2RlciBvdXQgb2Ygc3luYyAtIGRhdGEgY2hhbmdpbmcgdW5kZXJmb290P2ZhdGFsOiBzeXN0ZW1zdGFjayBjYWxsZWQgZnJvbSB1bmV4cGVjdGVkIGdvcm91dGluZWxpbWl0ZXJFdmVudC5zdG9wOiBpbnZhbGlkIGxpbWl0ZXIgZQ==129:T554,bWUuTG9jYWx0cmFjZWZyZWUodHJhY2VnYygpdW5peHBhY2tldHVua25vd24gcGN3czJfMzIuZGxsICBvZiBzaXplICAgKHRhcmdldHBjPSAsIHBsdWdpbjogIEtpQiB3b3JrLCAgZXhwLikgZm9yICBmcmVlaW5kZXg9IGdjd2FpdGluZz0gaWRsZXByb2NzPSBpbiBzdGF0dXMgIG1hbGxvY2luZz0gbXMgY2xvY2ssICBuQlNTUm9vdHM9IHAtPnN0YXR1cz0gcy5uZWxlbXM9ICBzY2hlZHRpY2s9IHNwYW4ubGlzdD0gdGltZXJzbGVuPSUhKEJBRFBSRUMpKSBhdCBlbnRyeSssIGVsZW1zaXplPSwgbnBhZ2VzID0gL2Rldi9zdGRlcnIvZGV2L3N0ZG91dDMwNTE3NTc4MTI1OiBmcmFtZS5zcD1DbG9zZUhhbmRsZUNyZWF0ZUZpbGVXRGVsZXRlRmlsZVdEaXZlc19Ba3VydUV4aXRQcm9jZXNzRnJlZUxpYnJhcnlHT01FTUxJTUlUPUdPVFJBQ0VCQUNLR2V0RmlsZVR5cGVJZGVvZ3JhcGhpY01hcnNoYWxKU09OTWFyc2hhbFRleHRNZWRlZmFpZHJpbk1lc3NhZ2VCb3hBTW92ZUZpbGVFeFdOYW5kaW5hZ2FyaU5ldFNoYXJlQWRkTmV0U2hhcmVEZWxOZXdfVGFpX0x1ZU9sZF9QZXJzaWFuT2xkX1NvZ2RpYW5PcGVuUHJvY2Vzc1BhdV9DaW5fSGF1UmVnQ2xvc2VLZXlTZXRGaWxlVGltZVNpZ25Xcml0aW5nU29mdF9Eb3R0ZWRWaXJ0dWFsTG9ja1dTQVJlY3ZGcm9tV2FyYW5nX0NpdGlXaGl0ZV9TcGFjZWFzc2lzdFF1ZXVlYmFkIGFkZHJlc3NiYWQgYXJnU2l6ZWJhZCBtIHZhbHVlYmFkIG1lc3NhZ2ViYWQgdGltZWRpdmJyb2tlbiBwaXBlY2dvY2FsbCBuaWxjbG9iYmVyZnJlZWNsb3Nlc29ja2V0Y3JlYXRlZCBieSBjcnlwdDMyLmRsbGZpbGUgZXhpc3RzZmxvYXQzMm5hbjJmbG9hdDY0bmFuMWZsb2F0NjRuYW4yZmxvYXQ2NG5hbjNnY2NoZWNrbWFya2dldHBlZXJuYW1lZ2V0c29ja25hbWVnbG9iYWxBbGxvY2kvbyB0aW1lb3V0bVNwYW5NYW51YWxtZXRob2RhcmdzKG1pblRyaWdnZXI9bXN3c29jay5kbGxuZXRwb2xsSW5pdHBhcnNlIGVycm9ycmVmbGVjdC5TZXRyZWZsZWN0T2Zmc3J1bnRpbWU6IFAgcnVudGltZTo=12a:T554,bXN0YXJ0YmFkIHNlcXVlbmNlIG51bWJlcmJhZCB2YWx1ZSBmb3IgZmllbGRkZXZpY2Ugbm90IGEgc3RyZWFtZGlyZWN0b3J5IG5vdCBlbXB0eWRpc2sgcXVvdGEgZXhjZWVkZWRkb2RlbHRpbWVyOiB3cm9uZyBQZmlsZSBhbHJlYWR5IGNsb3NlZGZpbGUgYWxyZWFkeSBleGlzdHNmaWxlIGRvZXMgbm90IGV4aXN0bSBub3QgZm91bmQgaW4gYWxsbW1hcmtpbmcgZnJlZSBvYmplY3RtYXJrcm9vdDogYmFkIGluZGV4bWlzc2luZyBkZWZlcnJldHVybm1zcGFuLnN3ZWVwOiBzdGF0ZT1ub3Rlc2xlZXAgbm90IG9uIGcwbnRkbGwuZGxsIG5vdCBmb3VuZG53YWl0ID4gd29yay5ucHJvY3NwYW5pYyBkdXJpbmcgbWFsbG9jcGFuaWMgZHVyaW5nIHBhbmljcGFuaWMgaG9sZGluZyBsb2Nrc3Bhbmljd3JhcDogbm8gKCBpbiBwYW5pY3dyYXA6IG5vICkgaW4gcmVmbGVjdC5WYWx1ZS5CeXRlc3JlZmxlY3QuVmFsdWUuRmllbGRyZWZsZWN0LlZhbHVlLkZsb2F0cmVmbGVjdC5WYWx1ZS5JbmRleHJlZmxlY3QuVmFsdWUuSXNOaWxyZWZsZWN0LlZhbHVlLlNsaWNlcnVudGltZTogZzAgc3RhY2sgW3J1bnRpbWU6IHBjZGF0YSBpcyBydW50aW1lOiBwcmVlbXB0IGcwc2VtYVJvb3Qgcm90YXRlTGVmdHNraXAgdGhpcyBkaXJlY3RvcnlzdG9wbSBob2xkaW5nIGxvY2tzc3lzTWVtU3RhdCBvdmVyZmxvd3RvbyBtYW55IG9wZW4gZmlsZXN1bmV4cGVjdGVkIGcgc3RhdHVzdW5rbm93biB3YWl0IHJlYXNvbndpbm1tLmRsbCBub3QgZm91bmQgbWFya3Jvb3Qgam9icyBkb25lIHRvIHVuYWxsb2NhdGVkIHNwYW4zNzI1MjkwMjk4NDYxOTE0MDYyNUFyYWJpYyBTdGFuZGFyZCBUaW1lQXpvcmVzIFN0YW5kYXJkIFRpbWVDZXJ0T3BlblN5c3RlbVN0b3JlV0NyZWF0ZVByb2Nlc3NBc1VzZXJXQ3J5cHRBY3F1aXJlQ29udGV4dFdFZ3lwdGlhbl9IaWVyb2dseXBoc0dldEFjY2VwdEV4U29ja2FkZHJzR2V0QWRhcHRlcnNBZGRyZXNzZXNHZXRDdXJyZW50RGlyZWN0b3J5V0dldEZpbGVBdHRyaWJ1dGVzRXhXR2V0UHJvY2Vzc01lbW9yeQ==12b:T554,bXN0YXJ0YmFkIHNlcXVlbmNlIG51bWJlcmJhZCB2YWx1ZSBmb3IgZmllbGRkZXZpY2Ugbm90IGEgc3RyZWFtZGlyZWN0b3J5IG5vdCBlbXB0eWRpc2sgcXVvdGEgZXhjZWVkZWRkb2RlbHRpbWVyOiB3cm9uZyBQZmlsZSBhbHJlYWR5IGNsb3NlZGZpbGUgYWxyZWFkeSBleGlzdHNmaWxlIGRvZXMgbm90IGV4aXN0bSBub3QgZm91bmQgaW4gYWxsbW1hcmtpbmcgZnJlZSBvYmplY3RtYXJrcm9vdDogYmFkIGluZGV4bWlzc2luZyBkZWZlcnJldHVybm1zcGFuLnN3ZWVwOiBzdGF0ZT1ub3Rlc2xlZXAgbm90IG9uIGcwbnRkbGwuZGxsIG5vdCBmb3VuZG53YWl0ID4gd29yay5ucHJvY3NwYW5pYyBkdXJpbmcgbWFsbG9jcGFuaWMgZHVyaW5nIHBhbmljcGFuaWMgaG9sZGluZyBsb2Nrc3Bhbmljd3JhcDogbm8gKCBpbiBwYW5pY3dyYXA6IG5vICkgaW4gcmVmbGVjdC5WYWx1ZS5CeXRlc3JlZmxlY3QuVmFsdWUuRmllbGRyZWZsZWN0LlZhbHVlLkZsb2F0cmVmbGVjdC5WYWx1ZS5JbmRleHJlZmxlY3QuVmFsdWUuSXNOaWxyZWZsZWN0LlZhbHVlLlNsaWNlcnVudGltZTogZzAgc3RhY2sgW3J1bnRpbWU6IHBjZGF0YSBpcyBydW50aW1lOiBwcmVlbXB0IGcwc2VtYVJvb3Qgcm90YXRlTGVmdHNraXAgdGhpcyBkaXJlY3RvcnlzdG9wbSBob2xkaW5nIGxvY2tzc3lzTWVtU3RhdCBvdmVyZmxvd3RvbyBtYW55IG9wZW4gZmlsZXN1bmV4cGVjdGVkIGcgc3RhdHVzdW5rbm93biB3YWl0IHJlYXNvbndpbm1tLmRsbCBub3QgZm91bmQgbWFya3Jvb3Qgam9icyBkb25lIHRvIHVuYWxsb2NhdGVkIHNwYW4zNzI1MjkwMjk4NDYxOTE0MDYyNUFyYWJpYyBTdGFuZGFyZCBUaW1lQXpvcmVzIFN0YW5kYXJkIFRpbWVDZXJ0T3BlblN5c3RlbVN0b3JlV0NyZWF0ZVByb2Nlc3NBc1VzZXJXQ3J5cHRBY3F1aXJlQ29udGV4dFdFZ3lwdGlhbl9IaWVyb2dseXBoc0dldEFjY2VwdEV4U29ja2FkZHJzR2V0QWRhcHRlcnNBZGRyZXNzZXNHZXRDdXJyZW50RGlyZWN0b3J5V0dldEZpbGVBdHRyaWJ1dGVzRXhXR2V0UHJvY2Vzc01lbW9yeUk=12c:T554,bmZvSURTX1RyaW5hcnlfT3BlcmF0b3JJc3JhZWwgU3RhbmRhcmQgVGltZUpvcmRhbiBTdGFuZGFyZCBUaW1lTWVyb2l0aWNfSGllcm9nbHlwaHNNc2lDb25maWd1cmVQcm9kdWN0QU1zaURhdGFiYXNlT3BlblZpZXdBU2VlazogaW52YWxpZCBvZmZzZXRTZWVrOiBpbnZhbGlkIHdoZW5jZVNldEN1cnJlbnREaXJlY3RvcnlXU2V0SGFuZGxlSW5mb3JtYXRpb25UYWlwZWkgU3RhbmRhcmQgVGltZVRlcm1pbmFsX1B1bmN0dWF0aW9uVHVya2V5IFN0YW5kYXJkIFRpbWViYWQgZm9udCBmaWxlIGZvcm1hdGJhZCBzeXN0ZW0gcGFnZSBzaXplYmFkIHVzZSBvZiBidWNrZXQuYnBiYWQgdXNlIG9mIGJ1Y2tldC5tcGNoYW4gc2VuZCAobmlsIGNoYW4pY2xvc2Ugb2YgbmlsIGNoYW5uZWxjb25uZWN0aW9uIHRpbWVkIG91dGRvZGVsdGltZXIwOiB3cm9uZyBQZmxhZzogaGVscCByZXF1ZXN0ZWRmbG9hdGluZyBwb2ludCBlcnJvcmZvcmNlZ2M6IHBoYXNlIGVycm9yZ28gb2YgbmlsIGZ1bmMgdmFsdWVnb3Bhcms6IGJhZCBnIHN0YXR1c2ludmFsaWQgcmVxdWVzdCBjb2RlaW52YWxpZCB3cml0ZSByZXN1bHRpcyBhIG5hbWVkIHR5cGUgZmlsZWpzb246IFVubWFyc2hhbChuaWwganNvbjogVW5tYXJzaGFsKG5pbClqc29uOiBlcnJvciBjYWxsaW5nIGtleSBoYXMgYmVlbiByZXZva2VkbWFsbG9jIGR1cmluZyBzaWduYWxub3RldHNsZWVwIG5vdCBvbiBnMHAgbWNhY2hlIG5vdCBmbHVzaGVkcGFjZXI6IGFzc2lzdCByYXRpbz1wcmVlbXB0IG9mZiByZWFzb246IHJlZmxlY3QuVmFsdWUuU2V0SW50cmVmbGVjdC5tYWtlRnVuY1N0dWJydW50aW1lOiBkb3VibGUgd2FpdHNlbWFSb290IHJvdGF0ZVJpZ2h0dGltZTogaW52YWxpZCBudW1iZXJ0cmFjZTogb3V0IG9mIG1lbW9yeXdpcmVwOiBhbHJlYWR5IGluIGdvd29ya2J1ZiBpcyBub3QgZW1wdHl3cml0ZSBvZiBHbyBwb2ludGVyIHdzMl8zMi5kbGwgbm90IGZvdW5kIG9mIHVuZXhwb3J0ZWQgbWV0aG9kIHBjSGVhZGVyLnRleHRTdGFydD0gIHByZXZpb3VzIGFsbG9jQ29112d:T558,bmZvSURTX1RyaW5hcnlfT3BlcmF0b3JJc3JhZWwgU3RhbmRhcmQgVGltZUpvcmRhbiBTdGFuZGFyZCBUaW1lTWVyb2l0aWNfSGllcm9nbHlwaHNNc2lDb25maWd1cmVQcm9kdWN0QU1zaURhdGFiYXNlT3BlblZpZXdBU2VlazogaW52YWxpZCBvZmZzZXRTZWVrOiBpbnZhbGlkIHdoZW5jZVNldEN1cnJlbnREaXJlY3RvcnlXU2V0SGFuZGxlSW5mb3JtYXRpb25UYWlwZWkgU3RhbmRhcmQgVGltZVRlcm1pbmFsX1B1bmN0dWF0aW9uVHVya2V5IFN0YW5kYXJkIFRpbWViYWQgZm9udCBmaWxlIGZvcm1hdGJhZCBzeXN0ZW0gcGFnZSBzaXplYmFkIHVzZSBvZiBidWNrZXQuYnBiYWQgdXNlIG9mIGJ1Y2tldC5tcGNoYW4gc2VuZCAobmlsIGNoYW4pY2xvc2Ugb2YgbmlsIGNoYW5uZWxjb25uZWN0aW9uIHRpbWVkIG91dGRvZGVsdGltZXIwOiB3cm9uZyBQZmxhZzogaGVscCByZXF1ZXN0ZWRmbG9hdGluZyBwb2ludCBlcnJvcmZvcmNlZ2M6IHBoYXNlIGVycm9yZ28gb2YgbmlsIGZ1bmMgdmFsdWVnb3Bhcms6IGJhZCBnIHN0YXR1c2ludmFsaWQgcmVxdWVzdCBjb2RlaW52YWxpZCB3cml0ZSByZXN1bHRpcyBhIG5hbWVkIHR5cGUgZmlsZWpzb246IFVubWFyc2hhbChuaWwganNvbjogVW5tYXJzaGFsKG5pbClqc29uOiBlcnJvciBjYWxsaW5nIGtleSBoYXMgYmVlbiByZXZva2VkbWFsbG9jIGR1cmluZyBzaWduYWxub3RldHNsZWVwIG5vdCBvbiBnMHAgbWNhY2hlIG5vdCBmbHVzaGVkcGFjZXI6IGFzc2lzdCByYXRpbz1wcmVlbXB0IG9mZiByZWFzb246IHJlZmxlY3QuVmFsdWUuU2V0SW50cmVmbGVjdC5tYWtlRnVuY1N0dWJydW50aW1lOiBkb3VibGUgd2FpdHNlbWFSb290IHJvdGF0ZVJpZ2h0dGltZTogaW52YWxpZCBudW1iZXJ0cmFjZTogb3V0IG9mIG1lbW9yeXdpcmVwOiBhbHJlYWR5IGluIGdvd29ya2J1ZiBpcyBub3QgZW1wdHl3cml0ZSBvZiBHbyBwb2ludGVyIHdzMl8zMi5kbGwgbm90IGZvdW5kIG9mIHVuZXhwb3J0ZWQgbWV0aG9kIHBjSGVhZGVyLnRleHRTdGFydD0gIHByZXZpb3VzIGFsbG9jQ291bg==12e:T554,TnlpYWtlbmdfUHVhY2h1ZV9IbW9uZ1Bha2lzdGFuIFN0YW5kYXJkIFRpbWVQYW5pY2tlZDogJXZTdGFjazogJXZQYXJhZ3VheSBTdGFuZGFyZCBUaW1lUnRsR2V0TnRWZXJzaW9uTnVtYmVyc1Nha2hhbGluIFN0YW5kYXJkIFRpbWVTYW8gVG9tZSBTdGFuZGFyZCBUaW1lVGFzbWFuaWEgU3RhbmRhcmQgVGltZWFkZHJlc3MgYWxyZWFkeSBpbiB1c2VhZHZhcGkzMi5kbGwgbm90IGZvdW5kYXJndW1lbnQgbGlzdCB0b28gbG9uZ2Fzc2VtYmx5IGNoZWNrcyBmYWlsZWRiYWQgZy0+c3RhdHVzIGluIHJlYWR5YmFkIHN3ZWVwZ2VuIGluIHJlZmlsbGNhbm5vdCBhbGxvY2F0ZSBtZW1vcnljb21waWxlQ2FsbGFiY2s6IHR5cGUgZHVwbGljYXRlZCBkZWZlciBlbnRyeWZyZWVJbmRleCBpcyBub3QgdmFsaWRnZXRlbnYgYmVmb3JlIGVudiBpbml0aGVhZFRhaWxJbmRleCBvdmVyZmxvd2ludGVnZXIgZGl2aWRlIGJ5IHplcm9pbnRlcmZhY2UgY29udmVyc2lvbjoganNvbjogdW5rbm93biBmaWVsZCAlcWtlcm5lbDMyLmRsbCBub3QgZm91bmRtaW5wYyBvciBtYXhwYyBpbnZhbGlkbmV0d29yayBpcyB1bnJlYWNoYWJsZW5vbi1HbyBmdW5jdGlvbiBhdCBwYz1vbGRvdmVyZmxvdyBpcyBub3QgbmlscHJvdG9jb2wgbm90IGF2YWlsYWJsZXByb3RvY29sIG5vdCBzdXBwb3J0ZWRyZWZsZWN0LlZhbHVlLlNldEZsb2F0cmVtb3RlIGFkZHJlc3MgY2hhbmdlZHJ1bnRpbWUubWFpbiBub3Qgb24gbTBydW50aW1lOiB3b3JrLm53YWl0ID0gcnVudGltZTpzY2Fuc3RhY2s6IGdwPXMuZnJlZWluZGV4ID4gcy5uZWxlbXNzY2Fuc3RhY2sgLSBiYWQgc3RhdHVzc2VuZCBvbiBjbG9zZWQgY2hhbm5lbHNwYW4gaGFzIG5vIGZyZWUgc3BhY2VzdGFjayBub3QgYSBwb3dlciBvZiAydHJhY2UgcmVhZGVyIChibG9ja2VkKXRyYWNlOiBhbGxvYyB0b28gbGFyZ2V1bmV4cGVjdGVkIG1ldGhvZCBzdGVwd2lyZXA6IGludmFsaWQgcCBzdGF0ZSBpbnRvIEdvIHZhbHVlIG9mIHR5cGUgKSBtdXN0IGJlIGEgcG93ZXIgb2YgMjIzMjgzMDY0Mw==12f:T554,TnlpYWtlbmdfUHVhY2h1ZV9IbW9uZ1Bha2lzdGFuIFN0YW5kYXJkIFRpbWVQYW5pY2tlZDogJXZTdGFjazogJXZQYXJhZ3VheSBTdGFuZGFyZCBUaW1lUnRsR2V0TnRWZXJzaW9uTnVtYmVyc1Nha2hhbGluIFN0YW5kYXJkIFRpbWVTYW8gVG9tZSBTdGFuZGFyZCBUaW1lVGFzbWFuaWEgU3RhbmRhcmQgVGltZWFkZHJlc3MgYWxyZWFkeSBpbiB1c2VhZHZhcGkzMi5kbGwgbm90IGZvdW5kYXJndW1lbnQgbGlzdCB0b28gbG9uZ2Fzc2VtYmx5IGNoZWNrcyBmYWlsZWRiYWQgZy0+c3RhdHVzIGluIHJlYWR5YmFkIHN3ZWVwZ2VuIGluIHJlZmlsbGNhbm5vdCBhbGxvY2F0ZSBtZW1vcnljb21waWxlQ2FsbGFiY2s6IHR5cGUgZHVwbGljYXRlZCBkZWZlciBlbnRyeWZyZWVJbmRleCBpcyBub3QgdmFsaWRnZXRlbnYgYmVmb3JlIGVudiBpbml0aGVhZFRhaWxJbmRleCBvdmVyZmxvd2ludGVnZXIgZGl2aWRlIGJ5IHplcm9pbnRlcmZhY2UgY29udmVyc2lvbjoganNvbjogdW5rbm93biBmaWVsZCAlcWtlcm5lbDMyLmRsbCBub3QgZm91bmRtaW5wYyBvciBtYXhwYyBpbnZhbGlkbmV0d29yayBpcyB1bnJlYWNoYWJsZW5vbi1HbyBmdW5jdGlvbiBhdCBwYz1vbGRvdmVyZmxvdyBpcyBub3QgbmlscHJvdG9jb2wgbm90IGF2YWlsYWJsZXByb3RvY29sIG5vdCBzdXBwb3J0ZWRyZWZsZWN0LlZhbHVlLlNldEZsb2F0cmVtb3RlIGFkZHJlc3MgY2hhbmdlZHJ1bnRpbWUubWFpbiBub3Qgb24gbTBydW50aW1lOiB3b3JrLm53YWl0ID0gcnVudGltZTpzY2Fuc3RhY2s6IGdwPXMuZnJlZWluZGV4ID4gcy5uZWxlbXNzY2Fuc3RhY2sgLSBiYWQgc3RhdHVzc2VuZCBvbiBjbG9zZWQgY2hhbm5lbHNwYW4gaGFzIG5vIGZyZWUgc3BhY2VzdGFjayBub3QgYSBwb3dlciBvZiAydHJhY2UgcmVhZGVyIChibG9ja2VkKXRyYWNlOiBhbGxvYyB0b28gbGFyZ2V1bmV4cGVjdGVkIG1ldGhvZCBzdGVwd2lyZXA6IGludmFsaWQgcCBzdGF0ZSBpbnRvIEdvIHZhbHVlIG9mIHR5cGUgKSBtdXN0IGJlIGEgcG93ZXIgb2YgMjIzMjgzMDY0MzY=130:T554,b2MxOiBuZXdnIG1pc3Npbmcgc3RhY2tvczogcHJvY2VzcyBhbHJlYWR5IGZpbmlzaGVkcHJvdG9jb2wgZHJpdmVyIG5vdCBhdHRhY2hlZHJlZmxlY3QuTWFrZVNsaWNlOiBsZW4gPiBjYXByZWdpb24gZXhjZWVkcyB1aW50cHRyIHJhbmdlcnVudGltZS5zZW1hc2xlZXAgdW5leHBlY3RlZHJ1bnRpbWU6IGNhc2dzdGF0dXM6IG9sZHZhbD1ydW50aW1lOiBubyBtb2R1bGUgZGF0YSBmb3Igc2F2ZSBvbiBzeXN0ZW0gZyBub3QgYWxsb3dlZHVuZXhwZWN0ZWQgZW5kIG9mIEpTT04gaW5wdXQgY2Fubm90IGJlIGNvbnZlcnRlZCB0byB0eXBlIDQ1NDc0NzM1MDg4NjQ2NDExODk1NzUxOTUzMTI1Q2VudHJhbCBBbWVyaWNhIFN0YW5kYXJkIFRpbWVDZW50cmFsIFBhY2lmaWMgU3RhbmRhcmQgVGltZUNoYXRoYW0gSXNsYW5kcyBTdGFuZGFyZCBUaW1lREVQTE9ZTUVOVElEPSV2IEFTS0ZPUk5BTUU9JXZEZWxldGVQcm9jVGhyZWFkQXR0cmlidXRlTGlzdExvY2tPU1RocmVhZCBuZXN0aW5nIG92ZXJmbG93TXNpRGF0YWJhc2VHZW5lcmF0ZVRyYW5zZm9ybUFOLiBDZW50cmFsIEFzaWEgU3RhbmRhcmQgVGltZU5vcnRoIEFzaWEgRWFzdCBTdGFuZGFyZCBUaW1lV293NjRSZXZlcnRXb3c2NEZzUmVkaXJlY3Rpb25hZGRzcGVjaWFsIG9uIGludmFsaWQgcG9pbnRlcmRvUmVjb3JkR29yb3V0aW5lUHJvZmlsZSBncDE9Z2MgZG9uZSBidXQgZ2NwaGFzZSAhPSBfR0NvZmZnZnB1dDogYmFkIHN0YXR1cyAobm90IEdkZWFkKWludmFsaWQgZnVuY3Rpb24gc3ltYm9sIHRhYmxlaW52YWxpZCBsZW5ndGggb2YgdHJhY2UgZXZlbnRpbzogcmVhZC93cml0ZSBvbiBjbG9zZWQgcGlwZW1hY2hpbmUgaXMgbm90IG9uIHRoZSBuZXR3b3JrbmVlZCBwYWRkaW5nIGluIGJ1Y2tldCAoZWxlbSlubyBYRU5JWCBzZW1hcGhvcmVzIGF2YWlsYWJsZW5vdGVzbGVlcCAtIHdhaXRtIG91dCBvZiBzeW5jbnVtZXJpY2FsIHJlc3VsdCBvdXQgb2YgcmFuZ2VvcGVyYXRpb24gYWxyZWFkeSBpbiBwcm9ncmVzc3BhZGRpbmcgY29udGFpbmVkIGluIGFs131:T558,b2MxOiBuZXdnIG1pc3Npbmcgc3RhY2tvczogcHJvY2VzcyBhbHJlYWR5IGZpbmlzaGVkcHJvdG9jb2wgZHJpdmVyIG5vdCBhdHRhY2hlZHJlZmxlY3QuTWFrZVNsaWNlOiBsZW4gPiBjYXByZWdpb24gZXhjZWVkcyB1aW50cHRyIHJhbmdlcnVudGltZS5zZW1hc2xlZXAgdW5leHBlY3RlZHJ1bnRpbWU6IGNhc2dzdGF0dXM6IG9sZHZhbD1ydW50aW1lOiBubyBtb2R1bGUgZGF0YSBmb3Igc2F2ZSBvbiBzeXN0ZW0gZyBub3QgYWxsb3dlZHVuZXhwZWN0ZWQgZW5kIG9mIEpTT04gaW5wdXQgY2Fubm90IGJlIGNvbnZlcnRlZCB0byB0eXBlIDQ1NDc0NzM1MDg4NjQ2NDExODk1NzUxOTUzMTI1Q2VudHJhbCBBbWVyaWNhIFN0YW5kYXJkIFRpbWVDZW50cmFsIFBhY2lmaWMgU3RhbmRhcmQgVGltZUNoYXRoYW0gSXNsYW5kcyBTdGFuZGFyZCBUaW1lREVQTE9ZTUVOVElEPSV2IEFTS0ZPUk5BTUU9JXZEZWxldGVQcm9jVGhyZWFkQXR0cmlidXRlTGlzdExvY2tPU1RocmVhZCBuZXN0aW5nIG92ZXJmbG93TXNpRGF0YWJhc2VHZW5lcmF0ZVRyYW5zZm9ybUFOLiBDZW50cmFsIEFzaWEgU3RhbmRhcmQgVGltZU5vcnRoIEFzaWEgRWFzdCBTdGFuZGFyZCBUaW1lV293NjRSZXZlcnRXb3c2NEZzUmVkaXJlY3Rpb25hZGRzcGVjaWFsIG9uIGludmFsaWQgcG9pbnRlcmRvUmVjb3JkR29yb3V0aW5lUHJvZmlsZSBncDE9Z2MgZG9uZSBidXQgZ2NwaGFzZSAhPSBfR0NvZmZnZnB1dDogYmFkIHN0YXR1cyAobm90IEdkZWFkKWludmFsaWQgZnVuY3Rpb24gc3ltYm9sIHRhYmxlaW52YWxpZCBsZW5ndGggb2YgdHJhY2UgZXZlbnRpbzogcmVhZC93cml0ZSBvbiBjbG9zZWQgcGlwZW1hY2hpbmUgaXMgbm90IG9uIHRoZSBuZXR3b3JrbmVlZCBwYWRkaW5nIGluIGJ1Y2tldCAoZWxlbSlubyBYRU5JWCBzZW1hcGhvcmVzIGF2YWlsYWJsZW5vdGVzbGVlcCAtIHdhaXRtIG91dCBvZiBzeW5jbnVtZXJpY2FsIHJlc3VsdCBvdXQgb2YgcmFuZ2VvcGVyYXRpb24gYWxyZWFkeSBpbiBwcm9ncmVzc3BhZGRpbmcgY29udGFpbmVkIGluIGFscA==132:T550,b25pbmcgR0MgdG8gdGhlIHNhbWUgc3RhdGUgYXMgYmVmb3JlP3RyaWVkIHRvIHJ1biBzY2F2ZW5nZXIgZnJvbSBhbm90aGVyIGdvcm91dGluZXVuc2FmZS5TdHJpbmc6IHB0ciBpcyBuaWwgYW5kIGxlbiBpcyBub3QgemVybyAoYmFkIHVzZSBvZiB1bnNhZmUuUG9pbnRlcj8gdHJ5IC1kPWNoZWNrcHRyKUFnZW50IGFscmVhZHkgaW5zdGFsbGVkLCBza2lwcGluZyBpbnN0YWxsYXRpb25FcnJvciBydW5uaW5nIE1zaURhdGFiYXNlR2VuZXJhdGVUcmFuc2Zvcm06ICV2U0VMRUNUIFZhbHVlIEZST00gUHJvcGVydHkgV0hFUkUgUHJvcGVydHk9JyV2J1RpbWUuVW5tYXJzaGFsSlNPTjogaW5wdXQgaXMgbm90IGEgSlNPTiBzdHJpbmdtZW1vcnkgcmVzZXJ2YXRpb24gZXhjZWVkcyBhZGRyZXNzIHNwYWNlIGxpbWl0cGFuaWN3cmFwOiB1bmV4cGVjdGVkIHN0cmluZyBhZnRlciB0eXBlIG5hbWU6IHJlZmxlY3QuVmFsdWUuU2xpY2U6IHNsaWNlIGluZGV4IG91dCBvZiBib3VuZHNyZWxlYXNlZCBsZXNzIHRoYW4gb25lIHBoeXNpY2FsIHBhZ2Ugb2YgbWVtb3J5cnVudGltZTogZmFpbGVkIHRvIGNyZWF0ZSBuZXcgT1MgdGhyZWFkIChoYXZlIHJ1bnRpbWU6IG5hbWUgb2Zmc2V0IGJhc2UgcG9pbnRlciBvdXQgb2YgcmFuZ2VydW50aW1lOiBwYW5pYyBiZWZvcmUgbWFsbG9jIGhlYXAgaW5pdGlhbGl6ZWRydW50aW1lOiB0ZXh0IG9mZnNldCBiYXNlIHBvaW50ZXIgb3V0IG9mIHJhbmdlcnVudGltZTogdHlwZSBvZmZzZXQgYmFzZSBwb2ludGVyIG91dCBvZiByYW5nZXNpZ25hbCBhcnJpdmVkIGR1cmluZyBleHRlcm5hbCBjb2RlIGV4ZWN1dGlvbnNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzoleF0gd2l0aCBsZW5ndGggJXlzdG9wVGhlV29ybGQ6IG5vdCBzdG9wcGVkIChzdGF0dXMgIT0gX1BnY3N0b3Apc3lzR3JvdyBib3VuZHMgbm90IGFsaWduZWQgdG8gcGFsbG9jQ2h1bmtCeXRlc3RyaWVkIHRvIHBhcmsgc2NhdmVuZ2VyIGZyb20gYW5vdGhlciBnb3JvdXRpbmVFcnJvciBjYWxsaW5nIE1zaURhdGFi133:T554,b25pbmcgR0MgdG8gdGhlIHNhbWUgc3RhdGUgYXMgYmVmb3JlP3RyaWVkIHRvIHJ1biBzY2F2ZW5nZXIgZnJvbSBhbm90aGVyIGdvcm91dGluZXVuc2FmZS5TdHJpbmc6IHB0ciBpcyBuaWwgYW5kIGxlbiBpcyBub3QgemVybyAoYmFkIHVzZSBvZiB1bnNhZmUuUG9pbnRlcj8gdHJ5IC1kPWNoZWNrcHRyKUFnZW50IGFscmVhZHkgaW5zdGFsbGVkLCBza2lwcGluZyBpbnN0YWxsYXRpb25FcnJvciBydW5uaW5nIE1zaURhdGFiYXNlR2VuZXJhdGVUcmFuc2Zvcm06ICV2U0VMRUNUIFZhbHVlIEZST00gUHJvcGVydHkgV0hFUkUgUHJvcGVydHk9JyV2J1RpbWUuVW5tYXJzaGFsSlNPTjogaW5wdXQgaXMgbm90IGEgSlNPTiBzdHJpbmdtZW1vcnkgcmVzZXJ2YXRpb24gZXhjZWVkcyBhZGRyZXNzIHNwYWNlIGxpbWl0cGFuaWN3cmFwOiB1bmV4cGVjdGVkIHN0cmluZyBhZnRlciB0eXBlIG5hbWU6IHJlZmxlY3QuVmFsdWUuU2xpY2U6IHNsaWNlIGluZGV4IG91dCBvZiBib3VuZHNyZWxlYXNlZCBsZXNzIHRoYW4gb25lIHBoeXNpY2FsIHBhZ2Ugb2YgbWVtb3J5cnVudGltZTogZmFpbGVkIHRvIGNyZWF0ZSBuZXcgT1MgdGhyZWFkIChoYXZlIHJ1bnRpbWU6IG5hbWUgb2Zmc2V0IGJhc2UgcG9pbnRlciBvdXQgb2YgcmFuZ2VydW50aW1lOiBwYW5pYyBiZWZvcmUgbWFsbG9jIGhlYXAgaW5pdGlhbGl6ZWRydW50aW1lOiB0ZXh0IG9mZnNldCBiYXNlIHBvaW50ZXIgb3V0IG9mIHJhbmdlcnVudGltZTogdHlwZSBvZmZzZXQgYmFzZSBwb2ludGVyIG91dCBvZiByYW5nZXNpZ25hbCBhcnJpdmVkIGR1cmluZyBleHRlcm5hbCBjb2RlIGV4ZWN1dGlvbnNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzoleF0gd2l0aCBsZW5ndGggJXlzdG9wVGhlV29ybGQ6IG5vdCBzdG9wcGVkIChzdGF0dXMgIT0gX1BnY3N0b3Apc3lzR3JvdyBib3VuZHMgbm90IGFsaWduZWQgdG8gcGFsbG9jQ2h1bmtCeXRlc3RyaWVkIHRvIHBhcmsgc2NhdmVuZ2VyIGZyb20gYW5vdGhlciBnb3JvdXRpbmVFcnJvciBjYWxsaW5nIE1zaURhdGFiYQ==134:T550,cHJvZk1lbUFjdGl2ZXByb2ZNZW1GdXR1cmVydW50aW1lOiBzZXE9cnVudGltZTogdmFsPXNybW91bnQgZXJyb3J0ZXN0UkludGVybmFsdGltZXIgZXhwaXJlZHRyYWNlU3RhY2tUYWJ1bmltcGxlbWVudGVkdmFsdWUgbWV0aG9kIHhhZGQ2NCBmYWlsZWR4Y2hnNjQgZmFpbGVkfXNjaGVkPXtwYzogbmVlZHNwaW5uaW5nPSBubWlkbGVsb2NrZWQ9IG9uIHplcm8gVmFsdWUgb3V0IG9mIHJhbmdlICBwcm9jZWR1cmUgaW4gIHRvIGZpbmFsaXplciAgdW50eXBlZCBhcmdzIC10aHJlYWQgbGltaXQxOTA3MzQ4NjMyODEyNTk1MzY3NDMxNjQwNjI1OiBleHRyYSB0ZXh0OiBDZXJ0Q2xvc2VTdG9yZUNyZWF0ZVByb2Nlc3NXQ3J5cHRHZW5SYW5kb21GaW5kRmlyc3RGaWxlV0Zvcm1hdE1lc3NhZ2VXR0MgYXNzaXN0IHdhaXRHQyB3b3JrZXIgaW5pdEdldENvbnNvbGVNb2RlR2V0UHJvY0FkZHJlc3NHZXRVc2VyTmFtZUV4V0lzV293NjRQcm9jZXNzTUI7IGFsbG9jYXRlZCBNb2R1bGUzMkZpcnN0V01zaUNsb3NlSGFuZGxlTXNpVmlld0V4ZWN1dGVOZXRVc2VyR2V0SW5mb090aGVyX0lEX1N0YXJ0UGF0dGVybl9TeW50YXhQcm9jZXNzMzJOZXh0V1F1b3RhdGlvbl9NYXJrUmVnU2V0VmFsdWVFeFdTZXRGaWxlUG9pbnRlclRyYW5zbGF0ZU5hbWVXYWxsb2NmcmVldHJhY2ViYWQgYWxsb2NDb3VudGJhZCByZXN0YXJ0IFBDYmFkIHNwYW4gc3RhdGVmaWxlIHRvbyBsYXJnZWZpbmFsaXplciB3YWl0Z2NzdG9wdGhld29ybGRnZXRwcm90b2J5bmFtZWludmFsaWQgc3ludGF4aXMgYSBkaXJlY3RvcnlrZXkgc2l6ZSB3cm9uZ2xldmVsIDIgaGFsdGVkbGV2ZWwgMyBoYWx0ZWRtZW1wcm9maWxlcmF0ZW5pbCBlbGVtIHR5cGUhbm8gbW9kdWxlIGRhdGFubyBzdWNoIGRldmljZXByb3RvY29sIGVycm9ycmVmbGVjdC5WYWx1ZS5ydW50aW1lOiBmdWxsPXJ1bnRpbWU6IHdhbnQ9cy5hbGxvY0NvdW50PSBzZW1hUm9vdCBxdWV1ZXN0YWNrIG92ZXJmbG93c3RvcG0gc3Bpbm5pbmdzdG9yZTY0IGZhaWxlZHN5bmMuQ29uZC5XYWl0135:T554,cHJvZk1lbUFjdGl2ZXByb2ZNZW1GdXR1cmVydW50aW1lOiBzZXE9cnVudGltZTogdmFsPXNybW91bnQgZXJyb3J0ZXN0UkludGVybmFsdGltZXIgZXhwaXJlZHRyYWNlU3RhY2tUYWJ1bmltcGxlbWVudGVkdmFsdWUgbWV0aG9kIHhhZGQ2NCBmYWlsZWR4Y2hnNjQgZmFpbGVkfXNjaGVkPXtwYzogbmVlZHNwaW5uaW5nPSBubWlkbGVsb2NrZWQ9IG9uIHplcm8gVmFsdWUgb3V0IG9mIHJhbmdlICBwcm9jZWR1cmUgaW4gIHRvIGZpbmFsaXplciAgdW50eXBlZCBhcmdzIC10aHJlYWQgbGltaXQxOTA3MzQ4NjMyODEyNTk1MzY3NDMxNjQwNjI1OiBleHRyYSB0ZXh0OiBDZXJ0Q2xvc2VTdG9yZUNyZWF0ZVByb2Nlc3NXQ3J5cHRHZW5SYW5kb21GaW5kRmlyc3RGaWxlV0Zvcm1hdE1lc3NhZ2VXR0MgYXNzaXN0IHdhaXRHQyB3b3JrZXIgaW5pdEdldENvbnNvbGVNb2RlR2V0UHJvY0FkZHJlc3NHZXRVc2VyTmFtZUV4V0lzV293NjRQcm9jZXNzTUI7IGFsbG9jYXRlZCBNb2R1bGUzMkZpcnN0V01zaUNsb3NlSGFuZGxlTXNpVmlld0V4ZWN1dGVOZXRVc2VyR2V0SW5mb090aGVyX0lEX1N0YXJ0UGF0dGVybl9TeW50YXhQcm9jZXNzMzJOZXh0V1F1b3RhdGlvbl9NYXJrUmVnU2V0VmFsdWVFeFdTZXRGaWxlUG9pbnRlclRyYW5zbGF0ZU5hbWVXYWxsb2NmcmVldHJhY2ViYWQgYWxsb2NDb3VudGJhZCByZXN0YXJ0IFBDYmFkIHNwYW4gc3RhdGVmaWxlIHRvbyBsYXJnZWZpbmFsaXplciB3YWl0Z2NzdG9wdGhld29ybGRnZXRwcm90b2J5bmFtZWludmFsaWQgc3ludGF4aXMgYSBkaXJlY3RvcnlrZXkgc2l6ZSB3cm9uZ2xldmVsIDIgaGFsdGVkbGV2ZWwgMyBoYWx0ZWRtZW1wcm9maWxlcmF0ZW5pbCBlbGVtIHR5cGUhbm8gbW9kdWxlIGRhdGFubyBzdWNoIGRldmljZXByb3RvY29sIGVycm9ycmVmbGVjdC5WYWx1ZS5ydW50aW1lOiBmdWxsPXJ1bnRpbWU6IHdhbnQ9cy5hbGxvY0NvdW50PSBzZW1hUm9vdCBxdWV1ZXN0YWNrIG92ZXJmbG93c3RvcG0gc3Bpbm5pbmdzdG9yZTY0IGZhaWxlZHN5bmMuQ29uZC5XYWl0dA==136:T554,cnVudGltZTpzdG9wbG9ja2VkbTogbG9ja2VkZyAoYXRvbWljc3RhdHVzPXVuZmluaXNoZWQgb3Blbi1jb2RlZCBkZWZlcnMgaW4gZGVmZXJyZXR1cm51bmtub3duIHJ1bm5hYmxlIGdvcm91dGluZSBkdXJpbmcgYm9vdHN0cmFwIHVzaW5nIHZhbHVlIG9idGFpbmVkIHVzaW5nIHVuZXhwb3J0ZWQgZmllbGRDcmVhdGUgYW4gTVNJIGFuZCBNU1QgZmlsZSBmb3IgQUQgZGVwbG95bWVudGFjdGl2ZSBzd2VlcGVycyBmb3VuZCBhdCBzdGFydCBvZiBtYXJrIHBoYXNlY29tcGlsZUNhbGxiYWNrOiBmbG9hdCByZXN1bHRzIG5vdCBzdXBwb3J0ZWRlbmNvZGluZyBhbHBoYWJldCBjb250YWlucyBuZXdsaW5lIGNoYXJhY3RlcmdjbWFya25ld29iamVjdCBjYWxsZWQgd2hpbGUgZG9pbmcgY2hlY2ttYXJrbXVsdDEyOGJpdFBvdzEwOiBwb3dlciBvZiAxMCBpcyBvdXQgb2YgcmFuZ2VubyBQIGF2YWlsYWJsZSwgd3JpdGUgYmFycmllcnMgYXJlIGZvcmJpZGRlbm91dCBvZiBtZW1vcnkgYWxsb2NhdGluZyBoZWFwIGFyZW5hIG1ldGFkYXRhcmVmbGVjdDogZnVuY0xheW91dCB3aXRoIGludGVyZmFjZSByZWNlaXZlciByZWZsZWN0OiBzbGljZSBsZW5ndGggb3V0IG9mIHJhbmdlIGluIFNldExlbnNwYW4gb24gdXNlckFyZW5hLmZhdWx0TGlzdCBoYXMgaW52YWxpZCBzaXpldW5zYWZlLlNsaWNlOiBwdHIgaXMgbmlsIGFuZCBsZW4gaXMgbm90IHplcm9jYW5ub3Qgc2VuZCBhZnRlciB0cmFuc3BvcnQgZW5kcG9pbnQgc2h1dGRvd25leGl0c3lzY2FsbDogc3lzY2FsbCBmcmFtZSBpcyBubyBsb25nZXIgdmFsaWRwcm9kdWNlZCBhIHRyaWdnZXIgZ3JlYXRlciB0aGFuIHRoZSBoZWFwIGdvYWxyZWZsZWN0OiBpbnRlcm5hbCBlcnJvcjogaW52YWxpZCBtZXRob2QgaW5kZXhydW50aW1lLm1pbml0OiBkdXBsaWNhdGVoYW5kbGUgZmFpbGVkOyBlcnJubz1ydW50aW1lOiBDcmVhdGVXYWl0YWJsZVRpbWVyRXggZmFpbGVkOyBlcnJubz1ydW50aW1lOiBmYWlsZWQgbVNwYW5MaXN0LnJlbW92ZSBzcGFuLm5wYWdlcz10cmFuc2l0137:T558,cnVudGltZTpzdG9wbG9ja2VkbTogbG9ja2VkZyAoYXRvbWljc3RhdHVzPXVuZmluaXNoZWQgb3Blbi1jb2RlZCBkZWZlcnMgaW4gZGVmZXJyZXR1cm51bmtub3duIHJ1bm5hYmxlIGdvcm91dGluZSBkdXJpbmcgYm9vdHN0cmFwIHVzaW5nIHZhbHVlIG9idGFpbmVkIHVzaW5nIHVuZXhwb3J0ZWQgZmllbGRDcmVhdGUgYW4gTVNJIGFuZCBNU1QgZmlsZSBmb3IgQUQgZGVwbG95bWVudGFjdGl2ZSBzd2VlcGVycyBmb3VuZCBhdCBzdGFydCBvZiBtYXJrIHBoYXNlY29tcGlsZUNhbGxiYWNrOiBmbG9hdCByZXN1bHRzIG5vdCBzdXBwb3J0ZWRlbmNvZGluZyBhbHBoYWJldCBjb250YWlucyBuZXdsaW5lIGNoYXJhY3RlcmdjbWFya25ld29iamVjdCBjYWxsZWQgd2hpbGUgZG9pbmcgY2hlY2ttYXJrbXVsdDEyOGJpdFBvdzEwOiBwb3dlciBvZiAxMCBpcyBvdXQgb2YgcmFuZ2VubyBQIGF2YWlsYWJsZSwgd3JpdGUgYmFycmllcnMgYXJlIGZvcmJpZGRlbm91dCBvZiBtZW1vcnkgYWxsb2NhdGluZyBoZWFwIGFyZW5hIG1ldGFkYXRhcmVmbGVjdDogZnVuY0xheW91dCB3aXRoIGludGVyZmFjZSByZWNlaXZlciByZWZsZWN0OiBzbGljZSBsZW5ndGggb3V0IG9mIHJhbmdlIGluIFNldExlbnNwYW4gb24gdXNlckFyZW5hLmZhdWx0TGlzdCBoYXMgaW52YWxpZCBzaXpldW5zYWZlLlNsaWNlOiBwdHIgaXMgbmlsIGFuZCBsZW4gaXMgbm90IHplcm9jYW5ub3Qgc2VuZCBhZnRlciB0cmFuc3BvcnQgZW5kcG9pbnQgc2h1dGRvd25leGl0c3lzY2FsbDogc3lzY2FsbCBmcmFtZSBpcyBubyBsb25nZXIgdmFsaWRwcm9kdWNlZCBhIHRyaWdnZXIgZ3JlYXRlciB0aGFuIHRoZSBoZWFwIGdvYWxyZWZsZWN0OiBpbnRlcm5hbCBlcnJvcjogaW52YWxpZCBtZXRob2QgaW5kZXhydW50aW1lLm1pbml0OiBkdXBsaWNhdGVoYW5kbGUgZmFpbGVkOyBlcnJubz1ydW50aW1lOiBDcmVhdGVXYWl0YWJsZVRpbWVyRXggZmFpbGVkOyBlcnJubz1ydW50aW1lOiBmYWlsZWQgbVNwYW5MaXN0LnJlbW92ZSBzcGFuLm5wYWdlcz10cmFuc2l0aQ==138:T554,U0EgRWFzdGVybiBTdGFuZGFyZCBUaW1lU0EgUGFjaWZpYyBTdGFuZGFyZCBUaW1lU0EgV2VzdGVybiBTdGFuZGFyZCBUaW1lVVMgRWFzdGVybiBTdGFuZGFyZCBUaW1lYmFkIGRlZmVyIGVudHJ5IGluIHBhbmljYnlwYXNzZWQgcmVjb3ZlcnkgZmFpbGVkY2FuJ3Qgc2NhbiBvdXIgb3duIHN0YWNrY29ubmVjdGlvbiByZXNldCBieSBwZWVyZG91YmxlIHRyYWNlR0NTd2VlcFN0YXJ0ZnVuY3Rpb24gbm90IGltcGxlbWVudGVkZ2NEcmFpbk4gcGhhc2UgaW5jb3JyZWN0aGFzaCBvZiB1bmhhc2hhYmxlIHR5cGUganNvbjogdW5zdXBwb3J0ZWQgdHlwZTogbGV2ZWwgMiBub3Qgc3luY2hyb25pemVkbGluayBudW1iZXIgb3V0IG9mIHJhbmdlbm90IHN1cHBvcnRlZCBieSB3aW5kb3dzb3V0IG9mIHN0cmVhbXMgcmVzb3VyY2VzcGFnZUFsbG9jOiBvdXQgb2YgbWVtb3J5cXVldWVmaW5hbGl6ZXIgZHVyaW5nIEdDcmFuZ2UgcGFydGlhbGx5IG92ZXJsYXBzcnVucXN0ZWFsOiBydW5xIG92ZXJmbG93cnVudGltZTogVmlydHVhbEZyZWUgb2YgcnVudGltZTogZm91bmQgb2JqIGF0ICoocnVudGltZTogbWFya3Jvb3QgaW5kZXggcnVudGltZTogcC5zZWFyY2hBZGRyID0gc3BhbiBoYXMgbm8gZnJlZSBvYmplY3Rzc3RhY2sgdHJhY2UgdW5hdmFpbGFibGVzdHJ1Y3R1cmUgbmVlZHMgY2xlYW5pbmd1cGRhdGUgZHVyaW5nIHRyYW5zaXRpb24gYnl0ZXMgZmFpbGVkIHdpdGggZXJybm89IHRvIHVudXNlZCByZWdpb24gb2Ygc3BhbjIwMDYtMDEtMDJUMTU6MDQ6MDVaMDc6MDAyOTEwMzgzMDQ1NjczMzcwMzYxMzI4MTI1QVVTIENlbnRyYWwgU3RhbmRhcmQgVGltZUFVUyBFYXN0ZXJuIFN0YW5kYXJkIFRpbWVBZmdoYW5pc3RhbiBTdGFuZGFyZCBUaW1lRXJyb3IgY2xvc2luZyB0bXBGaWxlOiAldkVycm9yIGdldHRpbmcgZXhlUGF0aDogJXZFcnJvciBvcGVuaW5nIGxvZ2ZpbGU6ICV2RXJyb3Igd3JpdGluZyB0bXBGaWxlOiAldkV4cGFuZEVudmlyb25tZW50U3RyaW5nc1dGbGVldERlY2sgQWdlbnQgSW5zdGFsbGVyR08=139:T554,U0EgRWFzdGVybiBTdGFuZGFyZCBUaW1lU0EgUGFjaWZpYyBTdGFuZGFyZCBUaW1lU0EgV2VzdGVybiBTdGFuZGFyZCBUaW1lVVMgRWFzdGVybiBTdGFuZGFyZCBUaW1lYmFkIGRlZmVyIGVudHJ5IGluIHBhbmljYnlwYXNzZWQgcmVjb3ZlcnkgZmFpbGVkY2FuJ3Qgc2NhbiBvdXIgb3duIHN0YWNrY29ubmVjdGlvbiByZXNldCBieSBwZWVyZG91YmxlIHRyYWNlR0NTd2VlcFN0YXJ0ZnVuY3Rpb24gbm90IGltcGxlbWVudGVkZ2NEcmFpbk4gcGhhc2UgaW5jb3JyZWN0aGFzaCBvZiB1bmhhc2hhYmxlIHR5cGUganNvbjogdW5zdXBwb3J0ZWQgdHlwZTogbGV2ZWwgMiBub3Qgc3luY2hyb25pemVkbGluayBudW1iZXIgb3V0IG9mIHJhbmdlbm90IHN1cHBvcnRlZCBieSB3aW5kb3dzb3V0IG9mIHN0cmVhbXMgcmVzb3VyY2VzcGFnZUFsbG9jOiBvdXQgb2YgbWVtb3J5cXVldWVmaW5hbGl6ZXIgZHVyaW5nIEdDcmFuZ2UgcGFydGlhbGx5IG92ZXJsYXBzcnVucXN0ZWFsOiBydW5xIG92ZXJmbG93cnVudGltZTogVmlydHVhbEZyZWUgb2YgcnVudGltZTogZm91bmQgb2JqIGF0ICoocnVudGltZTogbWFya3Jvb3QgaW5kZXggcnVudGltZTogcC5zZWFyY2hBZGRyID0gc3BhbiBoYXMgbm8gZnJlZSBvYmplY3Rzc3RhY2sgdHJhY2UgdW5hdmFpbGFibGVzdHJ1Y3R1cmUgbmVlZHMgY2xlYW5pbmd1cGRhdGUgZHVyaW5nIHRyYW5zaXRpb24gYnl0ZXMgZmFpbGVkIHdpdGggZXJybm89IHRvIHVudXNlZCByZWdpb24gb2Ygc3BhbjIwMDYtMDEtMDJUMTU6MDQ6MDVaMDc6MDAyOTEwMzgzMDQ1NjczMzcwMzYxMzI4MTI1QVVTIENlbnRyYWwgU3RhbmRhcmQgVGltZUFVUyBFYXN0ZXJuIFN0YW5kYXJkIFRpbWVBZmdoYW5pc3RhbiBTdGFuZGFyZCBUaW1lRXJyb3IgY2xvc2luZyB0bXBGaWxlOiAldkVycm9yIGdldHRpbmcgZXhlUGF0aDogJXZFcnJvciBvcGVuaW5nIGxvZ2ZpbGU6ICV2RXJyb3Igd3JpdGluZyB0bXBGaWxlOiAldkV4cGFuZEVudmlyb25tZW50U3RyaW5nc1dGbGVldERlY2sgQWdlbnQgSW5zdGFsbGVyR09E13a:T45c,U2FpbnQgUGllcnJlIFN0YW5kYXJkIFRpbWVTZXRGaWxlSW5mb3JtYXRpb25CeUhhbmRsZVNvdXRoIEFmcmljYSBTdGFuZGFyZCBUaW1lVy4gQXVzdHJhbGlhIFN0YW5kYXJkIFRpbWVXZXN0IFBhY2lmaWMgU3RhbmRhcmQgVGltZWNvcnJ1cHRlZCBzZW1hcGhvcmUgdGlja2V0ZW5jb3VudGVyZWQgYSBjeWNsZSB2aWEgJXNlbnRlcnN5c2NhbGwgaW5jb25zaXN0ZW50IGZvckVhY2hQOiBQIGRpZCBub3QgcnVuIGZuZnJlZWRlZmVyIHdpdGggZC5mbiAhPSBuaWxpbnZhbGlkIHJlcXVlc3QgZGVzY3JpcHRvcm5hbWUgbm90IHVuaXF1ZSBvbiBuZXR3b3JrbmVnYXRpdmUgaWRsZSBtYXJrIHdvcmtlcnNubyBDU0kgc3RydWN0dXJlIGF2YWlsYWJsZW5vIG1lc3NhZ2Ugb2YgZGVzaXJlZCB0eXBlbm90ZXdha2V1cCAtIGRvdWJsZSB3YWtldXBvdXQgb2YgbWVtb3J5IChzdGFja2FsbG9jKXBlcnNpc3RlbnRhbGxvYzogc2l6ZSA9PSAwcmVmbGVjdC5WYWx1ZS5PdmVyZmxvd1VpbnRyZXF1aXJlZCBrZXkgbm90IGF2YWlsYWJsZXJ1bnRpbWU6IGJhZCBzcGFuIHMuc3RhdGU9cnVudGltZTogcGNIZWFkZXI6IG1hZ2ljPSBzaHJpbmtpbmcgc3RhY2sgaW4gbGliY2FsbHN0YXJ0bG9ja2VkbTogbG9ja2VkIHRvIG1ldW5rbm93biBBQkkgcGFyYW1ldGVyIGtpbmR1c2Ugb2YgaW52YWxpZCBzd2VlcExvY2tlcndha2VwOiBuZWdhdGl2ZSBubXNwaW5uaW5nIGlzIG5vdCBhc3NpZ25hYmxlIHRvIHR5cGUgIG5vdCBpbiBzdGFjayByb290cyByYW5nZSBbMzYzNzk3ODgwNzA5MTcxMjk1MTY2MDE1NjI1OiB1bmV4cGVjdGVkIHJldHVybiBwYyBmb3IgQWRkVmVjdG9yZWRDb250aW51ZUhhbmRsZXI=13b:T554,c2VHZW5lcmF0ZVRyYW5zZm9ybUE6ICV2RXJyb3IgcnVubmluZyBNc2lDcmVhdGVUcmFuc2Zvcm1TdW1tYXJ5SW5mbzogJXZQIGhhcyBjYWNoZWQgR0Mgd29yayBhdCBlbmQgb2YgbWFyayB0ZXJtaW5hdGlvbmF0dGVtcHRpbmcgdG8gbGluayBpbiB0b28gbWFueSBzaGFyZWQgbGlicmFyaWVzZmFpbGVkIHRvIGFjcXVpcmUgbG9jayB0byBzdGFydCBhIEdDIHRyYW5zaXRpb25maW5pc2hHQ1RyYW5zaXRpb24gY2FsbGVkIHdpdGhvdXQgc3RhcnRpbmcgb25lP2Z1bmN0aW9uIHN5bWJvbCB0YWJsZSBub3Qgc29ydGVkIGJ5IFBDIG9mZnNldDogcmFjeSBzdWRvZyBhZGp1c3RtZW50IGR1ZSB0byBwYXJraW5nIG9uIGNoYW5uZWxyZWZsZWN0LlZhbHVlLkJ5dGVzIG9mIHVuYWRkcmVzc2FibGUgYnl0ZSBhcnJheXJ1bnRpbWU6IENyZWF0ZUlvQ29tcGxldGlvblBvcnQgZmFpbGVkIChlcnJubz0gc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOjoleF0gd2l0aCBsZW5ndGggJXl0cmllZCB0byBzbGVlcCBzY2F2ZW5nZXIgZnJvbSBhbm90aGVyIGdvcm91dGluZUNyZWF0ZVdhaXRhYmxlVGltZXJFeCB3aGVuIGNyZWF0aW5nIHRpbWVyIGZhaWxlZEVycm9yIGNhbGxpbmcgTXNpQ3JlYXRlVHJhbnNmb3JtU3VtbWFyeUluZm9BOiAldmNvdWxkIG5vdCBmaW5kIEdldFN5c3RlbVRpbWVBc0ZpbGVUaW1lKCkgc3lzY2FsbG5vdCBlbm91Z2ggc2lnbmlmaWNhbnQgYml0cyBhZnRlciBtdWx0NjRiaXRQb3cxMHJ1bnRpbWUucHJlZW1wdE06IGR1cGxpY2F0ZWhhbmRsZSBmYWlsZWQ7IGVycm5vPXJ1bnRpbWU6IHdhaXRmb3JzaW5nbGVvYmplY3QgdW5leHBlY3RlZDsgcmVzdWx0PXJ1bnRpbWU6IHdhaXRmb3JzaW5nbGVvYmplY3Qgd2FpdF9mYWlsZWQ7IGVycm5vPXNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzoleF0gd2l0aCBjYXBhY2l0eSAleXN0cmNvbnY6IGlsbGVnYWwgQXBwZW5kRmxvYXQvRm9ybWF0RmxvYXQgYml0U2l6ZWNhc2dzdGF0dXM6IHdhaXRpbmcgZm9yIEd3YWl0aW5nIGJ1dCBpcyBHcnVubmFibGVk13c:T558,c2VHZW5lcmF0ZVRyYW5zZm9ybUE6ICV2RXJyb3IgcnVubmluZyBNc2lDcmVhdGVUcmFuc2Zvcm1TdW1tYXJ5SW5mbzogJXZQIGhhcyBjYWNoZWQgR0Mgd29yayBhdCBlbmQgb2YgbWFyayB0ZXJtaW5hdGlvbmF0dGVtcHRpbmcgdG8gbGluayBpbiB0b28gbWFueSBzaGFyZWQgbGlicmFyaWVzZmFpbGVkIHRvIGFjcXVpcmUgbG9jayB0byBzdGFydCBhIEdDIHRyYW5zaXRpb25maW5pc2hHQ1RyYW5zaXRpb24gY2FsbGVkIHdpdGhvdXQgc3RhcnRpbmcgb25lP2Z1bmN0aW9uIHN5bWJvbCB0YWJsZSBub3Qgc29ydGVkIGJ5IFBDIG9mZnNldDogcmFjeSBzdWRvZyBhZGp1c3RtZW50IGR1ZSB0byBwYXJraW5nIG9uIGNoYW5uZWxyZWZsZWN0LlZhbHVlLkJ5dGVzIG9mIHVuYWRkcmVzc2FibGUgYnl0ZSBhcnJheXJ1bnRpbWU6IENyZWF0ZUlvQ29tcGxldGlvblBvcnQgZmFpbGVkIChlcnJubz0gc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOjoleF0gd2l0aCBsZW5ndGggJXl0cmllZCB0byBzbGVlcCBzY2F2ZW5nZXIgZnJvbSBhbm90aGVyIGdvcm91dGluZUNyZWF0ZVdhaXRhYmxlVGltZXJFeCB3aGVuIGNyZWF0aW5nIHRpbWVyIGZhaWxlZEVycm9yIGNhbGxpbmcgTXNpQ3JlYXRlVHJhbnNmb3JtU3VtbWFyeUluZm9BOiAldmNvdWxkIG5vdCBmaW5kIEdldFN5c3RlbVRpbWVBc0ZpbGVUaW1lKCkgc3lzY2FsbG5vdCBlbm91Z2ggc2lnbmlmaWNhbnQgYml0cyBhZnRlciBtdWx0NjRiaXRQb3cxMHJ1bnRpbWUucHJlZW1wdE06IGR1cGxpY2F0ZWhhbmRsZSBmYWlsZWQ7IGVycm5vPXJ1bnRpbWU6IHdhaXRmb3JzaW5nbGVvYmplY3QgdW5leHBlY3RlZDsgcmVzdWx0PXJ1bnRpbWU6IHdhaXRmb3JzaW5nbGVvYmplY3Qgd2FpdF9mYWlsZWQ7IGVycm5vPXNsaWNlIGJvdW5kcyBvdXQgb2YgcmFuZ2UgWzoleF0gd2l0aCBjYXBhY2l0eSAleXN0cmNvbnY6IGlsbGVnYWwgQXBwZW5kRmxvYXQvRm9ybWF0RmxvYXQgYml0U2l6ZWNhc2dzdGF0dXM6IHdhaXRpbmcgZm9yIEd3YWl0aW5nIGJ1dCBpcyBHcnVubmFibGVkZQ==13d:T554,c2xpY2VydW50aW1lLlNldEZpbmFsaXplcjogZmlyc3QgYXJndW1lbnQgaXMgcnVudGltZS5wcmVlbXB0TTogZHVwbGljYXRlaGFuZGxlIGZhaWxlZHJ1bnRpbWU6IFN5c2NhbGxOIGhhcyB0b28gbWFueSBhcmd1bWVudHNydW50aW1lOiBvdXQgb2YgbWVtb3J5OiBjYW5ub3QgYWxsb2NhdGUgcnVudGltZTogdHlwZUJpdHNCdWxrQmFycmllciB3aXRoIHR5cGUgIHJ5dUZ0b2FGaXhlZDMyIGNhbGxlZCB3aXRoIG5lZ2F0aXZlIHByZWMzNDY5NDQ2OTUxOTUzNjE0MTg4ODIzODQ4OTYyNzgzODEzNDc2NTYyNU1hcEl0ZXIuTmV4dCBjYWxsZWQgb24gZXhoYXVzdGVkIGl0ZXJhdG9yYXR0ZW1wdGVkIHRvIGFkZCB6ZXJvLXNpemVkIGFkZHJlc3MgcmFuZ2ViaW5hcnk6IHZhcmludCBvdmVyZmxvd3MgYSA2NC1iaXQgaW50ZWdlcmNhbid0IGNhbGwgcG9pbnRlciBvbiBhIG5vbi1wb2ludGVyIFZhbHVlZ2NTd2VlcCBiZWluZyBkb25lIGJ1dCBwaGFzZSBpcyBub3QgR0NvZmZtaGVhcC5mcmVlU3BhbkxvY2tlZCAtIGludmFsaWQgc3BhbiBzdGF0ZW1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBzdGFjayBmcmVlb2JqZWN0cyBhZGRlZCBvdXQgb2Ygb3JkZXIgb3Igb3ZlcmxhcHBpbmdyZWZsZWN0LlZhbHVlLkFkZHIgb2YgdW5hZGRyZXNzYWJsZSB2YWx1ZXJ1bnRpbWUuU2V0RmluYWxpemVyOiBzZWNvbmQgYXJndW1lbnQgaXMgcnVudGltZTogYmxvY2tlZCByZWFkIG9uIGNsb3NpbmcgcG9sbGRlc2NydW50aW1lOiB0eXBlQml0c0J1bGtCYXJyaWVyIHdpdGhvdXQgdHlwZXN0b3BUaGVXb3JsZDogbm90IHN0b3BwZWQgKHN0b3B3YWl0ICE9IDApc3RyY29udjogaWxsZWdhbCBBcHBlbmRJbnQvRm9ybWF0SW50IGJhc2V1bmV4cGVjdGVkIGNhbGwgdG8gb3MuRXhpdCgwKSBkdXJpbmcgdGVzdDE3MzQ3MjM0NzU5NzY4MDcwOTQ0MTE5MjQ0ODEzOTE5MDY3MzgyODEyNTg2NzM2MTczNzk4ODQwMzU0NzIwNTk2MjI0MDY5NTk1MzM2OTE0MDYyNU1hcEl0ZXIuVmFsdWUgY2FsbGVkIG9uIGV4aGF1c3RlZCBpdGVy13e:T558,c2xpY2VydW50aW1lLlNldEZpbmFsaXplcjogZmlyc3QgYXJndW1lbnQgaXMgcnVudGltZS5wcmVlbXB0TTogZHVwbGljYXRlaGFuZGxlIGZhaWxlZHJ1bnRpbWU6IFN5c2NhbGxOIGhhcyB0b28gbWFueSBhcmd1bWVudHNydW50aW1lOiBvdXQgb2YgbWVtb3J5OiBjYW5ub3QgYWxsb2NhdGUgcnVudGltZTogdHlwZUJpdHNCdWxrQmFycmllciB3aXRoIHR5cGUgIHJ5dUZ0b2FGaXhlZDMyIGNhbGxlZCB3aXRoIG5lZ2F0aXZlIHByZWMzNDY5NDQ2OTUxOTUzNjE0MTg4ODIzODQ4OTYyNzgzODEzNDc2NTYyNU1hcEl0ZXIuTmV4dCBjYWxsZWQgb24gZXhoYXVzdGVkIGl0ZXJhdG9yYXR0ZW1wdGVkIHRvIGFkZCB6ZXJvLXNpemVkIGFkZHJlc3MgcmFuZ2ViaW5hcnk6IHZhcmludCBvdmVyZmxvd3MgYSA2NC1iaXQgaW50ZWdlcmNhbid0IGNhbGwgcG9pbnRlciBvbiBhIG5vbi1wb2ludGVyIFZhbHVlZ2NTd2VlcCBiZWluZyBkb25lIGJ1dCBwaGFzZSBpcyBub3QgR0NvZmZtaGVhcC5mcmVlU3BhbkxvY2tlZCAtIGludmFsaWQgc3BhbiBzdGF0ZW1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBzdGFjayBmcmVlb2JqZWN0cyBhZGRlZCBvdXQgb2Ygb3JkZXIgb3Igb3ZlcmxhcHBpbmdyZWZsZWN0LlZhbHVlLkFkZHIgb2YgdW5hZGRyZXNzYWJsZSB2YWx1ZXJ1bnRpbWUuU2V0RmluYWxpemVyOiBzZWNvbmQgYXJndW1lbnQgaXMgcnVudGltZTogYmxvY2tlZCByZWFkIG9uIGNsb3NpbmcgcG9sbGRlc2NydW50aW1lOiB0eXBlQml0c0J1bGtCYXJyaWVyIHdpdGhvdXQgdHlwZXN0b3BUaGVXb3JsZDogbm90IHN0b3BwZWQgKHN0b3B3YWl0ICE9IDApc3RyY29udjogaWxsZWdhbCBBcHBlbmRJbnQvRm9ybWF0SW50IGJhc2V1bmV4cGVjdGVkIGNhbGwgdG8gb3MuRXhpdCgwKSBkdXJpbmcgdGVzdDE3MzQ3MjM0NzU5NzY4MDcwOTQ0MTE5MjQ0ODEzOTE5MDY3MzgyODEyNTg2NzM2MTczNzk4ODQwMzU0NzIwNTk2MjI0MDY5NTk1MzM2OTE0MDYyNU1hcEl0ZXIuVmFsdWUgY2FsbGVkIG9uIGV4aGF1c3RlZCBpdGVyYQ==13f:T558,c3VsdGpzb246IGludmFsaWQgbnVtYmVyIGxpdGVyYWwsIHRyeWluZyB0byB1bm1hcnNoYWwgJXEgaW50byBOdW1iZXJydW50aW1lLlNldEZpbmFsaXplcjogZmlyc3QgYXJndW1lbnQgd2FzIGFsbG9jYXRlZCBpbnRvIGFuIGFyZW5hcnVudGltZS5TZXRGaW5hbGl6ZXI6IHBvaW50ZXIgbm90IGF0IGJlZ2lubmluZyBvZiBhbGxvY2F0ZWQgYmxvY2t1c2VyIGFyZW5hIGNodW5rIHNpemUgaXMgbm90IGEgbXV0bGlwbGUgb2YgdGhlIHBoeXNpY2FsIHBhZ2Ugc2l6ZXJlZmxlY3Q6IHJlZmxlY3QuVmFsdWUuVW5zYWZlUG9pbnRlciBvbiBhbiBpbnZhbGlkIG5vdGluaGVhcCBwb2ludGVyYnl0ZXMuQnVmZmVyOiBVbnJlYWRCeXRlOiBwcmV2aW91cyBvcGVyYXRpb24gd2FzIG5vdCBhIHN1Y2Nlc3NmdWwgcmVhZGpzb246IGludmFsaWQgdXNlIG9mICxzdHJpbmcgc3RydWN0IHRhZywgdHJ5aW5nIHRvIHVubWFyc2hhbCAlcSBpbnRvICV2dG9vIG1hbnkgY29uY3VycmVudCBvcGVyYXRpb25zIG9uIGEgc2luZ2xlIGZpbGUgb3Igc29ja2V0IChtYXggMTA0ODU3NSlNYXBJdGVyLk5leHQgY2FsbGVkIG9uIGFuIGl0ZXJhdG9yIHRoYXQgZG9lcyBub3QgaGF2ZSBhbiBhc3NvY2lhdGVkIG1hcCBWYWx1ZWNhbm5vdCBjb252ZXJ0IHNsaWNlIHdpdGggbGVuZ3RoICV5IHRvIGFycmF5IG9yIHBvaW50ZXIgdG8gYXJyYXkgd2l0aCBsZW5ndGggJXhRdWVyeVBlcmZvcm1hbmNlRnJlcXVlbmN5IHN5c2NhbGwgcmV0dXJuZWQgemVybywgcnVubmluZyBvbiB1bnN1cHBvcnRlZCBoYXJkd2FyZWpzb246IGludmFsaWQgdXNlIG9mICxzdHJpbmcgc3RydWN0IHRhZywgdHJ5aW5nIHRvIHVubWFyc2hhbCB1bnF1b3RlZCB2YWx1ZSBpbnRvICV2cmVmbGVjdC5WYWx1ZS5JbnRlcmZhY2U6IGNhbm5vdCByZXR1cm4gdmFsdWUgb2J0YWluZWQgZnJvbSB1bmV4cG9ydGVkIGZpZWxkIG9yIG1ldGhvZFF1ZXJ5UGVyZm9ybWFuY2VGcmVxdWVuY3kgb3ZlcmZsb3cgMzIgYml0IGRpdmlkZXIsIGNoZWNrIG5vc3BsaXQgZGlzY3Vzc2lvbiB0bw==140:T554,dD0lcyBmbGFnIHJlZGVmaW5lZDogJXMsIGxldmVsQml0c1tsZXZlbF0gPSAxODYyNjQ1MTQ5MjMwOTU3MDMxMjU5MzEzMjI1NzQ2MTU0Nzg1MTU2MjVBZGp1c3RUb2tlblByaXZpbGVnZXNBbGFza2FuIFN0YW5kYXJkIFRpbWVBbmF0b2xpYW5fSGllcm9nbHlwaHNBcmFiaWFuIFN0YW5kYXJkIFRpbWVCZWxhcnVzIFN0YW5kYXJkIFRpbWVDZW50cmFsIFN0YW5kYXJkIFRpbWVFYXN0ZXJuIFN0YW5kYXJkIFRpbWVFcnJvciByZWFkaW5nIGV4ZTogJXZFcnJvciB3cml0aW5nIG1zaTogJXZHZXRQcm9maWxlc0RpcmVjdG9yeVdJbnNjcmlwdGlvbmFsX1BhaGxhdmlMb29rdXBQcml2aWxlZ2VWYWx1ZVdNYWdhZGFuIFN0YW5kYXJkIFRpbWVNb3JvY2NvIFN0YW5kYXJkIFRpbWVNeWFubWFyIFN0YW5kYXJkIFRpbWVOYW1pYmlhIFN0YW5kYXJkIFRpbWVOZXRHZXRKb2luSW5mb3JtYXRpb25OZXRVc2VyR2V0TG9jYWxHcm91cHNOb3Jmb2xrIFN0YW5kYXJkIFRpbWVPdGhlcl9HcmFwaGVtZV9FeHRlbmRQYWNpZmljIFN0YW5kYXJkIFRpbWVSZWFkRGlyZWN0b3J5Q2hhbmdlc1dSb21hbmNlIFN0YW5kYXJkIFRpbWVSdXNzaWFuIFN0YW5kYXJkIFRpbWVTRSBBc2lhIFN0YW5kYXJkIFRpbWVTYXJhdG92IFN0YW5kYXJkIFRpbWVZYWt1dHNrIFN0YW5kYXJkIFRpbWVhZnRlciB0b3AtbGV2ZWwgdmFsdWVhc3luYyBzdGFjayB0b28gbGFyZ2ViYWQgdHlwZSBpbiBjb21wYXJlOiBibG9jayBkZXZpY2UgcmVxdWlyZWRjaGVja2RlYWQ6IHJ1bm5hYmxlIGdjb25jdXJyZW50IG1hcCB3cml0ZXNkZWZlciBvbiBzeXN0ZW0gc3RhY2tmaW5kcnVubmFibGU6IHdyb25nIHBmbGFnICVxIGJlZ2lucyB3aXRoIC1pbiBzdHJpbmcgZXNjYXBlIGNvZGVsaW5rIGhhcyBiZWVuIHNldmVyZWRuZWdhdGl2ZSBzaGlmdCBhbW91bnRwYWNrYWdlIG5vdCBpbnN0YWxsZWRwYW5pYyBvbiBzeXN0ZW0gc3RhY2twcmVlbXB0IGF0IHVua25vd24gcGNyZWFkLW9ubHkgZmlsZSBzeXN0ZW1yZWZsZWN0LlZhbHVlLkNvbXBsZXhyZWZsZWN0LlZhbHVl141:T558,dD0lcyBmbGFnIHJlZGVmaW5lZDogJXMsIGxldmVsQml0c1tsZXZlbF0gPSAxODYyNjQ1MTQ5MjMwOTU3MDMxMjU5MzEzMjI1NzQ2MTU0Nzg1MTU2MjVBZGp1c3RUb2tlblByaXZpbGVnZXNBbGFza2FuIFN0YW5kYXJkIFRpbWVBbmF0b2xpYW5fSGllcm9nbHlwaHNBcmFiaWFuIFN0YW5kYXJkIFRpbWVCZWxhcnVzIFN0YW5kYXJkIFRpbWVDZW50cmFsIFN0YW5kYXJkIFRpbWVFYXN0ZXJuIFN0YW5kYXJkIFRpbWVFcnJvciByZWFkaW5nIGV4ZTogJXZFcnJvciB3cml0aW5nIG1zaTogJXZHZXRQcm9maWxlc0RpcmVjdG9yeVdJbnNjcmlwdGlvbmFsX1BhaGxhdmlMb29rdXBQcml2aWxlZ2VWYWx1ZVdNYWdhZGFuIFN0YW5kYXJkIFRpbWVNb3JvY2NvIFN0YW5kYXJkIFRpbWVNeWFubWFyIFN0YW5kYXJkIFRpbWVOYW1pYmlhIFN0YW5kYXJkIFRpbWVOZXRHZXRKb2luSW5mb3JtYXRpb25OZXRVc2VyR2V0TG9jYWxHcm91cHNOb3Jmb2xrIFN0YW5kYXJkIFRpbWVPdGhlcl9HcmFwaGVtZV9FeHRlbmRQYWNpZmljIFN0YW5kYXJkIFRpbWVSZWFkRGlyZWN0b3J5Q2hhbmdlc1dSb21hbmNlIFN0YW5kYXJkIFRpbWVSdXNzaWFuIFN0YW5kYXJkIFRpbWVTRSBBc2lhIFN0YW5kYXJkIFRpbWVTYXJhdG92IFN0YW5kYXJkIFRpbWVZYWt1dHNrIFN0YW5kYXJkIFRpbWVhZnRlciB0b3AtbGV2ZWwgdmFsdWVhc3luYyBzdGFjayB0b28gbGFyZ2ViYWQgdHlwZSBpbiBjb21wYXJlOiBibG9jayBkZXZpY2UgcmVxdWlyZWRjaGVja2RlYWQ6IHJ1bm5hYmxlIGdjb25jdXJyZW50IG1hcCB3cml0ZXNkZWZlciBvbiBzeXN0ZW0gc3RhY2tmaW5kcnVubmFibGU6IHdyb25nIHBmbGFnICVxIGJlZ2lucyB3aXRoIC1pbiBzdHJpbmcgZXNjYXBlIGNvZGVsaW5rIGhhcyBiZWVuIHNldmVyZWRuZWdhdGl2ZSBzaGlmdCBhbW91bnRwYWNrYWdlIG5vdCBpbnN0YWxsZWRwYW5pYyBvbiBzeXN0ZW0gc3RhY2twcmVlbXB0IGF0IHVua25vd24gcGNyZWFkLW9ubHkgZmlsZSBzeXN0ZW1yZWZsZWN0LlZhbHVlLkNvbXBsZXhyZWZsZWN0LlZhbHVlLg==142:T554,dGFuZGFyZCBUaW1lV293NjREaXNhYmxlV293NjRGc1JlZGlyZWN0aW9uYWJpIG1pc21hdGNoIGRldGVjdGVkIGJldHdlZW4gYXNzaWdubWVudCB0byBlbnRyeSBpbiBuaWwgbWFwY2hlY2tkZWFkOiBpbmNvbnNpc3RlbnQgY291bnRzZmFpbGVkIHRvIGdldCBzeXN0ZW0gcGFnZSBzaXplZnJlZWRlZmVyIHdpdGggZC5fcGFuaWMgIT0gbmlsaW4gZXhwb25lbnQgb2YgbnVtZXJpYyBsaXRlcmFsaW5hcHByb3ByaWF0ZSBpb2N0bCBmb3IgZGV2aWNlaW52YWxpZCBwb2ludGVyIGZvdW5kIG9uIHN0YWNrbG9va2luZyBmb3IgYmVnaW5uaW5nIG9mIHZhbHVlbm90ZXRzbGVlcCAtIHdhaXRtIG91dCBvZiBzeW5jcHJvdG9jb2wgd3JvbmcgdHlwZSBmb3Igc29ja2V0cmVmbGVjdDogRWxlbSBvZiBpbnZhbGlkIHR5cGUgcmVmbGVjdDogTGVuIG9mIG5vbi1hcnJheSB0eXBlcmVmbGVjdDogT3V0IG9mIG5vbi1mdW5jIHR5cGUgcnVucXB1dHNsb3c6IHF1ZXVlIGlzIG5vdCBmdWxscnVudGltZTogYmFkIGcgaW4gY2dvY2FsbGJhY2tydW50aW1lOiBiYWQgcG9pbnRlciBpbiBmcmFtZSBydW50aW1lOiBmb3VuZCBpbiBvYmplY3QgYXQgKihydW50aW1lOiBpbXBvc3NpYmxlIHR5cGUga2luZCBzb2NrZXQgb3BlcmF0aW9uIG9uIG5vbi1zb2NrZXRzeW5jOiBpbmNvbnNpc3RlbnQgbXV0ZXggc3RhdGVzeW5jOiB1bmxvY2sgb2YgdW5sb2NrZWQgbXV0ZXh1bnNhZmUuU2xpY2U6IGxlbiBvdXQgb2YgcmFuZ2V5ZWFyIG91dHNpZGUgb2YgcmFuZ2UgWzAsOTk5OV0pIG5vdCBpbiB1c2FibGUgYWRkcmVzcyBzcGFjZTogLi4uYWRkaXRpb25hbCBmcmFtZXMgZWxpZGVkLi4uLmxpYiBzZWN0aW9uIGluIGEub3V0IGNvcnJ1cHRlZDExMzY4NjgzNzcyMTYxNjAyOTczOTM3OTg4MjgxMjU1Njg0MzQxODg2MDgwODAxNDg2OTY4OTk0MTQwNjI1Q2VudHJhbCBCcmF6aWxpYW4gU3RhbmRhcmQgVGltZUVycm9yIGNhbGxpbmcgTXNpVmlld01vZGlmeTogJXZNb3VudGFpbiBTdGFuZGFyZCBUaW1lIChNZXhpY28pVy4gQ2VudHJhbCBBZg==143:T554,dGFuZGFyZCBUaW1lV293NjREaXNhYmxlV293NjRGc1JlZGlyZWN0aW9uYWJpIG1pc21hdGNoIGRldGVjdGVkIGJldHdlZW4gYXNzaWdubWVudCB0byBlbnRyeSBpbiBuaWwgbWFwY2hlY2tkZWFkOiBpbmNvbnNpc3RlbnQgY291bnRzZmFpbGVkIHRvIGdldCBzeXN0ZW0gcGFnZSBzaXplZnJlZWRlZmVyIHdpdGggZC5fcGFuaWMgIT0gbmlsaW4gZXhwb25lbnQgb2YgbnVtZXJpYyBsaXRlcmFsaW5hcHByb3ByaWF0ZSBpb2N0bCBmb3IgZGV2aWNlaW52YWxpZCBwb2ludGVyIGZvdW5kIG9uIHN0YWNrbG9va2luZyBmb3IgYmVnaW5uaW5nIG9mIHZhbHVlbm90ZXRzbGVlcCAtIHdhaXRtIG91dCBvZiBzeW5jcHJvdG9jb2wgd3JvbmcgdHlwZSBmb3Igc29ja2V0cmVmbGVjdDogRWxlbSBvZiBpbnZhbGlkIHR5cGUgcmVmbGVjdDogTGVuIG9mIG5vbi1hcnJheSB0eXBlcmVmbGVjdDogT3V0IG9mIG5vbi1mdW5jIHR5cGUgcnVucXB1dHNsb3c6IHF1ZXVlIGlzIG5vdCBmdWxscnVudGltZTogYmFkIGcgaW4gY2dvY2FsbGJhY2tydW50aW1lOiBiYWQgcG9pbnRlciBpbiBmcmFtZSBydW50aW1lOiBmb3VuZCBpbiBvYmplY3QgYXQgKihydW50aW1lOiBpbXBvc3NpYmxlIHR5cGUga2luZCBzb2NrZXQgb3BlcmF0aW9uIG9uIG5vbi1zb2NrZXRzeW5jOiBpbmNvbnNpc3RlbnQgbXV0ZXggc3RhdGVzeW5jOiB1bmxvY2sgb2YgdW5sb2NrZWQgbXV0ZXh1bnNhZmUuU2xpY2U6IGxlbiBvdXQgb2YgcmFuZ2V5ZWFyIG91dHNpZGUgb2YgcmFuZ2UgWzAsOTk5OV0pIG5vdCBpbiB1c2FibGUgYWRkcmVzcyBzcGFjZTogLi4uYWRkaXRpb25hbCBmcmFtZXMgZWxpZGVkLi4uLmxpYiBzZWN0aW9uIGluIGEub3V0IGNvcnJ1cHRlZDExMzY4NjgzNzcyMTYxNjAyOTczOTM3OTg4MjgxMjU1Njg0MzQxODg2MDgwODAxNDg2OTY4OTk0MTQwNjI1Q2VudHJhbCBCcmF6aWxpYW4gU3RhbmRhcmQgVGltZUVycm9yIGNhbGxpbmcgTXNpVmlld01vZGlmeTogJXZNb3VudGFpbiBTdGFuZGFyZCBUaW1lIChNZXhpY28pVy4gQ2VudHJhbCBBZnI=144:T554,VGltZS5NYXJzaGFsSlNPTjogVGltZS5NYXJzaGFsVGV4dDogVmFyaWF0aW9uX1NlbGVjdG9yYWRhcHRpdmVzdGFja3N0YXJ0YmFkIG1hbnVhbEZyZWVMaXN0Y29ubmVjdGlvbiByZWZ1c2VkZWxlbSBhbGlnbiB0b28gYmlnZXhjZWVkZWQgbWF4IGRlcHRoZmlsZSBuYW1lIHRvbyBsb25nZmxhZyAlcSBjb250YWlucyA9ZmxhZyByZWRlZmluZWQ6ICVzZm9yRWFjaFA6IG5vdCBkb25lZ2FyYmFnZSBjb2xsZWN0aW9uaWRlbnRpZmllciByZW1vdmVkaW4gbnVtZXJpYyBsaXRlcmFsaW5kZXggb3V0IG9mIHJhbmdlaW5wdXQvb3V0cHV0IGVycm9yaW52YWxpZCBjaGFyYWN0ZXIgbXVsdGlob3AgYXR0ZW1wdGVkbm8gY2hpbGQgcHJvY2Vzc2Vzbm8gbG9ja3MgYXZhaWxhYmxlb3BlcmF0aW9uIGNhbmNlbGVkcmVmbGVjdC5WYWx1ZS5FbGVtcmVmbGVjdC5WYWx1ZS5UeXBlcmVmbGVjdC5WYWx1ZS5VaW50cmVmbGVjdDogWmVybyhuaWwpcnVudGltZS5zZW1hY3JlYXRlcnVudGltZS5zZW1hd2FrZXVwcnVudGltZTogICBncDogZ3A9cnVudGltZTogZ2V0ZzogIGc9cnVudGltZTogbnBhZ2VzID0gcnVudGltZTogcmFuZ2UgPSB7cnVudGltZTogdGV4dEFkZHIgc3RvcHBpbmcgdGhlIHdvcmxkc3RyZWFtcyBwaXBlIGVycm9yc3luYy5SV011dGV4LlJMb2Nrc3lzdGVtIHBhZ2Ugc2l6ZSAodHJhY2ViYWNrYW5jZXN0b3JzdXNlIG9mIGNsb3NlZCBmaWxldmFsdWUgb3V0IG9mIHJhbmdlIFtjb250cm9sbGVyIHJlc2V0XSBjYWxsZWQgdXNpbmcgbmlsICosICBnLT5hdG9taWNzdGF0dXM9LCBncC0+YXRvbWljc3RhdHVzPTE0OTAxMTYxMTkzODQ3NjU2MjU3NDUwNTgwNTk2OTIzODI4MTI1QWx0YWkgU3RhbmRhcmQgVGltZUJhaGlhIFN0YW5kYXJkIFRpbWVDYW5hZGlhbl9BYm9yaWdpbmFsQ2hpbmEgU3RhbmRhcmQgVGltZUNyZWF0ZVN5bWJvbGljTGlua1dDcnlwdFJlbGVhc2VDb250ZXh0RWd5cHQgU3RhbmRhcmQgVGltZUdDIG1hcmsgdGVybWluYXRpb25HQyB3b3JrIG5vdCBmbHVzaGVkR2V0Q3VycmVudFByb2Nlc3NJ145:T558,VGltZS5NYXJzaGFsSlNPTjogVGltZS5NYXJzaGFsVGV4dDogVmFyaWF0aW9uX1NlbGVjdG9yYWRhcHRpdmVzdGFja3N0YXJ0YmFkIG1hbnVhbEZyZWVMaXN0Y29ubmVjdGlvbiByZWZ1c2VkZWxlbSBhbGlnbiB0b28gYmlnZXhjZWVkZWQgbWF4IGRlcHRoZmlsZSBuYW1lIHRvbyBsb25nZmxhZyAlcSBjb250YWlucyA9ZmxhZyByZWRlZmluZWQ6ICVzZm9yRWFjaFA6IG5vdCBkb25lZ2FyYmFnZSBjb2xsZWN0aW9uaWRlbnRpZmllciByZW1vdmVkaW4gbnVtZXJpYyBsaXRlcmFsaW5kZXggb3V0IG9mIHJhbmdlaW5wdXQvb3V0cHV0IGVycm9yaW52YWxpZCBjaGFyYWN0ZXIgbXVsdGlob3AgYXR0ZW1wdGVkbm8gY2hpbGQgcHJvY2Vzc2Vzbm8gbG9ja3MgYXZhaWxhYmxlb3BlcmF0aW9uIGNhbmNlbGVkcmVmbGVjdC5WYWx1ZS5FbGVtcmVmbGVjdC5WYWx1ZS5UeXBlcmVmbGVjdC5WYWx1ZS5VaW50cmVmbGVjdDogWmVybyhuaWwpcnVudGltZS5zZW1hY3JlYXRlcnVudGltZS5zZW1hd2FrZXVwcnVudGltZTogICBncDogZ3A9cnVudGltZTogZ2V0ZzogIGc9cnVudGltZTogbnBhZ2VzID0gcnVudGltZTogcmFuZ2UgPSB7cnVudGltZTogdGV4dEFkZHIgc3RvcHBpbmcgdGhlIHdvcmxkc3RyZWFtcyBwaXBlIGVycm9yc3luYy5SV011dGV4LlJMb2Nrc3lzdGVtIHBhZ2Ugc2l6ZSAodHJhY2ViYWNrYW5jZXN0b3JzdXNlIG9mIGNsb3NlZCBmaWxldmFsdWUgb3V0IG9mIHJhbmdlIFtjb250cm9sbGVyIHJlc2V0XSBjYWxsZWQgdXNpbmcgbmlsICosICBnLT5hdG9taWNzdGF0dXM9LCBncC0+YXRvbWljc3RhdHVzPTE0OTAxMTYxMTkzODQ3NjU2MjU3NDUwNTgwNTk2OTIzODI4MTI1QWx0YWkgU3RhbmRhcmQgVGltZUJhaGlhIFN0YW5kYXJkIFRpbWVDYW5hZGlhbl9BYm9yaWdpbmFsQ2hpbmEgU3RhbmRhcmQgVGltZUNyZWF0ZVN5bWJvbGljTGlua1dDcnlwdFJlbGVhc2VDb250ZXh0RWd5cHQgU3RhbmRhcmQgVGltZUdDIG1hcmsgdGVybWluYXRpb25HQyB3b3JrIG5vdCBmbHVzaGVkR2V0Q3VycmVudFByb2Nlc3NJZA==146:T554,dG9yYWNxdWlyZVN1ZG9nOiBmb3VuZCBzLmVsZW0gIT0gbmlsIGluIGNhY2hlZmF0YWwgZXJyb3I6IGNnbyBjYWxsYmFjayBiZWZvcmUgY2dvIGNhbGxsb29raW5nIGZvciBiZWdpbm5pbmcgb2Ygb2JqZWN0IGtleSBzdHJpbmdub24tZW1wdHkgbWFyayBxdWV1ZSBhZnRlciBjb25jdXJyZW50IG1hcmtvbiBhIGxvY2tlZCB0aHJlYWQgd2l0aCBubyB0ZW1wbGF0ZSB0aHJlYWRvdXQgb2YgbWVtb3J5IGFsbG9jYXRpbmcgY2hlY2ttYXJrcyBiaXRtYXBwZXJzaXN0ZW50YWxsb2M6IGFsaWduIGlzIG5vdCBhIHBvd2VyIG9mIDJyZWZsZWN0OiBjYW5ub3QgY29udmVydCBzbGljZSB3aXRoIGxlbmd0aCBydW50aW1lOiBibG9ja2VkIHdyaXRlIG9uIGNsb3NpbmcgcG9sbGRlc2Nzd2VlcDogdHJpZWQgdG8gcHJlc2VydmUgYSB1c2VyIGFyZW5hIHNwYW51bmV4cGVjdGVkIHNpZ25hbCBkdXJpbmcgcnVudGltZSBleGVjdXRpb25nY0JnTWFya1dvcmtlcjogdW5leHBlY3RlZCBnY01hcmtXb3JrZXJNb2RlZ3JldyBoZWFwLCBidXQgbm8gYWRlcXVhdGUgZnJlZSBzcGFjZSBmb3VuZGludGVycnVwdGVkIHN5c3RlbSBjYWxsIHNob3VsZCBiZSByZXN0YXJ0ZWRtZXRob2RWYWx1ZUNhbGxGcmFtZU9ianMgaXMgbm90IGluIGEgbW9kdWxlbXVsdDY0Yml0UG93MTA6IHBvd2VyIG9mIDEwIGlzIG91dCBvZiByYW5nZW11bHRpcGxlIFJlYWQgY2FsbHMgcmV0dXJuIG5vIGRhdGEgb3IgZXJyb3Jub24gaW4tdXNlIHNwYW4gZm91bmQgd2l0aCBzcGVjaWFscyBiaXQgc2V0cmVmbGVjdDogbmlsIHR5cGUgcGFzc2VkIHRvIFR5cGUuSW1wbGVtZW50c3Jvb3QgbGV2ZWwgbWF4IHBhZ2VzIGRvZXNuJ3QgZml0IGluIHN1bW1hcnlydW50aW1lLlNldEZpbmFsaXplcjogZmluYWxpemVyIGFscmVhZHkgc2V0cnVudGltZS5TZXRGaW5hbGl6ZXI6IGZpcnN0IGFyZ3VtZW50IGlzIG5pbHJ1bnRpbWU6IGNhc2Zyb21fR3NjYW5zdGF0dXMgYmFkIG9sZHZhbCBncD1ydW50aW1lOiByZWxlYXNlU3Vkb2cgd2l0aCBub24tbmlsIGdwLnBhcmE=147:T554,dG9yYWNxdWlyZVN1ZG9nOiBmb3VuZCBzLmVsZW0gIT0gbmlsIGluIGNhY2hlZmF0YWwgZXJyb3I6IGNnbyBjYWxsYmFjayBiZWZvcmUgY2dvIGNhbGxsb29raW5nIGZvciBiZWdpbm5pbmcgb2Ygb2JqZWN0IGtleSBzdHJpbmdub24tZW1wdHkgbWFyayBxdWV1ZSBhZnRlciBjb25jdXJyZW50IG1hcmtvbiBhIGxvY2tlZCB0aHJlYWQgd2l0aCBubyB0ZW1wbGF0ZSB0aHJlYWRvdXQgb2YgbWVtb3J5IGFsbG9jYXRpbmcgY2hlY2ttYXJrcyBiaXRtYXBwZXJzaXN0ZW50YWxsb2M6IGFsaWduIGlzIG5vdCBhIHBvd2VyIG9mIDJyZWZsZWN0OiBjYW5ub3QgY29udmVydCBzbGljZSB3aXRoIGxlbmd0aCBydW50aW1lOiBibG9ja2VkIHdyaXRlIG9uIGNsb3NpbmcgcG9sbGRlc2Nzd2VlcDogdHJpZWQgdG8gcHJlc2VydmUgYSB1c2VyIGFyZW5hIHNwYW51bmV4cGVjdGVkIHNpZ25hbCBkdXJpbmcgcnVudGltZSBleGVjdXRpb25nY0JnTWFya1dvcmtlcjogdW5leHBlY3RlZCBnY01hcmtXb3JrZXJNb2RlZ3JldyBoZWFwLCBidXQgbm8gYWRlcXVhdGUgZnJlZSBzcGFjZSBmb3VuZGludGVycnVwdGVkIHN5c3RlbSBjYWxsIHNob3VsZCBiZSByZXN0YXJ0ZWRtZXRob2RWYWx1ZUNhbGxGcmFtZU9ianMgaXMgbm90IGluIGEgbW9kdWxlbXVsdDY0Yml0UG93MTA6IHBvd2VyIG9mIDEwIGlzIG91dCBvZiByYW5nZW11bHRpcGxlIFJlYWQgY2FsbHMgcmV0dXJuIG5vIGRhdGEgb3IgZXJyb3Jub24gaW4tdXNlIHNwYW4gZm91bmQgd2l0aCBzcGVjaWFscyBiaXQgc2V0cmVmbGVjdDogbmlsIHR5cGUgcGFzc2VkIHRvIFR5cGUuSW1wbGVtZW50c3Jvb3QgbGV2ZWwgbWF4IHBhZ2VzIGRvZXNuJ3QgZml0IGluIHN1bW1hcnlydW50aW1lLlNldEZpbmFsaXplcjogZmluYWxpemVyIGFscmVhZHkgc2V0cnVudGltZS5TZXRGaW5hbGl6ZXI6IGZpcnN0IGFyZ3VtZW50IGlzIG5pbHJ1bnRpbWU6IGNhc2Zyb21fR3NjYW5zdGF0dXMgYmFkIG9sZHZhbCBncD1ydW50aW1lOiByZWxlYXNlU3Vkb2cgd2l0aCBub24tbmlsIGdwLnBhcmFt148:T554,VFdBUkVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cVGltZSBab25lc1VuZXhwZWN0ZWQgcmV0dXJuIHZhbHVlIGZyb20gTXNpTG9jYXRlQ29tcG9uZW50OiAldi4gJXZjYXNmcm9tX0dzY2Fuc3RhdHVzOnRvcCBncC0+c3RhdHVzIGlzIG5vdCBpbiBzY2FuIHN0YXRlZ2VudHJhY2ViYWNrIGNhbGxiYWNrIGNhbm5vdCBiZSB1c2VkIHdpdGggbm9uLXplcm8gc2tpcG1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBmcmVlIG9mIHVzZXIgYXJlbmEgY2h1bmtvczogaW52YWxpZCB1c2Ugb2YgV3JpdGVBdCBvbiBmaWxlIG9wZW5lZCB3aXRoIE9fQVBQRU5EcmVmbGVjdDogaW50ZXJuYWwgZXJyb3I6IGludmFsaWQgdXNlIG9mIG1ha2VNZXRob2RWYWx1ZWZhaWxlZCB0byBhbGxvY2F0ZSBhbGlnbmVkIGhlYXAgbWVtb3J5OyB0b28gbWFueSByZXRyaWVzaW4gZ2NNYXJrIGV4cGVjdGluZyB0byBzZWUgZ2NwaGFzZSBhcyBfR0NtYXJrdGVybWluYXRpb25ub24tZW1wdHkgcG9pbnRlciBtYXAgcGFzc2VkIGZvciBub24tcG9pbnRlci1zaXplIHZhbHVlc3Byb2ZpbGVhbGxvYyBjYWxsZWQgd2l0aG91dCBhIFAgb3Igb3V0c2lkZSBib290c3RyYXBwaW5ncHRyRW5jb2Rlci5lbmNvZGUgc2hvdWxkIGhhdmUgZW1wdGllZCBwdHJTZWVuIHZpYSBkZWZlcnNzdHJpbmdzOiBpbGxlZ2FsIHVzZSBvZiBub24temVybyBCdWlsZGVyIGNvcGllZCBieSB2YWx1ZWdlbnRyYWNlYmFjayBjYW5ub3QgdHJhY2UgdXNlciBnb3JvdXRpbmUgb24gaXRzIG93biBzdGFja3J1bnRpbWU6IGNoZWNrbWFya3MgZm91bmQgdW5leHBlY3RlZCB1bm1hcmtlZCBvYmplY3Qgb2JqPXN5bmM6IFdhaXRHcm91cCBtaXN1c2U6IEFkZCBjYWxsZWQgY29uY3VycmVudGx5IHdpdGggV2FpdGpzb246IGNhbm5vdCBzZXQgZW1iZWRkZWQgcG9pbnRlciB0byB1bmV4cG9ydGVkIHN0cnVjdDogJXZFcnJvciB3aGVuIHF1ZXJ5aW5nIGZvciBwcmV2aW91c2x5IGluc3RhbGxlZCBkZXBsb3ltZW50OiAldnJlZmxlY3Q6IHJlZmxlY3Qu149:T558,VFdBUkVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cVGltZSBab25lc1VuZXhwZWN0ZWQgcmV0dXJuIHZhbHVlIGZyb20gTXNpTG9jYXRlQ29tcG9uZW50OiAldi4gJXZjYXNmcm9tX0dzY2Fuc3RhdHVzOnRvcCBncC0+c3RhdHVzIGlzIG5vdCBpbiBzY2FuIHN0YXRlZ2VudHJhY2ViYWNrIGNhbGxiYWNrIGNhbm5vdCBiZSB1c2VkIHdpdGggbm9uLXplcm8gc2tpcG1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBmcmVlIG9mIHVzZXIgYXJlbmEgY2h1bmtvczogaW52YWxpZCB1c2Ugb2YgV3JpdGVBdCBvbiBmaWxlIG9wZW5lZCB3aXRoIE9fQVBQRU5EcmVmbGVjdDogaW50ZXJuYWwgZXJyb3I6IGludmFsaWQgdXNlIG9mIG1ha2VNZXRob2RWYWx1ZWZhaWxlZCB0byBhbGxvY2F0ZSBhbGlnbmVkIGhlYXAgbWVtb3J5OyB0b28gbWFueSByZXRyaWVzaW4gZ2NNYXJrIGV4cGVjdGluZyB0byBzZWUgZ2NwaGFzZSBhcyBfR0NtYXJrdGVybWluYXRpb25ub24tZW1wdHkgcG9pbnRlciBtYXAgcGFzc2VkIGZvciBub24tcG9pbnRlci1zaXplIHZhbHVlc3Byb2ZpbGVhbGxvYyBjYWxsZWQgd2l0aG91dCBhIFAgb3Igb3V0c2lkZSBib290c3RyYXBwaW5ncHRyRW5jb2Rlci5lbmNvZGUgc2hvdWxkIGhhdmUgZW1wdGllZCBwdHJTZWVuIHZpYSBkZWZlcnNzdHJpbmdzOiBpbGxlZ2FsIHVzZSBvZiBub24temVybyBCdWlsZGVyIGNvcGllZCBieSB2YWx1ZWdlbnRyYWNlYmFjayBjYW5ub3QgdHJhY2UgdXNlciBnb3JvdXRpbmUgb24gaXRzIG93biBzdGFja3J1bnRpbWU6IGNoZWNrbWFya3MgZm91bmQgdW5leHBlY3RlZCB1bm1hcmtlZCBvYmplY3Qgb2JqPXN5bmM6IFdhaXRHcm91cCBtaXN1c2U6IEFkZCBjYWxsZWQgY29uY3VycmVudGx5IHdpdGggV2FpdGpzb246IGNhbm5vdCBzZXQgZW1iZWRkZWQgcG9pbnRlciB0byB1bmV4cG9ydGVkIHN0cnVjdDogJXZFcnJvciB3aGVuIHF1ZXJ5aW5nIGZvciBwcmV2aW91c2x5IGluc3RhbGxlZCBkZXBsb3ltZW50OiAldnJlZmxlY3Q6IHJlZmxlY3QuVg==14a:T554,dW5sb2NrOiBsb2NrIGNvdW50c2lnc2VuZDogaW5jb25zaXN0ZW50IHN0YXRlc3RhY2sgc2l6ZSBub3QgYSBwb3dlciBvZiAyc3RvcFRoZVdvcmxkOiBob2xkaW5nIGxvY2tzdGltZTogaW52YWxpZCBsb2NhdGlvbiBuYW1ldGltZXIgd2hlbiBtdXN0IGJlIHBvc2l0aXZldG9vIG1hbnkgY2FsbGJhY2sgZnVuY3Rpb25zd29yay5ud2FpdCB3YXMgPiB3b3JrLm5wcm9jIGFyZ3Mgc3RhY2sgbWFwIGVudHJpZXMgZm9yICEjJCUmKCkqKy0uLzo7PD0+P0BbXV5fe3x9fiAxODE4OTg5NDAzNTQ1ODU2NDc1ODMwMDc4MTI1OTA5NDk0NzAxNzcyOTI4MjM3OTE1MDM5MDYyNUF1cyBDZW50cmFsIFcuIFN0YW5kYXJkIFRpbWVDYW5hZGEgQ2VudHJhbCBTdGFuZGFyZCBUaW1lQ2VuLiBBdXN0cmFsaWEgU3RhbmRhcmQgVGltZUNlbnRyYWwgRXVyb3BlIFN0YW5kYXJkIFRpbWVDZXJ0Q3JlYXRlQ2VydGlmaWNhdGVDb250ZXh0RW5nbGlzaCBuYW1lIGZvciB0aW1lIHpvbmUgIkZpeGVkU3RhY2sgaXMgbm90IHBvd2VyLW9mLTJHZXRGaWxlSW5mb3JtYXRpb25CeUhhbmRsZUV4UHJlcGVuZGVkX0NvbmNhdGVuYXRpb25fTWFya1tvcmlnaW5hdGluZyBmcm9tIGdvcm91dGluZSBjb21wYXJpbmcgdW5jb21wYXJhYmxlIHR5cGUgZGVzdGluYXRpb24gYWRkcmVzcyByZXF1aXJlZGZhdGFsOiBtb3Jlc3RhY2sgb24gZ3NpZ25hbGZpbGUgZGVzY3JpcHRvciBpbiBiYWQgc3RhdGVmaW5kcnVubmFibGU6IG5ldHBvbGwgd2l0aCBwZm91bmQgcG9pbnRlciB0byBmcmVlIG9iamVjdGdjQmdNYXJrV29ya2VyOiBtb2RlIG5vdCBzZXRnY3N0b3BtOiBuZWdhdGl2ZSBubXNwaW5uaW5naW52YWxpZCBydW50aW1lIHN5bWJvbCB0YWJsZWpzb246IFVubWFyc2hhbChub24tcG9pbnRlciBtaGVhcC5mcmVlU3BhbkxvY2tlZCAtIHNwYW4gbWlzc2luZyBzdGFjayBpbiBzaHJpbmtzdGFja21zcGFuLnN3ZWVwOiBtIGlzIG5vdCBsb2NrZWRuZWVkIHBhZGRpbmcgaW4gYnVja2V0IChrZXkpbmV3cHJvYzE6IG5ldyBnIGlzIG5vdCBHZGVhZG5ld3A=14b:T554,dW5sb2NrOiBsb2NrIGNvdW50c2lnc2VuZDogaW5jb25zaXN0ZW50IHN0YXRlc3RhY2sgc2l6ZSBub3QgYSBwb3dlciBvZiAyc3RvcFRoZVdvcmxkOiBob2xkaW5nIGxvY2tzdGltZTogaW52YWxpZCBsb2NhdGlvbiBuYW1ldGltZXIgd2hlbiBtdXN0IGJlIHBvc2l0aXZldG9vIG1hbnkgY2FsbGJhY2sgZnVuY3Rpb25zd29yay5ud2FpdCB3YXMgPiB3b3JrLm5wcm9jIGFyZ3Mgc3RhY2sgbWFwIGVudHJpZXMgZm9yICEjJCUmKCkqKy0uLzo7PD0+P0BbXV5fe3x9fiAxODE4OTg5NDAzNTQ1ODU2NDc1ODMwMDc4MTI1OTA5NDk0NzAxNzcyOTI4MjM3OTE1MDM5MDYyNUF1cyBDZW50cmFsIFcuIFN0YW5kYXJkIFRpbWVDYW5hZGEgQ2VudHJhbCBTdGFuZGFyZCBUaW1lQ2VuLiBBdXN0cmFsaWEgU3RhbmRhcmQgVGltZUNlbnRyYWwgRXVyb3BlIFN0YW5kYXJkIFRpbWVDZXJ0Q3JlYXRlQ2VydGlmaWNhdGVDb250ZXh0RW5nbGlzaCBuYW1lIGZvciB0aW1lIHpvbmUgIkZpeGVkU3RhY2sgaXMgbm90IHBvd2VyLW9mLTJHZXRGaWxlSW5mb3JtYXRpb25CeUhhbmRsZUV4UHJlcGVuZGVkX0NvbmNhdGVuYXRpb25fTWFya1tvcmlnaW5hdGluZyBmcm9tIGdvcm91dGluZSBjb21wYXJpbmcgdW5jb21wYXJhYmxlIHR5cGUgZGVzdGluYXRpb24gYWRkcmVzcyByZXF1aXJlZGZhdGFsOiBtb3Jlc3RhY2sgb24gZ3NpZ25hbGZpbGUgZGVzY3JpcHRvciBpbiBiYWQgc3RhdGVmaW5kcnVubmFibGU6IG5ldHBvbGwgd2l0aCBwZm91bmQgcG9pbnRlciB0byBmcmVlIG9iamVjdGdjQmdNYXJrV29ya2VyOiBtb2RlIG5vdCBzZXRnY3N0b3BtOiBuZWdhdGl2ZSBubXNwaW5uaW5naW52YWxpZCBydW50aW1lIHN5bWJvbCB0YWJsZWpzb246IFVubWFyc2hhbChub24tcG9pbnRlciBtaGVhcC5mcmVlU3BhbkxvY2tlZCAtIHNwYW4gbWlzc2luZyBzdGFjayBpbiBzaHJpbmtzdGFja21zcGFuLnN3ZWVwOiBtIGlzIG5vdCBsb2NrZWRuZWVkIHBhZGRpbmcgaW4gYnVja2V0IChrZXkpbmV3cHJvYzE6IG5ldyBnIGlzIG5vdCBHZGVhZG5ld3By14c:T550,dmVudCB0eXBlIGZvdW5kcG90ZW50aWFsbHkgb3ZlcmxhcHBpbmcgaW4tdXNlIGFsbG9jYXRpb25zIGRldGVjdGVkcnVudGltZTogbmV0cG9sbDogUG9zdFF1ZXVlZENvbXBsZXRpb25TdGF0dXMgZmFpbGVkY2FzZnJvbV9Hc2NhbnN0YXR1czogZ3AtPnN0YXR1cyBpcyBub3QgaW4gc2NhbiBzdGF0ZW1hbGxvY2djIGNhbGxlZCB3aXRob3V0IGEgUCBvciBvdXRzaWRlIGJvb3RzdHJhcHBpbmdydW50aW1lLlNldEZpbmFsaXplcjogcG9pbnRlciBub3QgaW4gYWxsb2NhdGVkIGJsb2NrcnVudGltZTogR2V0UXVldWVkQ29tcGxldGlvblN0YXR1c0V4IGZhaWxlZCAoZXJybm89IHJ1bnRpbWU6IHVzZSBvZiBGaXhBbGxvY19BbGxvYyBiZWZvcmUgRml4QWxsb2NfSW5pdHNwYW4gc2V0IGJsb2NrIHdpdGggdW5wb3BwZWQgZWxlbWVudHMgZm91bmQgaW4gcmVzZXRjb21waWxlQ2FsbGJhY2s6IGFyZ3VtZW50IHNpemUgaXMgbGFyZ2VyIHRoYW4gdWludHB0cnJlZmxlY3QuVmFsdWUuU2xpY2U6IHN0cmluZyBzbGljZSBpbmRleCBvdXQgb2YgYm91bmRzcmVmbGVjdDogbm9uLWludGVyZmFjZSB0eXBlIHBhc3NlZCB0byBUeXBlLkltcGxlbWVudHNnb3JvdXRpbmUgcnVubmluZyBvbiBvdGhlciB0aHJlYWQ7IHN0YWNrIHVuYXZhaWxhYmxlYnl0ZXMuQnVmZmVyOiByZWFkZXIgcmV0dXJuZWQgbmVnYXRpdmUgY291bnQgZnJvbSBSZWFkZ2NDb250cm9sbGVyU3RhdGUuZmluZFJ1bm5hYmxlOiBibGFja2VuaW5nIG5vdCBlbmFibGVkaW50ZXJuYWwgZXJyb3I6IHBvbGxpbmcgb24gdW5zdXBwb3J0ZWQgZGVzY3JpcHRvciB0eXBlbm8gZ29yb3V0aW5lcyAobWFpbiBjYWxsZWQgcnVudGltZS5Hb2V4aXQpIC0gZGVhZGxvY2shcGFuaWMgY2FsbGluZyBTdHJpbmcgbWV0aG9kIG9uIHplcm8gJXYgZm9yIGZsYWcgJXM6ICV2cnVudGltZTogc2lnbmFsIHJlY2VpdmVkIG9uIHRocmVhZCBub3QgY3JlYXRlZCBieSBHby4gaXMgY3VycmVudGx5IG5vdCBzdXBwb3J0ZWQgZm9yIHVzZSBpbiBzeXN0ZW0gY2FsbGJhY2tzU08=14d:T550,dmVudCB0eXBlIGZvdW5kcG90ZW50aWFsbHkgb3ZlcmxhcHBpbmcgaW4tdXNlIGFsbG9jYXRpb25zIGRldGVjdGVkcnVudGltZTogbmV0cG9sbDogUG9zdFF1ZXVlZENvbXBsZXRpb25TdGF0dXMgZmFpbGVkY2FzZnJvbV9Hc2NhbnN0YXR1czogZ3AtPnN0YXR1cyBpcyBub3QgaW4gc2NhbiBzdGF0ZW1hbGxvY2djIGNhbGxlZCB3aXRob3V0IGEgUCBvciBvdXRzaWRlIGJvb3RzdHJhcHBpbmdydW50aW1lLlNldEZpbmFsaXplcjogcG9pbnRlciBub3QgaW4gYWxsb2NhdGVkIGJsb2NrcnVudGltZTogR2V0UXVldWVkQ29tcGxldGlvblN0YXR1c0V4IGZhaWxlZCAoZXJybm89IHJ1bnRpbWU6IHVzZSBvZiBGaXhBbGxvY19BbGxvYyBiZWZvcmUgRml4QWxsb2NfSW5pdHNwYW4gc2V0IGJsb2NrIHdpdGggdW5wb3BwZWQgZWxlbWVudHMgZm91bmQgaW4gcmVzZXRjb21waWxlQ2FsbGJhY2s6IGFyZ3VtZW50IHNpemUgaXMgbGFyZ2VyIHRoYW4gdWludHB0cnJlZmxlY3QuVmFsdWUuU2xpY2U6IHN0cmluZyBzbGljZSBpbmRleCBvdXQgb2YgYm91bmRzcmVmbGVjdDogbm9uLWludGVyZmFjZSB0eXBlIHBhc3NlZCB0byBUeXBlLkltcGxlbWVudHNnb3JvdXRpbmUgcnVubmluZyBvbiBvdGhlciB0aHJlYWQ7IHN0YWNrIHVuYXZhaWxhYmxlYnl0ZXMuQnVmZmVyOiByZWFkZXIgcmV0dXJuZWQgbmVnYXRpdmUgY291bnQgZnJvbSBSZWFkZ2NDb250cm9sbGVyU3RhdGUuZmluZFJ1bm5hYmxlOiBibGFja2VuaW5nIG5vdCBlbmFibGVkaW50ZXJuYWwgZXJyb3I6IHBvbGxpbmcgb24gdW5zdXBwb3J0ZWQgZGVzY3JpcHRvciB0eXBlbm8gZ29yb3V0aW5lcyAobWFpbiBjYWxsZWQgcnVudGltZS5Hb2V4aXQpIC0gZGVhZGxvY2shcGFuaWMgY2FsbGluZyBTdHJpbmcgbWV0aG9kIG9uIHplcm8gJXYgZm9yIGZsYWcgJXM6ICV2cnVudGltZTogc2lnbmFsIHJlY2VpdmVkIG9uIHRocmVhZCBub3QgY3JlYXRlZCBieSBHby4gaXMgY3VycmVudGx5IG5vdCBzdXBwb3J0ZWQgZm9yIHVzZSBpbiBzeXN0ZW0gY2FsbGJhY2tzU09G14e:T554,V2VzdCBBc2lhIFN0YW5kYXJkIFRpbWVXZXN0IEJhbmsgU3RhbmRhcmQgVGltZSIgbm90IGZvdW5kIGluIHJlZ2lzdHJ5IiwgbWlzc2luZyBDUFUgc3VwcG9ydGJ5dGVzLkJ1ZmZlcjogdG9vIGxhcmdlY2hhbiByZWNlaXZlIChuaWwgY2hhbiljbG9zZSBvZiBjbG9zZWQgY2hhbm5lbGRldmljZSBvciByZXNvdXJjZSBidXN5ZmF0YWw6IG1vcmVzdGFjayBvbiBnMGdhcmJhZ2UgY29sbGVjdGlvbiBzY2FuZ2NEcmFpbiBwaGFzZSBpbmNvcnJlY3RpbmRleCBvdXQgb2YgcmFuZ2UgWyV4XWludGVycnVwdGVkIHN5c3RlbSBjYWxsaW52YWxpZCBtLT5sb2NrZWRJbnQgPSBqc29uOiBjYW5ub3QgdW5tYXJzaGFsIGxlZnQgb3ZlciBtYXJrcm9vdCBqb2JzbWFrZWNoYW46IGJhZCBhbGlnbm1lbnRtaXNzaW5nIHR5cGUgaW4gcnVuZmlucW5hbm90aW1lIHJldHVybmluZyB6ZXJvbm8gc3BhY2UgbGVmdCBvbiBkZXZpY2VvcGVyYXRpb24gbm90IHBlcm1pdHRlZG9wZXJhdGlvbiBub3Qgc3VwcG9ydGVkcGFuaWMgZHVyaW5nIHByZWVtcHRvZmZwcm9jcmVzaXplOiBpbnZhbGlkIGFyZ3JlZmxlY3QuVmFsdWUuSW50ZXJmYWNlcmVmbGVjdC5WYWx1ZS5OdW1NZXRob2RyZWZsZWN0Lm1ldGhvZFZhbHVlQ2FsbHJ1bnRpbWU6IGludGVybmFsIGVycm9ycnVudGltZTogbmV0cG9sbCBmYWlsZWRydW50aW1lOiBzLmFsbG9jQ291bnQ9IHMuYWxsb2NDb3VudCA+IHMubmVsZW1zc2NoZWR1bGU6IGhvbGRpbmcgbG9ja3NzaHJpbmtzdGFjayBhdCBiYWQgdGltZXNwYW4gaGFzIG5vIGZyZWUgc3RhY2tzc3RhY2sgZ3Jvd3RoIGFmdGVyIGZvcmtzeW50YXggZXJyb3IgaW4gcGF0dGVybnN5c3RlbSBodWdlIHBhZ2Ugc2l6ZSAodW5leHBlY3RlZCBtYXAga2V5IHR5cGV3b3JrLm53YWl0ID4gd29yay5ucHJvYzExNjQxNTMyMTgyNjkzNDgxNDQ1MzEyNTU4MjA3NjYwOTEzNDY3NDA3MjI2NTYyNUF6ZXJiYWlqYW4gU3RhbmRhcmQgVGltZUJhbmdsYWRlc2ggU3RhbmRhcmQgVGltZUNhcGUgVmVyZGUgU3RhbmRhcmQgVGltZUNlcnRGcg==14f:T554,V2VzdCBBc2lhIFN0YW5kYXJkIFRpbWVXZXN0IEJhbmsgU3RhbmRhcmQgVGltZSIgbm90IGZvdW5kIGluIHJlZ2lzdHJ5IiwgbWlzc2luZyBDUFUgc3VwcG9ydGJ5dGVzLkJ1ZmZlcjogdG9vIGxhcmdlY2hhbiByZWNlaXZlIChuaWwgY2hhbiljbG9zZSBvZiBjbG9zZWQgY2hhbm5lbGRldmljZSBvciByZXNvdXJjZSBidXN5ZmF0YWw6IG1vcmVzdGFjayBvbiBnMGdhcmJhZ2UgY29sbGVjdGlvbiBzY2FuZ2NEcmFpbiBwaGFzZSBpbmNvcnJlY3RpbmRleCBvdXQgb2YgcmFuZ2UgWyV4XWludGVycnVwdGVkIHN5c3RlbSBjYWxsaW52YWxpZCBtLT5sb2NrZWRJbnQgPSBqc29uOiBjYW5ub3QgdW5tYXJzaGFsIGxlZnQgb3ZlciBtYXJrcm9vdCBqb2JzbWFrZWNoYW46IGJhZCBhbGlnbm1lbnRtaXNzaW5nIHR5cGUgaW4gcnVuZmlucW5hbm90aW1lIHJldHVybmluZyB6ZXJvbm8gc3BhY2UgbGVmdCBvbiBkZXZpY2VvcGVyYXRpb24gbm90IHBlcm1pdHRlZG9wZXJhdGlvbiBub3Qgc3VwcG9ydGVkcGFuaWMgZHVyaW5nIHByZWVtcHRvZmZwcm9jcmVzaXplOiBpbnZhbGlkIGFyZ3JlZmxlY3QuVmFsdWUuSW50ZXJmYWNlcmVmbGVjdC5WYWx1ZS5OdW1NZXRob2RyZWZsZWN0Lm1ldGhvZFZhbHVlQ2FsbHJ1bnRpbWU6IGludGVybmFsIGVycm9ycnVudGltZTogbmV0cG9sbCBmYWlsZWRydW50aW1lOiBzLmFsbG9jQ291bnQ9IHMuYWxsb2NDb3VudCA+IHMubmVsZW1zc2NoZWR1bGU6IGhvbGRpbmcgbG9ja3NzaHJpbmtzdGFjayBhdCBiYWQgdGltZXNwYW4gaGFzIG5vIGZyZWUgc3RhY2tzc3RhY2sgZ3Jvd3RoIGFmdGVyIGZvcmtzeW50YXggZXJyb3IgaW4gcGF0dGVybnN5c3RlbSBodWdlIHBhZ2Ugc2l6ZSAodW5leHBlY3RlZCBtYXAga2V5IHR5cGV3b3JrLm53YWl0ID4gd29yay5ucHJvYzExNjQxNTMyMTgyNjkzNDgxNDQ1MzEyNTU4MjA3NjYwOTEzNDY3NDA3MjI2NTYyNUF6ZXJiYWlqYW4gU3RhbmRhcmQgVGltZUJhbmdsYWRlc2ggU3RhbmRhcmQgVGltZUNhcGUgVmVyZGUgU3RhbmRhcmQgVGltZUNlcnRGcmU=150:T554,eDoleTpdc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOiV4OiV5XXRvbyBtYW55IHJlZmVyZW5jZXM6IGNhbm5vdCBzcGxpY2V1bmV4cGVjdGVkIHJ1bnRpbWUubmV0cG9sbCBlcnJvcjogMTc3NjM1NjgzOTQwMDI1MDQ2NDY3NzgxMDY2ODk0NTMxMjUyMDA2LTAxLTAyVDE1OjA0OjA1Ljk5OTk5OTk5OVowNzowMDg4ODE3ODQxOTcwMDEyNTIzMjMzODkwNTMzNDQ3MjY1NjI1U3VwcHJlc3MgYWxsIFVJIGR1cmluZyBpbnN0YWxsYXRpb25hdHRlbXB0IHRvIGNsZWFyIG5vbi1lbXB0eSBzcGFuIHNldGZpbGUgdHlwZSBkb2VzIG5vdCBzdXBwb3J0IGRlYWRsaW5lZmluZHJ1bm5hYmxlOiBuZXRwb2xsIHdpdGggc3Bpbm5pbmdncmV5b2JqZWN0OiBvYmogbm90IHBvaW50ZXItYWxpZ25lZG1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBmcmVlbWlzbWF0Y2hlZCBiZWdpbi9lbmQgb2YgYWN0aXZlU3dlZXBuZXR3b3JrIGRyb3BwZWQgY29ubmVjdGlvbiBvbiByZXNldHBlcnNpc3RlbnRhbGxvYzogYWxpZ24gaXMgdG9vIGxhcmdlcGlkbGVwdXQ6IFAgaGFzIG5vbi1lbXB0eSBydW4gcXVldWVyZWZsZWN0Lk1ha2VTbGljZSBvZiBub24tc2xpY2UgdHlwZXJ1bnRpbWU6IGNsb3NlIHBvbGxkZXNjIHcvbyB1bmJsb2NrcnVudGltZTogY3JlYXRlZXZlbnQgZmFpbGVkOyBlcnJubz1yeXVGdG9hRml4ZWQzMiBjYWxsZWQgd2l0aCBwcmVjID4gOXRyYWNlYmFjayBkaWQgbm90IHVud2luZCBjb21wbGV0ZWx5dHJhbnNwb3J0IGVuZHBvaW50IGlzIG5vdCBjb25uZWN0ZWQpIGlzIGxhcmdlciB0aGFuIG1heGltdW0gcGFnZSBzaXplICgpIGlzIG5vdCBHcnVubmFibGUgb3IgR3NjYW5ydW5uYWJsZTAxMjM0NTY3ODlhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejQ0NDA4OTIwOTg1MDA2MjYxNjE2OTQ1MjY2NzIzNjMyODEyNUVycm9yIGNhbGxpbmcgTXNpSW5zdGFsbFByb2R1Y3RBOiAldkdvIHBvaW50ZXIgc3RvcmVkIGludG8gbm9uLUdvIG1lbW9yeVVuYWJsZSB0byBkZXRlcm1pbmUgc3lzdGVtIGRpcmVjdG8=151:T554,eDoleTpdc2xpY2UgYm91bmRzIG91dCBvZiByYW5nZSBbOiV4OiV5XXRvbyBtYW55IHJlZmVyZW5jZXM6IGNhbm5vdCBzcGxpY2V1bmV4cGVjdGVkIHJ1bnRpbWUubmV0cG9sbCBlcnJvcjogMTc3NjM1NjgzOTQwMDI1MDQ2NDY3NzgxMDY2ODk0NTMxMjUyMDA2LTAxLTAyVDE1OjA0OjA1Ljk5OTk5OTk5OVowNzowMDg4ODE3ODQxOTcwMDEyNTIzMjMzODkwNTMzNDQ3MjY1NjI1U3VwcHJlc3MgYWxsIFVJIGR1cmluZyBpbnN0YWxsYXRpb25hdHRlbXB0IHRvIGNsZWFyIG5vbi1lbXB0eSBzcGFuIHNldGZpbGUgdHlwZSBkb2VzIG5vdCBzdXBwb3J0IGRlYWRsaW5lZmluZHJ1bm5hYmxlOiBuZXRwb2xsIHdpdGggc3Bpbm5pbmdncmV5b2JqZWN0OiBvYmogbm90IHBvaW50ZXItYWxpZ25lZG1oZWFwLmZyZWVTcGFuTG9ja2VkIC0gaW52YWxpZCBmcmVlbWlzbWF0Y2hlZCBiZWdpbi9lbmQgb2YgYWN0aXZlU3dlZXBuZXR3b3JrIGRyb3BwZWQgY29ubmVjdGlvbiBvbiByZXNldHBlcnNpc3RlbnRhbGxvYzogYWxpZ24gaXMgdG9vIGxhcmdlcGlkbGVwdXQ6IFAgaGFzIG5vbi1lbXB0eSBydW4gcXVldWVyZWZsZWN0Lk1ha2VTbGljZSBvZiBub24tc2xpY2UgdHlwZXJ1bnRpbWU6IGNsb3NlIHBvbGxkZXNjIHcvbyB1bmJsb2NrcnVudGltZTogY3JlYXRlZXZlbnQgZmFpbGVkOyBlcnJubz1yeXVGdG9hRml4ZWQzMiBjYWxsZWQgd2l0aCBwcmVjID4gOXRyYWNlYmFjayBkaWQgbm90IHVud2luZCBjb21wbGV0ZWx5dHJhbnNwb3J0IGVuZHBvaW50IGlzIG5vdCBjb25uZWN0ZWQpIGlzIGxhcmdlciB0aGFuIG1heGltdW0gcGFnZSBzaXplICgpIGlzIG5vdCBHcnVubmFibGUgb3IgR3NjYW5ydW5uYWJsZTAxMjM0NTY3ODlhYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5ejQ0NDA4OTIwOTg1MDA2MjYxNjE2OTQ1MjY2NzIzNjMyODEyNUVycm9yIGNhbGxpbmcgTXNpSW5zdGFsbFByb2R1Y3RBOiAldkdvIHBvaW50ZXIgc3RvcmVkIGludG8gbm9uLUdvIG1lbW9yeVVuYWJsZSB0byBkZXRlcm1pbmUgc3lzdGVtIGRpcmVjdG9y152:T554,eWFjY2Vzc2VkIGRhdGEgZnJvbSBmcmVlZCB1c2VyIGFyZW5hIGFjY2Vzc2luZyBhIGNvcnJ1cHRlZCBzaGFyZWQgbGlicmFyeWludmFsaWQgYm9vbGVhbiB2YWx1ZSAlcSBmb3IgLSVzOiAldmpzb246IGVuY29kaW5nIGVycm9yIGZvciB0eXBlICVxOiAlcWtleSBzaXplIG5vdCBhIG11bHRpcGxlIG9mIGtleSBhbGlnbmxmc3RhY2sgbm9kZSBhbGxvY2F0ZWQgZnJvbSB0aGUgaGVhcG1ldGhvZCBBQkkgYW5kIHZhbHVlIEFCSSBkb24ndCBhbGlnbnJlZmxlY3Q6IE51bUZpZWxkIG9mIG5vbi1zdHJ1Y3QgdHlwZXJ1bnRpbWU6IFZpcnR1YWxRdWVyeSBmYWlsZWQ7IGVycm5vPXJ1bnRpbWU6IGJhZCBub3RpZnlMaXN0IHNpemUgLSBzeW5jPXJ1bnRpbWU6IGludmFsaWQgcGMtZW5jb2RlZCB0YWJsZSBmPXJ1bnRpbWU6IGludmFsaWQgdHlwZUJpdHNCdWxrQmFycmllcnJ1bnRpbWU6IG1hcmtlZCBmcmVlIG9iamVjdCBpbiBzcGFuIHJ1bnRpbWU6IG1jYWxsIGNhbGxlZCBvbiBtLT5nMCBzdGFja3J1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCB3YWl0bGlua3J1bnRpbWU6IHVuYmxvY2sgb24gY2xvc2luZyBwb2xsZGVzY3J1bnRpbWU6IHdyb25nIGdvcm91dGluZSBpbiBuZXdzdGFja3J5dUZ0b2FGaXhlZDY0IGNhbGxlZCB3aXRoIHByZWMgPiAxOHN0YXJ0bTogUCByZXF1aXJlZCBmb3Igc3Bpbm5pbmc9dHJ1ZXN0cmluZ3MuQnVpbGRlci5Hcm93OiBuZWdhdGl2ZSBjb3VudHN5bnRheCBlcnJvciBzY2FubmluZyBjb21wbGV4IG51bWJlcnVuY2FjaGluZyBzcGFuIGJ1dCBzLmFsbG9jQ291bnQgPT0gMHVzZXIgYXJlbmEgc3BhbiBpcyBvbiB0aGUgd3JvbmcgbGlzdCkgaXMgc21hbGxlciB0aGFuIG1pbmltdW0gcGFnZSBzaXplICgyMjIwNDQ2MDQ5MjUwMzEzMDgwODQ3MjYzMzM2MTgxNjQwNjI1RXJyb3IgY2FsbGluZyBNc2lSZWNvcmRTZXRTdHJpbmdBOiAldl9jZ29fbm90aWZ5X3J1bnRpbWVfaW5pdF9kb25lIG1pc3NpbmdhbGwgZ29yb3V0aW5lcyBhcmUgYXNsZWVwIC0gZGVhZGxvY2shYnl0ZXMuQnVm153:T558,eWFjY2Vzc2VkIGRhdGEgZnJvbSBmcmVlZCB1c2VyIGFyZW5hIGFjY2Vzc2luZyBhIGNvcnJ1cHRlZCBzaGFyZWQgbGlicmFyeWludmFsaWQgYm9vbGVhbiB2YWx1ZSAlcSBmb3IgLSVzOiAldmpzb246IGVuY29kaW5nIGVycm9yIGZvciB0eXBlICVxOiAlcWtleSBzaXplIG5vdCBhIG11bHRpcGxlIG9mIGtleSBhbGlnbmxmc3RhY2sgbm9kZSBhbGxvY2F0ZWQgZnJvbSB0aGUgaGVhcG1ldGhvZCBBQkkgYW5kIHZhbHVlIEFCSSBkb24ndCBhbGlnbnJlZmxlY3Q6IE51bUZpZWxkIG9mIG5vbi1zdHJ1Y3QgdHlwZXJ1bnRpbWU6IFZpcnR1YWxRdWVyeSBmYWlsZWQ7IGVycm5vPXJ1bnRpbWU6IGJhZCBub3RpZnlMaXN0IHNpemUgLSBzeW5jPXJ1bnRpbWU6IGludmFsaWQgcGMtZW5jb2RlZCB0YWJsZSBmPXJ1bnRpbWU6IGludmFsaWQgdHlwZUJpdHNCdWxrQmFycmllcnJ1bnRpbWU6IG1hcmtlZCBmcmVlIG9iamVjdCBpbiBzcGFuIHJ1bnRpbWU6IG1jYWxsIGNhbGxlZCBvbiBtLT5nMCBzdGFja3J1bnRpbWU6IHN1ZG9nIHdpdGggbm9uLW5pbCB3YWl0bGlua3J1bnRpbWU6IHVuYmxvY2sgb24gY2xvc2luZyBwb2xsZGVzY3J1bnRpbWU6IHdyb25nIGdvcm91dGluZSBpbiBuZXdzdGFja3J5dUZ0b2FGaXhlZDY0IGNhbGxlZCB3aXRoIHByZWMgPiAxOHN0YXJ0bTogUCByZXF1aXJlZCBmb3Igc3Bpbm5pbmc9dHJ1ZXN0cmluZ3MuQnVpbGRlci5Hcm93OiBuZWdhdGl2ZSBjb3VudHN5bnRheCBlcnJvciBzY2FubmluZyBjb21wbGV4IG51bWJlcnVuY2FjaGluZyBzcGFuIGJ1dCBzLmFsbG9jQ291bnQgPT0gMHVzZXIgYXJlbmEgc3BhbiBpcyBvbiB0aGUgd3JvbmcgbGlzdCkgaXMgc21hbGxlciB0aGFuIG1pbmltdW0gcGFnZSBzaXplICgyMjIwNDQ2MDQ5MjUwMzEzMDgwODQ3MjYzMzM2MTgxNjQwNjI1RXJyb3IgY2FsbGluZyBNc2lSZWNvcmRTZXRTdHJpbmdBOiAldl9jZ29fbm90aWZ5X3J1bnRpbWVfaW5pdF9kb25lIG1pc3NpbmdhbGwgZ29yb3V0aW5lcyBhcmUgYXNsZWVwIC0gZGVhZGxvY2shYnl0ZXMuQnVmZg==154:T165c,MSwiZnVzaW9uIiwiR0FDIiwwMSwiV2luUlQiLCJOb3RBcHAiLDEzLCJTeXN0ZW0sIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiJVdJTkRJUiVcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtXGU0M2RkOWM3M2FiNTYxNWU0NjFiZjUxMDljM2ZhY2Q2XFN5c3RlbS5uaS5kbGwiLDAzLCJTeXN0ZW0uQ29yZSwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzY0XFN5c3RlbS5Db3JlXDBkNTliMGUyMzdkNzUxOTQxN2RlMTBjZDg0YmRhNGU3XFN5c3RlbS5Db3JlLm5pLmRsbCIsMDMsIk1pY3Jvc29mdC5Qb3dlclNoZWxsLkNvbnNvbGVIb3N0LCBWZXJzaW9uPTMuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBiMzc4ZWMwNyNcYjViYTM3ZTE1NThjZWQxNzhhOTkwMTFhMWQ2NTliNTJcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29uc29sZUhvc3QubmkuZGxsIiwwMywiU3lzdGVtLk1hbmFnZW1lbnQuQXV0b21hdGlvbiwgVmVyc2lvbj0zLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzUiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzY0XFN5c3RlbS5NYW5hYTU3ZmM4Y2MjXDZkYTAxOTEwYzI1NjIzMWQxYzUwYWQwYWFjZWU1OTQxXFN5c3RlbS5NYW5hZ2VtZW50LkF1dG9tYXRpb24ubmkuZGxsIiwwMywiU3lzdGVtLk1hbmFnZW1lbnQsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhIiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxTeXN0ZW0uTWFuYWdlbWVudFxiMjIxYWY4MTI4NWMxMzA1MzI0NjEyZTZkYzljODhmZlxTeXN0ZW0uTWFuYWdlbWVudC5uaS5kbGwiLDAzLCJTeXN0ZW0uRGlyZWN0b3J5U2VydmljZXMsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iMDNmNWY3ZjExZDUwYTNhIiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxTeXN0ZW0uRGlyZWQxM2IxOGE5I1w4YWQ0YzBhZjViM2Q1MWEwZjNhNGRhYzBkNDRkODVkNFxTeXN0ZW0uRGlyZWN0b3J5U2VydmljZXMubmkuZGxsIiwwMywiU3lzdGVtLlhtbCwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzY0XFN5c3RlbS5YbWxcNWVlMzVkZWJmYzIyZjcyN2U3MGU0NDc5ZGRjYmMwNDVcU3lzdGVtLlhtbC5uaS5kbGwiLDAzLCJTeXN0ZW0uTnVtZXJpY3MsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxTeXN0ZW0uTnVtZXJpY3NcODZjZmQ2OWNlMTI2MWJhZjQ3NDBlNzYwNmNhZGUwMTRcU3lzdGVtLk51bWVyaWNzLm5pLmRsbCIsMDMsIlN5c3RlbS5EYXRhLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkRhdGFcN2JlZDQ5YzQ2ZGU5Mjk1YTg0NTNkYjIwNWM2MGEwMjhcU3lzdGVtLkRhdGEubmkuZGxsIiwwMywiTWljcm9zb2Z0LlBvd2VyU2hlbGwuU2VjdXJpdHksIFZlcnNpb249My4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj0zMWJmMzg1NmFkMzY0ZTM1IiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxNaWNyb3NvZnQuUDZmNzkyNjI2I1w3ZmY1MTk5ZTc1N2NiOGFmOWFkOTQ5NDUzZjY5OGQwOVxNaWNyb3NvZnQuUG93ZXJTaGVsbC5TZWN1cml0eS5uaS5kbGwiLDAzLCJTeXN0ZW0uQ29uZmlndXJhdGlvbiwgVmVyc2lvbj00LjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWIwM2Y1ZjdmMTFkNTBhM2EiLCJDOlxXSU5ET1dTXGFzc2VtYmx5XE5hdGl2ZUltYWdlc192NC4wLjMwMzE5XzY0XFN5c3RlbS5Db25maWd1cmF0aW9uXDRiZWIxZWVjYTIwYjI3ZDRiZDFiYjk4ODBmMDNjYzJhXFN5c3RlbS5Db25maWd1cmF0aW9uLm5pLmRsbCIsMDMsIlN5c3RlbS5UcmFuc2FjdGlvbnMsIFZlcnNpb249NC4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5IiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxTeXN0ZW0uVHJhbnNhY3Rpb25zXDYwNDI3MmIwZmFlYzJlMDlkNTNkMzhlMDNiYzg5YzZjXFN5c3RlbS5UcmFuc2FjdGlvbnMubmkuZGxsIiwwMiwiTWljcm9zb2Z0LkFwcFYuQXBwdkNsaWVudENvbUNvbnN1bWVyLCBWZXJzaW9uPTEwLjAuMC4wLCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPTMxYmYzODU2YWQzNjRlMzUiLDAzLCJNaWNyb3NvZnQuUG93ZXJTaGVsbC5Db21tYW5kcy5VdGlsaXR5LCBWZXJzaW9uPTMuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlA1MjEyMjBlYSNcZGY3ZDk0N2E5OWNiY2ZhYTcyNmIxMjc3MjZmMDU0NzZcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29tbWFuZHMuVXRpbGl0eS5uaS5kbGwiLDAzLCJTeXN0ZW0uQ29uZmlndXJhdGlvbi5JbnN0YWxsLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49YjAzZjVmN2YxMWQ1MGEzYSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcU3lzdGVtLkNvbmZlNjRhOTA1MSNcMTIwYTA1MzI1NzdmODcxYzI0MTU1MDJkOWVkYWNkZDZcU3lzdGVtLkNvbmZpZ3VyYXRpb24uSW5zdGFsbC5uaS5kbGwiLDAzLCJNaWNyb3NvZnQuUG93ZXJTaGVsbC5Db21tYW5kcy5NYW5hZ2VtZW50LCBWZXJzaW9uPTMuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LlBhZTM0OThkOSNcZDkyMjQ0NWE4MjhiMzA5MzhjNzJkMzc1YTNiMzRhNjBcTWljcm9zb2Z0LlBvd2VyU2hlbGwuQ29tbWFuZHMuTWFuYWdlbWVudC5uaS5kbGwiLDAzLCJNaWNyb3NvZnQuSUlTLlBvd2Vyc2hlbGwuQ29tbWFuZHMsIFZlcnNpb249MTAuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LkliYWFlNWVkOSNcZTg2ZjdmODM2YTA3ZjY3M2NkZWY0YzlhNGQ0YjRkODBcTWljcm9zb2Z0LklJUy5Qb3dlcnNoZWxsLkNvbW1hbmRzLm5pLmRsbCIsMDMsIk1pY3Jvc29mdC5LZXlEaXN0cmlidXRpb25TZXJ2aWNlLkNtZGxldHMsIFZlcnNpb249MTAuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49MzFiZjM4NTZhZDM2NGUzNSIsIkM6XFdJTkRPV1NcYXNzZW1ibHlcTmF0aXZlSW1hZ2VzX3Y0LjAuMzAzMTlfNjRcTWljcm9zb2Z0LktkNTg4MjBhNSNcMDBmOWU5ZmYzMjFkOGExNDFmM2Q3MTE2M2M3MGM5MDZcTWljcm9zb2Z0LktleURpc3RyaWJ1dGlvblNlcnZpY2UuQ21kbGV0cy5uaS5kbGwiLDAzLCJNaWNyb3NvZnQuTWFuYWdlbWVudC5JbmZyYXN0cnVjdHVyZS5OYXRpdmUsIFZlcnNpb249MS4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj0zMWJmMzg1NmFkMzY0ZTM1IiwiQzpcV0lORE9XU1xhc3NlbWJseVxOYXRpdmVJbWFnZXNfdjQuMC4zMDMxOV82NFxNaWNyb3NvZnQuTTg3MGQ1NThhI1w1ZjY0ODgwYzg2Yzk4ZTdkZGVjZGYyOGU2MTkxNzMwN1xNaWNyb3NvZnQuTWFuYWdlbWVudC5JbmZyYXN0cnVjdHVyZS5OYXRpdmUubmkuZGxsIiww155:T43c, 0 : 47 45 54 20 2F 4D 46 45 77 54 7A 42 4E 4D 45 73 [GET /MFEwTzBNMEs] 10 : 77 53 54 41 4A 42 67 55 72 44 67 4D 43 47 67 55 [wSTAJBgUrDgMCGgU] 20 : 41 42 42 53 64 45 33 67 66 34 31 57 41 69 63 38 [ABBSdE3gf41WAic8] 30 : 55 68 39 6C 46 39 32 25 32 42 49 4A 71 68 35 71 [Uh9lF92%2BIJqh5q] 40 : 77 51 55 4D 75 75 53 6D 76 38 31 6C 6B 67 76 4B [wQUMuuSmv81lkgvK] 50 : 45 42 43 63 43 41 32 6B 56 77 58 68 65 59 43 45 [EBCcCA2kVwXheYCE] 60 : 44 50 58 43 4B 69 52 51 46 4D 5A 34 71 57 37 30 [DPXCKiRQFMZ4qW70] 70 : 7A 6D 35 72 57 34 25 33 44 20 48 54 54 50 2F 31 [zm5rW4%3D HTTP/1] 80 : 2E 31 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B [.1.Connection: K] 90 : 65 65 70 2D 41 6C 69 76 65 0A 41 63 63 65 70 74 [eep-Alive.Accept] A0 : 3A 20 2A 2F 2A 0A 55 73 65 72 2D 41 67 65 6E 74 [: */*.User-Agent] B0 : 3A 20 4D 69 63 72 6F 73 6F 66 74 2D 43 72 79 70 [: Microsoft-Cryp] C0 : 74 6F 41 50 49 2F 31 30 2E 30 0A 48 6F 73 74 3A [toAPI/10.0.Host:] D0 : 20 6F 63 73 70 2E 73 65 63 74 69 67 6F 2E 63 6F [ ocsp.sectigo.co] E0 : 6D 0A [m.] 156:T43c, 0 : 47 45 54 20 2F 4D 46 49 77 55 44 42 4F 4D 45 77 [GET /MFIwUDBOMEw] 10 : 77 53 6A 41 4A 42 67 55 72 44 67 4D 43 47 67 55 [wSjAJBgUrDgMCGgU] 20 : 41 42 42 52 64 30 4A 6F 7A 55 59 58 4D 71 71 57 [ABBRd0JozUYXMqqW] 30 : 34 79 34 7A 4A 54 72 4C 63 4D 43 52 53 6B 41 51 [4y4zJTrLcMCRSkAQ] 40 : 55 67 54 4B 53 51 53 73 6F 7A 55 62 49 78 4B 4C [UgTKSQSsozUbIxKL] 50 : 47 4B 6A 6B 53 37 45 69 70 50 78 51 43 45 51 43 [GKjkS7EipPxQCEQC] 60 : 39 34 78 74 78 46 4F 32 65 7A 36 41 42 44 25 32 [94xtxFO2ez6ABD%2] 70 : 46 4E 39 25 32 42 6C 36 39 20 48 54 54 50 2F 31 [FN9%2Bl69 HTTP/1] 80 : 2E 31 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 4B [.1.Connection: K] 90 : 65 65 70 2D 41 6C 69 76 65 0A 41 63 63 65 70 74 [eep-Alive.Accept] A0 : 3A 20 2A 2F 2A 0A 55 73 65 72 2D 41 67 65 6E 74 [: */*.User-Agent] B0 : 3A 20 4D 69 63 72 6F 73 6F 66 74 2D 43 72 79 70 [: Microsoft-Cryp] C0 : 74 6F 41 50 49 2F 31 30 2E 30 0A 48 6F 73 74 3A [toAPI/10.0.Host:] D0 : 20 6F 63 73 70 2E 73 65 63 74 69 67 6F 2E 63 6F [ ocsp.sectigo.co] E0 : 6D 0A [m.] 1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"job_id":"6ab4a03bf03ed6da920b9aab","environment_id":160,"environment_description":"Windows 10 64 bit","size":4398568,"type":"PE32 executable for MS Windows 6.01 (GUI), Intel i386 (stripped to external PDB), 7 sections","type_short":["peexe","executable"],"type_short_id":"exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"zoom.exe","md5":"9a8d6bf337a6fb060400e596bc616d40","sha1":"f1eeb0fd4d36d7c44a40c341fafdd65020976ab6","sha256":"db56557d0d20550a5b283196f8e4a41a10b931297463dbd3509b90b27408f035","sha512":"1e0a4764f233435dabac026fbdffe08bfd7bcc16c23694eb5ea192df3462214cfcb1ae4683bc116afa0e62cae277114a4d0fc32d1385cff2fbd53030f32ad45f","ssdeep":"49152:rP0dfmVfyr+CU8D1i+7BN53NPyVzc9neiUM1kIq8HQ442lyXp8SnUIA26YuD:rPt6Laeoi+0QFfXp4OiD","imphash":"9cbefe68f395e67356e2a5d8d1b285c0","entrypoint":"0x460300","entrypoint_section":".text","image_base":"0x400000","subsystem":"Windows Gui","image_file_characteristics":["EXECUTABLE_IMAGE","32BIT_MACHINE","DEBUG_STRIPPED"],"dll_characteristics":["DYNAMIC_BASE","NX_COMPAT","TERMINAL_SERVER_AWARE"],"major_os_version":"6","minor_os_version":"1","av_detect":20,"vx_family":"Tool.FleetDeck","url_analysis":false,"analysis_start_time":"2026-09-24T03:59:57+00:00","threat_score":84,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[{"owner":"CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB","issuer":"CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB","serial_number":"48fc93b46055948d36a7c98a89d69416","md5":"2A:A3:20:98:2E:00:19:3F:AD:3B:D0:EA:54:06:E4:CD","sha1":"32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92","valid_from":"2021-05-25T00:00:00+00:00","valid_until":"2028-12-31T23:59:59+00:00"},{"owner":"CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB","issuer":"CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB","serial_number":"33d708a891405319e2a5bbd339b9ad6e","md5":"D3:86:D4:05:6A:49:5D:D6:32:C4:C9:C8:BE:85:74:06","sha1":"01:85:FF:99:61:FF:0A:A2:E4:31:81:79:48:C2:8E:83:D3:F3:EC:70","valid_from":"2021-03-22T00:00:00+00:00","valid_until":"2036-03-21T23:59:59+00:00"},{"owner":"CN=FLEETDECK INC., O=FLEETDECK INC., ST=California, C=US, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US, SERIALNUMBER=4227785","issuer":"CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB","serial_number":"bde31b7114ed9ecfa0010ff37dfa5ebd","md5":"26:CD:01:61:64:79:D6:E4:DF:D6:63:A3:A6:4F:49:00","sha1":"CA:17:2B:AC:E9:7F:7C:97:A6:AE:9E:16:CC:93:60:F5:9E:7B:9C:F4","valid_from":"2024-07-19T00:00:00+00:00","valid_until":"2027-07-19T23:59:59+00:00"}],"is_certificates_valid":null,"certificates_validation_message":null,"domains":["ocsp.sectigo.com"],"compromised_hosts":[],"hosts":[],"total_network_connections":0,"total_processes":7,"total_signatures":285,"extracted_files":[{"name":"deployment.json","file_path":"%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\deployment.json","file_size":69,"md5":"4fe1de82455475e27ab01c4db5b5f481","sha1":"59109ecc52a9fb0cdd7af1a3a39dc0ece81b93cc","sha256":"1d913924d38242a71570b36ad8f6bde5304cefb5a4bb03d4d75521459c562137","sha512":"f0d668ef78adb0f649a1d784e5f12a53f42893dd9c2c4719414f95bf4831001c0de2a4536f8f3e5dd4418377b21143903c5febe88f15fb0d4a92a1c3d02b99fe","type_tags":["json"],"description":"JSON text data","runtime_process":"fleetdeck_agent_svc.exe (PID: 2548)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/6ab4a03bf03ed6da920b9aab/download/dropped-file?key=93922d5d529c7a01eaa259c2162e0ec23d0061ad6004c3b1a740965908540db408acf1e5a8a7c687dcde46e71ecd5420ec98da937190b7f18fc3cdc551c5adb594991b2456f7cc595a3b","submit_link":"/bff/report/6ab4a03bf03ed6da920b9aab/submit/dropped-file?key=93922d5d529c7a01eaa259c2162e0ec23d0061ad6004c3b1a740965908540db408acf1e5a8a7c687dcde46e71ecd5420ec98da937190b7f18fc3cdc551c5adb594991b2456f7cc595a3b","has_overview":false,"extended_details":null},{"name":"4041571202.msi","file_path":"%TEMP%\\4041571202.msi","file_size":2449408,"md5":"64de8b74901084b6c96a4a47fc97d564","sha1":"8012fe251350dbb961070d6e84036b1bca6e13c5","sha256":"0eb3b3136035ed9b30c1071cdbb69db06a871e04feda8a9cfe8e13ee82aa4d4b","sha512":"7512e03df8359c9cfccc096aa77dba17fd453f35c4a8ec2169ccae25c1441622a3f28c707b1f7b22d146ab4b2ece707bf4824656f931568299141085bb3cc1e2","type_tags":["msi","data"],"description":"Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: FleetDeck Agent, Author: FleetDeck Inc, Keywords: Installer, Comments: This installer database contains the logic and data required to install FleetDeck Agent., Template: Intel;1033, Revision Number: {A81C6934-4041-46E1-A95E-99E3002E9BF2}, Create Time/Date: Mon Feb 23 00:39:28 2026, Last Saved Time/Date: Mon Feb 23 00:39:28 2026, Number of Pages: 500, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2","runtime_process":"zoom.exe (PID: 3924)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/6ab4a03bf03ed6da920b9aab/download/dropped-file?key=7d8a9ae53b64d12d109e74bccef932064fa36ff26caae3c4814496c7a7e45a976db4671b05d8b5bf694cf38cbc5bddf4c248c6dd8de6db99a053625f686c75f73d4cb1fd66f8aed399","submit_link":"/bff/report/6ab4a03bf03ed6da920b9aab/submit/dropped-file?key=7d8a9ae53b64d12d109e74bccef932064fa36ff26caae3c4814496c7a7e45a976db4671b05d8b5bf694cf38cbc5bddf4c248c6dd8de6db99a053625f686c75f73d4cb1fd66f8aed399","has_overview":true,"extended_details":null},{"name":"FleetDeck Agent Installer.log","file_path":"%TEMP%\\FleetDeck\\FleetDeck Agent Installer.log","file_size":93,"md5":"da2f26c308d2fb1cf1ede476a6ebcbe6","sha1":"536c6f9d894a75bfc45e4c15ae6b41558fbf0091","sha256":"dded4c63049968775911d6a44b8cc7b6285b6b6cae605d7384130bd8676b241b","sha512":"0c3415d15c846c00337fdbdf1c62c8308ba71c84ba454aa7e0ea616e5b1ab9ee966ab545570799629a82abcdc4df64c33180e7c566c90ae2a454124fa4652a00","type_tags":["text"],"description":"ASCII text","runtime_process":"zoom.exe (PID: 3924)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/6ab4a03bf03ed6da920b9aab/download/dropped-file?key=11ed4e2a987f9ef5e062b069aa50485f3cac2b9c49f0b0b1caec228c74f8954c164370ec527402134172ab88a50828a449afac24814c69e3923e10ad9d81c61d6c5ac98dd3181043e22bc7729bf8093893bfd2616e5fcda5","submit_link":"/bff/report/6ab4a03bf03ed6da920b9aab/submit/dropped-file?key=11ed4e2a987f9ef5e062b069aa50485f3cac2b9c49f0b0b1caec228c74f8954c164370ec527402134172ab88a50828a449afac24814c69e3923e10ad9d81c61d6c5ac98dd3181043e22bc7729bf8093893bfd2616e5fcda5","has_overview":false,"extended_details":null},{"name":"FleetDeck Agent Service.log","file_path":"%TEMP%\\FleetDeck\\FleetDeck Agent Service.log","file_size":626,"md5":"cb36e691dc598552c8730a81e5a62bd0","sha1":"0a4415e31a5eb92ffb62d22c92ae9fce8f75d5ca","sha256":"45ed0698cf05209e6dc2edee6c4bc6211fe5fb8649fd47129b746bb7ca01d40c","sha512":"048d4220707ca53f774f459aa51edee37bf55e876a787a157de0f392544b6bca903afa59792f27fcc2f1f30ea61dd0bce25acfa5ccab0d26cd5508c2db5e9267","type_tags":["text"],"description":"ASCII text","runtime_process":"fleetdeck_agent_svc.exe (PID: 2548)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/6ab4a03bf03ed6da920b9aab/download/dropped-file?key=ed7b7c5553d63c722856bc0736062f6c1f94fb540b547c96b0e5101d825363d29bcd65306d314debac7faec824a857805cdf7c278863a3ec59525b2b71e18eac7cd56c15b8fd0c7150e3a3a3922168bd9643a6d6a17a","submit_link":"/bff/report/6ab4a03bf03ed6da920b9aab/submit/dropped-file?key=ed7b7c5553d63c722856bc0736062f6c1f94fb540b547c96b0e5101d825363d29bcd65306d314debac7faec824a857805cdf7c278863a3ec59525b2b71e18eac7cd56c15b8fd0c7150e3a3a3922168bd9643a6d6a17a","has_overview":false,"extended_details":null},{"name":"powershell.exe.log","file_path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log","file_size":4337,"md5":"966810a007b883a06cf7c343d00d2c8c","sha1":"333377732078395d60503c18f8ce886b82f45af5","sha256":"409e8edab5ebc5c59ede950428d9bb1b14f52f73590bd42112b390941c28bcc4","sha512":"b6eab20dc333b3e6566e6bd04414c8e07719f69a8cf0600472fa43d09d95522a655d35504888eae65b26d7a26a8e7b84345b7b6b2823000321910d6401f2c5b9","type_tags":["text"],"description":"CSV ASCII text","runtime_process":"powershell.exe (PID: 2636)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/6ab4a03bf03ed6da920b9aab/download/dropped-file?key=948d5bee192023710b85d8c3b3009d8e81191814f30ae9bcc9a22a55cc4ab8fbb65f0e7d3408604ce60a4446463d10f924b71424e2558982a73652c1de31e34d5f5789749170d923a48fce90","submit_link":"/bff/report/6ab4a03bf03ed6da920b9aab/submit/dropped-file?key=948d5bee192023710b85d8c3b3009d8e81191814f30ae9bcc9a22a55cc4ab8fbb65f0e7d3408604ce60a4446463d10f924b71424e2558982a73652c1de31e34d5f5789749170d923a48fce90","has_overview":false,"extended_details":null},{"name":"StartupProfileData-NonInteractive","file_path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","file_size":1324,"md5":"9acded47bef1f48de46cbea43f8e5499","sha1":"cdad9a02127d4c12a46dabb25acb12d17817ee90","sha256":"b40beb3a76e2f5a676554bcc60f7456ac88d2a81f0e81fae6c7fcd7d3472a3a0","sha512":"19f055069a7ec32a358b903db7bfd729a0f495669d34fba93945343488d9f341b4a7e2ac678348d9279cdcfa84d046498b186b95962fb9422abb3b115a96bb0f","type_tags":["data"],"description":"data","runtime_process":"powershell.exe (PID: 2636)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/6ab4a03bf03ed6da920b9aab/download/dropped-file?key=db4be46096cb09c26d02c6a82f388d510c81b60e5deba7a96b0dade1845e835b67621c47d874f7cae3edf4de9ffaa600306b378200f938dc13fffd67cf4bff2f6dfdc5302776132a189a66685aa417b87708ec6d07b912d264098a3a","submit_link":"/bff/report/6ab4a03bf03ed6da920b9aab/submit/dropped-file?key=db4be46096cb09c26d02c6a82f388d510c81b60e5deba7a96b0dade1845e835b67621c47d874f7cae3edf4de9ffaa600306b378200f938dc13fffd67cf4bff2f6dfdc5302776132a189a66685aa417b87708ec6d07b912d264098a3a","has_overview":false,"extended_details":null}],"file_metadata":{"file_compositions":[],"imported_objects":[],"file_analysis":[],"total_file_compositions_imports":null},"processes":[{"uid":"00000000-00003924","parentuid":null,"name":"zoom.exe","normalized_path":"C:\\zoom.exe","command_line":null,"sha256":"db56557d0d20550a5b283196f8e4a41a10b931297463dbd3509b90b27408f035","av_label":"Tool.FleetDeck","av_matched":5,"av_total":24,"pid":"3924","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABoElEQVR4XsVXW47DIAzMDfcr27stqXqk/mzb42QzBrNggjEhakcaBSWOPfhB2mk6gO/luRZ0z3VeHuvsNv78rvKdU1AEVQgxF/c6R4h03kMSchsQkjmjNL8yh1+3e1wj/VIA0eH66BeRBtZ2UQSsEOLlu1VYlMsANtb9RXBwrZsLx+h+5lIpRfCrZZPQE9wH3dbX3HHaG1IEBPKzYPB/wxvV0ySdFdwEpcFrQrIR5ZTR2vnrHopgClsZjFmAYaZMqU8WBCnfdgFiLQWA6e4losh0dmfL7q8GG6bTS4nYMf10Q5nT7uCBWkapDFZjPJf3UsjAkZpoZDw1lgYpWo64q7EJ9oVrMXISVgHal02r9VsEUDNVcJoAawkweodLMNqE6UhHNoR/fgw/fxCFo5hvaooz542jGM5NRzGQNoopCw0iuPljJOGdVB5OBhFHPscS3T9I0MgjP0gk/E7sInjnJIYFyefRTu+zCDYeKscu6/4K8EtzQ3UZZJ/aOVNF5gBleecfE0bhsIPoBy17XZDONVJgbdRGIIMRqTxhCpTpkfgD8D3/tXOFeNYAAAAASUVORK5CYII=","process_flags":[{"name":"Extracted Streams","data":null},{"name":"Multiscan Match","data":"5/24"}]},{"uid":"00000000-00003340","parentuid":null,"name":"msiexec.exe","normalized_path":"%WINDIR%\\system32\\msiexec.exe","command_line":"/V","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","av_label":null,"av_matched":null,"av_total":null,"pid":"3340","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABoElEQVR4XsVXW47DIAzMDfcr27stqXqk/mzb42QzBrNggjEhakcaBSWOPfhB2mk6gO/luRZ0z3VeHuvsNv78rvKdU1AEVQgxF/c6R4h03kMSchsQkjmjNL8yh1+3e1wj/VIA0eH66BeRBtZ2UQSsEOLlu1VYlMsANtb9RXBwrZsLx+h+5lIpRfCrZZPQE9wH3dbX3HHaG1IEBPKzYPB/wxvV0ySdFdwEpcFrQrIR5ZTR2vnrHopgClsZjFmAYaZMqU8WBCnfdgFiLQWA6e4losh0dmfL7q8GG6bTS4nYMf10Q5nT7uCBWkapDFZjPJf3UsjAkZpoZDw1lgYpWo64q7EJ9oVrMXISVgHal02r9VsEUDNVcJoAawkweodLMNqE6UhHNoR/fgw/fxCFo5hvaooz542jGM5NRzGQNoopCw0iuPljJOGdVB5OBhFHPscS3T9I0MgjP0gk/E7sInjnJIYFyefRTu+zCDYeKscu6/4K8EtzQ3UZZJ/aOVNF5gBleecfE0bhsIPoBy17XZDONVJgbdRGIIMRqTxhCpTpkfgD8D3/tXOFeNYAAAAASUVORK5CYII=","process_flags":[]},{"uid":"00000000-00002128","parentuid":"00000000-00003340","name":"MsiExec.exe","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","command_line":"-Embedding FA8A56715A6EEDF68978BAF9DDF0BF91","sha256":"8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b01","av_label":null,"av_matched":null,"av_total":null,"pid":"2128","icon":null,"process_flags":[]},{"uid":"00000000-00002548","parentuid":"00000000-00003340","name":"fleetdeck_agent_svc.exe","normalized_path":"%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe","command_line":"-deploymentID 4bfbc645-0cef-4572-939e-9f68af129ffb -askForName=0","sha256":"f7d793f458450f8da205887757af84967848fd42c8be78dfcd00524e6cf2ab65","av_label":null,"av_matched":null,"av_total":null,"pid":"2548","icon":null,"process_flags":[]},{"uid":"00000000-00002636","parentuid":"00000000-00002548","name":"powershell.exe","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","command_line":"%WINDIR%\\Sysnative\\WindowsPowerShell\\v1.0\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program '%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe' -Action Allow\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","av_label":null,"av_matched":null,"av_total":null,"pid":"2636","icon":null,"process_flags":[]},{"uid":"00000000-00004540","parentuid":"00000000-00002548","name":"powershell.exe","normalized_path":"%WINDIR%\\system32\\WindowsPowerShell\\v1.0\\powershell.exe","command_line":"%WINDIR%\\Sysnative\\WindowsPowerShell\\v1.0\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program '%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe' -Action Allow\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","av_label":null,"av_matched":null,"av_total":null,"pid":"4540","icon":null,"process_flags":[]},{"uid":"00000000-00001128","parentuid":"00000000-00003340","name":"MsiExec.exe","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","command_line":"-Embedding C1A5E774EDCB9D20734CA56859DB9F4E E Global\\MSI0000","sha256":"8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b01","av_label":null,"av_matched":null,"av_total":null,"pid":"1128","icon":null,"process_flags":[]}],"mitre_attcks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attck_id":"T1590","attck_id_wiki":"https://attack.mitre.org/techniques/T1590","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to access user sensitive domain"],"parent":null},{"tactic":"Reconnaissance","technique":"Credentials","attck_id":"T1589.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1589/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Attempts to steal credentials via Security Account Manager (SAM) modules"],"parent":{"technique":"Gather Victim Identity Information","attck_id":"T1589","attck_id_wiki":"https://attack.mitre.org/techniques/T1589"}},{"tactic":"Execution","technique":"Native API","attck_id":"T1106","attck_id_wiki":"https://attack.mitre.org/techniques/T1106","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Imports suspicious APIs"],"informative_identifiers_count":15,"informative_identifiers":["Contains ability to execute Windows APIs","Contains ability to load modules (API string)","Contains ability to create/open files (API string)","Contains ability to retrieve address of exported function from a DLL (API string)","Contains ability to retrieve/modify process thread (API string)","Input file contains API references not part of its Import Address Table (IAT)","Contains ability to set/get the last-error code for a calling thread (API string)","Contains ability to create a new process (API string)","Contains ability to retrieve the fully qualified path of module (API string)","Contains ability to execute an application (API string)","Contains ability to find and load resources of specific modules (API string)","Able to execute applications using .NET process API","Calls an API typically used to retrieve function addresses","Calls an API typically used to load a resource in memory","Calls an API typically used to find a resource in a module"],"parent":null},{"tactic":"Execution","technique":"Inter-Process Communication","attck_id":"T1559","attck_id_wiki":"https://attack.mitre.org/techniques/T1559","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to create/connect to a named pipe (API string)","Found named pipe like strings"],"parent":null},{"tactic":"Execution","technique":"Windows Command Shell","attck_id":"T1059.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the command-line string for the current process (API string)"],"parent":{"technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059"}},{"tactic":"Execution","technique":"Windows Management Instrumentation","attck_id":"T1047","attck_id_wiki":"https://attack.mitre.org/techniques/T1047","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to execute a WMI query"],"parent":null},{"tactic":"Execution","technique":"Service Execution","attck_id":"T1569.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1569/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to open a service (API string)","Contains reference to multiple windows system processes"],"parent":{"technique":"System Services","attck_id":"T1569","attck_id_wiki":"https://attack.mitre.org/techniques/T1569"}},{"tactic":"Execution","technique":"PowerShell","attck_id":"T1059.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1059/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Command line contains PowerShell","Able to build PowerShell events through modules contained in the .NET code","Executes PowerShell with command line"],"parent":{"technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059"}},{"tactic":"Execution","technique":"Scheduled Task/Job","attck_id":"T1053","attck_id_wiki":"https://attack.mitre.org/techniques/T1053","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Execution","technique":"Shared Modules","attck_id":"T1129","attck_id_wiki":"https://attack.mitre.org/techniques/T1129","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":6,"informative_identifiers":["Loads modules at runtime","Calls an API typically used to load libraries","Fails to load modules at runtime","Loads the RPC (Remote Procedure Call) module DLL","Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","Loads the .NET runtime environment"],"parent":null},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Persistence","technique":"Socket Filters","attck_id":"T1205.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1205/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to monitor socket connection"],"parent":{"technique":"Traffic Signaling","attck_id":"T1205","attck_id_wiki":"https://attack.mitre.org/techniques/T1205"}},{"tactic":"Persistence","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies Software Policy Settings"],"informative_identifiers_count":6,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Able to delete registry key/value (API string)","Contains ability to modify registry key/value (API string)","Able to create/load registry keys (API string)","Accesses System Certificates Settings","Writes registry keys"],"parent":null},{"tactic":"Persistence","technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"],"parent":null},{"tactic":"Persistence","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":7,"informative_identifiers":["Contains ability to create/control drivers (API string)","Contains ability to modify system service (API string)","Contains ability to start a service (API string)","Able to unregister service from Service Control Manager","Contains ability to create/modify Windows services (Powershell command string)","Contains ability to access device drivers","Creates/modifies Windows services using PowerShell"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Persistence","technique":"Scheduled Task/Job","attck_id":"T1053","attck_id_wiki":"https://attack.mitre.org/techniques/T1053","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":1,"malicious_identifiers":["Writes data to a remote process"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to inject code into another process (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to modify thread functionality – possible hijack (API string)","Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attck_id":"T1134.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to obtains specified information about the security of a file or directory (API string)","Contains ability to impersonate access tokens (API string)"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":7,"informative_identifiers":["Contains ability to create/control drivers (API string)","Contains ability to modify system service (API string)","Contains ability to start a service (API string)","Able to unregister service from Service Control Manager","Contains ability to create/modify Windows services (Powershell command string)","Contains ability to access device drivers","Creates/modifies Windows services using PowerShell"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attck_id":"T1134.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create process with token (API string)"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to modify access token privileges (API string)","Calls an API typically used to enable or disable privileges in the specified access token"],"parent":null},{"tactic":"Privilege Escalation","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Privilege Escalation","technique":"Scheduled Task/Job","attck_id":"T1053","attck_id_wiki":"https://attack.mitre.org/techniques/T1053","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attck_id":"T1068","attck_id_wiki":"https://attack.mitre.org/techniques/T1068","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Opens the Kernel Security Device Driver (KsecDD) of Windows"],"parent":null},{"tactic":"Privilege Escalation","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Defense Evasion","technique":"Time Based Checks","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":1,"malicious_identifiers":["Writes data to a remote process"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to inject code into another process (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to modify thread functionality – possible hijack (API string)","Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to register a top-level exception handler (API string)","Contains ability to check debugger is running (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Socket Filters","attck_id":"T1205.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1205/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to monitor socket connection"],"parent":{"technique":"Traffic Signaling","attck_id":"T1205","attck_id_wiki":"https://attack.mitre.org/techniques/T1205"}},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":4,"suspicious_identifiers":["Timestamp in PE header is very old or in the future"],"informative_identifiers_count":9,"informative_identifiers":["Contains CRYPTO related strings","Contains ability to perform AES/RC4 encryption (API string)","Contains ability to use Cryptographic classes","Loads the Bcrypt module DLL","Calls an API typically used to convert data from string to binary","Sample file has high entropy (likely encrypted/compressed content)","YARA signature match – Encryption algorithm","YARA signature match - AES encryption","Shows ability to obfuscate file or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found virtual disk drive like strings"],"parent":null},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attck_id":"T1134.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to obtains specified information about the security of a file or directory (API string)","Contains ability to impersonate access tokens (API string)"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies Software Policy Settings"],"informative_identifiers_count":6,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Able to delete registry key/value (API string)","Contains ability to modify registry key/value (API string)","Able to create/load registry keys (API string)","Accesses System Certificates Settings","Writes registry keys"],"parent":null},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1070.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Opens file with deletion access rights","Marks file for deletion"],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to delete files/directories (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Timestomp","attck_id":"T1070.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to set file time (API string)","Contains ability to retrieve file time (API string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to identify virtual environment by using user activity (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"System Checks","attck_id":"T1497.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Queries process mitigation policy via NtQueryInformationProcess"],"informative_identifiers_count":2,"informative_identifiers":["Contains a Wine emulator-related string","Able to identify virtual environment by using API string"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attck_id":"T1222","attck_id_wiki":"https://attack.mitre.org/techniques/T1222","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify file attributes (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Create Process with Token","attck_id":"T1134.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1134/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create process with token (API string)"],"parent":{"technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134"}},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to modify access token privileges (API string)","Calls an API typically used to enable or disable privileges in the specified access token"],"parent":null},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attck_id":"T1562.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to modify process attributes (API string)","Contains strings related to AMSI (Anti Malware Scan Interface)","Contains ability to disable Windows Defender using PowerShell","Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","Loads the AMSI (Antimalware Scan Interface) DLL"],"parent":{"technique":"Impair Defenses","attck_id":"T1562","attck_id_wiki":"https://attack.mitre.org/techniques/T1562"}},{"tactic":"Defense Evasion","technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify file system redirection (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Hidden Window","attck_id":"T1564.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to show a graphical window (API string)","Contains ability to pass information to a window procedure (API string)"],"parent":{"technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564"}},{"tactic":"Defense Evasion","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Software Packing","attck_id":"T1027.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":3,"suspicious_identifiers":["PE file has unusual entropy resources"],"informative_identifiers_count":1,"informative_identifiers":["Matched Compiler/Packer signature"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attck_id":"T1140","attck_id_wiki":"https://attack.mitre.org/techniques/T1140","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to perform decryption (API string)","Able to decrypt/decode data","Shows ability to deobfuscate/decode files or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attck_id":"T1562.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1562/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Modifies process error mode to suppress error dialogs"],"parent":{"technique":"Impair Defenses","attck_id":"T1562","attck_id_wiki":"https://attack.mitre.org/techniques/T1562"}},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Attempts to call APIs commonly associated with anti-analysis and evasion techniques","Observed a high volume of repeated registry API calls (API Hammering)","Triggers a burst of requests to the same API (API Hammering)","The input sample contains the RDTSCP instruction"],"parent":null},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attck_id":"T1480.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1480/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates mutants"],"parent":{"technique":"Execution Guardrails","attck_id":"T1480","attck_id_wiki":"https://attack.mitre.org/techniques/T1480"}},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attck_id":"T1620","attck_id_wiki":"https://attack.mitre.org/techniques/T1620","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Loads the CLR Loader DLL"],"parent":null},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attck_id":"T1036.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1036/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates file(s) in System32 or SysWOW64 directory"],"parent":{"technique":"Masquerading","attck_id":"T1036","attck_id_wiki":"https://attack.mitre.org/techniques/T1036"}},{"tactic":"Defense Evasion","technique":"Msiexec","attck_id":"T1218.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1218/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Detected msiexec.exe process execution"],"parent":{"technique":"System Binary Proxy Execution","attck_id":"T1218","attck_id_wiki":"https://attack.mitre.org/techniques/T1218"}},{"tactic":"Defense Evasion","technique":"Code Signing","attck_id":"T1553.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["The input sample is signed with a certificate"],"parent":{"technique":"Subvert Trust Controls","attck_id":"T1553","attck_id_wiki":"https://attack.mitre.org/techniques/T1553"}},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attck_id":"T1027.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to dynamically determine API calls","Able to read the PEB (Process Environment Block) structure"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attck_id":"T1027.009","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/009","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Section contains high entropy"],"informative_identifiers_count":1,"informative_identifiers":["YARA signature match – Embedded PE executable"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attck_id":"T1027.016","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/016","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attck_id":"T1027.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["XOR operations in executable file detected"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attck_id":"T1027.013","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/013","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["YARA signature match – Anomalous PE file structure"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attck_id":"T1480","attck_id_wiki":"https://attack.mitre.org/techniques/T1480","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to use execution guardrails"],"parent":null},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attck_id":"T1555","attck_id_wiki":"https://attack.mitre.org/techniques/T1555","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains string like password/secret"],"parent":null},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attck_id":"T1558","attck_id_wiki":"https://attack.mitre.org/techniques/T1558","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to access credential file using Kerberos"],"parent":null},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attck_id":"T1539","attck_id_wiki":"https://attack.mitre.org/techniques/T1539","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Credential Access","technique":"OS Credential Dumping","attck_id":"T1003","attck_id_wiki":"https://attack.mitre.org/techniques/T1003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"],"parent":null},{"tactic":"Credential Access","technique":"Credential API Hooking","attck_id":"T1056.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Hooks API calls"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Discovery","technique":"Time Based Checks","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/techniques/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":14,"informative_identifiers":["Contains ability to retrieve file and directory information (API string)","Able to rename or move file/directory (API string)","Contains ability to enumerate files on disk (API string)","Contains ability to read files (API string)","Contains ability to retrieve path in which Windows is installed (API string)","References Windows file paths for DLLs (possible dropped files)","Tries to access non-existent files (executable)","Touches files","Tries to access non-existent files (non-executable)","Reads files","Calls an API typically used for searching a directory for files","Touches files in program files directory","Touches files in the Windows directory","Tries to access Powershell profile file"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/techniques/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":11,"informative_identifiers":["Contains ability to enumerate process and/or its information (API string)","Contains ability to determine if process is running under WOW64 (API string)","Able to retrieve/open a process (API string)","Able to enumerate system processes using native API","Calls an API typically used for taking snapshot of the specified processes","Calls an API typically used to determine if process is running under WOW64","Queries process information","Queries basic information of the specified process","Spawns new processes that are not known child processes","Process launched with changed environment","Spawns new processes"],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/techniques/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":22,"informative_identifiers":["Able to retrieve information about the current system (API string)","Contains ability to retrieve the OS information (API string)","Able to retrieve geographical location information","Found system command-related strings","Contains ability to retrieve the NetBIOS name of the local computer (API string)","Able to discover operating system information (API string)","Contains ability to retrieve the host's architecture (API string)","Contains ability to retrieve the specified system metric or system configuration setting (API string)","Contains ability to retrieve a module handle (API string)","Able to gather system information (.NET)","Calls an API typically used to get system version information","Calls an API typically used to get product type","Calls an API typically used to retrieve information about the current system","Attempts to call APIs to gather system and hardware detail","Queries volume information","Reads the active computer name","Contains ability to read software policies","Reads information about supported languages","Queries volatile registry keys","Calls an API typically used to retrieve OS information","Calls an API typically used to retrieve computer name","Reads the cryptographic machine GUID"],"parent":null},{"tactic":"Discovery","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to register a top-level exception handler (API string)","Contains ability to check debugger is running (API string)"],"parent":null},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attck_id":"T1016","attck_id_wiki":"https://attack.mitre.org/techniques/T1016","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to retrieve the local name for a socket (API string)","Contains ability to query network adapter information (API string)","Contains ability to free the memory used by network management functions (API string)","Able to determine NetBIOS or DNS name associated with the local computer"],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/techniques/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Queries sensitive IE security settings"],"informative_identifiers_count":6,"informative_identifiers":["Able to query registry keys (API string)","Contains registry location strings","Found registry location strings in memory","Opens registry keys","Queries registry keys","Reads Windows Trust Settings"],"parent":null},{"tactic":"Discovery","technique":"System Owner/User Discovery","attck_id":"T1033","attck_id_wiki":"https://attack.mitre.org/techniques/T1033","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Able to retrieve usernames and/or user information (API string)","Able to query security token membership for user discovery (API string)","Calls an API typically used to retrieve account information for specified SID","Calls an API typically used to retrieve user name"],"parent":null},{"tactic":"Discovery","technique":"Local Account","attck_id":"T1087.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1087/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve information about user accounts on a server (API string)"],"parent":{"technique":"Account Discovery","attck_id":"T1087","attck_id_wiki":"https://attack.mitre.org/techniques/T1087"}},{"tactic":"Discovery","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to identify virtual environment by using user activity (API string)"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Checks","attck_id":"T1497.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Queries process mitigation policy via NtQueryInformationProcess"],"informative_identifiers_count":2,"informative_identifiers":["Contains a Wine emulator-related string","Able to identify virtual environment by using API string"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"Account Discovery","attck_id":"T1087","attck_id_wiki":"https://attack.mitre.org/techniques/T1087","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve SID for the specified name (API string)"],"parent":null},{"tactic":"Discovery","technique":"Domain Groups","attck_id":"T1069.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1069/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Able to enumerate permission groups in the domain","References Windows LDAP client module","Loads Windows LDAP client module"],"parent":{"technique":"Permission Groups Discovery","attck_id":"T1069","attck_id_wiki":"https://attack.mitre.org/techniques/T1069"}},{"tactic":"Discovery","technique":"System Time Discovery","attck_id":"T1124","attck_id_wiki":"https://attack.mitre.org/techniques/T1124","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve machine timezone (API string)"],"parent":null},{"tactic":"Discovery","technique":"System Service Discovery","attck_id":"T1007","attck_id_wiki":"https://attack.mitre.org/techniques/T1007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Able to enumerate service (API string)","Able to query service configuration on system (API string)","Queries services related registry keys"],"parent":null},{"tactic":"Discovery","technique":"Application Window Discovery","attck_id":"T1010","attck_id_wiki":"https://attack.mitre.org/techniques/T1010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to retrieve open application windows (API string)","Scanning for window names","Calls an API typically used to get active windows title","Calls an API typically used to enumerate active windows"],"parent":null},{"tactic":"Discovery","technique":"Cloud Groups","attck_id":"T1069.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1069/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["May be able to execute Exchange Online Remote PowerShell Modulee"],"parent":{"technique":"Permission Groups Discovery","attck_id":"T1069","attck_id_wiki":"https://attack.mitre.org/techniques/T1069"}},{"tactic":"Discovery","technique":"Remote System Discovery","attck_id":"T1018","attck_id_wiki":"https://attack.mitre.org/techniques/T1018","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to identify remote systems"],"parent":null},{"tactic":"Discovery","technique":"System Language Discovery","attck_id":"T1614.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Attempts to retrieve the system language code"],"informative_identifiers_count":1,"informative_identifiers":["Reads the windows installation language"],"parent":{"technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614"}},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Attempts to call APIs commonly associated with anti-analysis and evasion techniques","Observed a high volume of repeated registry API calls (API Hammering)","Triggers a burst of requests to the same API (API Hammering)","The input sample contains the RDTSCP instruction"],"parent":null},{"tactic":"Discovery","technique":"Local Storage Discovery","attck_id":"T1680","attck_id_wiki":"https://attack.mitre.org/techniques/T1680","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Calls an API typically used to enumerate Windows drive types"],"parent":null},{"tactic":"Discovery","technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Calls an API typically used to retrieve local language"],"parent":null},{"tactic":"Discovery","technique":"Software Discovery","attck_id":"T1518","attck_id_wiki":"https://attack.mitre.org/techniques/T1518","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Reads the registry for installed applications"],"parent":null},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attck_id":"T1120","attck_id_wiki":"https://attack.mitre.org/techniques/T1120","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attck_id":"T1570","attck_id_wiki":"https://attack.mitre.org/techniques/T1570","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to move file or directory (API string)","Identified known pipe name","Calls an API typically used to create an instance of a named pipe"],"parent":null},{"tactic":"Collection","technique":"Local Data Staging","attck_id":"T1074.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to create directories (API string)","Calls an API typically used to create a directory","Writes log files"],"parent":{"technique":"Data Staged","attck_id":"T1074","attck_id_wiki":"https://attack.mitre.org/techniques/T1074"}},{"tactic":"Collection","technique":"Data from Information Repositories","attck_id":"T1213","attck_id_wiki":"https://attack.mitre.org/techniques/T1213","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains SQL queries","Able to perform SQL operations"],"parent":null},{"tactic":"Collection","technique":"Screen Capture","attck_id":"T1113","attck_id_wiki":"https://attack.mitre.org/techniques/T1113","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to capture screen (API string)"],"parent":null},{"tactic":"Collection","technique":"Email Collection","attck_id":"T1114","attck_id_wiki":"https://attack.mitre.org/techniques/T1114","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found E-Mail address in binary/memory"],"parent":null},{"tactic":"Collection","technique":"Archive via Library","attck_id":"T1560.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1560/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to compress/decompress content at runtime"],"parent":{"technique":"Archive Collected Data","attck_id":"T1560","attck_id_wiki":"https://attack.mitre.org/techniques/T1560"}},{"tactic":"Collection","technique":"Data from Local System","attck_id":"T1005","attck_id_wiki":"https://attack.mitre.org/techniques/T1005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Writes files in a temp directory"],"parent":null},{"tactic":"Collection","technique":"Credential API Hooking","attck_id":"T1056.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1056/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Hooks API calls"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Input Capture","attck_id":"T1056","attck_id_wiki":"https://attack.mitre.org/techniques/T1056"}},{"tactic":"Collection","technique":"Automated Collection","attck_id":"T1119","attck_id_wiki":"https://attack.mitre.org/techniques/T1119","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to send encrypted data to the internet"],"parent":null},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attck_id":"T1105","attck_id_wiki":"https://attack.mitre.org/techniques/T1105","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to write files (API string)","Drops document files inside temp directory","Dropped files"],"parent":null},{"tactic":"Command and Control","technique":"Socket Filters","attck_id":"T1205.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1205/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to monitor socket connection"],"parent":{"technique":"Traffic Signaling","attck_id":"T1205","attck_id_wiki":"https://attack.mitre.org/techniques/T1205"}},{"tactic":"Command and Control","technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":6,"informative_identifiers":["Found potential URL in binary/memory","Contains ability to communicate with network (API string)","Contains references to network communication API (string)","Found potential IP address in binary/memory","Found potential URLs in memory dumps","Contacts domains"],"parent":null},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attck_id":"T1095","attck_id_wiki":"https://attack.mitre.org/techniques/T1095","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to communicate with C2 using Sockets (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Non-Standard Port","attck_id":"T1571","attck_id_wiki":"https://attack.mitre.org/techniques/T1571","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to open a port and listen for incoming connection (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to use Microsoft's Enhanced Cryptographic Provider"],"parent":null},{"tactic":"Command and Control","technique":"Data Encoding","attck_id":"T1132","attck_id_wiki":"https://attack.mitre.org/techniques/T1132","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to perform Base64 encoding/decoding","HTTP requests contain Base64 strings","HTTP requests contain custom Base62 strings"],"parent":null},{"tactic":"Command and Control","technique":"Proxy","attck_id":"T1090","attck_id_wiki":"https://attack.mitre.org/techniques/T1090","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains references to RPC protocol sequence strings"],"parent":null},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attck_id":"T1573.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform encryption/decryption using RSA algorithm"],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Command and Control","technique":"Internal Proxy","attck_id":"T1090.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1090/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies proxy settings"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Proxy","attck_id":"T1090","attck_id_wiki":"https://attack.mitre.org/techniques/T1090"}},{"tactic":"Command and Control","technique":"Web Protocols","attck_id":"T1071.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["GETs files from a web server (HTTPS)","Communicates with HTTP web server (GET/POST requests)","GETs files from a web server (PE files)"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"DNS","attck_id":"T1071.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries DNS server"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Remote Access Tools","attck_id":"T1219","attck_id_wiki":"https://attack.mitre.org/techniques/T1219","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["YARA signature match - RMM tools"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attck_id":"T1573.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to use encryption for command and control traffic"],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Impact","technique":"Service Stop","attck_id":"T1489","attck_id_wiki":"https://attack.mitre.org/techniques/T1489","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to terminate a process (API string)","Contains ability to close a handle to a service (API string)"],"parent":null},{"tactic":"Impact","technique":"System Shutdown/Reboot","attck_id":"T1529","attck_id_wiki":"https://attack.mitre.org/techniques/T1529","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to shutdown system"],"parent":null},{"tactic":"Impact","technique":"Data Encrypted for Impact","attck_id":"T1486","attck_id_wiki":"https://attack.mitre.org/techniques/T1486","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains reference to crypto DLLs","Contains reference to cryptographic keys","Able to import cryptographic keys (seen in ransomware)","Contains ability to perform encryption (API string)","Able to access crypto-related API (String)"],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-942","type":2,"relevance":1,"name":"Able to build PowerShell events through modules contained in the .NET code","description":"$27","description_v2":["Found string \":\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll\" (Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000000.228765.6D640000.00000004.mdmp, 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6D6FA000.00000004.mdmp, 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp\")","Found string \":\\WINDOWS\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\System.Management.Automation.ni.dll\" (Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000000.228765.6D640000.00000004.mdmp, 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6D6FA000.00000004.mdmp, 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp\")","Found string \"3,\"System.Management.Automation","Version=3.0.0.0","Culture=neutral","PublicKeyToken=31bf3856ad364e35\",\"C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\System.Management.Automation.ni.dll\",0\" (Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")","Found string \"System.Management.Automation.dll\" (Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")","Found string \"System.Management.Automation.resources\" (Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll\" (Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000000.228765.6D640000.00000004.mdmp, 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6D6FA000.00000004.mdmp, 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\System.Management.Automation.ni.dll\" (Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000000.228765.6D640000.00000004.mdmp, 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6D6FA000.00000004.mdmp, 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"3,\"System.Management.Automation"},{"type":"linebreak"},{"type":"text","value":"Version=3.0.0.0"},{"type":"linebreak"},{"type":"text","value":"Culture=neutral"},{"type":"linebreak"},{"type":"text","value":"PublicKeyToken=31bf3856ad364e35\",\"C:\\WINDOWS\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\System.Management.Automation.ni.dll\",0\" (Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Management.Automation.dll\" (Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"System.Management.Automation.resources\" (Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-935","type":2,"relevance":1,"name":"Able to compress/decompress content at runtime","description":"Found string \"system.io.compression\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp, 00000000-00002636.00000001.229385.B57F0000.00000004.mdmp\")\n Found string \"compressionmode\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")\n Found string \"decompressionmethods\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")\n Found string \"compressionlevel\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")\n Found string \"compressionstrategy\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")\n Found string \"compressionmethod\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")\n Found string \"compressiontracingswitchlevel\" (Source: \"00000000-00002636.00000001.229385.B57F0000.00000004.mdmp\")\n Found string \"compressiontracingswitch\" (Source: \"00000000-00002636.00000001.229385.B57F0000.00000004.mdmp\")","description_v2":["Found string \"system.io.compression\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp, 00000000-00002636.00000001.229385.B57F0000.00000004.mdmp\")","Found string \"compressionmode\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")","Found string \"decompressionmethods\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")","Found string \"compressionlevel\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")","Found string \"compressionstrategy\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")","Found string \"compressionmethod\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")","Found string \"compressiontracingswitchlevel\" (Source: \"00000000-00002636.00000001.229385.B57F0000.00000004.mdmp\")","Found string \"compressiontracingswitch\" (Source: \"00000000-00002636.00000001.229385.B57F0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"system.io.compression\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp, 00000000-00002636.00000001.229385.B57F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"compressionmode\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"decompressionmethods\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"compressionlevel\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"compressionstrategy\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"compressionmethod\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"compressiontracingswitchlevel\" (Source: \"00000000-00002636.00000001.229385.B57F0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"compressiontracingswitch\" (Source: \"00000000-00002636.00000001.229385.B57F0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1560.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1560/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-981","type":2,"relevance":1,"name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1069.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1069/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-92","type":2,"relevance":1,"name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"zoom.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"zoom.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"zoom.exe\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","description_v2":["Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"zoom.exe\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"zoom.exe\")","Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"zoom.exe\")","Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-309","type":2,"relevance":3,"name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"zoom.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"zoom.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"zoom.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"zoom.exe\")","description_v2":["Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"zoom.exe\")","Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"zoom.exe\")","Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"zoom.exe\")","Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"OpenThread\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"OpenThread\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1055.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-690","type":2,"relevance":1,"name":"Able to unregister service from Service Control Manager","description":"file/memory contains long string(File: \"zoom.exe\")","description_v2":["file/memory contains long string(File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string(File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-140","type":6,"relevance":3,"name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00002636)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00002636)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00002636)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00002636)","description_v2":["\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00002636)","\"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00002636)","\"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00002636)","\"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00002636)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00002636)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-139","type":6,"relevance":3,"name":"Calls an API typically used to load a resource in memory","description":"\"zoom.exe\" called \"LoadResource with parameter {'hModule': '79495170', 'hResInfo': '226362896'}\" (UID: 00000000-00003924)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '3085621460993', 'hResInfo': '3085621462240'}\" (UID: 00000000-00002636)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '3085621460993', 'hResInfo': '3085621462272'}\" (UID: 00000000-00002636)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '3085621460993', 'hResInfo': '3085621462288'}\" (UID: 00000000-00002636)","description_v2":["\"zoom.exe\" called \"LoadResource with parameter {'hModule': '79495170', 'hResInfo': '226362896'}\" (UID: 00000000-00003924)","\"powershell.exe\" called \"LoadResource with parameter {'hModule': '3085621460993', 'hResInfo': '3085621462240'}\" (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadResource with parameter {'hModule': '3085621460993', 'hResInfo': '3085621462272'}\" (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadResource with parameter {'hModule': '3085621460993', 'hResInfo': '3085621462288'}\" (UID: 00000000-00002636)"],"description_v3":[{"type":"text","value":"\"zoom.exe\" called \"LoadResource with parameter {'hModule': '79495170', 'hResInfo': '226362896'}\" (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '3085621460993', 'hResInfo': '3085621462240'}\" (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '3085621460993', 'hResInfo': '3085621462272'}\" (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '3085621460993', 'hResInfo': '3085621462288'}\" (UID: 00000000-00002636)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-226","type":2,"relevance":1,"name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","description_v2":["Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"zoom.exe\")","Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"zoom.exe\")","Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"WaitForSingleObject\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"NtWaitForSingleObject\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")","Found reference to API \"eCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")","Found reference to API \"GetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard TimePacific SA Standard TimeQueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"QueryPerformanceFrequency\"; File: \"zoom.exe\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"zoom.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"WaitForSingleObject\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"NtWaitForSingleObject\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"eCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard TimePacific SA Standard TimeQueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"QueryPerformanceFrequency\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-306","type":2,"relevance":1,"name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"zoom.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"zoom.exe\")","Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1134.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1134/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-318","type":2,"relevance":1,"name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"FreeLibrary\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")\n Found reference to API \"runtime.getLoadLibraryEx\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")\n Found reference to API \"runtime.getLoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"zoom.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","description_v2":["Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"FreeLibrary\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")","Found reference to API \"runtime.getLoadLibraryEx\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")","Found reference to API \"runtime.getLoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"zoom.exe\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"FreeLibrary\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"runtime.getLoadLibraryEx\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"runtime.getLoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-304","type":2,"relevance":1,"name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"zoom.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"zoom.exe\")","Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-192","type":2,"relevance":1,"name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"zoom.exe\")","description_v2":["Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-544","type":2,"relevance":1,"name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"zoom.exe\")","description_v2":["Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1569.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1569/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-320","type":2,"relevance":1,"name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")","description_v2":["Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-338","type":2,"relevance":1,"name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1132","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1132","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-409","type":2,"relevance":1,"name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"zoom.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"zoom.exe\")","Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-138","type":2,"relevance":2,"name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00002636-00000BC0-2560357319\")","description_v2":["Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00002636-00000BC0-2560357319\")"],"description_v3":[{"type":"text","value":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00002636-00000BC0-2560357319\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-231","type":2,"relevance":1,"name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002636.00000000.228765.6D640000.00000004.mdmp\n 00000000-00002636.00000001.229385.6D640000.00000004.mdmp","description_v2":["Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002636.00000000.228765.6D640000.00000004.mdmp","00000000-00002636.00000001.229385.6D640000.00000004.mdmp"],"description_v3":[{"type":"text","value":"Observed string: %WINDIR%\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002636.00000000.228765.6D640000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002636.00000001.229385.6D640000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1562.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"target-152","type":9,"relevance":2,"name":"Detected msiexec.exe process execution","description":"Process \"MsiExec.exe\" with commandline \"-Embedding FA8A56715A6EEDF68978BAF9DDF0BF91\" (UID: 00000000-00002128)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding C1A5E774EDCB9D20734CA56859DB9F4E E Global\\\\MSI0000\" (UID: 00000000-00001128)\n","description_v2":["Process \"MsiExec.exe\" with commandline \"-Embedding FA8A56715A6EEDF68978BAF9DDF0BF91\" (UID: 00000000-00002128)","","Process \"MsiExec.exe\" with commandline \"-Embedding C1A5E774EDCB9D20734CA56859DB9F4E E Global\\\\MSI0000\" (UID: 00000000-00001128)",""],"description_v3":[{"type":"text","value":"Process \"MsiExec.exe\" with commandline \"-Embedding FA8A56715A6EEDF68978BAF9DDF0BF91\""},{"type":"process","process_uid":"00000000-00002128","label":"Show Process"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"Process \"MsiExec.exe\" with commandline \"-Embedding C1A5E774EDCB9D20734CA56859DB9F4E E Global\\\\MSI0000\""},{"type":"process","process_uid":"00000000-00001128","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1218.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1218/007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-145","type":2,"relevance":1,"name":"Found virtual disk drive like strings","description":"$29","description_v2":["$2a","$2b","Found string - \\\\.\\ROOT\\standardcimv2:MSFT_NetFirewallRule.CreationClassName=\"MSFT|FW|FirewallRule|FleetDeck Agent Service\"","PolicyRuleName=\"\"","SystemCreationClassName=\"\"","SystemName=\"\"; Source: \"00000000-00002636.00000001.229385.6DD14000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"$2c"},{"type":"linebreak"},{"type":"text","value":"$2d"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\ROOT\\standardcimv2:MSFT_NetFirewallRule.CreationClassName=\"MSFT|FW|FirewallRule|FleetDeck Agent Service\""},{"type":"linebreak"},{"type":"text","value":"PolicyRuleName=\"\""},{"type":"linebreak"},{"type":"text","value":"SystemCreationClassName=\"\""},{"type":"linebreak"},{"type":"text","value":"SystemName=\"\"; Source: \"00000000-00002636.00000001.229385.6DD14000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-38","type":6,"relevance":10,"name":"Modifies process error mode to suppress error dialogs","description":"\"zoom.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"zoom.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"msiexec.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","description_v2":["\"zoom.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","\"zoom.exe\" set its error mode to SEM_FAILCRITICALERRORS","\"msiexec.exe\" set its error mode to SEM_NOOPENFILEERRORBOX"],"description_v3":[{"type":"text","value":"\"zoom.exe\" set its error mode to SEM_NOOPENFILEERRORBOX"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" set its error mode to SEM_FAILCRITICALERRORS"},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" set its error mode to SEM_NOOPENFILEERRORBOX"}],"origin":"API Call","attck_id":"T1562.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1562/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"registry-215","type":3,"relevance":7,"name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2e","description_v2":["\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\CERTIFICATES\\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB\")","\"powershell.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\")","\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\CRLS\")","\"powershell.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\CRLS\")","\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\CTLS\")","\"powershell.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\CTLS\")","\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\")","\"powershell.exe\" (Access type: \"QUERY\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\")","\"powershell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\\")","\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\")","\"powershell.exe\" (Access type: \"QUERY\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\")","\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CRLS\")","\"powershell.exe\" (Access type: \"QUERY\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CRLS\")","\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CTLS\")","\"powershell.exe\" (Access type: \"QUERY\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CTLS\")","\"powershell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\PHYSICALSTORES\")"],"description_v3":[{"type":"text","value":"\"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\CERTIFICATES\\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"QUERY\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\FLIGHTROOT\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"QUERY\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"QUERY\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"QUERY\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CRLS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"QUERY\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CTLS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\PHYSICALSTORES\")"}],"origin":"Registry Access","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-9","type":6,"relevance":4,"name":"Queries process information","description":"$2f","description_v2":["\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2553767126 [PID: 3924]","\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2553775778 [PID: 3924]","\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2553946496 [PID: 3924]","\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2553955036 [PID: 3924]","\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554062520 [PID: 3924]","\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554071476 [PID: 3924]","\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554240930 [PID: 3924]","\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554249664 [PID: 3924]","\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554473407 [PID: 3924]","\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554482037 [PID: 3924]","\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554660067 [PID: 3924]","\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554669149 [PID: 3924]","\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2555080808 [PID: 3924]","\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2555089523 [PID: 3924]","\"msiexec.exe\" queried SystemProcessInformation at 00000000-00003340-00000C15-2557590410 [PID: 3340]","\"msiexec.exe\" queried SystemProcessInformation at 00000000-00003340-00000C15-2557599223 [PID: 3340]","\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2558843393 [PID: 2548]","\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2558852504 [PID: 2548]","\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2559008943 [PID: 2548]","\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2559018533 [PID: 2548]","\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2559274424 [PID: 2548]","\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2559284776 [PID: 2548]","\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2559496217 [PID: 2548]","\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2559505154 [PID: 2548]","\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2574383358 [PID: 2548]"],"description_v3":[{"type":"text","value":"\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2553767126 [PID: 3924]"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2553775778 [PID: 3924]"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2553946496 [PID: 3924]"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2553955036 [PID: 3924]"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554062520 [PID: 3924]"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554071476 [PID: 3924]"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554240930 [PID: 3924]"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554249664 [PID: 3924]"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554473407 [PID: 3924]"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554482037 [PID: 3924]"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554660067 [PID: 3924]"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2554669149 [PID: 3924]"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2555080808 [PID: 3924]"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" queried SystemProcessInformation at 00000000-00003924-00000C15-2555089523 [PID: 3924]"},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" queried SystemProcessInformation at 00000000-00003340-00000C15-2557590410 [PID: 3340]"},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" queried SystemProcessInformation at 00000000-00003340-00000C15-2557599223 [PID: 3340]"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2558843393 [PID: 2548]"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2558852504 [PID: 2548]"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2559008943 [PID: 2548]"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2559018533 [PID: 2548]"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2559274424 [PID: 2548]"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2559284776 [PID: 2548]"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2559496217 [PID: 2548]"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2559505154 [PID: 2548]"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" queried SystemProcessInformation at 00000000-00002548-00000C15-2574383358 [PID: 2548]"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-289","type":6,"relevance":5,"name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call","description_v2":["\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call"],"description_v3":[{"type":"text","value":"\"powershell.exe\" obfuscates its traffic by mimicking legitimate API call"}],"origin":"API Call","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-183","type":2,"relevance":1,"name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard TimePacific SA Standard TimeQueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"zoom.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"zoom.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"zoom.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"zoom.exe\")","description_v2":["Found reference to API \"GetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard TimePacific SA Standard TimeQueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"zoom.exe\")","Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"zoom.exe\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"zoom.exe\")","Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard TimePacific SA Standard TimeQueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-148","type":2,"relevance":1,"name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"zoom.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"zoom.exe\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"zoom.exe\")","description_v2":["Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"zoom.exe\")","Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"zoom.exe\")","Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-920","type":2,"relevance":1,"name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","description_v2":["Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-356","type":2,"relevance":1,"name":"Able to decrypt/decode data","description":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002636.00000001.229385.B57B0000.00000004.mdmp\")","description_v2":["Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002636.00000001.229385.B57B0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"tripledescryptoserviceprovider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002636.00000001.229385.B57B0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-603","type":2,"relevance":1,"name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","description_v2":["Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-602","type":2,"relevance":1,"name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$30","description_v2":["Found api reference \"n (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWMsiViewModifyOld_HungarianRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWUsage of %s:VirtualUnlockWriteConsoleWadvapi32.dll\" (Indicator: \"CertOpenStore\"; File: \"zoom.exe\")","$31","$32","$33","$34","$35","Found api reference \"5386962890625Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeLogical_Order_ExceptionLord Howe Standard TimeMB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointQyzylorda Standard TimeRtlGetNtVersionNumbers\" (Indicator: \"CertGetCertificateChain\"; File: \"zoom.exe\")","Found api reference \"lock: lock countslice bounds out of rangesocket type not supportedstartm: p has runnable gsstoplockedm: not runnableunexpected fault address unexpected key value type using unaddressable value1455191522836685180664062572759576141834259033203125: day-of-year out of rangeBougainville Standard TimeCentral Asia Standard TimeCertFreeCertificateContextE. Australia Standard TimeEkaterinburg Standard TimeError creating tmpFile: %vGetFileInformationByHandleLine Islands Standard TimeNewfoundland Standard TimePostQueuedCompletionStatusQueryPerformanceFrequency\" (Indicator: \"CertFreeCertificateContext\"; File: \"zoom.exe\")","Found api reference \"CertEnumCertificatesInStoreEaster Island Standard TimeG waiting list is corruptedaddress not a stack addressafter object key:value pairchannel number out of rangecommunication error on sendcould not find QPC syscallsfailed to set sweep barrierflag needs an argument: -%sgcstopm: not waiting for gcgrowslice: len out of rangeinternal lockOSThread errorinvalid boolean flag %s: %vinvalid profile bucket typekey was rejected by servicemakechan: size out of rangemakeslice: cap out of rangemakeslice: len out of rangemspan.sweep: bad span statenot a XENIX named type fileprogToPointerMask: overflowreflect.Value.UnsafePointerrunlock of unlocked rwmutexruntime: asyncPreemptStack=runtime: checkdead: find g runtime: checkdead: nmidle=runtime: corrupted polldescruntime: netpollinit failedruntime: thread ID overflowruntime\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"zoom.exe\")","$36","$37","$38","$39","00000000-00002548.00000001.230295.035E0000.00000004.mdmp\"), Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp\"), Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\"), Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\"), Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\"), Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found api reference \"n (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWMsiViewModifyOld_HungarianRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWUsage of %s:VirtualUnlockWriteConsoleWadvapi32.dll\" (Indicator: \"CertOpenStore\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"$3a"},{"type":"linebreak"},{"type":"text","value":"$3b"},{"type":"linebreak"},{"type":"text","value":"$3c"},{"type":"linebreak"},{"type":"text","value":"$3d"},{"type":"linebreak"},{"type":"text","value":"$3e"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"5386962890625Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeGreenland Standard TimeGreenwich Standard TimeLogical_Order_ExceptionLord Howe Standard TimeMB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointQyzylorda Standard TimeRtlGetNtVersionNumbers\" (Indicator: \"CertGetCertificateChain\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"lock: lock countslice bounds out of rangesocket type not supportedstartm: p has runnable gsstoplockedm: not runnableunexpected fault address unexpected key value type using unaddressable value1455191522836685180664062572759576141834259033203125: day-of-year out of rangeBougainville Standard TimeCentral Asia Standard TimeCertFreeCertificateContextE. Australia Standard TimeEkaterinburg Standard TimeError creating tmpFile: %vGetFileInformationByHandleLine Islands Standard TimeNewfoundland Standard TimePostQueuedCompletionStatusQueryPerformanceFrequency\" (Indicator: \"CertFreeCertificateContext\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found api reference \"CertEnumCertificatesInStoreEaster Island Standard TimeG waiting list is corruptedaddress not a stack addressafter object key:value pairchannel number out of rangecommunication error on sendcould not find QPC syscallsfailed to set sweep barrierflag needs an argument: -%sgcstopm: not waiting for gcgrowslice: len out of rangeinternal lockOSThread errorinvalid boolean flag %s: %vinvalid profile bucket typekey was rejected by servicemakechan: size out of rangemakeslice: cap out of rangemakeslice: len out of rangemspan.sweep: bad span statenot a XENIX named type fileprogToPointerMask: overflowreflect.Value.UnsafePointerrunlock of unlocked rwmutexruntime: asyncPreemptStack=runtime: checkdead: find g runtime: checkdead: nmidle=runtime: corrupted polldescruntime: netpollinit failedruntime: thread ID overflowruntime\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"$3f"},{"type":"linebreak"},{"type":"text","value":"$40"},{"type":"linebreak"},{"type":"text","value":"$41"},{"type":"linebreak"},{"type":"text","value":"$42"},{"type":"linebreak"},{"type":"text","value":"00000000-00002548.00000001.230295.035E0000.00000004.mdmp\"), Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp\"), Found api reference \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\"), Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\"), Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\"), Found api reference \"CryptExportKey\" (Indicator: \"CryptExportKey\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"api-229","type":6,"relevance":3,"name":"Calls an API typically used to convert data from string to binary","description":"$43","description_v2":["\"powershell.exe\" called \"CryptStringToBinaryW\" with parameters {\"pszString\": \"MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR\"","\"cchString\": \"9410\"","\"dwFlags\": \"1\"","$44","\"pcbBinary\": \"bb1a0000\"","\"pdwFlags\": \"01000000\"}"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"CryptStringToBinaryW\" with parameters {\"pszString\": \"MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR\""},{"type":"linebreak"},{"type":"text","value":"\"cchString\": \"9410\""},{"type":"linebreak"},{"type":"text","value":"\"dwFlags\": \"1\""},{"type":"linebreak"},{"type":"text","value":"$45"},{"type":"linebreak"},{"type":"text","value":"\"pcbBinary\": \"bb1a0000\""},{"type":"linebreak"},{"type":"text","value":"\"pdwFlags\": \"01000000\"}"}],"origin":"API Call","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-438","type":2,"relevance":3,"name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-212","type":2,"relevance":1,"name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","description_v2":["Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-108","type":2,"relevance":1,"name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","description_v2":["Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-352","type":2,"relevance":1,"name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002636.00000001.229385.B57B0000.00000004.mdmp\")","description_v2":["Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002636.00000001.229385.B57B0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"rsacryptoserviceprovider\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00002636.00000001.229385.B57B0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1573.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-493","type":2,"relevance":1,"name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")","description_v2":["Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")","Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string %WINDIR%\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-280","type":2,"relevance":1,"name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp, 00000000-00002636.00000001.229385.6D6AB000.00000004.mdmp\")","description_v2":["Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp, 00000000-00002636.00000001.229385.6D6AB000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp, 00000000-00002636.00000001.229385.6D6AB000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"network-60","type":7,"relevance":1,"name":"HTTP requests contain Base64 strings","description":"$46","description_v2":["Contains base64 string in header \"Keep\" in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\"","Contains base64 string in header \"User\" in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\"","Contains base64 string in header \"CryptoAPI/10\" in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\"","Contains base64 string in header \"ocsp\" in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\"","Contains base64 string in header \"2FN9\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\"","Contains base64 string in header \"Keep\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\"","Contains base64 string in header \"User\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\"","Contains base64 string in header \"CryptoAPI/10\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\"","Contains base64 string in header \"ocsp\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""],"description_v3":[{"type":"text","value":"Contains base64 string in header \"Keep\" in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"User\" in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"CryptoAPI/10\" in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"ocsp\" in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"2FN9\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"Keep\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"User\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"CryptoAPI/10\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""},{"type":"linebreak"},{"type":"text","value":"Contains base64 string in header \"ocsp\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""}],"origin":"Network Traffic","attck_id":"T1132","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1132","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"binary-71","type":8,"relevance":1,"name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.44159","description_v2":["Sample file \"sample.bin\" has high entropy 7.44159"],"description_v3":[{"type":"text","value":"Sample file \"sample.bin\" has high entropy 7.44159"}],"origin":"Binary File","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-32","type":15,"relevance":1,"name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","description_v2":["The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","Matched sigs: HTTP requests contain Base64 strings","Matched sigs: YARA signature match - AES encryption"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: HTTP requests contain Base64 strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - AES encryption"}],"origin":"Indicator Combinations","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-28","type":15,"relevance":1,"name":"Shows ability to obfuscate file or information","description":"$47","description_v2":["The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings","Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider","Matched sigs: Contains ability to perform AES/RC4 encryption (API string)","Matched sigs: Contains ability to perform Base64 encoding/decoding","Matched sigs: Contains ability to use Cryptographic classes","Matched sigs: References bcrypt module and functions (used for encryption/decryption)","Matched sigs: Contains reference to crypto DLLs","Matched sigs: Contains reference to cryptographic keys","Matched sigs: Contains ability to perform decryption (API string)","Matched sigs: Able to import cryptographic keys (seen in ransomware)","Matched sigs: Contains ability to perform encryption (API string)","Matched sigs: Able to access crypto-related API (String)","Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm","Matched sigs: Able to decrypt/decode data","Matched sigs: Calls an API typically used to import cryptographic keys into a CSP","Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP","Matched sigs: Reads the cryptographic machine GUID","Matched sigs: HTTP requests contain Base64 strings","Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","Matched sigs: YARA signature match – Encryption algorithm","Matched sigs: YARA signature match - AES encryption"],"description_v3":[{"type":"text","value":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform AES/RC4 encryption (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform Base64 encoding/decoding"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Cryptographic classes"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: References bcrypt module and functions (used for encryption/decryption)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains reference to crypto DLLs"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains reference to cryptographic keys"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform decryption (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to import cryptographic keys (seen in ransomware)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform encryption (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to access crypto-related API (String)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to decrypt/decode data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to import cryptographic keys into a CSP"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Reads the cryptographic machine GUID"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: HTTP requests contain Base64 strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Sample file has high entropy (likely encrypted/compressed content)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match – Encryption algorithm"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - AES encryption"}],"origin":"Indicator Combinations","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-31","type":15,"relevance":1,"name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","description_v2":["The analysis shows use of encryption","use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption"},{"type":"linebreak"},{"type":"text","value":"use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption"}],"origin":"Indicator Combinations","attck_id":"T1573.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"binary-92","type":8,"relevance":0,"name":"XOR operations in executable file detected","description":"$48","description_v2":["Found XOR loop in file \"sample.bin\" at offset 1041180; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 1475597; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 1483653; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 1504618; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 1968392; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 2016831; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 2150144; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 2223049; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 2352544; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 2444329; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 2468879; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 2844772; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 2878601; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 2909783; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 2913627; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 2924295; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 2945589; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 3061135; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 3119563; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 3361682; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 3376379; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 3381006; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 3542369; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 3576313; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 3699323; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 3755372; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 3766914; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4148071; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4148903; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4171803; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4204830; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4274105; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4278711; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4286477; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4299851; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4300181; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4300573; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4301935; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4303405; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4303917; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4304563; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4304925; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4305535; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4307033; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4308243; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4312705; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4313139; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4313753; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4329205; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 4362238; code bytes = 30d0","Found XOR loop in file \"sample.bin\" at offset 446769; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 1933227; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 1934208; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2226302; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2297766; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2324646; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2335517; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2370195; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2396655; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2402496; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2546648; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2595791; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2696982; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2801449; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2822928; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2833014; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2847727; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2878283; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2892388; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 2936223; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3001766; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3075175; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3090064; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3155758; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3166032; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3186813; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3282026; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3448043; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3463417; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3518322; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3597636; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3615194; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3680178; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3758174; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3821218; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3824098; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 3917007; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 4006775; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 4158642; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 4275217; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 4296583; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 4298475; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 4320140; code bytes = 33c1","Found XOR loop in file \"sample.bin\" at offset 1381503; code bytes = 30040e","Found XOR loop in file \"sample.bin\" at offset 3534857; code bytes = 30040e","Found XOR loop in file \"sample.bin\" at offset 686850; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 686878; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 687007; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 687120; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 926432; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 1128566; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 1128584; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 1164872; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 1877008; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 1946392; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 1975005; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 1993625; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2177564; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2223468; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2229603; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2263672; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2290320; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2362419; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2463139; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2483286; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2532307; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2534768; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2617917; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2628497; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2716181; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2716778; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2818307; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2879860; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2907845; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 2985286; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 3058315; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 3061134; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 3103633; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 3174236; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 3236237; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 3305120; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 3328620; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 3448978; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 3604019; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 3706452; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 3750477; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 3919737; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 3927718; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4143528; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4145850; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4148884; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4152901; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4154955; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4248698; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4251444; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4289550; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4299812; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4300920; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4303404; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4304548; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4306018; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4308218; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4313736; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4390407; code bytes = 8030","Found XOR loop in file \"sample.bin\" at offset 4393173; code bytes = 8030"],"description_v3":[{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1041180; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1475597; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1483653; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1504618; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1968392; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2016831; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2150144; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2223049; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2352544; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2444329; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2468879; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2844772; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2878601; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2909783; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2913627; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2924295; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2945589; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3061135; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3119563; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3361682; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3376379; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3381006; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3542369; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3576313; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3699323; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3755372; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3766914; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4148071; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4148903; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4171803; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4204830; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4274105; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4278711; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4286477; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4299851; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4300181; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4300573; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4301935; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4303405; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4303917; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4304563; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4304925; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4305535; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4307033; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4308243; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4312705; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4313139; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4313753; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4329205; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4362238; code bytes = 30d0"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 446769; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1933227; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1934208; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2226302; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2297766; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2324646; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2335517; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2370195; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2396655; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2402496; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2546648; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2595791; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2696982; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2801449; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2822928; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2833014; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2847727; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2878283; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2892388; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2936223; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3001766; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3075175; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3090064; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3155758; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3166032; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3186813; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3282026; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3448043; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3463417; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3518322; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3597636; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3615194; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3680178; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3758174; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3821218; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3824098; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3917007; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4006775; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4158642; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4275217; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4296583; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4298475; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4320140; code bytes = 33c1"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1381503; code bytes = 30040e"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3534857; code bytes = 30040e"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 686850; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 686878; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 687007; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 687120; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 926432; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1128566; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1128584; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1164872; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1877008; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1946392; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1975005; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 1993625; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2177564; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2223468; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2229603; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2263672; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2290320; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2362419; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2463139; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2483286; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2532307; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2534768; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2617917; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2628497; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2716181; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2716778; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2818307; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2879860; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2907845; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 2985286; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3058315; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3061134; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3103633; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3174236; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3236237; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3305120; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3328620; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3448978; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3604019; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3706452; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3750477; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3919737; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 3927718; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4143528; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4145850; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4148884; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4152901; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4154955; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4248698; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4251444; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4289550; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4299812; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4300920; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4303404; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4304548; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4306018; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4308218; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4313736; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4390407; code bytes = 8030"},{"type":"linebreak"},{"type":"text","value":"Found XOR loop in file \"sample.bin\" at offset 4393173; code bytes = 8030"}],"origin":"Binary File","attck_id":"T1027.005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-761","type":2,"relevance":1,"name":"Able to access user sensitive domain","description":"Found string \"dep\tgithub.com/miekg/dns\tv1.1.43\th1:JKfpVSCB84vrAmHzyrsxB5NAr5kLoMXZArPSw7Qlgyg=\" (Indicator: \"github.com\"; Source: \"00000000-00002548.00000000.228697.013AF000.00000004.mdmp, 00000000-00002548.00000001.230295.013AF000.00000004.mdmp\")","description_v2":["Found string \"dep\tgithub.com/miekg/dns\tv1.1.43\th1:JKfpVSCB84vrAmHzyrsxB5NAr5kLoMXZArPSw7Qlgyg=\" (Indicator: \"github.com\"; Source: \"00000000-00002548.00000000.228697.013AF000.00000004.mdmp, 00000000-00002548.00000001.230295.013AF000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"dep\tgithub.com/miekg/dns\tv1.1.43\th1:JKfpVSCB84vrAmHzyrsxB5NAr5kLoMXZArPSw7Qlgyg=\" (Indicator: \"github.com\"; Source: \"00000000-00002548.00000000.228697.013AF000.00000004.mdmp, 00000000-00002548.00000001.230295.013AF000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1590","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1590","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-907","type":2,"relevance":1,"name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002636-00000C2C-2560720997\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002636-00000C2C-2560965974\")","description_v2":["Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002636-00000C2C-2560720997\")","Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002636-00000C2C-2560965974\")"],"description_v3":[{"type":"text","value":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002636-00000C2C-2560720997\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002636-00000C2C-2560965974\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-937","type":2,"relevance":1,"name":"Able to gather system information (.NET)","description":"Found string \"etUserNameExW\" (Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")\n Found string \"etUserNameExA\" (Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")\n Found string \"etUserNameExA\" (Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp, 00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")\n Found string \"etUserNameA\" (Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","description_v2":["Found string \"etUserNameExW\" (Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")","Found string \"etUserNameExA\" (Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")","Found string \"etUserNameExA\" (Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp, 00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","Found string \"etUserNameExW\" (Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","Found string \"etUserNameA\" (Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"etUserNameExW\" (Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"etUserNameExA\" (Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"etUserNameExA\" (Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp, 00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"etUserNameExW\" (Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"etUserNameA\" (Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-659","type":2,"relevance":1,"name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002636-00000C2C-2560720997\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002636-00000C2C-2560965974\")","description_v2":["Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002636-00000C2C-2560720997\")","Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002636-00000C2C-2560965974\")"],"description_v3":[{"type":"text","value":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002636-00000C2C-2560720997\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002636-00000C2C-2560965974\")"}],"origin":"File/Memory","attck_id":"T1497.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-661","type":2,"relevance":1,"name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")","Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")","Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")","Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1497.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-908","type":2,"relevance":1,"name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002636-00000C2C-2560229782\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002636-00000C2C-2560229964\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002636-00000C2C-2561611038\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002636-00000C2C-2561611071\")","description_v2":["Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002636-00000C2C-2560229782\")","Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002636-00000C2C-2560229964\")","Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002636-00000C2C-2561611038\")","Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002636-00000C2C-2561611071\")"],"description_v3":[{"type":"text","value":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002636-00000C2C-2560229782\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002636-00000C2C-2560229964\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002636-00000C2C-2561611038\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002636-00000C2C-2561611071\")"}],"origin":"File/Memory","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-910","type":2,"relevance":1,"name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceConfig2W\" (File: \"zoom.exe\")","description_v2":["Found string \"QueryServiceConfig2W\" (File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"Found string \"QueryServiceConfig2W\" (File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-739","type":2,"relevance":1,"name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-89","type":2,"relevance":1,"name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"zoom.exe\"\n Found system information discovery API: \"GetSystemInfo\" in file \"zoom.exe\"\n Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"zoom.exe\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"zoom.exe\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"zoom.exe\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\"","description_v2":["Found system information discovery API: \"GetEnvironmentStringsW\" in file \"zoom.exe\"","Found system information discovery API: \"GetSystemInfo\" in file \"zoom.exe\"","Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"zoom.exe\"","Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"zoom.exe\"","Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"zoom.exe\"","Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\""],"description_v3":[{"type":"text","value":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetSystemInfo\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\""}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-721","type":2,"relevance":1,"name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; File: \"zoom.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"zoom.exe\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"zoom.exe\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00002636-00000C2C-2560924965\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")","description_v2":["Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; File: \"zoom.exe\")","Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"zoom.exe\")","Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"zoom.exe\")","Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00002636-00000C2C-2560924965\")","Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00002636-00000C2C-2560924965\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-296","type":6,"relevance":3,"name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"zoom.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003924)\n \"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002636)","description_v2":["\"zoom.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003924)","\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002636)"],"description_v3":[{"type":"text","value":"\"zoom.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002636)"}],"origin":"API Call","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-294","type":6,"relevance":3,"name":"Attempts to call APIs to gather system and hardware detail","description":"\"zoom.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003924)\n \"zoom.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00003924)\n \"fleetdeck_agent_svc.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002548)\n \"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002636)\n \"powershell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002636)","description_v2":["\"zoom.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003924)","\"zoom.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00003924)","\"fleetdeck_agent_svc.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002548)","\"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002636)","\"powershell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002636)"],"description_v3":[{"type":"text","value":"\"zoom.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00002636)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-297","type":6,"relevance":3,"name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"zoom.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003924)","description_v2":["\"zoom.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003924)"],"description_v3":[{"type":"text","value":"\"zoom.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003924)"}],"origin":"API Call","attck_id":"T1003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-146","type":6,"relevance":3,"name":"Calls an API typically used to determine if process is running under WOW64","description":"\"zoom.exe\" called \"IsWow64Process\" with parameter \"3924\" - (UID: 00000000-00003924)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"2636\" - (UID: 00000000-00002636)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"4540\" - (UID: 00000000-00004540)","description_v2":["\"zoom.exe\" called \"IsWow64Process\" with parameter \"3924\" - (UID: 00000000-00003924)","\"powershell.exe\" called \"IsWow64Process\" with parameter \"2636\" - (UID: 00000000-00002636)","\"powershell.exe\" called \"IsWow64Process\" with parameter \"4540\" - (UID: 00000000-00004540)"],"description_v3":[{"type":"text","value":"\"zoom.exe\" called \"IsWow64Process\" with parameter \"3924\" - (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"2636\" - (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"4540\" - (UID: 00000000-00004540)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-152","type":6,"relevance":3,"name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002636)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004540)","description_v2":["\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002636)","\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004540)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004540)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-151","type":6,"relevance":3,"name":"Calls an API typically used to get active windows title","description":"\"zoom.exe\" called \"GetWindowTextW\" (UID: 00000000-00003924)\n \"zoom.exe\" called \"GetWindowTextW\" with parameter \"Preparing to install...\" - (UID: 00000000-00003924)\n \"zoom.exe\" called \"GetWindowTextW\" with parameter \"Please wait while Windows configures FleetDeck Agent\" - (UID: 00000000-00003924)\n \"zoom.exe\" called \"GetWindowTextW\" with parameter \"Gathering required information...\" - (UID: 00000000-00003924)","description_v2":["\"zoom.exe\" called \"GetWindowTextW\" (UID: 00000000-00003924)","\"zoom.exe\" called \"GetWindowTextW\" with parameter \"Preparing to install...\" - (UID: 00000000-00003924)","\"zoom.exe\" called \"GetWindowTextW\" with parameter \"Please wait while Windows configures FleetDeck Agent\" - (UID: 00000000-00003924)","\"zoom.exe\" called \"GetWindowTextW\" with parameter \"Gathering required information...\" - (UID: 00000000-00003924)"],"description_v3":[{"type":"text","value":"\"zoom.exe\" called \"GetWindowTextW\" (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetWindowTextW\" with parameter \"Preparing to install...\" - (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetWindowTextW\" with parameter \"Please wait while Windows configures FleetDeck Agent\" - (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetWindowTextW\" with parameter \"Gathering required information...\" - (UID: 00000000-00003924)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-124","type":6,"relevance":3,"name":"Calls an API typically used to get product type","description":"\"zoom.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003924)\n \"fleetdeck_agent_svc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002548)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002636)","description_v2":["\"zoom.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003924)","\"fleetdeck_agent_svc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002548)","\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002636)"],"description_v3":[{"type":"text","value":"\"zoom.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002636)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-125","type":6,"relevance":3,"name":"Calls an API typically used to get system version information","description":"$49","description_v2":["\"zoom.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120000009e290a7738d9cc020000000028000000240000000000cb02f8f0b3000000000000000000000000000000000000000000d007b5023000000000000000120000000000b50200000000dcdb00000000000000000000b0d5cc02f0b0cb021200000000000000200000000000b502d001b5023c0cb50200000000380cb50200000000f0f0b30050f5097738d9cc0258f1b300a4f1b300 (UID: 00000000-00003924)","\"zoom.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003924)","\"zoom.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003924)","\"zoom.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000e02cdd7544f4b300226e3f750000f104000000002d6e3f75d94951e02d000000ecb7d375c8f4b300b1ce9800c801cd02c820cc020d0000008000000008f4b3000000b5028cf4b30070c8407565cca795feffffff2d000000d0cce275270000005cf4b300856a41751c2346759cf4b300f85f417508000000bb694075b2694075014951e02d000000ecb7d37527000000d0cce27570f4b3002d000000d0cce27527000000a0f4b300856a41751c234675e8f4b3007e8ae175ee8ce175738ae175e870b8ea2d000000ecb7d37527000000d0cce275b413f1044813f104e870b8eab0f4b300fc521f769cf5b300e084e1753875169cfeffffff738ae175 (UID: 00000000-00003924)","\"zoom.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000001777000000000000000050dbcd025cdbcd02e0f4b3003ec70a7750dbcd02000000001c030d778a020b771e00000080f4b3000000000018f5b300c2020b7774dbcd025cf5b30000000000e9020b770000000000000000bd054073c802000000000000bd054073000000002e00cd02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004cf5b300c2a26d2228f5b300cd010b7750dbcd02 (UID: 00000000-00003924)","\"zoom.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000100000000000ff07000000000000702cce02ff0700000000000000000100feffffff00000000888acb02000000000000000600000000115c000000000000888acb027f0700007f070000115c00007f07000000000000000000007cf4b300506a0d77eea2cb55feffffff18f4b300b7160a77e8020000f00200000c04cb0204f4b3008020d40d0000cb0200000000f002000000000000000000005e000000030000000000cb02e802000008001000000000003cf4b300ee130a7740000000ee130a7708001000000000000000000008000000000000008cf4b300a40c9e740000cb0208001000b50c9e748e84c6e08020d40d0a0000000100000000000000 (UID: 00000000-00003924)","\"fleetdeck_agent_svc.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000005e030900000068a95f030f00000088025e03800000000000000000000000000000000000000000000000b8025e03010000002200000001000000000000000000000000000000000000000000000006000000000000000f0000009e290a7722005f03000000000f000000f8eb5e030000010106000000f8eb5e030000000070a95f0322000022e03c5e03000075000000000020a95f030000000098925f030f0000000f000000000000010f00000060025e0360025e03040000010000000020000000f8f1af00506a0d77dcb3e0d6feffffff50f0af000dfa09770000000070a95f03d8ba5f03b0f0af00fcf0af00 (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"RtlGetVersion\" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002548)","\"powershell.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002636)","\"powershell.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002636)","\"powershell.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000e0acca43fb7f0000000000000000000051edf345fb7f000000000000ce0200000000000000000000aec814ad9a6e00002a00000000000000d0dc646dce0200008fecf345fb7f0000e0acca43fb7f0000e0acca43fb7f0000000000000000000000000000fb7f0000ffffff7fd0d9000000000000000000000000000000000000d8cebe43fb7f00002a0000000000000069c37743fb7f00003100000000000000d003000000000000d403000000000000110001100000000090d21f96d100000003a36443fb7f000090d21f96d100000000000000000000002b00000000000000000000000000000020b07d43fb7f0000b43f7c43fb7f0000e0cebe43 (UID: 00000000-00002636)","\"powershell.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000696bce0200000b8ef145fb7f00000000696bce0200000200000000000000380000000000000040000000000000003003696bce02000088e0ec96d100000001000000000000000300000000000000010000000000000016000000000000004011276bce02000000000000000000000000276bce020000382ac46dce020000000000000000000078000000010000000000000000000000800000000000000004000000000000000000000000000000a849c46dce02000004000000000000003800000000000000f0986343fb7f00003800000000000000380000000000000000e2ec96d1000000c00c6b0efb7f000000000000 (UID: 00000000-00002636)","\"powershell.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0fd2dfb7f0000070000000000000000000000000000000100000000000000f0df696bce0200000000000000000000d079b46dce0200004c986343fb7f0000e0b0b46dce020000b3ce610efb7f00005080b46dce020000004ffd2dfb7f0000d0b0fd2dfb7f0000000000000000000000000000000000005080b46dce020000f0df696bce0200006095b46dce02000058e2ec96d10000004c986343fb7f0000010000000000000058e2ec96d10000006095b46dce0200005080b46dce020000010000000000000002bc610efb7f00004081b46dce02000080c0b26dce020000feffffff040000007df0fc2dfb7f0000e092b46d (UID: 00000000-00002636)","\"powershell.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000f0df696bce0200000000000000000000d079b46dce0200004c986343fb7f000060adb46dce020000b3ce610efb7f0000f07fb46dce020000384ffd2dfb7f0000d0b0fd2dfb7f000000000000000000000000000000000000f07fb46dce020000f0df696bce0200006095b46dce02000050e2ec96d10000004c986343fb7f0000010000000000000050e2ec96d10000006095b46dce020000f07fb46dce020000010000000000000002bc610efb7f0000000000000000000080c0b26dce0200004081b46d04000000fefffffffffffffff0df696bce0200007df0fc2dfb7f000000000000 (UID: 00000000-00002636)"],"description_v3":[{"type":"text","value":"\"zoom.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120000009e290a7738d9cc020000000028000000240000000000cb02f8f0b3000000000000000000000000000000000000000000d007b5023000000000000000120000000000b50200000000dcdb00000000000000000000b0d5cc02f0b0cb021200000000000000200000000000b502d001b5023c0cb50200000000380cb50200000000f0f0b30050f5097738d9cc0258f1b300a4f1b300 (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000e02cdd7544f4b300226e3f750000f104000000002d6e3f75d94951e02d000000ecb7d375c8f4b300b1ce9800c801cd02c820cc020d0000008000000008f4b3000000b5028cf4b30070c8407565cca795feffffff2d000000d0cce275270000005cf4b300856a41751c2346759cf4b300f85f417508000000bb694075b2694075014951e02d000000ecb7d37527000000d0cce27570f4b3002d000000d0cce27527000000a0f4b300856a41751c234675e8f4b3007e8ae175ee8ce175738ae175e870b8ea2d000000ecb7d37527000000d0cce275b413f1044813f104e870b8eab0f4b300fc521f769cf5b300e084e1753875169cfeffffff738ae175 (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000001777000000000000000050dbcd025cdbcd02e0f4b3003ec70a7750dbcd02000000001c030d778a020b771e00000080f4b3000000000018f5b300c2020b7774dbcd025cf5b30000000000e9020b770000000000000000bd054073c802000000000000bd054073000000002e00cd02000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004cf5b300c2a26d2228f5b300cd010b7750dbcd02 (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f0000020000000000100000000000ff07000000000000702cce02ff0700000000000000000100feffffff00000000888acb02000000000000000600000000115c000000000000888acb027f0700007f070000115c00007f07000000000000000000007cf4b300506a0d77eea2cb55feffffff18f4b300b7160a77e8020000f00200000c04cb0204f4b3008020d40d0000cb0200000000f002000000000000000000005e000000030000000000cb02e802000008001000000000003cf4b300ee130a7740000000ee130a7708001000000000000000000008000000000000008cf4b300a40c9e740000cb0208001000b50c9e748e84c6e08020d40d0a0000000100000000000000 (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000005e030900000068a95f030f00000088025e03800000000000000000000000000000000000000000000000b8025e03010000002200000001000000000000000000000000000000000000000000000006000000000000000f0000009e290a7722005f03000000000f000000f8eb5e030000010106000000f8eb5e030000000070a95f0322000022e03c5e03000075000000000020a95f030000000098925f030f0000000f000000000000010f00000060025e0360025e03040000010000000020000000f8f1af00506a0d77dcb3e0d6feffffff50f0af000dfa09770000000070a95f03d8ba5f03b0f0af00fcf0af00 (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"RtlGetVersion\" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000e0acca43fb7f0000000000000000000051edf345fb7f000000000000ce0200000000000000000000aec814ad9a6e00002a00000000000000d0dc646dce0200008fecf345fb7f0000e0acca43fb7f0000e0acca43fb7f0000000000000000000000000000fb7f0000ffffff7fd0d9000000000000000000000000000000000000d8cebe43fb7f00002a0000000000000069c37743fb7f00003100000000000000d003000000000000d403000000000000110001100000000090d21f96d100000003a36443fb7f000090d21f96d100000000000000000000002b00000000000000000000000000000020b07d43fb7f0000b43f7c43fb7f0000e0cebe43 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000000040000000000000000000696bce0200000b8ef145fb7f00000000696bce0200000200000000000000380000000000000040000000000000003003696bce02000088e0ec96d100000001000000000000000300000000000000010000000000000016000000000000004011276bce02000000000000000000000000276bce020000382ac46dce020000000000000000000078000000010000000000000000000000800000000000000004000000000000000000000000000000a849c46dce02000004000000000000003800000000000000f0986343fb7f00003800000000000000380000000000000000e2ec96d1000000c00c6b0efb7f000000000000 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b0fd2dfb7f0000070000000000000000000000000000000100000000000000f0df696bce0200000000000000000000d079b46dce0200004c986343fb7f0000e0b0b46dce020000b3ce610efb7f00005080b46dce020000004ffd2dfb7f0000d0b0fd2dfb7f0000000000000000000000000000000000005080b46dce020000f0df696bce0200006095b46dce02000058e2ec96d10000004c986343fb7f0000010000000000000058e2ec96d10000006095b46dce0200005080b46dce020000010000000000000002bc610efb7f00004081b46dce02000080c0b26dce020000feffffff040000007df0fc2dfb7f0000e092b46d (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000f0df696bce0200000000000000000000d079b46dce0200004c986343fb7f000060adb46dce020000b3ce610efb7f0000f07fb46dce020000384ffd2dfb7f0000d0b0fd2dfb7f000000000000000000000000000000000000f07fb46dce020000f0df696bce0200006095b46dce02000050e2ec96d10000004c986343fb7f0000010000000000000050e2ec96d10000006095b46dce020000f07fb46dce020000010000000000000002bc610efb7f0000000000000000000080c0b26dce0200004081b46d04000000fefffffffffffffff0df696bce0200007df0fc2dfb7f000000000000 (UID: 00000000-00002636)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-222","type":6,"relevance":2,"name":"Calls an API typically used to retrieve OS information","description":"$4a","description_v2":["\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00002636)","\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f000002000000007f0000f8c04142fb7f000000002d2afb7f00000000000000000000000000000000000008062e2afb7f00000001000000000000f0986343fb7f000000010000000000000001000000000000000000000000000000062e2afb7f000001000000000000000f182d2afb7f0000000000000000000000062e2afb7f000009000000 (UID: 00000000-00002636)","\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000e9010000d0c60f36e901000010c70f36e9010000020000027e77000030070d36 (UID: 00000000-00004540)","\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f000002000000007f0000f8c04142fb7f000000002d2afb7f00000000000000000000000000000000000008062e2afb7f00000001000000000000f0986343fb7f000000010000000000000001000000000000000000000000000000062e2afb7f000001000000000000000f182d2afb7f0000000000000000000000062e2afb7f000009000000 (UID: 00000000-00004540)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c004d006900630072006f0073006f00660074002e004e00450054005c004600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f000002000000007f0000f8c04142fb7f000000002d2afb7f00000000000000000000000000000000000008062e2afb7f00000001000000000000f0986343fb7f000000010000000000000001000000000000000000000000000000062e2afb7f000001000000000000000f182d2afb7f0000000000000000000000062e2afb7f000009000000 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000e9010000d0c60f36e901000010c70f36e9010000020000027e77000030070d36 (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f000002000000007f0000f8c04142fb7f000000002d2afb7f00000000000000000000000000000000000008062e2afb7f00000001000000000000f0986343fb7f000000010000000000000001000000000000000000000000000000062e2afb7f000001000000000000000f182d2afb7f0000000000000000000000062e2afb7f000009000000 (UID: 00000000-00004540)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-148","type":6,"relevance":3,"name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002636)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002636)","description_v2":["\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002636)","\"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002636)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002636)"}],"origin":"API Call","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-147","type":6,"relevance":3,"name":"Calls an API typically used to retrieve local language","description":"\"zoom.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003924)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002636)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002636)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004540)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004540)","description_v2":["\"zoom.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003924)","\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002636)","\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002636)","\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004540)","\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004540)"],"description_v3":[{"type":"text","value":"\"zoom.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004540)"}],"origin":"API Call","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-62","type":2,"relevance":5,"name":"Contains a Wine emulator-related string","description":"\"Sentence_TerminalSystemFunction036Unified_IdeographWSAEnumProtocolsWbad TinySizeClassentersyscallblockexec format errorfractional secondg already scannedin string literalinvalid bit size key align too biglocked m0 woke upmark - bad statusmarkBits overflowno data availablenotetsleepg on g0permission deniedreflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of runtime.newosprocruntime/internal/runtime: level = runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spansync.RWMutex.Lockthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version\" (Indicator: \"wine_get_version\"; File: \"zoom.exe\")\n \"wine_get_version\" (Indicator: \"wine_get_version\")","description_v2":["\"Sentence_TerminalSystemFunction036Unified_IdeographWSAEnumProtocolsWbad TinySizeClassentersyscallblockexec format errorfractional secondg already scannedin string literalinvalid bit size key align too biglocked m0 woke upmark - bad statusmarkBits overflowno data availablenotetsleepg on g0permission deniedreflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of runtime.newosprocruntime/internal/runtime: level = runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spansync.RWMutex.Lockthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version\" (Indicator: \"wine_get_version\"; File: \"zoom.exe\")","\"wine_get_version\" (Indicator: \"wine_get_version\")"],"description_v3":[{"type":"text","value":"\"Sentence_TerminalSystemFunction036Unified_IdeographWSAEnumProtocolsWbad TinySizeClassentersyscallblockexec format errorfractional secondg already scannedin string literalinvalid bit size key align too biglocked m0 woke upmark - bad statusmarkBits overflowno data availablenotetsleepg on g0permission deniedreflect.Value.Intreflect.Value.Lenreflect: New(nil)reflect: call of runtime.newosprocruntime/internal/runtime: level = runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spansync.RWMutex.Lockthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version\" (Indicator: \"wine_get_version\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"\"wine_get_version\" (Indicator: \"wine_get_version\")"}],"origin":"File/Memory","attck_id":"T1497.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-450","type":2,"relevance":1,"name":"Contains ability to determine if process is running under WOW64 (API string)","description":"file/memory contains long string with (Indicator: \"IsWow64Process\"; File: \"zoom.exe\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"IsWow64Process\"; File: \"zoom.exe\")","Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"IsWow64Process\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-433","type":2,"relevance":1,"name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM `%s`\" (Indicator: \"select * from \"; File: \"zoom.exe\")","description_v2":["Found string \"SELECT * FROM `%s`\" (Indicator: \"select * from \"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"Found string \"SELECT * FROM `%s`\" (Indicator: \"select * from \"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1047","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-78","type":3,"relevance":1,"name":"Contains ability to read software policies","description":"\"zoom.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"fleetdeck_agent_svc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","description_v2":["\"zoom.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","\"fleetdeck_agent_svc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")"],"description_v3":[{"type":"text","value":"\"zoom.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-249","type":2,"relevance":1,"name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")\n Found reference to API \"eCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"zoom.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","description_v2":["file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")","Found reference to API \"eCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")","Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"zoom.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"eCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-248","type":2,"relevance":1,"name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"zoom.exe\")\n Found reference to API \"syscall.GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"zoom.exe\")","Found reference to API \"syscall.GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"syscall.GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-141","type":2,"relevance":1,"name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"zoom.exe\")","description_v2":["Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-312","type":2,"relevance":1,"name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"zoom.exe\")","description_v2":["Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-171","type":2,"relevance":1,"name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"zoom.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"zoom.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"zoom.exe\")\n Found reference to API \"15738,4320,3024,,RtlGetVersion,NTDLL.dll,\"00:59:29.437\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","description_v2":["file/memory contains long string with (Indicator: \"GetVersion\"; File: \"zoom.exe\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"zoom.exe\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"zoom.exe\")","Found reference to API \"15738,4320,3024,,RtlGetVersion,NTDLL.dll,\"00:59:29.437\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"15738,4320,3024,,RtlGetVersion,NTDLL.dll,\"00:59:29.437\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-167","type":2,"relevance":1,"name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"zoom.exe\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"zoom.exe\")","Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1543","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-139","type":3,"relevance":1,"name":"Queries volatile registry keys","description":"\"fleetdeck_agent_svc.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")\n \"fleetdeck_agent_svc.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")","description_v2":["\"fleetdeck_agent_svc.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")","\"fleetdeck_agent_svc.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"fleetdeck_agent_svc.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\VOLATILE ENVIRONMENT\\1\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-39","type":6,"relevance":8,"name":"Queries volume information","description":"$4b","description_v2":["\"zoom.exe\" queries volume information of \"C:\\zoom.exe\" at 00000000-00003924-00000C17-2554575771","\"msiexec.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00003340-00000C17-2556058932","\"msiexec.exe\" queries volume information of \"C:\\share\" at 00000000-00003340-00000C17-2557554555","\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00002636-00000C17-2561563118","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2561627369","\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll\" at 00000000-00002636-00000C17-2562145431","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2562809474","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2563000044","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2563098922","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2563702261","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Package_734_for_KB4074588~31bf3856ad364e35~amd64~~10.0.1.17.cat\" at 00000000-00002636-00000C17-2563768398","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient\\Microsoft.AppV.AppVClientPowerShell.dll\" at 00000000-00002636-00000C17-2563804913","\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\Microsoft.AppV.AppvClientComConsumer\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.AppV.AppvClientComConsumer.dll\" at 00000000-00002636-00000C17-2563838580","\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\Microsoft.AppV.AppvClientComConsumer\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.AppV.AppvClientComConsumer.dll\" at 00000000-00002636-00000C17-2563838929","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2563926831","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2563966074","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564052435","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564174864","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564231797","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\BitLocker\\Microsoft.BitLocker.Structures.dll\" at 00000000-00002636-00000C17-2564312496","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564454418","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564496678","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564780835","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564821333","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-IIS-WebServer-AddOn-2-ServerCommon-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564880260"],"description_v3":[{"type":"text","value":"\"zoom.exe\" queries volume information of \"C:\\zoom.exe\" at 00000000-00003924-00000C17-2554575771"},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00003340-00000C17-2556058932"},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" queries volume information of \"C:\\share\" at 00000000-00003340-00000C17-2557554555"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00002636-00000C17-2561563118"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2561627369"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll\" at 00000000-00002636-00000C17-2562145431"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2562809474"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2563000044"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2563098922"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2563702261"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Package_734_for_KB4074588~31bf3856ad364e35~amd64~~10.0.1.17.cat\" at 00000000-00002636-00000C17-2563768398"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient\\Microsoft.AppV.AppVClientPowerShell.dll\" at 00000000-00002636-00000C17-2563804913"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\Microsoft.AppV.AppvClientComConsumer\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.AppV.AppvClientComConsumer.dll\" at 00000000-00002636-00000C17-2563838580"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\Microsoft.AppV.AppvClientComConsumer\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.AppV.AppvClientComConsumer.dll\" at 00000000-00002636-00000C17-2563838929"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2563926831"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2563966074"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564052435"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564174864"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564231797"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Modules\\BitLocker\\Microsoft.BitLocker.Structures.dll\" at 00000000-00002636-00000C17-2564312496"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564454418"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564496678"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564780835"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-WOW64-Package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564821333"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-IIS-WebServer-AddOn-2-ServerCommon-Package~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002636-00000C17-2564880260"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"zoom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"fleetdeck_agent_svc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"zoom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"fleetdeck_agent_svc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"zoom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":5,"name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-55","type":3,"relevance":10,"name":"Reads the registry for installed applications","description":"\"zoom.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ZOOM.EXE\")","description_v2":["\"zoom.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ZOOM.EXE\")"],"description_v3":[{"type":"text","value":"\"zoom.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ZOOM.EXE\")"}],"origin":"Registry Access","attck_id":"T1518","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1518","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-307","type":2,"relevance":1,"name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKey (in long string)\" in file \"zoom.exe\"\n Found registry modification API: \"RegLoadMUIString (in long string)\" in file \"zoom.exe\"\n Found registry modification API: \"internal/syscall/windows/registry.LoadRegLoadMUIString\" in file \"zoom.exe\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"zoom.exe\"","description_v2":["Found registry modification API: \"RegCreateKey (in long string)\" in file \"zoom.exe\"","Found registry modification API: \"RegLoadMUIString (in long string)\" in file \"zoom.exe\"","Found registry modification API: \"internal/syscall/windows/registry.LoadRegLoadMUIString\" in file \"zoom.exe\"","Found registry modification API: \"RegCreateKeyExW\" in file \"zoom.exe\""],"description_v3":[{"type":"text","value":"Found registry modification API: \"RegCreateKey (in long string)\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegLoadMUIString (in long string)\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"internal/syscall/windows/registry.LoadRegLoadMUIString\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry modification API: \"RegCreateKeyExW\" in file \"zoom.exe\""}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-191","type":2,"relevance":1,"name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"zoom.exe\")","description_v2":["Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-934","type":2,"relevance":1,"name":"Able to execute applications using .NET process API","description":"Found string \"processstartinfo\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")","description_v2":["Found string \"processstartinfo\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"processstartinfo\" (Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"binary-30","type":8,"relevance":3,"name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 4028336)","description_v2":["\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 4028336)"],"description_v3":[{"type":"text","value":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 4028336)"}],"origin":"Binary File","attck_id":"T1027.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-884","type":2,"relevance":1,"name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-272","type":2,"relevance":1,"name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"zoom.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"zoom.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","description_v2":["Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"zoom.exe\")","Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"zoom.exe\")","Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-17","type":3,"relevance":10,"name":"Accesses System Certificates Settings","description":"$4c","description_v2":["\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\AUTOUPDATE\"; Key: \"DISALLOWEDCERTSYNCDELTATIME\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\90E98BB05040666936B20E23F209B10C3CBC4D96\"; Key: \"BLOB\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\97EFF3028677894BDD4F9AC53F789BEE5DF4AD86\"; Key: \"BLOB\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\"; Key: \"BLOB\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01\"; Key: \"BLOB\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\"; Key: \"BLOB\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\"; Key: \"BLOB\")"],"description_v3":[{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\AUTOUPDATE\"; Key: \"DISALLOWEDCERTSYNCDELTATIME\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\90E98BB05040666936B20E23F209B10C3CBC4D96\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\97EFF3028677894BDD4F9AC53F789BEE5DF4AD86\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\83DA05A9886F7658BE73ACF0A4930C0F99B92F01\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\"; Key: \"BLOB\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-179","type":6,"relevance":1,"name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002636)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004540)","description_v2":["\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004540)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00004540)"}],"origin":"API Call","attck_id":"T1562.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-122","type":6,"relevance":3,"name":"Calls an API typically used to create a directory","description":"\"zoom.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\FleetDeck (UID: 00000000-00003924)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter %WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\PowerShell (UID: 00000000-00002636)","description_v2":["\"zoom.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\FleetDeck (UID: 00000000-00003924)","\"powershell.exe\" called \"CreateDirectoryW\" with parameter %WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\PowerShell (UID: 00000000-00002636)"],"description_v3":[{"type":"text","value":"\"zoom.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\FleetDeck (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"CreateDirectoryW\" with parameter %WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\PowerShell (UID: 00000000-00002636)"}],"origin":"API Call","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-138","type":6,"relevance":3,"name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134346960327451147.2636.DefaultAppDomain.powershell\" - (UID: 00000000-00002636)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134346962674272721.4540.DefaultAppDomain.powershell\" - (UID: 00000000-00004540)","description_v2":["\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134346960327451147.2636.DefaultAppDomain.powershell\" - (UID: 00000000-00002636)","\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134346962674272721.4540.DefaultAppDomain.powershell\" - (UID: 00000000-00004540)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134346960327451147.2636.DefaultAppDomain.powershell\" - (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134346962674272721.4540.DefaultAppDomain.powershell\" - (UID: 00000000-00004540)"}],"origin":"API Call","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-175","type":6,"relevance":1,"name":"Calls an API typically used to load libraries","description":"$4d","description_v2":["\"zoom.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter winmm.dll (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter ws2_32.dll (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter powrprof.dll (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter msi.dll (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter Comctl32.dll (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter srpapi.dll (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\TSAPPCMP.DLL (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter Ntdll.dll (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\SHLWAPI.DLL (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\OLE32.DLL (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter COMCTL32 (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\KERNEL32.DLL (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter MsiMsg.dll (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\SHELL32.DLL (UID: 00000000-00003924)","\"zoom.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\NETAPI32.DLL (UID: 00000000-00003924)","\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter winmm.dll (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter ws2_32.dll (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter powrprof.dll (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter psapi.dll (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter userenv.dll (UID: 00000000-00002548)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter SHLWAPI.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter VERSION.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter mscoree.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\combase.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter oleaut32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\b5ba37e1558ced178a99011a1d659b52\\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter OLEAUT32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\System.Management.Automation. (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter combase.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter version.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter psapi.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter wintrust.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\mscorrc.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en\\mscorrc.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\7b1f35fb0c2d6955ce5af2bd372c65f2\\Microsoft.Management.Infrastr (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\b221af81285c1305324612e6dc9c88ff\\System.Management.ni.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\8ad4c0af5b3d51a0f3a4dac0d44d85d4\\System.DirectoryServices.ni.d (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\5ee35debfc22f727e70e4479ddcbc045\\System.Xml.ni.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\86cfd69ce1261baf4740e7606cade014\\System.Numerics.ni.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\7bed49c46de9295a8453db205c60a028\\System.Data.ni.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\en-US\\tzres.dll.mui (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter CRYPT32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\7ff5199e757cb8af9ad949453f698d09\\Microsoft.PowerShell.Security (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\System.Configuration.ni.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\604272b0faec2e09d53d38e03bc89c6c\\System.Transactions.ni.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter secur32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter shlwapi.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wldp.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter wldp.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MPCLIENT.DLL (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MsMpLics.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\kernel32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter USERENV.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\5f64880c86c98e7ddecdf28e61917307\\Microsoft.Management.Infrastr (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\urlmon.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter urlmon.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.AppV.AppvClientComConsumer\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.AppV.AppvC (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\df7d947a99cbcfaa726b127726f05476\\Microsoft.PowerShell.Commands (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\120a0532577f871c2415502d9edacdd6\\System.Configuration.Install. (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter bcrypt.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter oleaut32 (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\d922445a828b30938c72d375a3b34a60\\Microsoft.PowerShell.Commands (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ibaae5ed9#\\e86f7f836a07f673cdef4c9a4d4b4d80\\Microsoft.IIS.Powershell.Comm (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\00f9e9ff321d8a141f3d71163c70c906\\Microsoft.KeyDistributionServ (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.KeyDistributionService.Cmdlets\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.KeyDis (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter KERNEL32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\api-ms-win-core (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\msvcrt.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter msvcrt.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\Microsoft.Manag (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\mi.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter mi.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter GDI32.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter SHLWAPI.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter VERSION.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter mscoree.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\combase.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter oleaut32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\b5ba37e1558ced178a99011a1d659b52\\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter OLEAUT32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\System.Management.Automation. (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter combase.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter version.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter psapi.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter wintrust.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\mscorrc.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en\\mscorrc.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\en-US\\tzres.dll.mui (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\7b1f35fb0c2d6955ce5af2bd372c65f2\\Microsoft.Management.Infrastr (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\b221af81285c1305324612e6dc9c88ff\\System.Management.ni.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\8ad4c0af5b3d51a0f3a4dac0d44d85d4\\System.DirectoryServices.ni.d (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\7bed49c46de9295a8453db205c60a028\\System.Data.ni.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\5ee35debfc22f727e70e4479ddcbc045\\System.Xml.ni.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter CRYPT32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\86cfd69ce1261baf4740e7606cade014\\System.Numerics.ni.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\7ff5199e757cb8af9ad949453f698d09\\Microsoft.PowerShell.Security (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\System.Configuration.ni.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\604272b0faec2e09d53d38e03bc89c6c\\System.Transactions.ni.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter secur32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter shlwapi.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wldp.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter wldp.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MPCLIENT.DLL (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MsMpLics.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\kernel32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter USERENV.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\5f64880c86c98e7ddecdf28e61917307\\Microsoft.Management.Infrastr (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\urlmon.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter urlmon.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.AppV.AppvClientComConsumer\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.AppV.AppvC (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\df7d947a99cbcfaa726b127726f05476\\Microsoft.PowerShell.Commands (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\120a0532577f871c2415502d9edacdd6\\System.Configuration.Install. (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter bcrypt.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter oleaut32 (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\d922445a828b30938c72d375a3b34a60\\Microsoft.PowerShell.Commands (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ibaae5ed9#\\e86f7f836a07f673cdef4c9a4d4b4d80\\Microsoft.IIS.Powershell.Comm (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\00f9e9ff321d8a141f3d71163c70c906\\Microsoft.KeyDistributionServ (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.KeyDistributionService.Cmdlets\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.KeyDis (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter KERNEL32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\api-ms-win-core (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\msvcrt.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter msvcrt.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\Microsoft.Manag (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\mi.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter mi.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter GDI32.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00004540)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00004540)"],"description_v3":[{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter winmm.dll (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter ws2_32.dll (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter powrprof.dll (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter msi.dll (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter Comctl32.dll (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter srpapi.dll (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\TSAPPCMP.DLL (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter Ntdll.dll (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\SHLWAPI.DLL (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\OLE32.DLL (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter COMCTL32 (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\KERNEL32.DLL (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter MsiMsg.dll (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\SHELL32.DLL (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\SysWOW64\\NETAPI32.DLL (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter winmm.dll (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter ws2_32.dll (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter powrprof.dll (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter psapi.dll (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"LoadLibrary\" with a parameter userenv.dll (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter SHLWAPI.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter VERSION.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter mscoree.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\combase.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter oleaut32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\b5ba37e1558ced178a99011a1d659b52\\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter OLEAUT32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\System.Management.Automation. (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter combase.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter version.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter psapi.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter wintrust.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\mscorrc.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en\\mscorrc.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\7b1f35fb0c2d6955ce5af2bd372c65f2\\Microsoft.Management.Infrastr (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\b221af81285c1305324612e6dc9c88ff\\System.Management.ni.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\8ad4c0af5b3d51a0f3a4dac0d44d85d4\\System.DirectoryServices.ni.d (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\5ee35debfc22f727e70e4479ddcbc045\\System.Xml.ni.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\86cfd69ce1261baf4740e7606cade014\\System.Numerics.ni.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\7bed49c46de9295a8453db205c60a028\\System.Data.ni.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\en-US\\tzres.dll.mui (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter CRYPT32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\7ff5199e757cb8af9ad949453f698d09\\Microsoft.PowerShell.Security (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\System.Configuration.ni.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\604272b0faec2e09d53d38e03bc89c6c\\System.Transactions.ni.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter secur32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter shlwapi.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wldp.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter wldp.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MPCLIENT.DLL (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MsMpLics.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\kernel32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter USERENV.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\5f64880c86c98e7ddecdf28e61917307\\Microsoft.Management.Infrastr (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\urlmon.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter urlmon.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.AppV.AppvClientComConsumer\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.AppV.AppvC (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\df7d947a99cbcfaa726b127726f05476\\Microsoft.PowerShell.Commands (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\120a0532577f871c2415502d9edacdd6\\System.Configuration.Install. (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter bcrypt.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter oleaut32 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\d922445a828b30938c72d375a3b34a60\\Microsoft.PowerShell.Commands (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ibaae5ed9#\\e86f7f836a07f673cdef4c9a4d4b4d80\\Microsoft.IIS.Powershell.Comm (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\00f9e9ff321d8a141f3d71163c70c906\\Microsoft.KeyDistributionServ (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.KeyDistributionService.Cmdlets\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.KeyDis (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter KERNEL32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\api-ms-win-core (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\msvcrt.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter msvcrt.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\Microsoft.Manag (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\mi.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter mi.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter GDI32.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter SHLWAPI.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter VERSION.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter mscoree.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\combase.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter oleaut32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\b5ba37e1558ced178a99011a1d659b52\\Microsoft.PowerShell.ConsoleH (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter OLEAUT32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\System.Management.Automation. (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter combase.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter version.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter psapi.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter wintrust.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\mscorrc.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en\\mscorrc.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\en-US\\tzres.dll.mui (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\7b1f35fb0c2d6955ce5af2bd372c65f2\\Microsoft.Management.Infrastr (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\b221af81285c1305324612e6dc9c88ff\\System.Management.ni.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\8ad4c0af5b3d51a0f3a4dac0d44d85d4\\System.DirectoryServices.ni.d (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\7bed49c46de9295a8453db205c60a028\\System.Data.ni.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\5ee35debfc22f727e70e4479ddcbc045\\System.Xml.ni.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter CRYPT32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\86cfd69ce1261baf4740e7606cade014\\System.Numerics.ni.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\7ff5199e757cb8af9ad949453f698d09\\Microsoft.PowerShell.Security (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\System.Configuration.ni.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\604272b0faec2e09d53d38e03bc89c6c\\System.Transactions.ni.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter secur32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter shlwapi.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wldp.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter wldp.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MPCLIENT.DLL (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MsMpLics.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\kernel32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter USERENV.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.M870d558a#\\5f64880c86c98e7ddecdf28e61917307\\Microsoft.Management.Infrastr (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\urlmon.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter urlmon.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.AppV.AppvClientComConsumer\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.AppV.AppvC (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\df7d947a99cbcfaa726b127726f05476\\Microsoft.PowerShell.Commands (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\120a0532577f871c2415502d9edacdd6\\System.Configuration.Install. (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter bcrypt.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter oleaut32 (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\d922445a828b30938c72d375a3b34a60\\Microsoft.PowerShell.Commands (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Ibaae5ed9#\\e86f7f836a07f673cdef4c9a4d4b4d80\\Microsoft.IIS.Powershell.Comm (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Kd58820a5#\\00f9e9ff321d8a141f3d71163c70c906\\Microsoft.KeyDistributionServ (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.KeyDistributionService.Cmdlets\\v4.0_10.0.0.0__31bf3856ad364e35\\Microsoft.KeyDis (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter KERNEL32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\api-ms-win-core (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\msvcrt.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter msvcrt.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\Microsoft.Manag (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\mi.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter mi.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter GDI32.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00004540)"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-176","type":6,"relevance":1,"name":"Calls an API typically used to retrieve function addresses","description":"$4e","description_v2":["\"zoom.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter AddDllDirectory (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter AddVectoredContinueHandler (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExA (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExW (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter SystemFunction036 (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter NtWaitForSingleObject (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter RtlGetCurrentPeb (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter timeBeginPeriod (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter timeEndPeriod (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter WSAGetOverlappedResult (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter wine_get_version (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter GetStdHandle (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectoryW (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter WSAStartup (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter WSAEnumProtocolsW (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter GetConsoleMode (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter GetFileType (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter GetCommandLineW (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter GetTempPathW (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesExW (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter CreateDirectoryW (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter GetNativeSystemInfo (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter MsiSetInternalUI (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter GetFullPathNameW (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter IsWow64Process (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandle (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter ReadFile (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter MsiLocateComponentA (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter MsiInstallProductA (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter QueryActCtxW (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter ActivateActCtx (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter FindActCtxSectionStringW (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter DeactivateActCtx (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter SrpOpenTrackInstall (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter SrpCloseTrackInstall (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter WinSqmIsOptedIn (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter UrlIsW (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter StgOpenStorage (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter CoGetMalloc (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter InitCommonControlsEx (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter SHGetPropertyStoreForWindow (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter CoInitialize (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter NetGetJoinInformation (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter NetApiBufferFree (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter CoQueryProxyBlanket (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter CoSetProxyBlanket (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter CoTaskMemAlloc (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter SHChangeNotify (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter CoTaskMemFree (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter CoUninitialize (UID: 00000000-00003924)","\"zoom.exe\" called \"GetProcAddress\" with a parameter DeleteFileW (UID: 00000000-00003924)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter AddDllDirectory (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter AddVectoredContinueHandler (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExA (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExW (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter SystemFunction036 (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter NtWaitForSingleObject (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter RtlGetCurrentPeb (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter timeBeginPeriod (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter timeEndPeriod (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter WSAGetOverlappedResult (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter wine_get_version (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetStdHandle (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectoryW (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter WSAStartup (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter WSAEnumProtocolsW (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetConsoleMode (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetFileType (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetCommandLineW (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariableW (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter SetHandleInformation (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetTempPathW (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesExW (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameW (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter SetCurrentDirectoryW (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetCurrentDirectoryW (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter FindFirstFileW (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter FindNextFileW (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter FindClose (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter EnumProcesses (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter OpenProcess (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter OpenProcessToken (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetTokenInformation (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter ConvertSidToStringSidW (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter LocalFree (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter DuplicateTokenEx (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter SetTokenInformation (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CreateEnvironmentBlock (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter DestroyEnvironmentBlock (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter DuplicateHandle (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CreateProcessAsUserW (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter WaitForSingleObject (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcess (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetProcessTimes (UID: 00000000-00002548)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyExW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryInfoKeyW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegEnumKeyExW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegEnumValueW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegCloseKey (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryValueExW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AddDllDirectory (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EventRegister (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EventSetInformation (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterShimImplCallback (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetShellShimInstance (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter OnShimDllMainCalled (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CorBindToRuntimeEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter UrlIsW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AppPolicyGetClrCompat (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageInfo (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackagePath (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcessToken (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenInformation (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter VerQueryValueW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetRuntimeInfo (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessWindowStation (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserObjectInformationW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DllGetClassObjectInternal (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter QuirkIsEnabled3 (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter QuirkGetData2 (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateConfigStream (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RtlVirtualUnwind (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AllocateAndInitializeSid (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeAcl (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AddAccessAllowedAce (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeSid (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RoInitialize (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreatePrivateNamespaceW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenPrivateNamespaceW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RaiseException (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoInitializeEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RoUninitialize (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessExecutableHeap (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetContextToken (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetSystemFileCacheSize (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter NtSetSystemInformation (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SysStringByteLen (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LocaleNameToLCID (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RoGetActivationFactory (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WindowsCreateStringReference (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WindowsDeleteString (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WindowsCreateString (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter NtQueryInformationThread (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter NtQuerySystemInformation (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateWaitableTimerExW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetWaitableTimerEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EventActivityIdControl (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EventWriteTransfer (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LocalFree (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LocalAlloc (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFullPathNameW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadErrorMode (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesExW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSize (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfo (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter VerQueryValue (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LCIDToLocaleName (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter VerLanguageName (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter VerLanguageNameW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessId (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessIdW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupPrivilegeValue (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupPrivilegeValueW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcessTokenW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AdjustTokenPrivileges (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcess (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcessW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoUninitialize (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FindNLSStringEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryValueEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ResolveLocaleName (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CompareStringOrdinal (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFullPathName (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumProcessModules (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumProcessModulesW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleInformation (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleInformationW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleBaseName (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleBaseNameW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoTaskMemAlloc (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoTaskMemFree (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameExW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcess (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcessW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumWindows (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumWindowsW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessId (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter NtQuerySystemInformationW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WerSetFlags (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SHGetFolderPath (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SHGetFolderPathW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariable (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariableW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributes (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateFile (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileType (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WTGetSignatureInfo (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiInitialize (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoExW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoCreateGuid (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleCP (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleCPW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateDirectory (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateDirectoryW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleMode (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleModeW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleMode (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleModeW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter _CorDllMain_RetAddr (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter _CorDllMain (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleCtrlHandler (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetStdHandle (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenForVTableEntry (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetTargetForVTableEntry (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTargetForVTableEntry (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenInformationW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LocalAllocW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DuplicateTokenEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DuplicateTokenExW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CheckTokenMembership (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CheckTokenMembershipW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessTimes (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessTimesW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleTitle (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleTitleW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileMUIPath (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeLibrary (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeLibraryW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LoadStringW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleTitle (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleTitleW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateContext (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContext (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CertGetCertificateContextProperty (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WinVerifyTrust (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WinVerifyTrustW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateContextW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateWellKnownSid (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateNamedPipe (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateNamedPipeW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateEvent (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateEventW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ConnectNamedPipe (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetEnvironmentVariable (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetEnvironmentVariableW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter sxsJitStartup (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter jitStartup (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter getJit (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ExpandEnvironmentStrings (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTimeZoneInformation (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryInfoKey (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegEnumKeyEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserNameEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserNameExW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserName (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserNameW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupAccountName (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupAccountNameW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FormatMessage (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FormatMessageW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumCalendarInfoExEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCalendarInfoEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumTimeFormatsEx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReleaseMutex (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterEventSource (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterEventSourceW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DeregisterEventSource (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReportEvent (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReportEventW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetLogicalDrives (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetDriveType (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetDriveTypeW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetVolumeInformation (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetVolumeInformationW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter PathIsNetworkPath (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter PathIsNetworkPathW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentDirectoryW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectory (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectoryW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WldpGetLockdownPolicy (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTempPath (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTempPathW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SaferIdentifyLevel (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SaferCloseLevel (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DeleteFile (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DeleteFileW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemInfo (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryPerformanceFrequency (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryPerformanceCounter (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetEvent (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoWaitForMultipleHandles (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadUILanguage (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadUILanguageW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiOpenSession (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiScanBuffer (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpManagerOpen (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpHandleClose (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpFreeMemory (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpScanStart (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpMemoryScanStart (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpScanResult (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpThreatOpen (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpThreatEnumerate (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigOpen (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigGetValue (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigGetValueAlloc (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigClose (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpFastMemoryScanOpen (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpFastMemoryScan (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpTelemetryInitialize (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpTelemetryUninitialize (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpAmsiScan (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpAmsiCloseSession (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpClientUtilExportFunctions (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpManagerVersionQuery (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EventWrite (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EventUnregister (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter IsWow64Process (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterGPNotification (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter UnregisterGPNotification (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FindFirstFile (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FindFirstFileW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FindClose (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FindNextFile (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FindNextFileW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetACP (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter UnmapViewOfFile (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetFilePointer (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReadFile (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiCloseSession (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoInitialize (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter StgOpenStorage (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter _create_locale (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter _free_locale (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter _wcstod_l (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyNameObject (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetObjectContext (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyEnum (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyEnumW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ConvertSidToStringSidW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileName (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileSize (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateActCtxW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AddRefActCtx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReleaseActCtx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ActivateActCtx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DeactivateActCtx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentActCtx (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryActCtxW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetLastError (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EncodePointer (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleA (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter malloc (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Application_InitializeV1 (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetComputerName (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetComputerNameW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleOutputCP (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleOutputCPW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter TranslateCharsetInfo (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter TranslateCharsetInfoW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReadConsoleOutput (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReadConsoleOutputW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsoleOutput (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsoleOutputW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentThread (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadToken (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsole (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsoleW (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiUninitialize (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CorExitProcess_RetAddr (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CorExitProcess (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DecodePointer (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter free (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00002636)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyExW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryInfoKeyW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegEnumKeyExW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegEnumValueW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegCloseKey (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryValueExW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AddDllDirectory (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EventRegister (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EventSetInformation (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterShimImplCallback (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetShellShimInstance (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter OnShimDllMainCalled (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CorBindToRuntimeEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter UrlIsW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageInfo (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackagePath (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcessToken (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenInformation (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter VerQueryValueW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetRuntimeInfo (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessWindowStation (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserObjectInformationW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DllGetClassObjectInternal (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter QuirkIsEnabled3 (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter QuirkGetData2 (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateConfigStream (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RtlVirtualUnwind (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AllocateAndInitializeSid (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeAcl (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AddAccessAllowedAce (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeSid (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RoInitialize (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RaiseException (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoInitializeEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RoUninitialize (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessExecutableHeap (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetContextToken (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetSystemFileCacheSize (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter NtSetSystemInformation (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SysStringByteLen (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LocaleNameToLCID (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RoGetActivationFactory (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WindowsCreateStringReference (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WindowsDeleteString (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WindowsCreateString (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter NtQueryInformationThread (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter NtQuerySystemInformation (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateWaitableTimerExW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetWaitableTimerEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EventActivityIdControl (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EventWriteTransfer (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LocalFree (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LocalAlloc (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFullPathNameW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadErrorMode (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesExW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSize (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfo (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter VerQueryValue (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LCIDToLocaleName (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter VerLanguageName (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter VerLanguageNameW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessId (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessIdW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupPrivilegeValue (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupPrivilegeValueW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcessTokenW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AdjustTokenPrivileges (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcess (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcessW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoUninitialize (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FindNLSStringEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryValueEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ResolveLocaleName (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CompareStringOrdinal (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFullPathName (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumProcessModules (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumProcessModulesW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleInformation (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleInformationW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleBaseName (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleBaseNameW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoTaskMemAlloc (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoTaskMemFree (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameExW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcess (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcessW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SHGetFolderPath (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SHGetFolderPathW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributes (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariable (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariableW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateFile (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileType (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumWindows (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumWindowsW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessId (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter NtQuerySystemInformationW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WerSetFlags (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WTGetSignatureInfo (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoCreateGuid (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleCP (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleCPW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleMode (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleModeW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiInitialize (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleMode (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleModeW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetStdHandle (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessTimes (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessTimesW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileMUIPath (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeLibrary (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeLibraryW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LoadStringW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoExW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateWellKnownSid (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenInformationW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LocalAllocW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DuplicateTokenEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DuplicateTokenExW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CheckTokenMembership (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CheckTokenMembershipW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateNamedPipe (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateNamedPipeW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateEvent (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateEventW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ConnectNamedPipe (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetEnvironmentVariable (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetEnvironmentVariableW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter _CorDllMain_RetAddr (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter _CorDllMain (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateContext (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenForVTableEntry (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetTargetForVTableEntry (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTargetForVTableEntry (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContext (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CertGetCertificateContextProperty (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WinVerifyTrust (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WinVerifyTrustW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateContextW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleTitle (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleTitleW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter sxsJitStartup (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter jitStartup (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter getJit (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ExpandEnvironmentStrings (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleTitle (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleTitleW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTimeZoneInformation (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryInfoKey (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegEnumKeyEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserNameEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserNameExW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserName (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserNameW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupAccountName (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupAccountNameW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FormatMessage (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FormatMessageW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumCalendarInfoExEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCalendarInfoEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumTimeFormatsEx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReleaseMutex (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterEventSource (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterEventSourceW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DeregisterEventSource (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReportEvent (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReportEventW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetLogicalDrives (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetDriveType (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetDriveTypeW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetVolumeInformation (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetVolumeInformationW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter PathIsNetworkPath (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter PathIsNetworkPathW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentDirectoryW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectory (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectoryW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTempPath (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTempPathW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SaferIdentifyLevel (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SaferCloseLevel (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DeleteFile (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DeleteFileW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemInfo (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryPerformanceFrequency (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryPerformanceCounter (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetEvent (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadUILanguage (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadUILanguageW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiOpenSession (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiScanBuffer (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpManagerOpen (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpHandleClose (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpFreeMemory (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpScanStart (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpMemoryScanStart (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpScanResult (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpThreatOpen (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpThreatEnumerate (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigOpen (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigGetValue (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigGetValueAlloc (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigClose (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpFastMemoryScanOpen (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpFastMemoryScan (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpTelemetryInitialize (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpTelemetryUninitialize (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpAmsiScan (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpAmsiCloseSession (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpClientUtilExportFunctions (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MpManagerVersionQuery (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EventWrite (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EventUnregister (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter IsWow64Process (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterGPNotification (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter UnregisterGPNotification (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FindFirstFile (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FindFirstFileW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FindClose (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FindNextFile (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter FindNextFileW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetACP (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter UnmapViewOfFile (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetFilePointer (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReadFile (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiCloseSession (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoInitialize (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter StgOpenStorage (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter _create_locale (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter _free_locale (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter _wcstod_l (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyNameObject (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetObjectContext (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyEnum (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyEnumW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ConvertSidToStringSidW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileName (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileSize (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateActCtxW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AddRefActCtx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReleaseActCtx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ActivateActCtx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DeactivateActCtx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentActCtx (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryActCtxW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetLastError (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter EncodePointer (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleA (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter malloc (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Application_InitializeV1 (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetComputerName (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetComputerNameW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleOutputCP (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleOutputCPW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter TranslateCharsetInfo (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter TranslateCharsetInfoW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReadConsoleOutput (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter ReadConsoleOutputW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsoleOutput (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsoleOutputW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentThread (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadToken (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsole (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsoleW (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiUninitialize (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CorExitProcess_RetAddr (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter CorExitProcess (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter DecodePointer (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter free (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00004540)","\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00004540)"],"description_v3":[{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter AddDllDirectory (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter AddVectoredContinueHandler (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExA (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExW (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter SystemFunction036 (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter NtWaitForSingleObject (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter RtlGetCurrentPeb (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter timeBeginPeriod (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter timeEndPeriod (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter WSAGetOverlappedResult (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter wine_get_version (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter GetStdHandle (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectoryW (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter WSAStartup (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter WSAEnumProtocolsW (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter GetConsoleMode (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter GetFileType (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter GetCommandLineW (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter GetTempPathW (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesExW (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter CreateDirectoryW (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter GetNativeSystemInfo (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter MsiSetInternalUI (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter GetFullPathNameW (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter IsWow64Process (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandle (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter ReadFile (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter MsiLocateComponentA (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter MsiInstallProductA (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter QueryActCtxW (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter ActivateActCtx (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter FindActCtxSectionStringW (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter DeactivateActCtx (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter SrpOpenTrackInstall (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter SrpCloseTrackInstall (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter WinSqmIsOptedIn (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter UrlIsW (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter StgOpenStorage (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter CoGetMalloc (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter InitCommonControlsEx (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter SHGetPropertyStoreForWindow (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter CoInitialize (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter NetGetJoinInformation (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter NetApiBufferFree (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter CoQueryProxyBlanket (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter CoSetProxyBlanket (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter CoTaskMemAlloc (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter SHChangeNotify (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter CoTaskMemFree (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter CoUninitialize (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" called \"GetProcAddress\" with a parameter DeleteFileW (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter AddDllDirectory (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter AddVectoredContinueHandler (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExA (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExW (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter SystemFunction036 (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter NtWaitForSingleObject (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter RtlGetCurrentPeb (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter timeBeginPeriod (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter timeEndPeriod (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter WSAGetOverlappedResult (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter wine_get_version (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetStdHandle (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectoryW (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter WSAStartup (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter WSAEnumProtocolsW (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetConsoleMode (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetFileType (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetCommandLineW (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariableW (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter SetHandleInformation (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetTempPathW (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesExW (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameW (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter SetCurrentDirectoryW (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetCurrentDirectoryW (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter FindFirstFileW (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter FindNextFileW (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter FindClose (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter EnumProcesses (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter OpenProcess (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter OpenProcessToken (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetTokenInformation (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter ConvertSidToStringSidW (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter LocalFree (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter DuplicateTokenEx (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter SetTokenInformation (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CreateEnvironmentBlock (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter DestroyEnvironmentBlock (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter DuplicateHandle (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter CreateProcessAsUserW (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter WaitForSingleObject (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcess (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"GetProcAddress\" with a parameter GetProcessTimes (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyExW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryInfoKeyW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegEnumKeyExW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegEnumValueW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegCloseKey (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryValueExW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AddDllDirectory (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EventRegister (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EventSetInformation (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterShimImplCallback (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetShellShimInstance (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter OnShimDllMainCalled (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CorBindToRuntimeEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter UrlIsW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AppPolicyGetClrCompat (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageInfo (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackagePath (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcessToken (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenInformation (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter VerQueryValueW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetRuntimeInfo (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessWindowStation (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserObjectInformationW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DllGetClassObjectInternal (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter QuirkIsEnabled3 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter QuirkGetData2 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateConfigStream (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RtlVirtualUnwind (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AllocateAndInitializeSid (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeAcl (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AddAccessAllowedAce (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeSid (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RoInitialize (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreatePrivateNamespaceW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenPrivateNamespaceW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RaiseException (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoInitializeEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RoUninitialize (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessExecutableHeap (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetContextToken (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetSystemFileCacheSize (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter NtSetSystemInformation (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SysStringByteLen (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LocaleNameToLCID (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RoGetActivationFactory (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WindowsCreateStringReference (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WindowsDeleteString (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WindowsCreateString (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter NtQueryInformationThread (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter NtQuerySystemInformation (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateWaitableTimerExW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetWaitableTimerEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EventActivityIdControl (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EventWriteTransfer (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LocalFree (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LocalAlloc (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFullPathNameW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadErrorMode (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesExW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSize (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfo (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter VerQueryValue (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserDefaultLocaleName (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LCIDToLocaleName (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserPreferredUILanguages (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter VerLanguageName (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter VerLanguageNameW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessId (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessIdW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupPrivilegeValue (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupPrivilegeValueW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcessTokenW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AdjustTokenPrivileges (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcess (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcessW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoUninitialize (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FindNLSStringEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryValueEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ResolveLocaleName (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CompareStringOrdinal (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFullPathName (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumProcessModules (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumProcessModulesW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleInformation (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleInformationW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleBaseName (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleBaseNameW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoTaskMemAlloc (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoTaskMemFree (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameExW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcess (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcessW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumWindows (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumWindowsW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessId (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter NtQuerySystemInformationW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WerSetFlags (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SHGetFolderPath (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SHGetFolderPathW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariable (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariableW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributes (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateFile (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileType (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WTGetSignatureInfo (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiInitialize (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoExW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoCreateGuid (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleCP (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleCPW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateDirectory (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateDirectoryW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleMode (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleModeW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleMode (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleModeW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter _CorDllMain_RetAddr (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter _CorDllMain (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleCtrlHandler (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetStdHandle (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenForVTableEntry (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetTargetForVTableEntry (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTargetForVTableEntry (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenInformationW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LocalAllocW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DuplicateTokenEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DuplicateTokenExW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CheckTokenMembership (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CheckTokenMembershipW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessTimes (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessTimesW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleTitle (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleTitleW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileMUIPath (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeLibrary (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeLibraryW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LoadStringW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleTitle (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleTitleW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateContext (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContext (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CertGetCertificateContextProperty (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WinVerifyTrust (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WinVerifyTrustW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateContextW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateWellKnownSid (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateNamedPipe (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateNamedPipeW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateEvent (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateEventW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ConnectNamedPipe (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetEnvironmentVariable (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetEnvironmentVariableW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetEnabledXStateFeatures (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter sxsJitStartup (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter jitStartup (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter getJit (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ExpandEnvironmentStrings (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTimeZoneInformation (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryInfoKey (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegEnumKeyEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserNameEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserNameExW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserName (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserNameW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupAccountName (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupAccountNameW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FormatMessage (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FormatMessageW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumCalendarInfoExEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCalendarInfoEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumTimeFormatsEx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReleaseMutex (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterEventSource (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterEventSourceW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DeregisterEventSource (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReportEvent (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReportEventW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetLogicalDrives (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetDriveType (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetDriveTypeW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetVolumeInformation (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetVolumeInformationW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter PathIsNetworkPath (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter PathIsNetworkPathW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentDirectoryW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectory (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectoryW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WldpGetLockdownPolicy (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTempPath (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTempPathW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SaferIdentifyLevel (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SaferCloseLevel (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DeleteFile (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DeleteFileW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemInfo (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryPerformanceFrequency (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryPerformanceCounter (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetEvent (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoWaitForMultipleHandles (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadUILanguage (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadUILanguageW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiOpenSession (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiScanBuffer (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpManagerOpen (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpHandleClose (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpFreeMemory (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpScanStart (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpMemoryScanStart (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpScanResult (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpThreatOpen (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpThreatEnumerate (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigOpen (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigGetValue (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigGetValueAlloc (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigClose (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpFastMemoryScanOpen (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpFastMemoryScan (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpTelemetryInitialize (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpTelemetryUninitialize (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpAmsiScan (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpAmsiCloseSession (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpClientUtilExportFunctions (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpManagerVersionQuery (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EventWrite (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EventUnregister (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter IsWow64Process (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterGPNotification (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter UnregisterGPNotification (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FindFirstFile (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FindFirstFileW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FindClose (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FindNextFile (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FindNextFileW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetACP (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter UnmapViewOfFile (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetFilePointer (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReadFile (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiCloseSession (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoInitialize (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter StgOpenStorage (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter _create_locale (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter _free_locale (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter _wcstod_l (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyNameObject (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetObjectContext (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyEnum (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyEnumW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ConvertSidToStringSidW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileName (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileSize (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateActCtxW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AddRefActCtx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReleaseActCtx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ActivateActCtx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DeactivateActCtx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentActCtx (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryActCtxW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetLastError (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EncodePointer (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleA (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter malloc (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Application_InitializeV1 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetComputerName (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetComputerNameW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleOutputCP (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleOutputCPW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter TranslateCharsetInfo (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter TranslateCharsetInfoW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReadConsoleOutput (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReadConsoleOutputW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsoleOutput (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsoleOutputW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentThread (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadToken (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsole (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsoleW (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiUninitialize (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CorExitProcess_RetAddr (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CorExitProcess (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DecodePointer (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter free (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeConditionVariable (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyExW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryInfoKeyW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegEnumKeyExW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegEnumValueW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegCloseKey (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryValueExW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsAlloc (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsSetValue (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LCMapStringEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AddDllDirectory (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EventRegister (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EventSetInformation (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterShimImplCallback (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetShellShimInstance (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter OnShimDllMainCalled (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CorBindToRuntimeEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter UrlIsW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AppPolicyGetClrCompat (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageId (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackageInfo (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentPackagePath (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcessToken (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenInformation (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter VerQueryValueW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetRuntimeInfo (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessWindowStation (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserObjectInformationW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DllGetClassObjectInternal (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter QuirkIsEnabled3 (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter QuirkGetData2 (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateConfigStream (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FlsFree (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RtlVirtualUnwind (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AllocateAndInitializeSid (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeAcl (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AddAccessAllowedAce (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeSid (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RoInitialize (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreatePrivateNamespaceW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenPrivateNamespaceW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RaiseException (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoInitializeEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RoUninitialize (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessExecutableHeap (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetContextToken (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetSystemFileCacheSize (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter NtSetSystemInformation (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SysStringByteLen (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetLocaleInfoEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LocaleNameToLCID (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RoGetActivationFactory (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WindowsCreateStringReference (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WindowsDeleteString (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WindowsCreateString (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter NtQueryInformationThread (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter NtQuerySystemInformation (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateWaitableTimerExW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetWaitableTimerEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EventActivityIdControl (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EventWriteTransfer (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegOpenKeyEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LocalFree (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LocalAlloc (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFullPathNameW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadErrorMode (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesExW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSize (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfo (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter VerQueryValue (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserDefaultLocaleName (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LCIDToLocaleName (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserPreferredUILanguages (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter VerLanguageName (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter VerLanguageNameW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessId (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessIdW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupPrivilegeValue (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupPrivilegeValueW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcess (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcessTokenW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AdjustTokenPrivileges (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseHandle (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcess (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter OpenProcessW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoUninitialize (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FindNLSStringEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryValueEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ResolveLocaleName (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CompareStringOrdinal (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFullPathName (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumProcessModules (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumProcessModulesW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleInformation (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleInformationW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleBaseName (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleBaseNameW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoTaskMemAlloc (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoTaskMemFree (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameExW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcess (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetExitCodeProcessW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SHGetFolderPath (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SHGetFolderPathW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributes (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileAttributesW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariable (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetEnvironmentVariableW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateFile (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateFileW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileType (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumWindows (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumWindowsW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessId (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter NtQuerySystemInformationW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WerSetFlags (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WTGetSignatureInfo (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoCreateGuid (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleCP (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleCPW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleMode (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleModeW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiInitialize (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleMode (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleModeW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetStdHandle (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessTimes (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcessTimesW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileMUIPath (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LoadLibraryExW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeLibrary (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeLibraryW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LoadStringW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileVersionInfoExW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateWellKnownSid (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenInformationW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LocalAllocW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DuplicateTokenEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DuplicateTokenExW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CheckTokenMembership (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CheckTokenMembershipW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateNamedPipe (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateNamedPipeW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter InitOnceExecuteOnce (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateEventExW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateSemaphoreExW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolTimer (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolTimer (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolTimer (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWait (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadpoolWait (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWait (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateSymbolicLinkW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTickCount64 (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetFileInformationByHandle (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WakeConditionVariable (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter InitializeSRWLock (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableSRW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateThreadpoolWork (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SubmitThreadpoolWork (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CloseThreadpoolWork (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CompareStringEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AreFileApisANSI (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateEvent (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateEventW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ConnectNamedPipe (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetEnvironmentVariable (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetEnvironmentVariableW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter _CorDllMain_RetAddr (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter _CorDllMain (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateContext (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenForVTableEntry (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetTargetForVTableEntry (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTargetForVTableEntry (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContext (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CertGetCertificateContextProperty (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetEnabledXStateFeatures (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WinVerifyTrust (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WinVerifyTrustW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CertFreeCertificateContextW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleTitle (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleTitleW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter sxsJitStartup (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter jitStartup (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter getJit (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ExpandEnvironmentStrings (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleTitle (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetConsoleTitleW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTimeZoneInformation (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegQueryInfoKey (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegEnumKeyEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserNameEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserNameExW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserName (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetUserNameW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupAccountName (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter LookupAccountNameW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FormatMessage (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FormatMessageW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumCalendarInfoExEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCalendarInfoEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EnumTimeFormatsEx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReleaseMutex (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterEventSource (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterEventSourceW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DeregisterEventSource (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReportEvent (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReportEventW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetLogicalDrives (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetDriveType (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetDriveTypeW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetVolumeInformation (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetVolumeInformationW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter PathIsNetworkPath (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter PathIsNetworkPathW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentDirectoryW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectory (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemDirectoryW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WldpGetLockdownPolicy (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTempPath (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetTempPathW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteFile (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SaferIdentifyLevel (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SaferCloseLevel (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DeleteFile (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DeleteFileW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetSystemInfo (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryPerformanceFrequency (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryPerformanceCounter (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetEvent (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoWaitForMultipleHandles (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadUILanguage (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadUILanguageW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiOpenSession (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiScanBuffer (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpManagerOpen (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpHandleClose (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpFreeMemory (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpScanStart (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpMemoryScanStart (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpScanResult (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpThreatOpen (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpThreatEnumerate (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigOpen (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigGetValue (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigGetValueAlloc (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigClose (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpFastMemoryScanOpen (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpFastMemoryScan (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpTelemetryInitialize (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpTelemetryUninitialize (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpAmsiScan (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpAmsiCloseSession (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpClientUtilExportFunctions (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MpManagerVersionQuery (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EventWrite (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EventUnregister (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter IsWow64Process (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RegisterGPNotification (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter UnregisterGPNotification (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FindFirstFile (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FindFirstFileW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FindClose (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FindNextFile (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter FindNextFileW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetACP (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter UnmapViewOfFile (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetFilePointer (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReadFile (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiCloseSession (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoInitialize (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter StgOpenStorage (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter _create_locale (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter _free_locale (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter _wcstod_l (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyNameObject (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyNameObjectW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CoGetObjectContext (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyEnum (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateAssemblyEnumW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ConvertSidToStringSidW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileName (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleFileNameW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetFileSize (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CreateActCtxW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AddRefActCtx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReleaseActCtx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ActivateActCtx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DeactivateActCtx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentActCtx (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter QueryActCtxW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetLastError (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter EncodePointer (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetModuleHandleA (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetProcAddress (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter malloc (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_ApplicationWrapper_Initialize (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Application_InitializeV1 (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Helpers_SetClrIsNotShuttingDown (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Helpers_GetCurrentSecurityToken (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetComputerName (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetComputerNameW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_Initialize (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeInstanceCallback (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeWriteMessageCallback (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeWriteProgressCallback (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativeWriteErrorCallback (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_OperationCallbacks_NativePromptUserCallback (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_SetupDrainingIfNeeded (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleOutputCP (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetConsoleOutputCPW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter TranslateCharsetInfo (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter TranslateCharsetInfoW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReadConsoleOutput (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter ReadConsoleOutputW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsoleOutput (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsoleOutputW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetCurrentThread (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter SetThreadToken (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_ScheduleDrainingWorkIfNeeded (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_OperationWrapper_DecrementCount_AndDontWorryAboutLifetimeOfMiDotNetDll (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsole (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter WriteConsoleW (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter AmsiUninitialize (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CorExitProcess_RetAddr (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter CorExitProcess (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter DecodePointer (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_Helpers_SetClrIsShuttingDown (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter free (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter GetAddr_SessionHandle_OnReleaseHandleCompleted (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_ApplicationWrapper_SetAppDomainIsUnloading (UID: 00000000-00004540)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter MI_ApplicationWrapper_ScheduleCleanupCallback (UID: 00000000-00004540)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-0","type":7,"relevance":1,"name":"Contacts domains","description":"\"ocsp.sectigo.com\"","description_v2":["\"ocsp.sectigo.com\""],"description_v3":[{"type":"text","value":"\"ocsp.sectigo.com\""}],"origin":"Network Traffic","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-7","type":2,"relevance":1,"name":"Contains PDB pathways","description":"\"C:\\agent\\_work\\66\\s\\build\\ship\\x86\\wixca.pdb\"","description_v2":["\"C:\\agent\\_work\\66\\s\\build\\ship\\x86\\wixca.pdb\""],"description_v3":[{"type":"text","value":"\"C:\\agent\\_work\\66\\s\\build\\ship\\x86\\wixca.pdb\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-16","type":2,"relevance":2,"name":"Contains SQL queries","description":"$4f","description_v2":["\"SELECT `WixCloseApplication`, `Target`, `Description`, `Condition`, `Attributes`, `Property`, `TerminateExitCode`, `Timeout` FROM `WixCloseApplication` ORDER BY `Sequence`\" (Source: zoom.exe, Indicator: \"select `wixcloseapplication`, `target`, `description`, `condition`, `attributes`, `property`, `terminateexitcode`, `timeout` from `wixcloseapplication` order by `sequence`\")","\"SELECT `WixRemoveFolderEx`, `Component_`, `Property`, `InstallMode` FROM `WixRemoveFolderEx`\" (Source: zoom.exe, Indicator: \"select `wixremovefolderex`, `component_`, `property`, `installmode` from `wixremovefolderex`\")","\"SELECT `SecureObjects`.`SecureObject`, `SecureObjects`.`Table`, `SecureObjects`.`Domain`, `SecureObjects`.`User`, `SecureObjects`.`Permission`, `SecureObjects`.`Component_`, `Component`.`Attributes` FROM `SecureObjects`,`Component` WHERE `SecureObjects`.`Component_`=`Component`.`Component`\" (Source: zoom.exe, Indicator: \"select `secureobjects`.`secureobject`, `secureobjects`.`table`, `secureobjects`.`domain`, `secureobjects`.`user`, `secureobjects`.`permission`, `secureobjects`.`component_`, `component`.`attributes` from `secureobjects`,`component` where `secureobjects`.`component_`=`component`.`component`\")","\"SELECT `Registry`.`Registry`, `Registry`.`Root`, `Registry`.`Key` FROM `Registry` WHERE `Registry`.`Registry`=?\" (Source: zoom.exe, Indicator: \"select `registry`.`registry`, `registry`.`root`, `registry`.`key` from `registry` where `registry`.`registry`=?\")","\"SELECT `ServiceInstall`.`Name` FROM `ServiceInstall` WHERE `ServiceInstall`.`ServiceInstall`=?\" (Source: zoom.exe, Indicator: \"select `serviceinstall`.`name` from `serviceinstall` where `serviceinstall`.`serviceinstall`=?\")","\"SELECT `ServiceName`, `Component_`, `NewService`, `FirstFailureActionType`, `SecondFailureActionType`, `ThirdFailureActionType`, `ResetPeriodInDays`, `RestartServiceDelayInSeconds`, `ProgramCommandLine`, `RebootMessage` FROM `ServiceConfig`\" (Source: zoom.exe, Indicator: \"select `servicename`, `component_`, `newservice`, `firstfailureactiontype`, `secondfailureactiontype`, `thirdfailureactiontype`, `resetperiodindays`, `restartservicedelayinseconds`, `programcommandline`, `rebootmessage` from `serviceconfig`\")","\"SELECT `Data` FROM `Binary` WHERE `Name`='%s'\" (Source: zoom.exe, Indicator: \"select `data` from `binary` where `name`='%s'\")","\"SELECT `XmlFile`.`XmlFile`, `XmlFile`.`File`, `XmlFile`.`ElementPath`, `XmlFile`.`Name`, `XmlFile`.`Value`, `XmlFile`.`Flags`, `XmlFile`.`Component_`, `Component`.`Attributes` FROM `XmlFile`,`Component` WHERE `XmlFile`.`Component_`=`Component`.`Component` ORDER BY `File`, `Sequence`\" (Source: zoom.exe, Indicator: \"select `xmlfile`.`xmlfile`, `xmlfile`.`file`, `xmlfile`.`elementpath`, `xmlfile`.`name`, `xmlfile`.`value`, `xmlfile`.`flags`, `xmlfile`.`component_`, `component`.`attributes` from `xmlfile`,`component` where `xmlfile`.`component_`=`component`.`component` order by `file`, `sequence`\")","\"SELECT `XmlConfig`.`XmlConfig`, `XmlConfig`.`File`, `XmlConfig`.`ElementPath`, `XmlConfig`.`VerifyPath`, `XmlConfig`.`Name`, `XmlConfig`.`Value`, `XmlConfig`.`Flags`, `XmlConfig`.`Component_`, `Component`.`Attributes` FROM `XmlConfig`,`Component` WHERE `XmlConfig`.`Component_`=`Component`.`Component` ORDER BY `File`, `Sequence`\" (Source: zoom.exe, Indicator: \"select `xmlconfig`.`xmlconfig`, `xmlconfig`.`file`, `xmlconfig`.`elementpath`, `xmlconfig`.`verifypath`, `xmlconfig`.`name`, `xmlconfig`.`value`, `xmlconfig`.`flags`, `xmlconfig`.`component_`, `component`.`attributes` from `xmlconfig`,`component` where `xmlconfig`.`component_`=`component`.`component` order by `file`, `sequence`\")","\"SELECT * FROM `%s`\" (Source: zoom.exe, Indicator: \"select * from `%s`\")","\"SELECT `Component_`, `Directory_`, `Name`, `Target`, `Attributes`, `IconFile`, `IconIndex` FROM `WixInternetShortcut`\" (Source: zoom.exe, Indicator: \"select `component_`, `directory_`, `name`, `target`, `attributes`, `iconfile`, `iconindex` from `wixinternetshortcut`\")","\"SELECT `WixRestartResource`.`WixRestartResource`, `WixRestartResource`.`Component_`, `WixRestartResource`.`Resource`, `WixRestartResource`.`Attributes` FROM `WixRestartResource`\" (Source: zoom.exe, Indicator: \"select `wixrestartresource`.`wixrestartresource`, `wixrestartresource`.`component_`, `wixrestartresource`.`resource`, `wixrestartresource`.`attributes` from `wixrestartresource`\")"],"description_v3":[{"type":"text","value":"\"SELECT `WixCloseApplication`, `Target`, `Description`, `Condition`, `Attributes`, `Property`, `TerminateExitCode`, `Timeout` FROM `WixCloseApplication` ORDER BY `Sequence`\" (Source: zoom.exe, Indicator: \"select `wixcloseapplication`, `target`, `description`, `condition`, `attributes`, `property`, `terminateexitcode`, `timeout` from `wixcloseapplication` order by `sequence`\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT `WixRemoveFolderEx`, `Component_`, `Property`, `InstallMode` FROM `WixRemoveFolderEx`\" (Source: zoom.exe, Indicator: \"select `wixremovefolderex`, `component_`, `property`, `installmode` from `wixremovefolderex`\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT `SecureObjects`.`SecureObject`, `SecureObjects`.`Table`, `SecureObjects`.`Domain`, `SecureObjects`.`User`, `SecureObjects`.`Permission`, `SecureObjects`.`Component_`, `Component`.`Attributes` FROM `SecureObjects`,`Component` WHERE `SecureObjects`.`Component_`=`Component`.`Component`\" (Source: zoom.exe, Indicator: \"select `secureobjects`.`secureobject`, `secureobjects`.`table`, `secureobjects`.`domain`, `secureobjects`.`user`, `secureobjects`.`permission`, `secureobjects`.`component_`, `component`.`attributes` from `secureobjects`,`component` where `secureobjects`.`component_`=`component`.`component`\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT `Registry`.`Registry`, `Registry`.`Root`, `Registry`.`Key` FROM `Registry` WHERE `Registry`.`Registry`=?\" (Source: zoom.exe, Indicator: \"select `registry`.`registry`, `registry`.`root`, `registry`.`key` from `registry` where `registry`.`registry`=?\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT `ServiceInstall`.`Name` FROM `ServiceInstall` WHERE `ServiceInstall`.`ServiceInstall`=?\" (Source: zoom.exe, Indicator: \"select `serviceinstall`.`name` from `serviceinstall` where `serviceinstall`.`serviceinstall`=?\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT `ServiceName`, `Component_`, `NewService`, `FirstFailureActionType`, `SecondFailureActionType`, `ThirdFailureActionType`, `ResetPeriodInDays`, `RestartServiceDelayInSeconds`, `ProgramCommandLine`, `RebootMessage` FROM `ServiceConfig`\" (Source: zoom.exe, Indicator: \"select `servicename`, `component_`, `newservice`, `firstfailureactiontype`, `secondfailureactiontype`, `thirdfailureactiontype`, `resetperiodindays`, `restartservicedelayinseconds`, `programcommandline`, `rebootmessage` from `serviceconfig`\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT `Data` FROM `Binary` WHERE `Name`='%s'\" (Source: zoom.exe, Indicator: \"select `data` from `binary` where `name`='%s'\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT `XmlFile`.`XmlFile`, `XmlFile`.`File`, `XmlFile`.`ElementPath`, `XmlFile`.`Name`, `XmlFile`.`Value`, `XmlFile`.`Flags`, `XmlFile`.`Component_`, `Component`.`Attributes` FROM `XmlFile`,`Component` WHERE `XmlFile`.`Component_`=`Component`.`Component` ORDER BY `File`, `Sequence`\" (Source: zoom.exe, Indicator: \"select `xmlfile`.`xmlfile`, `xmlfile`.`file`, `xmlfile`.`elementpath`, `xmlfile`.`name`, `xmlfile`.`value`, `xmlfile`.`flags`, `xmlfile`.`component_`, `component`.`attributes` from `xmlfile`,`component` where `xmlfile`.`component_`=`component`.`component` order by `file`, `sequence`\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT `XmlConfig`.`XmlConfig`, `XmlConfig`.`File`, `XmlConfig`.`ElementPath`, `XmlConfig`.`VerifyPath`, `XmlConfig`.`Name`, `XmlConfig`.`Value`, `XmlConfig`.`Flags`, `XmlConfig`.`Component_`, `Component`.`Attributes` FROM `XmlConfig`,`Component` WHERE `XmlConfig`.`Component_`=`Component`.`Component` ORDER BY `File`, `Sequence`\" (Source: zoom.exe, Indicator: \"select `xmlconfig`.`xmlconfig`, `xmlconfig`.`file`, `xmlconfig`.`elementpath`, `xmlconfig`.`verifypath`, `xmlconfig`.`name`, `xmlconfig`.`value`, `xmlconfig`.`flags`, `xmlconfig`.`component_`, `component`.`attributes` from `xmlconfig`,`component` where `xmlconfig`.`component_`=`component`.`component` order by `file`, `sequence`\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT * FROM `%s`\" (Source: zoom.exe, Indicator: \"select * from `%s`\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT `Component_`, `Directory_`, `Name`, `Target`, `Attributes`, `IconFile`, `IconIndex` FROM `WixInternetShortcut`\" (Source: zoom.exe, Indicator: \"select `component_`, `directory_`, `name`, `target`, `attributes`, `iconfile`, `iconindex` from `wixinternetshortcut`\")"},{"type":"linebreak"},{"type":"text","value":"\"SELECT `WixRestartResource`.`WixRestartResource`, `WixRestartResource`.`Component_`, `WixRestartResource`.`Resource`, `WixRestartResource`.`Attributes` FROM `WixRestartResource`\" (Source: zoom.exe, Indicator: \"select `wixrestartresource`.`wixrestartresource`, `wixrestartresource`.`component_`, `wixrestartresource`.`resource`, `wixrestartresource`.`attributes` from `wixrestartresource`\")"}],"origin":"File/Memory","attck_id":"T1213","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1213","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-242","type":2,"relevance":1,"name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"zoom.exe\")","description_v2":["Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1489","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1489","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-204","type":2,"relevance":1,"name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"zoom.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"zoom.exe\")","Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-423","type":2,"relevance":1,"name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"zoom.exe\")\n Found reference to API \"syscall.CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"zoom.exe\")","Found reference to API \"syscall.CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"syscall.CreateDirectory\" (Indicator: \"CreateDirectory\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-220","type":2,"relevance":1,"name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-315","type":2,"relevance":1,"name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"CreateFile\"; File: \"zoom.exe\")\n Found reference to API \"syscall.CreateFile\" (Indicator: \"CreateFile\"; File: \"zoom.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"zoom.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"CreateFile\"; File: \"zoom.exe\")","Found reference to API \"syscall.CreateFile\" (Indicator: \"CreateFile\"; File: \"zoom.exe\")","Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"zoom.exe\")","Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"CreateFile\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"syscall.CreateFile\" (Indicator: \"CreateFile\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-345","type":2,"relevance":1,"name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"zoom.exe\")\n Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"zoom.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"zoom.exe\")","Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"zoom.exe\")","Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-79","type":0,"relevance":1,"name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: zoom.exe)","description_v2":["Found GetProcAddress() and LoadLibraryA() in an import section (Source: zoom.exe)"],"description_v3":[{"type":"text","value":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: zoom.exe)"}],"origin":"Static Parser","attck_id":"T1027.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-101","type":2,"relevance":1,"name":"Contains ability to execute Windows APIs","description":"$50","description_v2":["Found reference to API (Indicator: \"WaitForMultipleObjects\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"LoadLibraryA\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"VirtualAlloc\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"AddVectoredExceptionHandler\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetProcessAffinityMask\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetSystemDirectoryA\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SetConsoleCtrlHandler\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CreateWaitableTimerExW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CreateFileA\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetProcAddress\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CreateThread\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SetErrorMode\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"WriteFile\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"PostQueuedCompletionStatus\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"LoadLibraryW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SetThreadContext\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"DuplicateHandle\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CreateIoCompletionPort\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetConsoleMode\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SetEvent\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetEnvironmentStringsW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetSystemInfo\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"ExitProcess\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CreateEventA\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CloseHandle\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"WriteConsoleW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SetWaitableTimer\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"VirtualFree\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetThreadContext\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetQueuedCompletionStatusEx\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetStdHandle\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"ResumeThread\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SetProcessPriorityBoost\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"VirtualQuery\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SwitchToThread\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SuspendThread\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"WSAIoctl\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetFileType\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetFileInformationByHandle\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"LoadLibraryExW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SeShutdownPrivilege\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SeDebugPrivilege\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"IsWow64Process\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"Wow64EnableWow64FsRedirection\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"FlsAlloc\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"FlsFree\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"FlsGetValue\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"FlsSetValue\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"LCMapStringEx\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"LocaleNameToLCID\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"LookupAccountSidW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetSecurityDescriptorControl\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetSecurityDescriptorDacl\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"ConvertStringSecurityDescriptorToSecurityDescriptorW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"ConvertSecurityDescriptorToStringSecurityDescriptorW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SetEntriesInAclW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetNamedSecurityInfoW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SetNamedSecurityInfoW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"OpenProcessToken\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"AdjustTokenPrivileges\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"LookupPrivilegeValueW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CloseServiceHandle\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"OpenSCManagerW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"OpenServiceW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"RegCloseKey\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"RegOpenKeyExW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetTokenInformation\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CreateWellKnownSid\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"LookupAccountNameW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"RegCreateKeyExW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"RegDeleteKeyW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"RegDeleteValueW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"RegEnumKeyExW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"RegEnumValueW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"RegQueryInfoKeyW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"RegQueryValueExW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"RegSetValueExW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"EnumWindows\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetWindowThreadProcessId\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetSystemMetrics\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"TranslateMessage\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"DispatchMessageW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"DefWindowProcW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"PostQuitMessage\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"RegisterClassW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"UnregisterClassW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CreateWindowExW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"IsWindow\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SHGetFolderPathW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"ShellExecuteW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CoInitialize\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CoUninitialize\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CoCreateInstance\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetFileVersionInfoSizeW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetFileVersionInfoW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"VerQueryValueW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"OpenProcess\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"TerminateProcess\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetLastError\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SetLastError\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"FreeLibrary\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"LocalFree\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetVersionExW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"FindClose\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"FindFirstFileW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"FindNextFileW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"lstrcmpW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"FormatMessageW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"lstrcmpiW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetTempPathW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CreateFileW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CreateEventW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"Sleep\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"lstrlenW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"LCMapStringW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SetFilePointer\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetModuleFileNameA\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetSystemDirectoryW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"HeapAlloc\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"HeapReAlloc\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"HeapFree\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"HeapSize\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetProcessHeap\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetExitCodeProcess\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CreatePipe\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CreateProcessW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetPriorityClass\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CreateToolhelp32Snapshot\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"Process32FirstW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"Process32NextW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GlobalAlloc\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GlobalFree\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetFileSizeEx\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"ReadFile\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetFileTime\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SetFileTime\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"ExpandEnvironmentStringsW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetFullPathNameW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SetFileAttributesW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"DeleteFileW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"InterlockedIncrement\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"InterlockedDecrement\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetProcessTimes\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"InitializeCriticalSection\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"DeleteCriticalSection\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetModuleFileNameW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetModuleHandleA\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GlobalDeleteAtom\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GlobalAddAtomW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GlobalFindAtomW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetTickCount\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"FlushFileBuffers\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetWindowsDirectoryW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"UnhandledExceptionFilter\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"InitializeSListHead\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"IsDebuggerPresent\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetStartupInfoW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"InterlockedFlushSList\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"RtlUnwind\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"TlsAlloc\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"TlsGetValue\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"TlsSetValue\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"TlsFree\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"RaiseException\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetModuleHandleExW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetStringTypeW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetACP\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"FindFirstFileExA\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"FindNextFileA\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"IsValidCodePage\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetOEMCP\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetCPInfo\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetCommandLineA\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetCommandLineW\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"SetStdHandle\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"GetConsoleCP\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"DecodePointer\"; File: \"zoom.exe\")","Found reference to API (Indicator: \"CryptEncrypt\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptExportKey\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptImportKey\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptEncrypt\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptExportKey\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","Found reference to API (Indicator: \"InitializeConditionVariable\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"SleepConditionVariableCS\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"WakeAllConditionVariable\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"EventRegister\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"EventUnregister\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileVersionInfoSizeExW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileVersionInfoSizeW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileVersionInfoW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileVersionInfoExW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"VerQueryValueW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"RaiseException\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSection\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadLibraryExW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcessTimes\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetVersionExW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTickCount\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlVirtualUnwind\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleExW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"CoCreateInstance\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"CoTaskMemFree\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"StringFromGUID2\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileSizeEx\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTempPathW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemDirectoryW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateEventW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"DisableThreadLibraryCalls\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"EncodePointer\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"DecodePointer\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"CoTaskMemAlloc\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"SizeofResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"LockResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"FindResourceW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API (Indicator: \"WaitForMultipleObjects\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryA\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualAlloc\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AddVectoredExceptionHandler\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessAffinityMask\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemDirectoryA\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetConsoleCtrlHandler\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateWaitableTimerExW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileA\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThread\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetErrorMode\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFile\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PostQueuedCompletionStatus\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadContext\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DuplicateHandle\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateIoCompletionPort\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleMode\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEvent\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentStringsW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemInfo\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitProcess\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventA\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseHandle\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteConsoleW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetWaitableTimer\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualFree\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetThreadContext\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetQueuedCompletionStatusEx\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStdHandle\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ResumeThread\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetProcessPriorityBoost\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualQuery\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SwitchToThread\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SuspendThread\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAIoctl\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileType\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileInformationByHandle\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryExW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SeShutdownPrivilege\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SeDebugPrivilege\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsWow64Process\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Wow64EnableWow64FsRedirection\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsAlloc\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsFree\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsGetValue\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsSetValue\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringEx\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocaleNameToLCID\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LookupAccountSidW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSecurityDescriptorControl\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSecurityDescriptorDacl\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ConvertStringSecurityDescriptorToSecurityDescriptorW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ConvertSecurityDescriptorToStringSecurityDescriptorW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEntriesInAclW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetNamedSecurityInfoW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetNamedSecurityInfoW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenProcessToken\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AdjustTokenPrivileges\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LookupPrivilegeValueW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseServiceHandle\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenSCManagerW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenServiceW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCloseKey\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegOpenKeyExW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTokenInformation\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateWellKnownSid\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LookupAccountNameW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCreateKeyExW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegDeleteKeyW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegDeleteValueW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegEnumKeyExW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegEnumValueW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegQueryInfoKeyW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegQueryValueExW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegSetValueExW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumWindows\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowThreadProcessId\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemMetrics\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TranslateMessage\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DispatchMessageW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DefWindowProcW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PostQuitMessage\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterClassW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnregisterClassW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateWindowExW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsWindow\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHGetFolderPathW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShellExecuteW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoInitialize\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoUninitialize\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoCreateInstance\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileVersionInfoSizeW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileVersionInfoW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerQueryValueW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenProcess\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastError\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetLastError\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibrary\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocalFree\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetVersionExW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindClose\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindNextFileW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"lstrcmpW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FormatMessageW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"lstrcmpiW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"lstrlenW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointer\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameA\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemDirectoryW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapAlloc\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapReAlloc\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapFree\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapSize\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessHeap\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeProcess\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreatePipe\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateProcessW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetPriorityClass\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateToolhelp32Snapshot\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Process32FirstW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Process32NextW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalAlloc\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalFree\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSizeEx\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadFile\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileTime\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileTime\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExpandEnvironmentStringsW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFullPathNameW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileAttributesW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedIncrement\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedDecrement\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessTimes\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSection\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteCriticalSection\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleA\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalDeleteAtom\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalAddAtomW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalFindAtomW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushFileBuffers\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetWindowsDirectoryW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhandledExceptionFilter\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSListHead\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsDebuggerPresent\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStartupInfoW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedFlushSList\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlUnwind\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsAlloc\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsGetValue\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsSetValue\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsFree\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RaiseException\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleExW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStringTypeW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetACP\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileExA\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindNextFileA\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidCodePage\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetOEMCP\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCPInfo\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineA\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineW\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetStdHandle\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleCP\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DecodePointer\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptEncrypt\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptExportKey\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptImportKey\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptEncrypt\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptExportKey\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeConditionVariable\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepConditionVariableCS\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WakeAllConditionVariable\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EventRegister\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EventUnregister\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileVersionInfoSizeExW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileVersionInfoSizeW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileVersionInfoW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileVersionInfoExW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerQueryValueW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RaiseException\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSection\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryExW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessTimes\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetVersionExW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlVirtualUnwind\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleExW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoCreateInstance\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoTaskMemFree\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"StringFromGUID2\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSizeEx\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemDirectoryW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DisableThreadLibraryCalls\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EncodePointer\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DecodePointer\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoTaskMemAlloc\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SizeofResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LockResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindResourceW\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-240","type":2,"relevance":1,"name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"zoom.exe\")","description_v2":["Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-550","type":2,"relevance":1,"name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","description_v2":["Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-322","type":2,"relevance":1,"name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"MoveFile\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-206","type":2,"relevance":1,"name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"zoom.exe\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"zoom.exe\")","Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")","Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")","Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1059.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-161","type":2,"relevance":1,"name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"zoom.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"zoom.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"zoom.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"zoom.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"zoom.exe\")","description_v2":["Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"zoom.exe\")","Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"zoom.exe\")","Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"zoom.exe\")","Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"zoom.exe\")","Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"OpenThread\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"OpenThread\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-319","type":2,"relevance":1,"name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; File: \"zoom.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"zoom.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"zoom.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","description_v2":["file/memory contains long string with (Indicator: \"GetLastError\"; File: \"zoom.exe\")","Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"zoom.exe\")","Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"zoom.exe\")","Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"GetLastError\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-208","type":2,"relevance":1,"name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"zoom.exe\")","description_v2":["Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-209","type":2,"relevance":1,"name":"Contains ability to start a service (API string)","description":"file/memory contains long string with (Indicator: \"StartService\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"StartService\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"StartService\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-120","type":2,"relevance":1,"name":"Contains registry location strings","description":"$51","description_v2":["\"uSoftware\\Policies\\Microsoft\\Windows\\Installer\" in Source: zoom.exe","\"Software\\Policies\\Microsoft\\Windows\\Installer\" in Source: zoom.exe","\"STRY\\USER\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00002548.00000001.230295.035E0000.00000004.mdmp","\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp","00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp","\"1\\Scripts\\;C:\\Users\\HAPUBWS\\AppData\\Local\\Programs\\Python\\Python311\\;C:\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\WindowsApps;C:\\Program Files\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{000C101C-0000-0000-C000-000000000046}\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp","00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp","\"Y\\MACHINE\\SOFTWARE\\Classes\\AppID\\powershell.exe\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp","00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp","\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00002636.00000000.228765.6D640000.00000004.mdmp","00000000-00002636.00000001.229385.6D640000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp","00000000-00002636.00000001.229385.6DC20000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp","00000000-00002636.00000001.229385.6DC20000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp","00000000-00002636.00000001.229385.6DC20000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\WOW6432Node\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp","00000000-00002636.00000001.229385.6DC20000.00000004.mdmp","\"REGISTRY\\MACHINE\\Software\\WOW6432NodeP\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp","00000000-00002636.00000001.229385.6DC20000.00000004.mdmp","\"REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000339-0000-0000-C000-000000000046}\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp","\"REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000339-0000-0000-C000-000000000,\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"uSoftware\\Policies\\Microsoft\\Windows\\Installer\" in Source: zoom.exe"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\Installer\" in Source: zoom.exe"},{"type":"linebreak"},{"type":"text","value":"\"STRY\\USER\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00002548.00000001.230295.035E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"1\\Scripts\\;C:\\Users\\%USERNAME%\\AppData\\Local\\Programs\\Python\\Python311\\;C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\WindowsApps;%PROGRAMFILES%\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{000C101C-0000-0000-C000-000000000046}\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Y\\MACHINE\\SOFTWARE\\Classes\\AppID\\powershell.exe\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00002636.00000000.228765.6D640000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002636.00000001.229385.6D640000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002636.00000001.229385.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002636.00000001.229385.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002636.00000001.229385.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\WOW6432Node\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002636.00000001.229385.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"REGISTRY\\MACHINE\\Software\\WOW6432NodeP\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002636.00000001.229385.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000339-0000-0000-C000-000000000046}\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000339-0000-0000-C000-000000000,\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"$52","description_v2":["Process zoom.exe created mutex with name \"\\BaseNamedObjects\\_MSIExecute\"","Process zoom.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3924:168:WilStaging_02\"","Process zoom.exe created mutex with name \"Local\\SM0:3924:168:WilStaging_02\"","Process zoom.exe created mutex with name \"SM0:3924:168:WilStaging_02\"","Process zoom.exe created mutex with name \"SM0:3924:64:WilError_01\"","Process zoom.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:3924:168:WilStaging_02\"","Process zoom.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:3924:64:WilError_01\"","Process msiexec.exe created mutex with name \"\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"","Process msiexec.exe created mutex with name \"\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"","Process msiexec.exe created mutex with name \"\\BaseNamedObjects\\Local\\SM0:3340:304:WilStaging_02\"","Process msiexec.exe created mutex with name \"\\BaseNamedObjects\\SM0:3340:120:WilError_01\"","Process msiexec.exe created mutex with name \"\\BaseNamedObjects\\SM0:3340:304:WilStaging_02\"","Process MsiExec.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:2128:168:WilStaging_02\"","Process MsiExec.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2128:168:WilStaging_02\"","Process MsiExec.exe created mutex with name \"Local\\SM0:2128:168:WilStaging_02\"","Process MsiExec.exe created mutex with name \"SM0:2128:168:WilStaging_02\"","Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"","Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","Process powershell.exe created mutex with name \"SM0:2636:304:WilStaging_02\"","Process powershell.exe created mutex with name \"Local\\ZonesCacheCounterMutex\"","Process powershell.exe created mutex with name \"Local\\ZonesLockedCacheCounterMutex\"","Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:2636:304:WilStaging_02\"","Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:4540:304:WilStaging_02\"","Process powershell.exe created mutex with name \"SM0:4540:304:WilStaging_02\""],"description_v3":[{"type":"text","value":"Process zoom.exe created mutex with name \"\\BaseNamedObjects\\_MSIExecute\""},{"type":"linebreak"},{"type":"text","value":"Process zoom.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3924:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process zoom.exe created mutex with name \"Local\\SM0:3924:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process zoom.exe created mutex with name \"SM0:3924:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process zoom.exe created mutex with name \"SM0:3924:64:WilError_01\""},{"type":"linebreak"},{"type":"text","value":"Process zoom.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:3924:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process zoom.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:3924:64:WilError_01\""},{"type":"linebreak"},{"type":"text","value":"Process msiexec.exe created mutex with name \"\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\""},{"type":"linebreak"},{"type":"text","value":"Process msiexec.exe created mutex with name \"\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\""},{"type":"linebreak"},{"type":"text","value":"Process msiexec.exe created mutex with name \"\\BaseNamedObjects\\Local\\SM0:3340:304:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process msiexec.exe created mutex with name \"\\BaseNamedObjects\\SM0:3340:120:WilError_01\""},{"type":"linebreak"},{"type":"text","value":"Process msiexec.exe created mutex with name \"\\BaseNamedObjects\\SM0:3340:304:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process MsiExec.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:2128:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process MsiExec.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2128:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process MsiExec.exe created mutex with name \"Local\\SM0:2128:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process MsiExec.exe created mutex with name \"SM0:2128:168:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"Process powershell.exe created mutex with name \"SM0:2636:304:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process powershell.exe created mutex with name \"Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"Process powershell.exe created mutex with name \"Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:2636:304:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process powershell.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:4540:304:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"Process powershell.exe created mutex with name \"SM0:4540:304:WilStaging_02\""}],"origin":"Created Mutant","attck_id":"T1480.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-486","type":9,"relevance":1,"name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program '%PROGRAMFILES%\\\\(x86)\\\\FleetDeck Agent\\\\fleetdeck_agent_svc.exe' -Action Allow\"\" (UID: 00000000-00002636)\n Process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program '%PROGRAMFILES%\\\\(x86)\\\\FleetDeck Agent\\\\fleetdeck_agent_svc.exe' -Action Allow\"\" (UID: 00000000-00004540)","description_v2":["Process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program '%PROGRAMFILES%\\\\(x86)\\\\FleetDeck Agent\\\\fleetdeck_agent_svc.exe' -Action Allow\"\" (UID: 00000000-00002636)","Process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program '%PROGRAMFILES%\\\\(x86)\\\\FleetDeck Agent\\\\fleetdeck_agent_svc.exe' -Action Allow\"\" (UID: 00000000-00004540)"],"description_v3":[{"type":"text","value":"Process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program '%PROGRAMFILES%\\\\(x86)\\\\FleetDeck Agent\\\\fleetdeck_agent_svc.exe' -Action Allow\"\""},{"type":"process","process_uid":"00000000-00002636","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program '%PROGRAMFILES%\\\\(x86)\\\\FleetDeck Agent\\\\fleetdeck_agent_svc.exe' -Action Allow\"\""},{"type":"process","process_uid":"00000000-00004540","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1059.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-22","type":6,"relevance":1,"name":"Fails to load modules at runtime","description":"$53","description_v2":["\"zoom.exe\" failed to load missing module \"%WINDIR%\\SysWOW64\\TSAPPCMP.DLL\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wldp.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\urlmon.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\api-ms-win-core-libraryloader-l1-2-0.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\msvcrt.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\mi.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\api-ms-win-core-processthreads-l1-1-0.dll\" - [base:0; Status:c0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\api-ms-win-core-handle-l1-1-0.dll\" - [base:0; Status:c0000135]"],"description_v3":[{"type":"text","value":"\"zoom.exe\" failed to load missing module \"%WINDIR%\\SysWOW64\\TSAPPCMP.DLL\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wldp.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\urlmon.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\api-ms-win-core-libraryloader-l1-2-0.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\msvcrt.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\mi.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\api-ms-win-core-processthreads-l1-1-0.dll\" - [base:0; Status:c0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\Microsoft.Management.Infrastructure.Native\\v4.0_1.0.0.0__31bf3856ad364e35\\api-ms-win-core-handle-l1-1-0.dll\" - [base:0; Status:c0000135]"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-154","type":0,"relevance":0,"name":"File contains dynamic base/NX flags","description":"\"zoom.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","description_v2":["\"zoom.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"],"description_v3":[{"type":"text","value":"\"zoom.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-63","type":2,"relevance":3,"name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","description_v2":["Pattern match: \"premium-server@thawte.com\""],"description_v3":[{"type":"text","value":"Pattern match: \"premium-server@thawte.com\""}],"origin":"File/Memory","attck_id":"T1114","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1114","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-146","type":2,"relevance":1,"name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.134346960327451147.2636.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134346962674272721.4540.DefaultAppDomain.powershell","description_v2":["Found string - \\\\.\\pipe\\PSHost.134346960327451147.2636.DefaultAppDomain.powershell","Found string - \\\\.\\pipe\\PSHost.134346962674272721.4540.DefaultAppDomain.powershell"],"description_v3":[{"type":"text","value":"Found string - \\\\.\\pipe\\PSHost.134346960327451147.2636.DefaultAppDomain.powershell"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\pipe\\PSHost.134346962674272721.4540.DefaultAppDomain.powershell"}],"origin":"File/Memory","attck_id":"T1559","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1559","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"memorydump-10","type":20,"relevance":1,"name":"Found registry location strings in memory","description":"$54","description_v2":["\"STRY\\USER\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00002548.00000001.230295.035E0000.00000004.mdmp","\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp","\"1\\Scripts\\;C:\\Users\\HAPUBWS\\AppData\\Local\\Programs\\Python\\Python311\\;C:\\Users\\HAPUBWS\\AppData\\Local\\Microsoft\\WindowsApps;C:\\Program Files\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{000C101C-0000-0000-C000-000000000046}\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp","\"Y\\MACHINE\\SOFTWARE\\Classes\\AppID\\powershell.exe\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp","\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00002636.00000000.228765.6D640000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\WOW6432Node\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp","\"REGISTRY\\MACHINE\\Software\\WOW6432NodeP\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp","\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp","\"Y\\MACHINE\\SOFTWARE\\Classes\\AppID\\powershell.exe\" in Source: 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp","\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00002636.00000001.229385.6D640000.00000004.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp","\"REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000339-0000-0000-C000-000000000046}\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp","\"REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000339-0000-0000-C000-000000000,\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\WOW6432Node\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp","\"REGISTRY\\MACHINE\\Software\\WOW6432NodeP\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00003924.00000000.228373.02CB0000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\AppID\\zoom.exe\" in Source: 00000000-00003924.00000000.228373.02CB0000.00000004.mdmp","\"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\W\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{752073A1-23F2-4396\" in Source: 00000000-00003924.00000000.228373.02CB0000.00000004.mdmp","$55","\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00003924.00000001.230292.02CB0000.00000004.mdmp","\"Registry\\Machine\\Software\\Classes\\AppID\\zoom.exe\" in Source: 00000000-00003924.00000001.230292.02CB0000.00000004.mdmp","\"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\W\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{752073A1-23F2-4396\" in Source: 00000000-00003924.00000001.230292.02CB0000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00003924.00000002.230420.02CB0000.00000004.mdmp","\"SOFTWARE\\Microsoft\\PowerShell\\%1!ls!\\PowerShellEngine\" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp","\"SOFTWARE\\Microsoft\\PowerShell\" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp","\"SOFTWARE\\Microsoft\\PowerShell\\%1!ls!\" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\MiniNT\" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp","\"SOFTWARE\\Microsoft\\PowerShell\\3\" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp","\"Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}\" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp","\"SOFTWARE\\Policies\\Microsoft\" in Source: 00000000-00004540.00000000.229712.0E668000.00000002.mdmp","\"HKLM\\\" in Source: 00000000-00004540.00000000.229712.0E668000.00000002.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\Stats\" in Source: 00000000-00004540.00000000.229712.0E668000.00000002.mdmp","\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00004540.00000000.229712.0E668000.00000002.mdmp","\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Server\\ServerLevels\" in Source: 00000000-00004540.00000000.229712.0E668000.00000002.mdmp","\"E\\Software\\M\" in Source: 00000000-00004540.00000000.229712.360D0000.00000004.mdmp","\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00004540.00000000.229712.360D0000.00000004.mdmp","\"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\W\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000C101C-0000-0000-C000-000000000046}\" in Source: 00000000-00004540.00000000.229712.360D0000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00004540.00000000.229712.360D0000.00000004.mdmp","\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00004540.00000000.229712.505E0000.00000004.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00004540.00000000.229712.50C29000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: 00000000-00004540.00000000.229712.50C29000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00004540.00000000.229712.50C29000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\WOW6432Node\" in Source: 00000000-00004540.00000000.229712.50C29000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\WOW6432NodeP\" in Source: 00000000-00004540.00000000.229712.50C29000.00000004.mdmp","\"E\\Software\\M\" in Source: 00000000-00004540.00000001.230288.360D0000.00000004.mdmp","\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00004540.00000001.230288.360D0000.00000004.mdmp","\"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\W\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000C101C-0000-0000-C000-000000000046}\" in Source: 00000000-00004540.00000001.230288.360D0000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00004540.00000001.230288.360D0000.00000004.mdmp","\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00004540.00000001.230288.505E0000.00000004.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00004540.00000001.230288.50C29000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00004540.00000001.230288.50C72000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\WOW6432Node\" in Source: 00000000-00004540.00000001.230288.50C72000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\WOW6432NodeP\" in Source: 00000000-00004540.00000001.230288.50C72000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00004540.00000001.230288.50CD3000.00000004.mdmp","\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\" in Source: 00000000-00004540.00000001.230288.50DBA000.00000004.mdmp","\"REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\" in Source: 00000000-00004540.00000001.230288.50DBA000.00000004.mdmp"],"description_v3":[{"type":"text","value":"\"STRY\\USER\\S-1-5-18\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" in Source: 00000000-00002548.00000001.230295.035E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"1\\Scripts\\;C:\\Users\\%USERNAME%\\AppData\\Local\\Programs\\Python\\Python311\\;C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\WindowsApps;C:\\Program Files\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{000C101C-0000-0000-C000-000000000046}\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Y\\MACHINE\\SOFTWARE\\Classes\\AppID\\powershell.exe\" in Source: 00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00002636.00000000.228765.6D640000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Lockdown_Zones\\\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\WOW6432Node\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"REGISTRY\\MACHINE\\Software\\WOW6432NodeP\" in Source: 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Y\\MACHINE\\SOFTWARE\\Classes\\AppID\\powershell.exe\" in Source: 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00002636.00000001.229385.6D640000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000339-0000-0000-C000-000000000046}\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000339-0000-0000-C000-000000000,\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\WOW6432Node\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"REGISTRY\\MACHINE\\Software\\WOW6432NodeP\" in Source: 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00003924.00000000.228373.02CB0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\AppID\\zoom.exe\" in Source: 00000000-00003924.00000000.228373.02CB0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Path=%ALLUSERSPROFILE%\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\W\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{752073A1-23F2-4396\" in Source: 00000000-00003924.00000000.228373.02CB0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"$56"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00003924.00000001.230292.02CB0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Registry\\Machine\\Software\\Classes\\AppID\\zoom.exe\" in Source: 00000000-00003924.00000001.230292.02CB0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\W\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{752073A1-23F2-4396\" in Source: 00000000-00003924.00000001.230292.02CB0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00003924.00000002.230420.02CB0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\PowerShell\\%1!ls!\\PowerShellEngine\" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\PowerShell\" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\PowerShell\\%1!ls!\" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\MiniNT\" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\PowerShell\\3\" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}\" in Source: 00000000-00004540.00000000.229712.010FA000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Policies\\Microsoft\" in Source: 00000000-00004540.00000000.229712.0E668000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKLM\\\" in Source: 00000000-00004540.00000000.229712.0E668000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\Stats\" in Source: 00000000-00004540.00000000.229712.0E668000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00004540.00000000.229712.0E668000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Server\\ServerLevels\" in Source: 00000000-00004540.00000000.229712.0E668000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"E\\Software\\M\" in Source: 00000000-00004540.00000000.229712.360D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00004540.00000000.229712.360D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\W\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000C101C-0000-0000-C000-000000000046}\" in Source: 00000000-00004540.00000000.229712.360D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00004540.00000000.229712.360D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00004540.00000000.229712.505E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00004540.00000000.229712.50C29000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" in Source: 00000000-00004540.00000000.229712.50C29000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00004540.00000000.229712.50C29000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\WOW6432Node\" in Source: 00000000-00004540.00000000.229712.50C29000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\WOW6432NodeP\" in Source: 00000000-00004540.00000000.229712.50C29000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"E\\Software\\M\" in Source: 00000000-00004540.00000001.230288.360D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00004540.00000001.230288.360D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Path=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\W\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{000C101C-0000-0000-C000-000000000046}\" in Source: 00000000-00004540.00000001.230288.360D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00004540.00000001.230288.360D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00004540.00000001.230288.505E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00004540.00000001.230288.50C29000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00004540.00000001.230288.50C72000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\WOW6432Node\" in Source: 00000000-00004540.00000001.230288.50C72000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\WOW6432NodeP\" in Source: 00000000-00004540.00000001.230288.50C72000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\Software\\Classes\\PackagedCom\" in Source: 00000000-00004540.00000001.230288.50CD3000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\" in Source: 00000000-00004540.00000001.230288.50DBA000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"REGISTRY\\MACHINE\\SOFTWARE\\Classes\\WOW6432Node\\CLSID\\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\" in Source: 00000000-00004540.00000001.230288.50DBA000.00000004.mdmp"}],"origin":"Memory Dumps","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-135","type":2,"relevance":1,"name":"Found well known domains (string)","description":"\"dep\tgithub.com/miekg/dns\tv1.1.43\th1:JKfpVSCB84vrAmHzyrsxB5NAr5kLoMXZArPSw7Qlgyg=\" (Indicator: \"github.com\")","description_v2":["\"dep\tgithub.com/miekg/dns\tv1.1.43\th1:JKfpVSCB84vrAmHzyrsxB5NAr5kLoMXZArPSw7Qlgyg=\" (Indicator: \"github.com\")"],"description_v3":[{"type":"text","value":"\"dep\tgithub.com/miekg/dns\tv1.1.43\th1:JKfpVSCB84vrAmHzyrsxB5NAr5kLoMXZArPSw7Qlgyg=\" (Indicator: \"github.com\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-2","type":7,"relevance":5,"name":"GETs files from a web server (PE files)","description":"$57","description_v2":["\"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1","Connection: Keep-Alive","Accept: */*","User-Agent: Microsoft-CryptoAPI/10.0","Host: ocsp.sectigo.com\" Response ==> HTTP/1.1 200 OK","Date: Thu","24 Sep 2026 04:00:33 GMT","Content-Type: application/ocsp-response","Content-Length: 765","Connection: keep-alive","CF-Ray: a3fee1fec937405d-SJC","CF-Cache-Status: HIT","Accept-Ranges: bytes","Age: 1066","Cache-Control: max-age=445392","s-maxage=1800","public","no-transform","must-revalidate","ETag: \"b99d5bb5088549867eecadc8ae7707db3a8878db\"","Expires: Tue","29 Sep 2026 06:56:27 GMT","Last-Modified: Tue","22 Sep 2026 06:56:28 GMT","Server: cloudflare","X-CCACDN-Proxy-ID: scdpinlb6","X-Frame-Options: SAMEORIGIN","set-cookie: __cf_bm=OX8akekXItYav31iOkQydObTIBqvAgXk0oWclNhEcvA-1790222433.081204-1.0.1.1-tAPRuM_kBgqEth0IyK1hXwHDOsRWfEVODXLO0zAoNLIgWFO.KKdQThs6BCCiP8GWK.h.HtkJibHANi10aemKMinGNonzPb6zFT2NbDvNEOxQGxOduaLymxkzy6Iwgh3I; HttpOnly; Path=/; Domain=ocsp.sectigo.com; Expires=Thu","24 Sep 2026 04:30:33 GMT with response body ==>30C28202C3B90A0100C2A0C28202C3B230C28202C3AE06092B060105050730010104C28202C39F30C28202C39B30C281C384C2A216041432C3ABC292C29AC3BF.......","\"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1","Connection: Keep-Alive","Accept: */*","User-Agent: Microsoft-CryptoAPI/10.0","Host: ocsp.sectigo.com\" Response ==> HTTP/1.1 200 OK","Date: Thu","24 Sep 2026 04:00:33 GMT","Content-Type: application/ocsp-response","Content-Length: 638","Connection: keep-alive","CF-Ray: a3fee1ff5a34405d-SJC","CF-Cache-Status: HIT","Accept-Ranges: bytes","Age: 1096","Cache-Control: max-age=526778","s-maxage=1800","public","no-transform","must-revalidate","ETag: \"b8daeafeadf6ce149692bc239ce5f1f64cc391b5\"","Expires: Wed","30 Sep 2026 05:53:33 GMT","Last-Modified: Wed","23 Sep 2026 05:53:34 GMT","Server: cloudflare","X-CCACDN-Proxy-ID: scdpinlb6","X-Frame-Options: SAMEORIGIN","set-cookie: __cf_bm=yilWTiY2TcnDfpxWYUHNDGdkoD8b7RfQLZ3Bnpt65j4-1790222433.1794693-1.0.1.1-.smLFo0m7z_h11S459QUAG_mHbNjEIYYO4BVi1zLPbsyj9Uc9a3RijSWVO2ld0mH3uh25uBq6UH_xode3mI8TlONJ5nWKk5nQjdfvyog51q3zGuRq.igPCO5YlmalVVt; HttpOnly; Path=/; Domain=ocsp.sectigo.com; Expires=Thu","24 Sep 2026 04:30:33 GMT with response body ==>30C282027A0A0100C2A0C282027330C282026F06092B060105050730010104C282026030C282025C30C281C385C2A2160414C28132C292412B28C38D46C388C3......."],"description_v3":[{"type":"text","value":"\"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Connection: Keep-Alive"},{"type":"linebreak"},{"type":"text","value":"Accept: */*"},{"type":"linebreak"},{"type":"text","value":"User-Agent: Microsoft-CryptoAPI/10.0"},{"type":"linebreak"},{"type":"text","value":"Host: ocsp.sectigo.com\" Response ==> HTTP/1.1 200 OK"},{"type":"linebreak"},{"type":"text","value":"Date: Thu"},{"type":"linebreak"},{"type":"text","value":"24 Sep 2026 04:00:33 GMT"},{"type":"linebreak"},{"type":"text","value":"Content-Type: application/ocsp-response"},{"type":"linebreak"},{"type":"text","value":"Content-Length: 765"},{"type":"linebreak"},{"type":"text","value":"Connection: keep-alive"},{"type":"linebreak"},{"type":"text","value":"CF-Ray: a3fee1fec937405d-SJC"},{"type":"linebreak"},{"type":"text","value":"CF-Cache-Status: HIT"},{"type":"linebreak"},{"type":"text","value":"Accept-Ranges: bytes"},{"type":"linebreak"},{"type":"text","value":"Age: 1066"},{"type":"linebreak"},{"type":"text","value":"Cache-Control: max-age=445392"},{"type":"linebreak"},{"type":"text","value":"s-maxage=1800"},{"type":"linebreak"},{"type":"text","value":"public"},{"type":"linebreak"},{"type":"text","value":"no-transform"},{"type":"linebreak"},{"type":"text","value":"must-revalidate"},{"type":"linebreak"},{"type":"text","value":"ETag: \"b99d5bb5088549867eecadc8ae7707db3a8878db\""},{"type":"linebreak"},{"type":"text","value":"Expires: Tue"},{"type":"linebreak"},{"type":"text","value":"29 Sep 2026 06:56:27 GMT"},{"type":"linebreak"},{"type":"text","value":"Last-Modified: Tue"},{"type":"linebreak"},{"type":"text","value":"22 Sep 2026 06:56:28 GMT"},{"type":"linebreak"},{"type":"text","value":"Server: cloudflare"},{"type":"linebreak"},{"type":"text","value":"X-CCACDN-Proxy-ID: scdpinlb6"},{"type":"linebreak"},{"type":"text","value":"X-Frame-Options: SAMEORIGIN"},{"type":"linebreak"},{"type":"text","value":"set-cookie: __cf_bm=OX8akekXItYav31iOkQydObTIBqvAgXk0oWclNhEcvA-1790222433.081204-1.0.1.1-tAPRuM_kBgqEth0IyK1hXwHDOsRWfEVODXLO0zAoNLIgWFO.KKdQThs6BCCiP8GWK.h.HtkJibHANi10aemKMinGNonzPb6zFT2NbDvNEOxQGxOduaLymxkzy6Iwgh3I; HttpOnly; Path=/; Domain=ocsp.sectigo.com; Expires=Thu"},{"type":"linebreak"},{"type":"text","value":"24 Sep 2026 04:30:33 GMT with response body ==>30C28202C3B90A0100C2A0C28202C3B230C28202C3AE06092B060105050730010104C28202C39F30C28202C39B30C281C384C2A216041432C3ABC292C29AC3BF......."},{"type":"linebreak"},{"type":"text","value":"\"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Connection: Keep-Alive"},{"type":"linebreak"},{"type":"text","value":"Accept: */*"},{"type":"linebreak"},{"type":"text","value":"User-Agent: Microsoft-CryptoAPI/10.0"},{"type":"linebreak"},{"type":"text","value":"Host: ocsp.sectigo.com\" Response ==> HTTP/1.1 200 OK"},{"type":"linebreak"},{"type":"text","value":"Date: Thu"},{"type":"linebreak"},{"type":"text","value":"24 Sep 2026 04:00:33 GMT"},{"type":"linebreak"},{"type":"text","value":"Content-Type: application/ocsp-response"},{"type":"linebreak"},{"type":"text","value":"Content-Length: 638"},{"type":"linebreak"},{"type":"text","value":"Connection: keep-alive"},{"type":"linebreak"},{"type":"text","value":"CF-Ray: a3fee1ff5a34405d-SJC"},{"type":"linebreak"},{"type":"text","value":"CF-Cache-Status: HIT"},{"type":"linebreak"},{"type":"text","value":"Accept-Ranges: bytes"},{"type":"linebreak"},{"type":"text","value":"Age: 1096"},{"type":"linebreak"},{"type":"text","value":"Cache-Control: max-age=526778"},{"type":"linebreak"},{"type":"text","value":"s-maxage=1800"},{"type":"linebreak"},{"type":"text","value":"public"},{"type":"linebreak"},{"type":"text","value":"no-transform"},{"type":"linebreak"},{"type":"text","value":"must-revalidate"},{"type":"linebreak"},{"type":"text","value":"ETag: \"b8daeafeadf6ce149692bc239ce5f1f64cc391b5\""},{"type":"linebreak"},{"type":"text","value":"Expires: Wed"},{"type":"linebreak"},{"type":"text","value":"30 Sep 2026 05:53:33 GMT"},{"type":"linebreak"},{"type":"text","value":"Last-Modified: Wed"},{"type":"linebreak"},{"type":"text","value":"23 Sep 2026 05:53:34 GMT"},{"type":"linebreak"},{"type":"text","value":"Server: cloudflare"},{"type":"linebreak"},{"type":"text","value":"X-CCACDN-Proxy-ID: scdpinlb6"},{"type":"linebreak"},{"type":"text","value":"X-Frame-Options: SAMEORIGIN"},{"type":"linebreak"},{"type":"text","value":"set-cookie: __cf_bm=yilWTiY2TcnDfpxWYUHNDGdkoD8b7RfQLZ3Bnpt65j4-1790222433.1794693-1.0.1.1-.smLFo0m7z_h11S459QUAG_mHbNjEIYYO4BVi1zLPbsyj9Uc9a3RijSWVO2ld0mH3uh25uBq6UH_xode3mI8TlONJ5nWKk5nQjdfvyog51q3zGuRq.igPCO5YlmalVVt; HttpOnly; Path=/; Domain=ocsp.sectigo.com; Expires=Thu"},{"type":"linebreak"},{"type":"text","value":"24 Sep 2026 04:30:33 GMT with response body ==>30C282027A0A0100C2A0C282027330C282026F06092B060105050730010104C282026030C282025C30C281C385C2A2160414C28132C292412B28C38D46C388C3......."}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-17","type":10,"relevance":3,"name":"Loads Windows LDAP client module","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 45E60000","description_v2":["\"powershell.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 45E60000"],"description_v3":[{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 45E60000"}],"origin":"Loaded Module","attck_id":"T1069.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1069/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-7","type":6,"relevance":1,"name":"Loads modules at runtime","description":"$58","description_v2":["\"zoom.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 73860000","\"zoom.exe\" loaded module \"KERNEL32.DLL\" at base 73b40000","\"zoom.exe\" loaded module \"ADVAPI32.DLL\" at base 73c40000","\"zoom.exe\" loaded module \"NTDLL.DLL\" at base 77060000","\"zoom.exe\" loaded module \"WINMM.DLL\" at base 73810000","\"zoom.exe\" loaded module \"WS2_32.DLL\" at base 75750000","\"zoom.exe\" loaded module \"POWRPROF.DLL\" at base 75670000","\"zoom.exe\" loaded module \"MSI.DLL\" at base 733f0000","\"zoom.exe\" loaded module \"COMCTL32.DLL\" at base 731b0000","\"zoom.exe\" loaded module \"SRPAPI.DLL\" at base 73180000","\"zoom.exe\" loaded module \"%WINDIR%\\SYSWOW64\\SHLWAPI.DLL\" at base 752a0000","\"zoom.exe\" loaded module \"%WINDIR%\\SYSWOW64\\OLE32.DLL\" at base 74600000","\"zoom.exe\" loaded module \"COMCTL32\" at base 731b0000","\"zoom.exe\" loaded module \"%WINDIR%\\SYSWOW64\\KERNEL32.DLL\" at base 73b40000","\"zoom.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 73100000","\"zoom.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSCTF.DLL\" at base 75120000","\"zoom.exe\" loaded module \"%WINDIR%\\SYSWOW64\\SHELL32.DLL\" at base 75d10000","\"zoom.exe\" loaded module \"SHELL32.DLL\" at base 75d10000","\"zoom.exe\" loaded module \"%WINDIR%\\SYSWOW64\\NETAPI32.DLL\" at base 72f30000","\"zoom.exe\" loaded module \"RPCRT4.DLL\" at base 752f0000","\"zoom.exe\" loaded module \"%WINDIR%\\SYSWOW64\\MSI.DLL\" at base 733f0000","\"fleetdeck_agent_svc.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 73860000","\"fleetdeck_agent_svc.exe\" loaded module \"KERNEL32.DLL\" at base 73b40000","\"fleetdeck_agent_svc.exe\" loaded module \"ADVAPI32.DLL\" at base 73c40000","\"fleetdeck_agent_svc.exe\" loaded module \"NTDLL.DLL\" at base 77060000","\"fleetdeck_agent_svc.exe\" loaded module \"WINMM.DLL\" at base 73810000","\"fleetdeck_agent_svc.exe\" loaded module \"WS2_32.DLL\" at base 75750000","\"fleetdeck_agent_svc.exe\" loaded module \"POWRPROF.DLL\" at base 75670000","\"fleetdeck_agent_svc.exe\" loaded module \"PSAPI.DLL\" at base 77050000","\"fleetdeck_agent_svc.exe\" loaded module \"USERENV.DLL\" at base 72b50000","\"fleetdeck_agent_svc.exe\" loaded module \"RPCRT4.DLL\" at base 752f0000","\"fleetdeck_agent_svc.exe\" loaded module \"SSPICLI.DLL\" at base 73a80000","\"powershell.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffb22e00000","\"powershell.exe\" loaded module \"KERNEL32.DLL\" at base 7ffb458e0000","\"powershell.exe\" loaded module \"ADVAPI32.DLL\" at base 7ffb455a0000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ffb424c0000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ffb424c0000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ffb424c0000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\MSCOREEI.DLL\" at base 7ffb20e60000","\"powershell.exe\" loaded module \"SHLWAPI.DLL\" at base 7ffb45650000","\"powershell.exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL\" at base 7ffb42260000","\"powershell.exe\" loaded module \"VERSION.DLL\" at base 7ffb3a860000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\CLR.DLL\" at base 7ffb14bd0000","\"powershell.exe\" loaded module \"USER32.DLL\" at base 7ffb433c0000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL\" at base 7ffb424c0000","\"powershell.exe\" loaded module \"MSCOREE.DLL\" at base 7ffb29170000","\"powershell.exe\" loaded module \"NTDLL\" at base 7ffb45ef0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\COMBASE.DLL\" at base 7ffb459a0000","\"powershell.exe\" loaded module \"RPCRT4.DLL\" at base 7ffb457c0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MSCORLIB\\FE2524177EB3088C77BE666722039F52\\MSCORLIB.NI.DLL\" at base 7ffb135d0000","\"powershell.exe\" loaded module \"OLE32.DLL\" at base 7ffb45cb0000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-L1-1-0.DLL\" at base 7ffb459a0000","\"powershell.exe\" loaded module \"OLEAUT32.DLL\" at base 7ffb43550000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM\\E43DD9C73AB5615E461BF5109C3FACD6\\SYSTEM.NI.DLL\" at base 7ffb12960000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.CORE\\0D59B0E237D7519417DE10CD84BDA4E7\\SYSTEM.CORE.NI.DLL\" at base 7ffb11ee0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.PB378EC07#\\B5BA37E1558CED178A99011A1D659B52\\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL\" at base 7ffb1eb70000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 7ffb416e0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 7ffb42a40000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.MANAA57FC8CC#\\6DA01910C256231D1C50AD0AACEE5941\\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL\" at base 7ffb0fe70000","\"powershell.exe\" loaded module \"COMBASE.DLL\" at base 7ffb459a0000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL\" at base 7ffb459a0000","\"powershell.exe\" loaded module \"NTDLL.DLL\" at base 7ffb45ef0000","\"powershell.exe\" loaded module \"PSAPI.DLL\" at base 7ffb44ed0000","\"powershell.exe\" loaded module \"SHELL32.DLL\" at base 7ffb436c0000","\"powershell.exe\" loaded module \"WINTRUST.DLL\" at base 7ffb42ac0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINTRUST.DLL\" at base 7ffb42ac0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPT32.DLL\" at base 7ffb422f0000","\"powershell.exe\" loaded module \"AMSI.DLL\" at base 7ffb2ec30000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\VERSION.DLL\" at base 7ffb3a860000","\"powershell.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.12.17007.18022-0\\MPOAV.DLL\" at base 7ffb2dfc0000","\"powershell.exe\" loaded module \"KERNEL32\" at base 7ffb458e0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\H7TQ1KDF.DLL\" at base 7ffb266d0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.MF49F6405#\\7B1F35FB0C2D6955CE5AF2BD372C65F2\\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL\" at base 7ffb1ead0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.MANAGEMENT\\B221AF81285C1305324612E6DC9C88FF\\SYSTEM.MANAGEMENT.NI.DLL\" at base 7ffb1c980000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.DIRED13B18A9#\\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\\SYSTEM.DIRECTORYSERVICES.NI.DLL\" at base 7ffb1c810000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.XML\\5EE35DEBFC22F727E70E4479DDCBC045\\SYSTEM.XML.NI.DLL\" at base 7ffb0f5c0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.NUMERICS\\86CFD69CE1261BAF4740E7606CADE014\\SYSTEM.NUMERICS.NI.DLL\" at base 7ffb238f0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.DATA\\7BED49C46DE9295A8453DB205C60A028\\SYSTEM.DATA.NI.DLL\" at base 7ffb0ec50000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\SYSTEM.DATA\\V4.0_4.0.0.0__B77A5C561934E089\\SYSTEM.DATA.DLL\" at base 7ffb0e8e0000","\"powershell.exe\" loaded module \"CRYPT32.DLL\" at base 7ffb422f0000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-XSTATE-L2-1-0.DLL\" at base 7ffb424c0000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\CLRJIT.DLL\" at base 7ffb1e980000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.P6F792626#\\7FF5199E757CB8AF9AD949453F698D09\\MICROSOFT.POWERSHELL.SECURITY.NI.DLL\" at base 7ffb1c7a0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.CONFIGURATION\\4BEB1EECA20B27D4BD1BB9880F03CC2A\\SYSTEM.CONFIGURATION.NI.DLL\" at base 7ffb0e7a0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.TRANSACTIONS\\604272B0FAEC2E09D53D38E03BC89C6C\\SYSTEM.TRANSACTIONS.NI.DLL\" at base 7ffb0e6c0000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\SYSTEM.TRANSACTIONS\\V4.0_4.0.0.0__B77A5C561934E089\\SYSTEM.TRANSACTIONS.DLL\" at base 7ffb1c750000","\"powershell.exe\" loaded module \"SECUR32.DLL\" at base 7ffb39360000","\"powershell.exe\" loaded module \"SSPICLI.DLL\" at base 7ffb42140000","\"powershell.exe\" loaded module \"WLDP.DLL\" at base 7ffb412a0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 7ffb40880000","\"powershell.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.12.17007.18022-0\\MPCLIENT.DLL\" at base 7ffb0e5e0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\KERNEL32.DLL\" at base 7ffb458e0000","\"powershell.exe\" loaded module \"USERENV.DLL\" at base 7ffb42170000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\ADVAPI32.DLL\" at base 7ffb455a0000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL\" at base 7ffb459a0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSISIP.DLL\" at base 7ffb33ad0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WSHEXT.DLL\" at base 7ffb2a2d0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\APPXSIP.DLL\" at base 7ffb290b0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\PWRSHSIP.DLL\" at base 7ffb2e8a0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPTNET.DLL\" at base 7ffb337a0000","\"powershell.exe\" loaded module \"CRYPTNET.DLL\" at base 7ffb337a0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.M870D558A#\\5F64880C86C98E7DDECDF28E61917307\\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL\" at base 7ffb0e2e0000","\"powershell.exe\" loaded module \"URLMON.DLL\" at base 7ffb38530000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-URL-L1-1-0.DLL\" at base 7ffb424c0000","\"powershell.exe\" loaded module \"MSISO.DLL\" at base 7ffb290f0000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\\V4.0_10.0.0.0__31BF3856AD364E35\\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL\" at base 7ffb0e220000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.P521220EA#\\DF7D947A99CBCFAA726B127726F05476\\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL\" at base 7ffb0d510000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.CONFE64A9051#\\120A0532577F871C2415502D9EDACDD6\\SYSTEM.CONFIGURATION.INSTALL.NI.DLL\" at base 7ffb29760000","\"powershell.exe\" loaded module \"BCRYPT.DLL\" at base 7ffb41da0000","\"powershell.exe\" loaded module \"OLEAUT32\" at base 7ffb43550000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.PAE3498D9#\\D922445A828B30938C72D375A3B34A60\\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL\" at base 7ffb0d2d0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.IBAAE5ED9#\\E86F7F836A07F673CDEF4C9A4D4B4D80\\MICROSOFT.IIS.POWERSHELL.COMMANDS.NI.DLL\" at base 7ffb0d260000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.KD58820A5#\\00F9E9FF321D8A141F3D71163C70C906\\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.NI.DLL\" at base 7ffb225a0000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS\\V4.0_10.0.0.0__31BF3856AD364E35\\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.DLL\" at base 7ffb2a180000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL\" at base 7ffb424c0000","\"powershell.exe\" loaded module \"MSVCRT.DLL\" at base 7ffb43620000","\"powershell.exe\" loaded module \"MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL\" at base 7ffb2e5a0000","\"powershell.exe\" loaded module \"MI.DLL\" at base 7ffb38d20000","\"powershell.exe\" loaded module \"API-MS-WIN-SECURITY-BASE-L1-1-0.DLL\" at base 7ffb424c0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WMIDCOM.DLL\" at base 7ffb38c50000","\"powershell.exe\" loaded module \"GDI32.DLL\" at base 7ffb45080000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL\" at base 7ffb424c0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\WBEMPROX.DLL\" at base 7ffb37b60000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\WBEMSVC.DLL\" at base 7ffb374d0000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL\" at base 7ffb424c0000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL\" at base 7ffb424c0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\FASTPROX.DLL\" at base 7ffb36cd0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\WMIUTILS.DLL\" at base 7ffb36e30000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL\" at base 7ffb458e0000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-HANDLE-L1-1-0.DLL\" at base 7ffb424c0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.DATA\\7BED49C46DE9295A8453DB205C60A028\\SYSTEM.DATA.NI.DLL\" at base 7ffb0f500000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\SYSTEM.DATA\\V4.0_4.0.0.0__B77A5C561934E089\\SYSTEM.DATA.DLL\" at base 7ffb0f190000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.XML\\5EE35DEBFC22F727E70E4479DDCBC045\\SYSTEM.XML.NI.DLL\" at base 7ffb0e8e0000"],"description_v3":[{"type":"text","value":"\"zoom.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 73860000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"KERNEL32.DLL\" at base 73b40000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"ADVAPI32.DLL\" at base 73c40000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"NTDLL.DLL\" at base 77060000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"WINMM.DLL\" at base 73810000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"WS2_32.DLL\" at base 75750000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"POWRPROF.DLL\" at base 75670000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"MSI.DLL\" at base 733f0000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"COMCTL32.DLL\" at base 731b0000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"SRPAPI.DLL\" at base 73180000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"%WINDIR%\\SYSWOW64\\SHLWAPI.DLL\" at base 752a0000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"%WINDIR%\\SYSWOW64\\OLE32.DLL\" at base 74600000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"COMCTL32\" at base 731b0000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"%WINDIR%\\SYSWOW64\\KERNEL32.DLL\" at base 73b40000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 73100000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSCTF.DLL\" at base 75120000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"%WINDIR%\\SYSWOW64\\SHELL32.DLL\" at base 75d10000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"SHELL32.DLL\" at base 75d10000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"%WINDIR%\\SYSWOW64\\NETAPI32.DLL\" at base 72f30000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"RPCRT4.DLL\" at base 752f0000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"%WINDIR%\\SYSWOW64\\MSI.DLL\" at base 733f0000"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 73860000"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" loaded module \"KERNEL32.DLL\" at base 73b40000"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" loaded module \"ADVAPI32.DLL\" at base 73c40000"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" loaded module \"NTDLL.DLL\" at base 77060000"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" loaded module \"WINMM.DLL\" at base 73810000"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" loaded module \"WS2_32.DLL\" at base 75750000"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" loaded module \"POWRPROF.DLL\" at base 75670000"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" loaded module \"PSAPI.DLL\" at base 77050000"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" loaded module \"USERENV.DLL\" at base 72b50000"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" loaded module \"RPCRT4.DLL\" at base 752f0000"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" loaded module \"SSPICLI.DLL\" at base 73a80000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffb22e00000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"KERNEL32.DLL\" at base 7ffb458e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"ADVAPI32.DLL\" at base 7ffb455a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ffb424c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ffb424c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ffb424c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\MSCOREEI.DLL\" at base 7ffb20e60000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"SHLWAPI.DLL\" at base 7ffb45650000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL\" at base 7ffb42260000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"VERSION.DLL\" at base 7ffb3a860000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\CLR.DLL\" at base 7ffb14bd0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"USER32.DLL\" at base 7ffb433c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL\" at base 7ffb424c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"MSCOREE.DLL\" at base 7ffb29170000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"NTDLL\" at base 7ffb45ef0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\COMBASE.DLL\" at base 7ffb459a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"RPCRT4.DLL\" at base 7ffb457c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MSCORLIB\\FE2524177EB3088C77BE666722039F52\\MSCORLIB.NI.DLL\" at base 7ffb135d0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"OLE32.DLL\" at base 7ffb45cb0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-L1-1-0.DLL\" at base 7ffb459a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"OLEAUT32.DLL\" at base 7ffb43550000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM\\E43DD9C73AB5615E461BF5109C3FACD6\\SYSTEM.NI.DLL\" at base 7ffb12960000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.CORE\\0D59B0E237D7519417DE10CD84BDA4E7\\SYSTEM.CORE.NI.DLL\" at base 7ffb11ee0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.PB378EC07#\\B5BA37E1558CED178A99011A1D659B52\\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL\" at base 7ffb1eb70000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 7ffb416e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 7ffb42a40000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.MANAA57FC8CC#\\6DA01910C256231D1C50AD0AACEE5941\\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL\" at base 7ffb0fe70000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"COMBASE.DLL\" at base 7ffb459a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL\" at base 7ffb459a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"NTDLL.DLL\" at base 7ffb45ef0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"PSAPI.DLL\" at base 7ffb44ed0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"SHELL32.DLL\" at base 7ffb436c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"WINTRUST.DLL\" at base 7ffb42ac0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINTRUST.DLL\" at base 7ffb42ac0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPT32.DLL\" at base 7ffb422f0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"AMSI.DLL\" at base 7ffb2ec30000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\VERSION.DLL\" at base 7ffb3a860000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.12.17007.18022-0\\MPOAV.DLL\" at base 7ffb2dfc0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"KERNEL32\" at base 7ffb458e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\H7TQ1KDF.DLL\" at base 7ffb266d0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.MF49F6405#\\7B1F35FB0C2D6955CE5AF2BD372C65F2\\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL\" at base 7ffb1ead0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.MANAGEMENT\\B221AF81285C1305324612E6DC9C88FF\\SYSTEM.MANAGEMENT.NI.DLL\" at base 7ffb1c980000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.DIRED13B18A9#\\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\\SYSTEM.DIRECTORYSERVICES.NI.DLL\" at base 7ffb1c810000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.XML\\5EE35DEBFC22F727E70E4479DDCBC045\\SYSTEM.XML.NI.DLL\" at base 7ffb0f5c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.NUMERICS\\86CFD69CE1261BAF4740E7606CADE014\\SYSTEM.NUMERICS.NI.DLL\" at base 7ffb238f0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.DATA\\7BED49C46DE9295A8453DB205C60A028\\SYSTEM.DATA.NI.DLL\" at base 7ffb0ec50000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\SYSTEM.DATA\\V4.0_4.0.0.0__B77A5C561934E089\\SYSTEM.DATA.DLL\" at base 7ffb0e8e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"CRYPT32.DLL\" at base 7ffb422f0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-XSTATE-L2-1-0.DLL\" at base 7ffb424c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\CLRJIT.DLL\" at base 7ffb1e980000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.P6F792626#\\7FF5199E757CB8AF9AD949453F698D09\\MICROSOFT.POWERSHELL.SECURITY.NI.DLL\" at base 7ffb1c7a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.CONFIGURATION\\4BEB1EECA20B27D4BD1BB9880F03CC2A\\SYSTEM.CONFIGURATION.NI.DLL\" at base 7ffb0e7a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.TRANSACTIONS\\604272B0FAEC2E09D53D38E03BC89C6C\\SYSTEM.TRANSACTIONS.NI.DLL\" at base 7ffb0e6c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\SYSTEM.TRANSACTIONS\\V4.0_4.0.0.0__B77A5C561934E089\\SYSTEM.TRANSACTIONS.DLL\" at base 7ffb1c750000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"SECUR32.DLL\" at base 7ffb39360000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"SSPICLI.DLL\" at base 7ffb42140000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"WLDP.DLL\" at base 7ffb412a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 7ffb40880000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.12.17007.18022-0\\MPCLIENT.DLL\" at base 7ffb0e5e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\KERNEL32.DLL\" at base 7ffb458e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"USERENV.DLL\" at base 7ffb42170000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\ADVAPI32.DLL\" at base 7ffb455a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL\" at base 7ffb459a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSISIP.DLL\" at base 7ffb33ad0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WSHEXT.DLL\" at base 7ffb2a2d0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\APPXSIP.DLL\" at base 7ffb290b0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\PWRSHSIP.DLL\" at base 7ffb2e8a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPTNET.DLL\" at base 7ffb337a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"CRYPTNET.DLL\" at base 7ffb337a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.M870D558A#\\5F64880C86C98E7DDECDF28E61917307\\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.NI.DLL\" at base 7ffb0e2e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"URLMON.DLL\" at base 7ffb38530000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-URL-L1-1-0.DLL\" at base 7ffb424c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"MSISO.DLL\" at base 7ffb290f0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\\V4.0_10.0.0.0__31BF3856AD364E35\\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL\" at base 7ffb0e220000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.P521220EA#\\DF7D947A99CBCFAA726B127726F05476\\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL\" at base 7ffb0d510000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.CONFE64A9051#\\120A0532577F871C2415502D9EDACDD6\\SYSTEM.CONFIGURATION.INSTALL.NI.DLL\" at base 7ffb29760000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"BCRYPT.DLL\" at base 7ffb41da0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"OLEAUT32\" at base 7ffb43550000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.PAE3498D9#\\D922445A828B30938C72D375A3B34A60\\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL\" at base 7ffb0d2d0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.IBAAE5ED9#\\E86F7F836A07F673CDEF4C9A4D4B4D80\\MICROSOFT.IIS.POWERSHELL.COMMANDS.NI.DLL\" at base 7ffb0d260000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.KD58820A5#\\00F9E9FF321D8A141F3D71163C70C906\\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.NI.DLL\" at base 7ffb225a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS\\V4.0_10.0.0.0__31BF3856AD364E35\\MICROSOFT.KEYDISTRIBUTIONSERVICE.CMDLETS.DLL\" at base 7ffb2a180000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL\" at base 7ffb424c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"MSVCRT.DLL\" at base 7ffb43620000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL\" at base 7ffb2e5a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"MI.DLL\" at base 7ffb38d20000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-SECURITY-BASE-L1-1-0.DLL\" at base 7ffb424c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WMIDCOM.DLL\" at base 7ffb38c50000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"GDI32.DLL\" at base 7ffb45080000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL\" at base 7ffb424c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\WBEMPROX.DLL\" at base 7ffb37b60000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\WBEMSVC.DLL\" at base 7ffb374d0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL\" at base 7ffb424c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL\" at base 7ffb424c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\FASTPROX.DLL\" at base 7ffb36cd0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\WMIUTILS.DLL\" at base 7ffb36e30000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL\" at base 7ffb458e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-HANDLE-L1-1-0.DLL\" at base 7ffb424c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.DATA\\7BED49C46DE9295A8453DB205C60A028\\SYSTEM.DATA.NI.DLL\" at base 7ffb0f500000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\SYSTEM.DATA\\V4.0_4.0.0.0__B77A5C561934E089\\SYSTEM.DATA.DLL\" at base 7ffb0f190000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.XML\\5EE35DEBFC22F727E70E4479DDCBC045\\SYSTEM.XML.NI.DLL\" at base 7ffb0e8e0000"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-3","type":10,"relevance":0,"name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 135D0000","description_v2":["\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 135D0000"],"description_v3":[{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 135D0000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-8","type":10,"relevance":0,"name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 2EC30000","description_v2":["\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 2EC30000"],"description_v3":[{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 2EC30000"}],"origin":"Loaded Module","attck_id":"T1562.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-9","type":10,"relevance":0,"name":"Loads the Bcrypt module DLL","description":"\"zoom.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73CC0000\n \"zoom.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 733D0000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 42A40000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 41DA0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73CC0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 733D0000\n \"fleetdeck_agent_svc.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73CC0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 42A40000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 41DA0000","description_v2":["\"zoom.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73CC0000","\"zoom.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 733D0000","\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 42A40000","\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 41DA0000","\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73CC0000","\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 733D0000","\"fleetdeck_agent_svc.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73CC0000","\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 42A40000","\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 41DA0000"],"description_v3":[{"type":"text","value":"\"zoom.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73CC0000"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 733D0000"},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 42A40000"},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 41DA0000"},{"type":"linebreak"},{"type":"text","value":"\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73CC0000"},{"type":"linebreak"},{"type":"text","value":"\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 733D0000"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73CC0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 42A40000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 41DA0000"}],"origin":"Loaded Module","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-7","type":10,"relevance":0,"name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 14BD0000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 14BD0000","description_v2":["\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 14BD0000","\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 14BD0000"],"description_v3":[{"type":"text","value":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 14BD0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 14BD0000"}],"origin":"Loaded Module","attck_id":"T1620","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1620","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-10","type":10,"relevance":0,"name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"zoom.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 752F0000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 457C0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 752F0000\n \"fleetdeck_agent_svc.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 752F0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 457C0000","description_v2":["\"zoom.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 752F0000","\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 457C0000","\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 752F0000","\"fleetdeck_agent_svc.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 752F0000","\"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 457C0000"],"description_v3":[{"type":"text","value":"\"zoom.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 752F0000"},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 457C0000"},{"type":"linebreak"},{"type":"text","value":"\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 752F0000"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 752F0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 457C0000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-8","type":6,"relevance":1,"name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00d100000040c76342fb7f0000@ntdll.dll\"\n \"22002300d100000018c76342fb7f0000@ntdll.dll\"\n \"19001a005d00000040c76342fb7f0000@ntdll.dll\"\n \"\"#]@ntdll.dll\"","description_v2":["\"19001a00d100000040c76342fb7f0000@ntdll.dll\"","\"22002300d100000018c76342fb7f0000@ntdll.dll\"","\"19001a005d00000040c76342fb7f0000@ntdll.dll\"","\"\"#]@ntdll.dll\""],"description_v3":[{"type":"text","value":"\"19001a00d100000040c76342fb7f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"22002300d100000018c76342fb7f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"19001a005d00000040c76342fb7f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"\"#]@ntdll.dll\""}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-770","type":2,"relevance":1,"name":"May be able to execute Exchange Online Remote PowerShell Modulee","description":"Found reference to API (Indicator: \"= 'get-appvvirtualprocess', 'start-appvvirtualprocess'\"; Source: \"00000000-00002636.00000000.228765.6DC20000.00000004.mdmp\")","description_v2":["Found reference to API (Indicator: \"= 'get-appvvirtualprocess', 'start-appvvirtualprocess'\"; Source: \"00000000-00002636.00000000.228765.6DC20000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API (Indicator: \"= 'get-appvvirtualprocess', 'start-appvvirtualprocess'\"; Source: \"00000000-00002636.00000000.228765.6DC20000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1069.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1069/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-72","type":3,"relevance":3,"name":"Overview of unique CLSIDs touched in registry","description":"$59","description_v2":["\"zoom.exe\" touched \"Msi install server\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\")","\"zoom.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C103E-0000-0000-C000-000000000046}\\TREATAS\")","\"zoom.exe\" touched \"Window Property Store\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\INSTANCE\")","\"powershell.exe\" touched \"Microsoft WBEM WbemClassObject Marshalling proxy\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{4590F812-1D3A-11D0-891F-00AA004B2E24}\\PROGID\")","\"powershell.exe\" touched \"WBEM Locator\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\\TREATAS\")","\"powershell.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")","\"powershell.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")","\"powershell.exe\" touched \"Microsoft WBEM Call Context\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\\TREATAS\")","\"powershell.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\\TREATAS\")","\"powershell.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\\TREATAS\")","\"powershell.exe\" touched \"WbemDefaultPathParser\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\\TREATAS\")","\"powershell.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")"],"description_v3":[{"type":"text","value":"\"zoom.exe\" touched \"Msi install server\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C103E-0000-0000-C000-000000000046}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" touched \"Window Property Store\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\\INSTANCE\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched \"Microsoft WBEM WbemClassObject Marshalling proxy\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{4590F812-1D3A-11D0-891F-00AA004B2E24}\\PROGID\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched \"WBEM Locator\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched \"Microsoft WBEM Call Context\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched \"WbemDefaultPathParser\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")"}],"origin":"Registry Access","attck_id":"T1546.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-80","type":0,"relevance":1,"name":"PE file contains executable sections","description":"\"zoom.exe\" has an executable section named \".text\"","description_v2":["\"zoom.exe\" has an executable section named \".text\""],"description_v3":[{"type":"text","value":"\"zoom.exe\" has an executable section named \".text\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-95","type":0,"relevance":0,"name":"PE file contains writable sections","description":"\"zoom.exe\" has an writable section named \".data\"\n \"zoom.exe\" has an writable section named \".idata\"","description_v2":["\"zoom.exe\" has an writable section named \".data\"","\"zoom.exe\" has an writable section named \".idata\""],"description_v3":[{"type":"text","value":"\"zoom.exe\" has an writable section named \".data\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" has an writable section named \".idata\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-96","type":0,"relevance":0,"name":"PE file entrypoint instructions","description":"\"zoom.exe\" file has an entrypoint instructions - \"jmp\t0x45e0b0,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,mov\tecx, dword ptr [esp + 4],sub\tesp, 0x28,mov\tdword ptr [esp + 0x1c], ebx,mov\tdword ptr [esp + 0x10], ebp,mov\tdword ptr [esp + 0x14], esi,mov\tdword ptr [esp + 0x18], edi,mov\tesi, eax,mov\tedx, dword ptr fs:[0x14],cmp\tedx, 0,jne\t0x46033c,mov\teax, 0,jmp\t0x4603a0,mov\tedx, dword ptr [edx],cmp\tedx, 0,jne\t0x46034c,call\t0x460440,mov\tdword ptr [esp + 0x20], edx,mov\tdword ptr [esp + 0x24], esp,mov\tebx, dword ptr [edx + 0x18],mov\tebx, dword ptr [ebx],cmp\tedx, ebx,je\t0x460375,mov\tebp, dword ptr fs:[0x14],\"","description_v2":["\"zoom.exe\" file has an entrypoint instructions - \"jmp\t0x45e0b0,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,mov\tecx, dword ptr [esp + 4],sub\tesp, 0x28,mov\tdword ptr [esp + 0x1c], ebx,mov\tdword ptr [esp + 0x10], ebp,mov\tdword ptr [esp + 0x14], esi,mov\tdword ptr [esp + 0x18], edi,mov\tesi, eax,mov\tedx, dword ptr fs:[0x14],cmp\tedx, 0,jne\t0x46033c,mov\teax, 0,jmp\t0x4603a0,mov\tedx, dword ptr [edx],cmp\tedx, 0,jne\t0x46034c,call\t0x460440,mov\tdword ptr [esp + 0x20], edx,mov\tdword ptr [esp + 0x24], esp,mov\tebx, dword ptr [edx + 0x18],mov\tebx, dword ptr [ebx],cmp\tedx, ebx,je\t0x460375,mov\tebp, dword ptr fs:[0x14],\""],"description_v3":[{"type":"text","value":"\"zoom.exe\" file has an entrypoint instructions - \"jmp\t0x45e0b0,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,mov\tecx, dword ptr [esp + 4],sub\tesp, 0x28,mov\tdword ptr [esp + 0x1c], ebx,mov\tdword ptr [esp + 0x10], ebp,mov\tdword ptr [esp + 0x14], esi,mov\tdword ptr [esp + 0x18], edi,mov\tesi, eax,mov\tedx, dword ptr fs:[0x14],cmp\tedx, 0,jne\t0x46033c,mov\teax, 0,jmp\t0x4603a0,mov\tedx, dword ptr [edx],cmp\tedx, 0,jne\t0x46034c,call\t0x460440,mov\tdword ptr [esp + 0x20], edx,mov\tdword ptr [esp + 0x24], esp,mov\tebx, dword ptr [edx + 0x18],mov\tebx, dword ptr [ebx],cmp\tedx, ebx,je\t0x460375,mov\tebp, dword ptr fs:[0x14],\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-125","type":0,"relevance":3,"name":"PE file has a big raw size section","description":"Raw size of \".data\" is \"0x26c200\" greater than 0x100000","description_v2":["Raw size of \".data\" is \"0x26c200\" greater than 0x100000"],"description_v3":[{"type":"text","value":"Raw size of \".data\" is \"0x26c200\" greater than 0x100000"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-124","type":0,"relevance":3,"name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x295288\" greater than 0x100000","description_v2":["Virtual size of \".data\" is \"0x295288\" greater than 0x100000"],"description_v3":[{"type":"text","value":"Virtual size of \".data\" is \"0x295288\" greater than 0x100000"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-170","type":2,"relevance":1,"name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00002548-00000BC0-2559612503]\n Observed system executable string:\"%WINDIR%\\Sysnative\\WindowsPowerShell\\v1.0\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program '%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe' -Action Allow\"\" [Source: powershell.exe]\n Observed system executable string:\"%WINDIR%\\Sysnative\\WindowsPowerShell\\v1.0\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program '%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe' -Action Allow\"\" [Source: powershell.exe]","description_v2":["Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00002548-00000BC0-2559612503]","Observed system executable string:\"%WINDIR%\\Sysnative\\WindowsPowerShell\\v1.0\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program '%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe' -Action Allow\"\" [Source: powershell.exe]","Observed system executable string:\"%WINDIR%\\Sysnative\\WindowsPowerShell\\v1.0\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program '%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe' -Action Allow\"\" [Source: powershell.exe]"],"description_v3":[{"type":"text","value":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00002548-00000BC0-2559612503]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Sysnative\\WindowsPowerShell\\v1.0\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program '%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe' -Action Allow\"\" [Source: powershell.exe]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Sysnative\\WindowsPowerShell\\v1.0\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program '%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe' -Action Allow\"\" [Source: powershell.exe]"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-67","type":9,"relevance":10,"name":"Process launched with changed environment","description":"$5a","description_v2":["Process \"msiexec.exe\" (UID: 00000000-00003340) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP\"","Process \"msiexec.exe\" (UID: 00000000-00003340) was launched with missing environment variables: \"USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE\"","Process \"MsiExec.exe\" (UID: 00000000-00002128) was launched with new environment variables: \"USERDOMAIN_ROAMINGPROFILE=\"DESKTOP-FVVF82A\", LOGONSERVER=\"\\\\DESKTOP-FVVF82A\", OneDrive=\"%USERPROFILE%\\OneDrive\", HOMEPATH=\"\\Users\\K0dlOnu\", HOMEDRIVE=\"C:\"\"","Process \"MsiExec.exe\" (UID: 00000000-00002128) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP\"","Process \"powershell.exe\" (UID: 00000000-00002636) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles\"","Process \"powershell.exe\" (UID: 00000000-00002636) was launched with missing environment variables: \"USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE\"","Process \"MsiExec.exe\" (UID: 00000000-00001128) was launched with new environment variables: \"USERDOMAIN_ROAMINGPROFILE=\"DESKTOP-FVVF82A\", LOGONSERVER=\"\\\\DESKTOP-FVVF82A\", OneDrive=\"%USERPROFILE%\\OneDrive\", HOMEPATH=\"\\Users\\K0dlOnu\", HOMEDRIVE=\"C:\"\"","Process \"MsiExec.exe\" (UID: 00000000-00001128) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles\""],"description_v3":[{"type":"text","value":"Process \"msiexec.exe\""},{"type":"process","process_uid":"00000000-00003340","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP\""},{"type":"linebreak"},{"type":"text","value":"Process \"msiexec.exe\""},{"type":"process","process_uid":"00000000-00003340","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE\""},{"type":"linebreak"},{"type":"text","value":"Process \"MsiExec.exe\""},{"type":"process","process_uid":"00000000-00002128","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"USERDOMAIN_ROAMINGPROFILE=\"DESKTOP-FVVF82A\", LOGONSERVER=\"\\\\DESKTOP-FVVF82A\", OneDrive=\"%USERPROFILE%\\OneDrive\", HOMEPATH=\"\\Users\\K0dlOnu\", HOMEDRIVE=\"C:\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"MsiExec.exe\""},{"type":"process","process_uid":"00000000-00002128","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP\""},{"type":"linebreak"},{"type":"text","value":"Process \"powershell.exe\""},{"type":"process","process_uid":"00000000-00002636","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles\""},{"type":"linebreak"},{"type":"text","value":"Process \"powershell.exe\""},{"type":"process","process_uid":"00000000-00002636","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, HOMEPATH, HOMEDRIVE\""},{"type":"linebreak"},{"type":"text","value":"Process \"MsiExec.exe\""},{"type":"process","process_uid":"00000000-00001128","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"USERDOMAIN_ROAMINGPROFILE=\"DESKTOP-FVVF82A\", LOGONSERVER=\"\\\\DESKTOP-FVVF82A\", OneDrive=\"%USERPROFILE%\\OneDrive\", HOMEPATH=\"\\Users\\K0dlOnu\", HOMEDRIVE=\"C:\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"MsiExec.exe\""},{"type":"process","process_uid":"00000000-00001128","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles\""}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-51","type":7,"relevance":1,"name":"Queries DNS server","description":"\"ocsp.sectigo.com\"","description_v2":["\"ocsp.sectigo.com\""],"description_v3":[{"type":"text","value":"\"ocsp.sectigo.com\""}],"origin":"Network Traffic","attck_id":"T1071.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-20","type":3,"relevance":5,"name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","description_v2":["\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")"],"description_v3":[{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"$5b","description_v2":["\"zoom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","\"zoom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"zoom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","\"zoom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"fleetdeck_agent_svc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","\"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","\"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\🌎🌏🌍\"; Key: \"CURRENCIES\")","\"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\🌎🌏🌍\"; Key: \"NLS CURRENCY DATA\")","\"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\🌎🌏🌍\"; Key: \"CLOCK\")","\"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SCURRENCYOVERRIDE\")","\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")","\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")","\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")"],"description_v3":[{"type":"text","value":"\"zoom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\🌎🌏🌍\"; Key: \"CURRENCIES\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\🌎🌏🌍\"; Key: \"NLS CURRENCY DATA\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\🌎🌏🌍\"; Key: \"CLOCK\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SCURRENCYOVERRIDE\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-987","type":2,"relevance":1,"name":"References Windows LDAP client module","description":"Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp\")","description_v2":["Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string %WINDIR%\\System32\\WLDAP32.dll\" (Source: \"00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1069.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1069/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-625","type":2,"relevance":1,"name":"References Windows file paths for DLLs (possible dropped files)","description":"$5c","description_v2":["Observed system executable string:\"%WINDIR%\\SysWOW64\\TSAPPCMP.DLL\" [Source: 00000000-00003924-00000C2B-2554772498]","Observed system executable string:\"%WINDIR%\\SysWOW64\\SHLWAPI.DLL\" [Source: 00000000-00003924-00000C2B-2554810288]","Observed system executable string:\"%WINDIR%\\SysWOW64\\OLE32.DLL\" [Source: 00000000-00003924-00000C2B-2554834474]","Observed system executable string:\"%WINDIR%\\SysWOW64\\KERNEL32.DLL\" [Source: 00000000-00003924-00000C2B-2554891604]","Observed system executable string:\"%WINDIR%\\SysWOW64\\SHELL32.DLL\" [Source: 00000000-00003924-00000C2B-2554977223]","Observed system executable string:\"%WINDIR%\\SysWOW64\\NETAPI32.DLL\" [Source: 00000000-00003924-00000C2B-2555059974]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00002636-00000C2E-148157806]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" [Source: 00000000-00002636-00000C2B-2560147357]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll\" [Source: 00000000-00002636-00000C2B-2560192197]","Observed system executable string:\"%WINDIR%\\system32\\combase.dll\" [Source: 00000000-00002636-00000C2B-2560230270]","Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" [Source: 00000000-00002636-00000C2B-2560345713]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll\" [Source: 00000000-00002636-00000C2B-2560360812]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" [Source: 00000000-00002636-00000C2B-2560383228]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll\" [Source: 00000000-00002636-00000C2B-2560406561]","Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll\" [Source: 00000000-00002636-00000C2B-2560449582]","Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll\" [Source: 00000000-00002636-00000C2B-2560476167]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll\" [Source: 00000000-00002636-00000C2B-2560521831]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll\" [Source: 00000000-00002636-00000C2B-2560604824]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll\" [Source: 00000000-00002636-00000C2B-2560657575]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll\" [Source: 00000000-00002636-00000C2B-2560760019]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll\" [Source: 00000000-00002636-00000C2B-2560760925]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll\" [Source: 00000000-00002636-00000C2B-2560926002]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll\" [Source: 00000000-00002636-00000C2B-2560990739]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\mscorrc.dll\" [Source: 00000000-00002636-00000C2B-2561228266]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en\\mscorrc.dll\" [Source: 00000000-00002636-00000C2B-2561239361]"],"description_v3":[{"type":"text","value":"Observed system executable string:\"%WINDIR%\\SysWOW64\\TSAPPCMP.DLL\" [Source: 00000000-00003924-00000C2B-2554772498]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\SysWOW64\\SHLWAPI.DLL\" [Source: 00000000-00003924-00000C2B-2554810288]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\SysWOW64\\OLE32.DLL\" [Source: 00000000-00003924-00000C2B-2554834474]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\SysWOW64\\KERNEL32.DLL\" [Source: 00000000-00003924-00000C2B-2554891604]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\SysWOW64\\SHELL32.DLL\" [Source: 00000000-00003924-00000C2B-2554977223]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\SysWOW64\\NETAPI32.DLL\" [Source: 00000000-00003924-00000C2B-2555059974]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00002636-00000C2E-148157806]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" [Source: 00000000-00002636-00000C2B-2560147357]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll\" [Source: 00000000-00002636-00000C2B-2560192197]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\combase.dll\" [Source: 00000000-00002636-00000C2B-2560230270]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" [Source: 00000000-00002636-00000C2B-2560345713]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll\" [Source: 00000000-00002636-00000C2B-2560360812]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" [Source: 00000000-00002636-00000C2B-2560383228]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll\" [Source: 00000000-00002636-00000C2B-2560406561]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll\" [Source: 00000000-00002636-00000C2B-2560449582]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll\" [Source: 00000000-00002636-00000C2B-2560476167]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll\" [Source: 00000000-00002636-00000C2B-2560521831]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll\" [Source: 00000000-00002636-00000C2B-2560604824]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll\" [Source: 00000000-00002636-00000C2B-2560657575]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll\" [Source: 00000000-00002636-00000C2B-2560760019]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll\" [Source: 00000000-00002636-00000C2B-2560760925]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll\" [Source: 00000000-00002636-00000C2B-2560926002]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll\" [Source: 00000000-00002636-00000C2B-2560990739]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\mscorrc.dll\" [Source: 00000000-00002636-00000C2B-2561228266]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en\\mscorrc.dll\" [Source: 00000000-00002636-00000C2B-2561239361]"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-70","type":6,"relevance":10,"name":"Scanning for window names","description":"\"zoom.exe\" searching for class \"Shell_TrayWnd\"","description_v2":["\"zoom.exe\" searching for class \"Shell_TrayWnd\""],"description_v3":[{"type":"text","value":"\"zoom.exe\" searching for class \"Shell_TrayWnd\""}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-25","type":9,"relevance":3,"name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00003340)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding FA8A56715A6EEDF68978BAF9DDF0BF91\" (UID: 00000000-00002128)\n Spawned process \"fleetdeck_agent_svc.exe\" with commandline \"-deploymentID 4bfbc645-0cef-4572-939e-9f68af129ffb -askForName=0\" (UID: 00000000-00002548)\n Spawned process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Co ...\" (UID: 00000000-00002636)\n Spawned process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Co ...\" (UID: 00000000-00004540)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding C1A5E774EDCB9D20734CA56859DB9F4E E Global\\\\MSI0000\" (UID: 00000000-00001128)","description_v2":["Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00003340)","Spawned process \"MsiExec.exe\" with commandline \"-Embedding FA8A56715A6EEDF68978BAF9DDF0BF91\" (UID: 00000000-00002128)","Spawned process \"fleetdeck_agent_svc.exe\" with commandline \"-deploymentID 4bfbc645-0cef-4572-939e-9f68af129ffb -askForName=0\" (UID: 00000000-00002548)","Spawned process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Co ...\" (UID: 00000000-00002636)","Spawned process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Co ...\" (UID: 00000000-00004540)","Spawned process \"MsiExec.exe\" with commandline \"-Embedding C1A5E774EDCB9D20734CA56859DB9F4E E Global\\\\MSI0000\" (UID: 00000000-00001128)"],"description_v3":[{"type":"text","value":"Spawned process \"msiexec.exe\" with commandline \"/V\""},{"type":"process","process_uid":"00000000-00003340","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"MsiExec.exe\" with commandline \"-Embedding FA8A56715A6EEDF68978BAF9DDF0BF91\""},{"type":"process","process_uid":"00000000-00002128","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"fleetdeck_agent_svc.exe\" with commandline \"-deploymentID 4bfbc645-0cef-4572-939e-9f68af129ffb -askForName=0\""},{"type":"process","process_uid":"00000000-00002548","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Co ...\""},{"type":"process","process_uid":"00000000-00002636","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Co ...\""},{"type":"process","process_uid":"00000000-00004540","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"MsiExec.exe\" with commandline \"-Embedding C1A5E774EDCB9D20734CA56859DB9F4E E Global\\\\MSI0000\""},{"type":"process","process_uid":"00000000-00001128","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-103","type":9,"relevance":3,"name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00003340)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding FA8A56715A6EEDF68978BAF9DDF0BF91\" (UID: 00000000-00002128)\n Spawned process \"fleetdeck_agent_svc.exe\" with commandline \"-deploymentID 4bfbc645-0cef-4572-939e-9f68af129ffb -askForName=0\" (UID: 00000000-00002548)\n Spawned process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Co ...\" (UID: 00000000-00002636)\n Spawned process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Co ...\" (UID: 00000000-00004540)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding C1A5E774EDCB9D20734CA56859DB9F4E E Global\\\\MSI0000\" (UID: 00000000-00001128)","description_v2":["Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00003340)","Spawned process \"MsiExec.exe\" with commandline \"-Embedding FA8A56715A6EEDF68978BAF9DDF0BF91\" (UID: 00000000-00002128)","Spawned process \"fleetdeck_agent_svc.exe\" with commandline \"-deploymentID 4bfbc645-0cef-4572-939e-9f68af129ffb -askForName=0\" (UID: 00000000-00002548)","Spawned process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Co ...\" (UID: 00000000-00002636)","Spawned process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Co ...\" (UID: 00000000-00004540)","Spawned process \"MsiExec.exe\" with commandline \"-Embedding C1A5E774EDCB9D20734CA56859DB9F4E E Global\\\\MSI0000\" (UID: 00000000-00001128)"],"description_v3":[{"type":"text","value":"Spawned process \"msiexec.exe\" with commandline \"/V\""},{"type":"process","process_uid":"00000000-00003340","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"MsiExec.exe\" with commandline \"-Embedding FA8A56715A6EEDF68978BAF9DDF0BF91\""},{"type":"process","process_uid":"00000000-00002128","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"fleetdeck_agent_svc.exe\" with commandline \"-deploymentID 4bfbc645-0cef-4572-939e-9f68af129ffb -askForName=0\""},{"type":"process","process_uid":"00000000-00002548","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Co ...\""},{"type":"process","process_uid":"00000000-00002636","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Co ...\""},{"type":"process","process_uid":"00000000-00004540","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"MsiExec.exe\" with commandline \"-Embedding C1A5E774EDCB9D20734CA56859DB9F4E E Global\\\\MSI0000\""},{"type":"process","process_uid":"00000000-00001128","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"binary-26","type":8,"relevance":5,"name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 387705)","description_v2":["Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 387705)"],"description_v3":[{"type":"text","value":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 387705)"}],"origin":"Binary File","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"certificate-0","type":17,"relevance":10,"name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB\" (SHA1: 01:85:FF:99:61:FF:0A:A2:E4:31:81:79:48:C2:8E:83:D3:F3:EC:70; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB\" (SHA1: CA:17:2B:AC:E9:7F:7C:97:A6:AE:9E:16:CC:93:60:F5:9E:7B:9C:F4; see report for more information)","description_v2":["The input sample is signed with a certificate issued by \"CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information)","The input sample is signed with a certificate issued by \"CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB\" (SHA1: 01:85:FF:99:61:FF:0A:A2:E4:31:81:79:48:C2:8E:83:D3:F3:EC:70; see report for more information)","The input sample is signed with a certificate issued by \"CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB\" (SHA1: CA:17:2B:AC:E9:7F:7C:97:A6:AE:9E:16:CC:93:60:F5:9E:7B:9C:F4; see report for more information)"],"description_v3":[{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 32:9B:78:A5:C9:EB:C2:04:32:42:DE:90:CE:1B:7C:6B:1B:A6:C6:92; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB\" (SHA1: 01:85:FF:99:61:FF:0A:A2:E4:31:81:79:48:C2:8E:83:D3:F3:EC:70; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB\" (SHA1: CA:17:2B:AC:E9:7F:7C:97:A6:AE:9E:16:CC:93:60:F5:9E:7B:9C:F4; see report for more information)"}],"origin":"Certificate Data","attck_id":"T1553.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-153","type":0,"relevance":0,"name":"Uses 32 bit executable PE","description":"\"zoom.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","description_v2":["\"zoom.exe\" has flags like IMAGE_FILE_32BIT_MACHINE","IMAGE_FILE_EXECUTABLE"],"description_v3":[{"type":"text","value":"\"zoom.exe\" has flags like IMAGE_FILE_32BIT_MACHINE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_FILE_EXECUTABLE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-267","type":6,"relevance":1,"name":"Writes files in a temp directory","description":"$5d","description_v2":["\"zoom.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\4041571202.msi\"","\"zoom.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\FleetDeck\\FleetDeck Agent Installer.log\"","\"fleetdeck_agent_svc.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\FleetDeck\\FleetDeck Agent Service.log\"","\"powershell.exe\" writes to a file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_iphrlbb4.qj1.ps1\"","\"powershell.exe\" writes to a file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_32nsukb0.yfm.psm1\"","\"powershell.exe\" writes to a file \"%WINDIR%\\Temp\\__PSScriptPolicyTest_iphrlbb4.qj1.ps1\"","\"powershell.exe\" writes to a file \"%WINDIR%\\Temp\\__PSScriptPolicyTest_32nsukb0.yfm.psm1\"","\"powershell.exe\" writes to a file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_iscuh4ak.jwc.ps1\"","\"powershell.exe\" writes to a file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_2ahizkk2.qnc.psm1\"","\"powershell.exe\" writes to a file \"%WINDIR%\\Temp\\__PSScriptPolicyTest_iscuh4ak.jwc.ps1\"","\"powershell.exe\" writes to a file \"%WINDIR%\\Temp\\__PSScriptPolicyTest_2ahizkk2.qnc.psm1\""],"description_v3":[{"type":"text","value":"\"zoom.exe\" writes to a file \"%TEMP%\\4041571202.msi\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" writes to a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\FleetDeck\\FleetDeck Agent Installer.log\""},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" writes to a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\FleetDeck\\FleetDeck Agent Service.log\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" writes to a file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_iphrlbb4.qj1.ps1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" writes to a file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_32nsukb0.yfm.psm1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" writes to a file \"%WINDIR%\\Temp\\__PSScriptPolicyTest_iphrlbb4.qj1.ps1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" writes to a file \"%WINDIR%\\Temp\\__PSScriptPolicyTest_32nsukb0.yfm.psm1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" writes to a file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_iscuh4ak.jwc.ps1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" writes to a file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_2ahizkk2.qnc.psm1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" writes to a file \"%WINDIR%\\Temp\\__PSScriptPolicyTest_iscuh4ak.jwc.ps1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" writes to a file \"%WINDIR%\\Temp\\__PSScriptPolicyTest_2ahizkk2.qnc.psm1\""}],"origin":"API Call","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-396","type":2,"relevance":1,"name":"Contains ability to create/modify Windows services (Powershell command string)","description":"$5e","description_v2":["file/memory contains long string with (Indicator: \"New-NetFirewallRule\"; File: \"powershell.exe\")","file/memory contains long string with (Indicator: \"New-NetFirewallRule\"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")","Found string \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program 'C:\\Program Files (x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe' -Action Allow\" (Indicator: \"New-NetFirewallRule\"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000000.228765.6B690000.00000004.mdmp, 00000000-00002636.00000000.228765.6CD30000.00000004.mdmp, 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B690000.00000004.mdmp, 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6DD14000.00000004.mdmp\")","Found string \"New-NetFirewallRule\" (Indicator: \"New-NetFirewallRule\"; Source: \"00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp, 00000000-00002636.00000001.229385.6DF90000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"New-NetFirewallRule\"; File: \"powershell.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"New-NetFirewallRule\"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program '%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe' -Action Allow\" (Indicator: \"New-NetFirewallRule\"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000000.228765.6B690000.00000004.mdmp, 00000000-00002636.00000000.228765.6CD30000.00000004.mdmp, 00000000-00002636.00000000.228765.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B690000.00000004.mdmp, 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6DD14000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"New-NetFirewallRule\" (Indicator: \"New-NetFirewallRule\"; Source: \"00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp, 00000000-00002636.00000001.229385.6DF90000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-310","type":2,"relevance":1,"name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")\n Found reference to API \"runtime.getLoadLibraryEx\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")\n Found reference to API \"runtime.getLoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","description_v2":["Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")","Found reference to API \"runtime.getLoadLibraryEx\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")","Found reference to API \"runtime.getLoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"runtime.getLoadLibraryEx\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"runtime.getLoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-264","type":6,"relevance":3,"name":"Creates a thread in a self process","description":"\"zoom.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"msiexec.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"MsiExec.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"fleetdeck_agent_svc.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","description_v2":["\"zoom.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","\"msiexec.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","\"MsiExec.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","\"fleetdeck_agent_svc.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"],"description_v3":[{"type":"text","value":"\"zoom.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"},{"type":"linebreak"},{"type":"text","value":"\"MsiExec.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"}],"origin":"API Call","attck_id":"T1055.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-324","type":6,"relevance":5,"name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"","description_v2":["\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"","\"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\""],"description_v3":[{"type":"text","value":"\"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\""}],"origin":"API Call","attck_id":"T1036.005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1036/005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"target-478","type":9,"relevance":3,"name":"Creates/modifies Windows services using PowerShell","description":"Process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program '%PROGRAMFILES%\\\\(x86)\\\\FleetDeck Agent\\\\fleetdeck_agent_svc.exe' -Action Allow\"\" (UID: 00000000-00002636)\n Process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program '%PROGRAMFILES%\\\\(x86)\\\\FleetDeck Agent\\\\fleetdeck_agent_svc.exe' -Action Allow\"\" (UID: 00000000-00004540)","description_v2":["Process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program '%PROGRAMFILES%\\\\(x86)\\\\FleetDeck Agent\\\\fleetdeck_agent_svc.exe' -Action Allow\"\" (UID: 00000000-00002636)","Process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program '%PROGRAMFILES%\\\\(x86)\\\\FleetDeck Agent\\\\fleetdeck_agent_svc.exe' -Action Allow\"\" (UID: 00000000-00004540)"],"description_v3":[{"type":"text","value":"Process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service' -Direction Inbound -Program '%PROGRAMFILES%\\\\(x86)\\\\FleetDeck Agent\\\\fleetdeck_agent_svc.exe' -Action Allow\"\""},{"type":"process","process_uid":"00000000-00002636","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"powershell.exe\" with commandline \"%WINDIR%\\\\Sysnative\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe -Command \"New-NetFirewallRule -DisplayName 'FleetDeck Agent Service' -Name 'FleetDeck Agent Service Command' -Direction Inbound -Program '%PROGRAMFILES%\\\\(x86)\\\\FleetDeck Agent\\\\fleetdeck_agent_svc.exe' -Action Allow\"\""},{"type":"process","process_uid":"00000000-00004540","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"$5f","description_v2":["\"4041571202.msi\" has type \"Composite Document File V2 Document Little Endian Os: Windows Version 6.2 MSI Installer Code page: 1252 Title: Installation Database Subject: FleetDeck Agent Author: FleetDeck Inc Keywords: Installer Comments: This installer database contains the logic and data required to install FleetDeck Agent. Template: Intel;1033 Revision Number: {A81C6934-4041-46E1-A95E-99E3002E9BF2} Create Time/Date: Mon Feb 23 00:39:28 2026 Last Saved Time/Date: Mon Feb 23 00:39:28 2026 Number of Pages: 500 Number of Words: 2 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 2\"- Location: [%TEMP%\\4041571202.msi]- [targetUID: 00000000-00003924]","\"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002636]","\"FleetDeck Agent Service.log\" has type \"ASCII text\"- Location: [%TEMP%\\FleetDeck\\FleetDeck Agent Service.log]- [targetUID: 00000000-00002548]","\"FleetDeck Agent Installer.log\" has type \"ASCII text\"- Location: [%TEMP%\\FleetDeck\\FleetDeck Agent Installer.log]- [targetUID: 00000000-00003924]","\"deployment.json\" has type \"JSON text data\"- Location: [%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\deployment.json]- [targetUID: 00000000-00002548]"],"description_v3":[{"type":"text","value":"\"4041571202.msi\" has type \"Composite Document File V2 Document Little Endian O%WINDIR%\\Version 6.2 MSI Installer Code page: 1252 Title: Installation Database Subject: FleetDeck Agent Author: FleetDeck Inc Keywords: Installer Comments: This installer database contains the logic and data required to install FleetDeck Agent. Template: Intel;1033 Revision Number: {A81C6934-4041-46E1-A95E-99E3002E9BF2} Create Time/Date: Mon Feb 23 00:39:28 2026 Last Saved Time/Date: Mon Feb 23 00:39:28 2026 Number of Pages: 500 Number of Words: 2 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 2\"- Location: [%TEMP%\\4041571202.msi]- [targetUID: 00000000-00003924]"},{"type":"linebreak"},{"type":"text","value":"\"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002636]"},{"type":"linebreak"},{"type":"text","value":"\"FleetDeck Agent Service.log\" has type \"ASCII text\"- Location: [%TEMP%\\FleetDeck\\FleetDeck Agent Service.log]- [targetUID: 00000000-00002548]"},{"type":"linebreak"},{"type":"text","value":"\"FleetDeck Agent Installer.log\" has type \"ASCII text\"- Location: [%TEMP%\\FleetDeck\\FleetDeck Agent Installer.log]- [targetUID: 00000000-00003924]"},{"type":"linebreak"},{"type":"text","value":"\"deployment.json\" has type \"JSON text data\"- Location: [%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\deployment.json]- [targetUID: 00000000-00002548]"}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-177","type":3,"relevance":1,"name":"Opens registry keys","description":"$60","description_v2":["\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\RPC\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\SETUP\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\ZOOM.EXE\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS NT\\RPC\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COM3\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\\TREATAS\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\\TREATAS\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\\INPROCSERVER32\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\\INPROCSERVER32\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\\INPROCHANDLER32\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\RPC\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\SETUP\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\IMAGE FILE EXECUTION OPTIONS\\ZOOM.EXE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS NT\\RPC\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COM3\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\\TREATAS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\\TREATAS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\\INPROCSERVER32\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\\INPROCSERVER32\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\\INPROCHANDLER32\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-235","type":6,"relevance":1,"name":"Queries basic information of the specified process","description":"\"zoom.exe\" queries basic process information of the \"C:\\zoom.exe\" (UID: 3924)\n \"msiexec.exe\" queries basic process information of the \"C:\\Windows\\System32\\msiexec.exe\" (UID: 3340)\n \"msiexec.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\msiexec.exe\" (UID: 3340)\n \"msiexec.exe\" queries basic process information of the \"C:\\Program Files (x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe\" (UID: 3340)\n \"fleetdeck_agent_svc.exe\" queries basic process information of the \"C:\\Program Files (x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe\" (UID: 2548)\n \"fleetdeck_agent_svc.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 2548)\n \"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 2636)","description_v2":["\"zoom.exe\" queries basic process information of the \"C:\\zoom.exe\" (UID: 3924)","\"msiexec.exe\" queries basic process information of the \"C:\\Windows\\System32\\msiexec.exe\" (UID: 3340)","\"msiexec.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\msiexec.exe\" (UID: 3340)","\"msiexec.exe\" queries basic process information of the \"C:\\Program Files (x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe\" (UID: 3340)","\"fleetdeck_agent_svc.exe\" queries basic process information of the \"C:\\Program Files (x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe\" (UID: 2548)","\"fleetdeck_agent_svc.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 2548)","\"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 2636)"],"description_v3":[{"type":"text","value":"\"zoom.exe\" queries basic process information of the \"C:\\zoom.exe\" (UID: 3924)"},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" queries basic process information of the \"C:\\Windows\\System32\\msiexec.exe\" (UID: 3340)"},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" queries basic process information of the \"C:\\Windows\\SysWOW64\\msiexec.exe\" (UID: 3340)"},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" queries basic process information of the \"%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe\" (UID: 3340)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" queries basic process information of the \"C:\\Program Files (x86)\\FleetDeck Agent\\fleetdeck_agent_svc.exe\" (UID: 2548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 2548)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries basic process information of the \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" (UID: 2636)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-172","type":3,"relevance":1,"name":"Queries registry keys","description":"$61","description_v2":["\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\RPC\"; Key: \"MAXRPCSIZE\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\SETUP\"; Key: \"OOBEINPROGRESS\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\SETUP\"; Key: \"SYSTEMSETUPINPROGRESS\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\RPC\"; Key: \"IDLETIMERWINDOW\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"MAXIMUMALLOWEDALLOCATIONSIZE\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COM3\"; Key: \"COM+ENABLED\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"MAXSXSHASHCOUNT\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\APPX\"; Key: \"ALLOWDEVELOPMENTWITHOUTDEVLICENSE\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APPMODELUNLOCK\"; Key: \"ALLOWDEVELOPMENTWITHOUTDEVLICENSE\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\\APPCOMPAT\"; Key: \"RAISEDEFAULTAUTHNLEVEL\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"DEFAULTACCESSPERMISSION\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"ANONYMOUSAPPCONTAINERIMPERSONATIONLEVELCHECK\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"EVERYONEINCLUDESANONYMOUS\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\INTERFACE\\{00000134-0000-0000-C000-000000000046}\\PROXYSTUBCLSID32\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\RPC\\EXTENSIONS\"; Key: \"NDROLEEXTDLL\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\\PROGID\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\INTERFACE\\{000C101C-0000-0000-C000-000000000046}\\PROXYSTUBCLSID32\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C103E-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C103E-0000-0000-C000-000000000046}\\INPROCSERVER32\"; Key: \"INPROCSERVER32\"; Value: \"\")","\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C103E-0000-0000-C000-000000000046}\\INPROCSERVER32\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\RPC\"; Key: \"MAXRPCSIZE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\SETUP\"; Key: \"OOBEINPROGRESS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\SETUP\"; Key: \"SYSTEMSETUPINPROGRESS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\RPC\"; Key: \"IDLETIMERWINDOW\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"MAXIMUMALLOWEDALLOCATIONSIZE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\COM3\"; Key: \"COM+ENABLED\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"MAXSXSHASHCOUNT\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\APPX\"; Key: \"ALLOWDEVELOPMENTWITHOUTDEVLICENSE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APPMODELUNLOCK\"; Key: \"ALLOWDEVELOPMENTWITHOUTDEVLICENSE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\\APPCOMPAT\"; Key: \"RAISEDEFAULTAUTHNLEVEL\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\"; Key: \"DEFAULTACCESSPERMISSION\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"ANONYMOUSAPPCONTAINERIMPERSONATIONLEVELCHECK\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\LSA\"; Key: \"EVERYONEINCLUDESANONYMOUS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\INTERFACE\\{00000134-0000-0000-C000-000000000046}\\PROXYSTUBCLSID32\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\RPC\\EXTENSIONS\"; Key: \"NDROLEEXTDLL\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C101C-0000-0000-C000-000000000046}\\PROGID\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\INTERFACE\\{000C101C-0000-0000-C000-000000000046}\\PROXYSTUBCLSID32\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C103E-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C103E-0000-0000-C000-000000000046}\\INPROCSERVER32\"; Key: \"INPROCSERVER32\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{000C103E-0000-0000-C000-000000000046}\\INPROCSERVER32\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-243","type":6,"relevance":1,"name":"Reads files","description":"$62","description_v2":["\"zoom.exe\" reads file \"c:\\zoom.exe\"","\"zoom.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","\"powershell.exe\" reads file \"c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe.config\"","\"powershell.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\"","\"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux\"","\"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pb378ec07#\\b5ba37e1558ced178a99011a1d659b52\\microsoft.powershell.consolehost.ni.dll.aux\"","\"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll.aux\"","\"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\0d59b0e237d7519417de10cd84bda4e7\\system.core.ni.dll.aux\"","\"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\system.management.automation.ni.dll.aux\""],"description_v3":[{"type":"text","value":"\"zoom.exe\" reads file \"c:\\zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" reads file \"%WINDIR%\\fonts\\staticcache.dat\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" reads file \"c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe.config\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" reads file \"c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\config\\machine.config\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll.aux\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\microsoft.pb378ec07#\\b5ba37e1558ced178a99011a1d659b52\\microsoft.powershell.consolehost.ni.dll.aux\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\e43dd9c73ab5615e461bf5109c3facd6\\system.ni.dll.aux\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\0d59b0e237d7519417de10cd84bda4e7\\system.core.ni.dll.aux\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" reads file \"c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\system.management.automation.ni.dll.aux\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"summary-29","type":15,"relevance":1,"name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains a Wine emulator-related string\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: The input sample contains the RDTSCP instruction","description_v2":["The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)","Matched sigs: Able to identify virtual environment by using user activity (API string)","Matched sigs: Contains a Wine emulator-related string","Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","Matched sigs: Able to identify virtual environment by using API string","Matched sigs: Queries process mitigation policy via NtQueryInformationProcess","Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","Matched sigs: Triggers a burst of requests to the same API (API Hammering)","Matched sigs: The input sample contains the RDTSCP instruction"],"description_v3":[{"type":"text","value":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to identify virtual environment by using user activity (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains a Wine emulator-related string"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to identify virtual environment by using API string"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Queries process mitigation policy via NtQueryInformationProcess"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Triggers a burst of requests to the same API (API Hammering)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: The input sample contains the RDTSCP instruction"}],"origin":"Indicator Combinations","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-263","type":6,"relevance":1,"name":"Touches files","description":"\"zoom.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"zoom.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"zoom.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"zoom.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"zoom.exe\" trying to touch file \"C:\\zoom.exe\"\n \"zoom.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"zoom.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"zoom.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"zoom.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","description_v2":["\"zoom.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"","\"zoom.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"","\"zoom.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"","\"zoom.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"","\"zoom.exe\" trying to touch file \"C:\\zoom.exe\"","\"zoom.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"","\"zoom.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"","\"zoom.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"","\"zoom.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\""],"description_v3":[{"type":"text","value":"\"zoom.exe\" trying to touch file \"%WINDIR%\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to touch file \"C:\\zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-113","type":6,"relevance":5,"name":"Touches files in program files directory","description":"\"fleetdeck_agent_svc.exe\" touched file \"C:\\Program Files (x86)\\FleetDeck Agent\\deployment.json\"","description_v2":["\"fleetdeck_agent_svc.exe\" touched file \"C:\\Program Files (x86)\\FleetDeck Agent\\deployment.json\""],"description_v3":[{"type":"text","value":"\"fleetdeck_agent_svc.exe\" touched file \"%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\deployment.json\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-55","type":6,"relevance":7,"name":"Touches files in the Windows directory","description":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" touched file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_iphrlbb4.qj1.ps1\"\n \"powershell.exe\" touched file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_32nsukb0.yfm.psm1\"","description_v2":["\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"","\"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","\"powershell.exe\" touched file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_iphrlbb4.qj1.ps1\"","\"powershell.exe\" touched file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_32nsukb0.yfm.psm1\""],"description_v3":[{"type":"text","value":"\"powershell.exe\" touched file \"%WINDIR%\\System32\\CatRoot\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_iphrlbb4.qj1.ps1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched file \"C:\\Windows\\Temp\\__PSScriptPolicyTest_32nsukb0.yfm.psm1\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-173","type":6,"relevance":1,"name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Program Files (x86)\\FleetDeck Agent\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Program Files (x86)\\FleetDeck Agent\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","description_v2":["\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"","\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","\"powershell.exe\" trying to access file \"C:\\Program Files (x86)\\FleetDeck Agent\\WINDOWSPOWERSHELL\\PROFILE.PS1\"","\"powershell.exe\" trying to access file \"C:\\Program Files (x86)\\FleetDeck Agent\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","\"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"","\"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","\"powershell.exe\" trying to access file \"%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\WINDOWSPOWERSHELL\\PROFILE.PS1\"","\"powershell.exe\" trying to access file \"%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\""],"description_v3":[{"type":"text","value":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" trying to access file \"%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\WINDOWSPOWERSHELL\\PROFILE.PS1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" trying to access file \"C:\\Program Files (x86)\\FleetDeck Agent\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" trying to access file \"%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\WINDOWSPOWERSHELL\\PROFILE.PS1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" trying to access file \"%PROGRAMFILES%\\(x86)\\FleetDeck Agent\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-126","type":6,"relevance":3,"name":"Tries to access non-existent files (executable)","description":"$63","description_v2":["\"zoom.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"","\"zoom.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wow64log.dll\"","\"zoom.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"","\"zoom.exe\" trying to access non-existent file \"C:\\MSVCP140.DLL\"","\"zoom.exe\" trying to access non-existent file \"C:\\MSVCP140.dll\"","\"zoom.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.DLL\"","\"zoom.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.dll\"","\"zoom.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","\"zoom.exe\" trying to access non-existent file \"C:\\MSI.DLL\"","\"zoom.exe\" trying to access non-existent file \"C:\\msi.dll\"","\"zoom.exe\" trying to access non-existent file \"C:\\BCRYPT.DLL\"","\"zoom.exe\" trying to access non-existent file \"C:\\bcrypt.dll\"","\"zoom.exe\" trying to access non-existent file \"C:\\SRPAPI.DLL\"","\"zoom.exe\" trying to access non-existent file \"C:\\srpapi.dll\"","\"zoom.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\TSAPPCMP.DLL\"","\"zoom.exe\" trying to access non-existent file \"C:\\WINDOWS\\SysWOW64\\TSAPPCMP.DLL\"","\"zoom.exe\" trying to access non-existent file \"C:\\MSIMSG.DLL\"","\"zoom.exe\" trying to access non-existent file \"C:\\MsiMsg.dll\"","\"zoom.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\"","\"zoom.exe\" trying to access non-existent file \"C:\\WINDOWS\\SysWOW64\\rpcss.dll\"","\"zoom.exe\" trying to access non-existent file \"C:\\PROPSYS.DLL\"","\"zoom.exe\" trying to access non-existent file \"C:\\PROPSYS.dll\"","\"zoom.exe\" trying to access non-existent file \"C:\\SAMCLI.DLL\""],"description_v3":[{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"%WINDIR%\\System32\\WOW64LOG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wow64log.dll\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\MSVCP140.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\MSVCP140.dll\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.dll\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\MSI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\msi.dll\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\BCRYPT.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\bcrypt.dll\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\SRPAPI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\srpapi.dll\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\TSAPPCMP.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\WINDOWS\\SysWOW64\\TSAPPCMP.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\MSIMSG.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\MsiMsg.dll\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\RPCSS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\WINDOWS\\SysWOW64\\rpcss.dll\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\PROPSYS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\PROPSYS.dll\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\SAMCLI.DLL\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-161","type":6,"relevance":3,"name":"Tries to access non-existent files (non-executable)","description":"\"zoom.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\FLEETDECK\"\n \"zoom.exe\" trying to access non-existent file \"C:\\ZOOM.EXE.LOCAL\"\n \"zoom.exe\" trying to access non-existent file \"C:\\zoom.exe.Local\\\"\n \"zoom.exe\" trying to access non-existent file \"SrpDevice\"\n \"msiexec.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\msiexec.exe.Local\\\"\n \"msiexec.exe\" trying to access non-existent file \"C:\\WINDOWS\\Installer\\inprogressinstallinfo.ipi\"\n \"msiexec.exe\" trying to access non-existent file \"A:\"\n \"msiexec.exe\" trying to access non-existent file \"B:\"\n \"msiexec.exe\" trying to access non-existent file \"D:\"\n \"msiexec.exe\" trying to access non-existent file \"E:\"","description_v2":["\"zoom.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\FLEETDECK\"","\"zoom.exe\" trying to access non-existent file \"C:\\ZOOM.EXE.LOCAL\"","\"zoom.exe\" trying to access non-existent file \"C:\\zoom.exe.Local\\\"","\"zoom.exe\" trying to access non-existent file \"SrpDevice\"","\"msiexec.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\msiexec.exe.Local\\\"","\"msiexec.exe\" trying to access non-existent file \"C:\\WINDOWS\\Installer\\inprogressinstallinfo.ipi\"","\"msiexec.exe\" trying to access non-existent file \"A:\"","\"msiexec.exe\" trying to access non-existent file \"B:\"","\"msiexec.exe\" trying to access non-existent file \"D:\"","\"msiexec.exe\" trying to access non-existent file \"E:\""],"description_v3":[{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"%TEMP%\\FLEETDECK\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\ZOOM.EXE.LOCAL\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"C:\\zoom.exe.Local\\\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" trying to access non-existent file \"SrpDevice\""},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\msiexec.exe.Local\\\""},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" trying to access non-existent file \"C:\\WINDOWS\\Installer\\inprogressinstallinfo.ipi\""},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" trying to access non-existent file \"A:\""},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" trying to access non-existent file \"B:\""},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" trying to access non-existent file \"D:\""},{"type":"linebreak"},{"type":"text","value":"\"msiexec.exe\" trying to access non-existent file \"E:\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-242","type":6,"relevance":1,"name":"Writes files","description":"$64","description_v2":["\"zoom.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\4041571202.msi\"","\"zoom.exe\" writes file \"\\device\\namedpipe\\wkssvc\"","\"zoom.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\fleetdeck\\fleetdeck agent installer.log\"","\"zoom.exe\" writes file \"%temp%\\4041571202.msi\"","\"zoom.exe\" writes file \"%temp%\\fleetdeck\\fleetdeck agent installer.log\"","\"fleetdeck_agent_svc.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\fleetdeck\\fleetdeck agent service.log\"","\"fleetdeck_agent_svc.exe\" writes file \"c:\\program files (x86)\\fleetdeck agent\\deployment.json\"","\"fleetdeck_agent_svc.exe\" writes file \"%programfiles%\\(x86)\\fleetdeck agent\\deployment.json\"","\"fleetdeck_agent_svc.exe\" writes file \"%temp%\\fleetdeck\\fleetdeck agent service.log\"","\"powershell.exe\" writes file \"c:\\windows\\temp\\__psscriptpolicytest_iphrlbb4.qj1.ps1\"","\"powershell.exe\" writes file \"c:\\windows\\temp\\__psscriptpolicytest_32nsukb0.yfm.psm1\"","\"powershell.exe\" writes file \"c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\""],"description_v3":[{"type":"text","value":"\"zoom.exe\" writes file \"%TEMP%\\4041571202.msi\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" writes file \"\\device\\namedpipe\\wkssvc\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" writes file \"C:\\Users\\%USERNAME%\\appdata\\local\\temp\\fleetdeck\\fleetdeck agent installer.log\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" writes file \"%temp%\\4041571202.msi\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" writes file \"%temp%\\fleetdeck\\fleetdeck agent installer.log\""},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" writes file \"C:\\Users\\%USERNAME%\\appdata\\local\\temp\\fleetdeck\\fleetdeck agent service.log\""},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" writes file \"c:\\program files (x86)\\fleetdeck agent\\deployment.json\""},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" writes file \"%programfiles%\\(x86)\\fleetdeck agent\\deployment.json\""},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" writes file \"%temp%\\fleetdeck\\fleetdeck agent service.log\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" writes file \"c:\\windows\\temp\\__psscriptpolicytest_iphrlbb4.qj1.ps1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" writes file \"c:\\windows\\temp\\__psscriptpolicytest_32nsukb0.yfm.psm1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" writes file \"c:\\windows\\system32\\config\\systemprofile\\appdata\\local\\microsoft\\windows\\powershell\\startupprofiledata-noninteractive\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-159","type":6,"relevance":1,"name":"Writes log files","description":"\"zoom.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\FleetDeck\\FleetDeck Agent Installer.log\"\n \"zoom.exe\" writes a file \"%TEMP%\\FleetDeck\\FleetDeck Agent Installer.log\"\n \"fleetdeck_agent_svc.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\FleetDeck\\FleetDeck Agent Service.log\"\n \"fleetdeck_agent_svc.exe\" writes a file \"%TEMP%\\FleetDeck\\FleetDeck Agent Service.log\"\n \"powershell.exe\" writes a file \"C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log\"\n \"powershell.exe\" writes a file \"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log\"","description_v2":["\"zoom.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\FleetDeck\\FleetDeck Agent Installer.log\"","\"zoom.exe\" writes a file \"%TEMP%\\FleetDeck\\FleetDeck Agent Installer.log\"","\"fleetdeck_agent_svc.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\FleetDeck\\FleetDeck Agent Service.log\"","\"fleetdeck_agent_svc.exe\" writes a file \"%TEMP%\\FleetDeck\\FleetDeck Agent Service.log\"","\"powershell.exe\" writes a file \"C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log\"","\"powershell.exe\" writes a file \"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log\""],"description_v3":[{"type":"text","value":"\"zoom.exe\" writes a file \"%TEMP%\\FleetDeck\\FleetDeck Agent Installer.log\""},{"type":"linebreak"},{"type":"text","value":"\"zoom.exe\" writes a file \"%TEMP%\\FleetDeck\\FleetDeck Agent Installer.log\""},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" writes a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\FleetDeck\\FleetDeck Agent Service.log\""},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" writes a file \"%TEMP%\\FleetDeck\\FleetDeck Agent Service.log\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" writes a file \"C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" writes a file \"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\powershell.exe.log\""}],"origin":"API Call","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-736","type":2,"relevance":1,"name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-417","type":2,"relevance":7,"name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")","description_v2":["Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1018","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1018","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-879","type":2,"relevance":1,"name":"Able to monitor socket connection","description":"Found reference to API \"Setsockopt\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")\n Found reference to API \"SetsockoptInt\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")\n Found reference to API \"SetsockoptIPMreq\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")\n Found reference to API \"SetsockoptLinger\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")\n Found reference to API \"SetsockoptIPv6Mreq\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")\n Found reference to API \"SetsockoptInet4Addr\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"setsockopt\"; File: \"zoom.exe\")","description_v2":["Found reference to API \"Setsockopt\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")","Found reference to API \"SetsockoptInt\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")","Found reference to API \"SetsockoptIPMreq\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")","Found reference to API \"SetsockoptLinger\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")","Found reference to API \"SetsockoptIPv6Mreq\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")","Found reference to API \"SetsockoptInet4Addr\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"setsockopt\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"Found reference to API \"Setsockopt\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetsockoptInt\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetsockoptIPMreq\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetsockoptLinger\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetsockoptIPv6Mreq\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetsockoptInet4Addr\" (Indicator: \"setsockopt\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1205.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1205/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-62","type":7,"relevance":1,"name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D\"\n Found http requests in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69\"","description_v2":["Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D\"","Found http requests in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69\""],"description_v3":[{"type":"text","value":"Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D\""},{"type":"linebreak"},{"type":"text","value":"Found http requests in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69\""}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-228","type":2,"relevance":1,"name":"Contains ability to communicate with C2 using Sockets (API string)","description":"file/memory contains long string with (Indicator: \"WSARecv\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"WSASend\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"zoom.exe\")\n Found reference to API \"syscall.WSARecv\" (Indicator: \"WSARecv\"; File: \"zoom.exe\")\n Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; File: \"zoom.exe\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"WSARecv\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"WSASend\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"zoom.exe\")","Found reference to API \"syscall.WSARecv\" (Indicator: \"WSARecv\"; File: \"zoom.exe\")","Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; File: \"zoom.exe\")","Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"WSARecv\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"WSASend\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"syscall.WSARecv\" (Indicator: \"WSARecv\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1095","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1095","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-601","type":2,"relevance":1,"name":"Contains ability to communicate with network (API string)","description":"file/memory contains long string with (Indicator: \"WSARecv\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"WSASend\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"zoom.exe\")\n Found reference to API \"syscall.WSARecv\" (Indicator: \"WSARecv\"; File: \"zoom.exe\")\n Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; File: \"zoom.exe\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; File: \"zoom.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003924-00000C2C-2554356412\")","description_v2":["file/memory contains long string with (Indicator: \"WSARecv\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"WSASend\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"zoom.exe\")","Found reference to API \"syscall.WSARecv\" (Indicator: \"WSARecv\"; File: \"zoom.exe\")","Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; File: \"zoom.exe\")","Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; File: \"zoom.exe\")","Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003924-00000C2C-2554356412\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"WSARecv\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"WSASend\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"syscall.WSARecv\" (Indicator: \"WSARecv\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003924-00000C2C-2554356412\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-210","type":2,"relevance":1,"name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"zoom.exe\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"zoom.exe\")","Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1559","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1559","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-419","type":2,"relevance":1,"name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"setsockopt\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1571","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1571","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-112","type":2,"relevance":1,"name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1087.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1087/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-899","type":2,"relevance":1,"name":"Contains references to network communication API (string)","description":"$65","description_v2":["file/memory contains long string with (Indicator: \"wsastartup\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"wsacleanup\"; File: \"zoom.exe\")","Found reference to API \"bad flushGen bad map statedalTLDpSugct?double unlockexchange fullexecRInternalfatal error: gethostbynamegetservbynameinvalid base kernel32.dll\" (Indicator: \"gethostbyname\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \" send \"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \" socket \"; File: \"zoom.exe\")","Found reference to API \"syscall.WSAStartup\" (Indicator: \"wsastartup\"; File: \"zoom.exe\")","Found reference to API \"App: %ls found running, %d processes, attempting to send message.\" (Indicator: \" send \"; File: \"zoom.exe\")","Found reference to API \"failed to send progress message\" (Indicator: \" send \"; File: \"zoom.exe\")","Found reference to API \"failed to get message to send to users when server reboots due to service failure.\" (Indicator: \" send \"; File: \"zoom.exe\")","Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00003924-00000C2C-2554356412\")","Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")","Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"wsastartup\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"wsacleanup\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"bad flushGen bad map statedalTLDpSugct?double unlockexchange fullexecRInternalfatal error: gethostbynamegetservbynameinvalid base kernel32.dll\" (Indicator: \"gethostbyname\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \" send \"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \" socket \"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"syscall.WSAStartup\" (Indicator: \"wsastartup\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"App: %ls found running, %d processes, attempting to send message.\" (Indicator: \" send \"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"failed to send progress message\" (Indicator: \" send \"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"failed to get message to send to users when server reboots due to service failure.\" (Indicator: \" send \"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00003924-00000C2C-2554356412\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" (Indicator: \" bind \"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ote: There is some performance penalty associated with assembly bind failure logging.\" (Indicator: \" bind \"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-14","type":2,"relevance":0,"name":"Found potential IP address in binary/memory","description":"$66","description_v2":["\"2.5.29.37\"","\"2.5.29.35\"","Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\"","Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"","\"192.168.0.2\"","Potential IP \"4.0.0.0\" found in string \"4.0.0.0,\"","Potential IP \"1.0.0.0\" found in string \"anagement.Infrastructure,1.0.0.0,,31bf3856ad364e35\"","Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"","\"2.5.29.31\"","Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"","\"2.5.29.14\"","\"2.5.29.15\"","\"2.5.29.19\"","\"2.5.29.32\"","\"2.5.4.3\"","\"2.5.29.1\"","\"2.5.29.10\"","\"2.5.29.17\"","Potential IP \"2.5.4.11\" found in string \"2.5.4.11`\"","\"2.5.4.8\"","\"2.5.4.10\"","\"2.5.4.6\"","\"2.5.4.11\"","\"2.5.4.7\"","\"2.5.4.5\"","\"2.5.29.16\"","\"1.10.3.6\"","Potential IP \"4.0.0.0\" found in string \"#n=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\"","Potential IP \"10.0.0.0\" found in string \"ppV.AppvClientComConsumer,10.0.0.0,,31bf3856ad364e35\"","Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\"","Potential IP \"1.0.0.0\" found in string \"1.0.0.0)\"","Potential IP \"10.0.0.0\" found in string \"icrosoft.Windows.Firewall.Commands,10.0.0.0,,31bf3856ad364e35\"","Potential IP \"1.0.0.0\" found in string \":\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts\\1.0.0.0\"","Potential IP \"1.0.0.0\" found in string \"C:/WINDOWS/system32/WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/Microsoft.Powershell.LocalAccounts.dll\"","Potential IP \"1.0.0.0\" found in string \"ile:///C:/WINDOWS/system32/WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/Microsoft.Powershell.LocalAccounts.dll\"","Potential IP \"1.0.0.0\" found in string \"C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts\\1.0.0.0\\Microsoft.Powershell.LocalAccounts.dll\"","\"1.0.0.0\""],"description_v3":[{"type":"text","value":"\"2.5.29.37\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.35\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\""},{"type":"linebreak"},{"type":"text","value":"\"192.168.0.2\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"4.0.0.0\" found in string \"4.0.0.0,\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"1.0.0.0\" found in string \"anagement.Infrastructure,1.0.0.0,,31bf3856ad364e35\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.31\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.14\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.15\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.19\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.32\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.3\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.1\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.10\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.17\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"2.5.4.11\" found in string \"2.5.4.11`\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.8\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.10\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.6\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.11\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.7\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.5\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.16\""},{"type":"linebreak"},{"type":"text","value":"\"1.10.3.6\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"4.0.0.0\" found in string \"#n=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"10.0.0.0\" found in string \"ppV.AppvClientComConsumer,10.0.0.0,,31bf3856ad364e35\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"4.0.0.0\" found in string \"rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"1.0.0.0\" found in string \"1.0.0.0)\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"10.0.0.0\" found in string \"icrosoft.Windows.Firewall.Commands,10.0.0.0,,31bf3856ad364e35\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"1.0.0.0\" found in string %WINDIR%\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts\\1.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"1.0.0.0\" found in string \"C:/WINDOWS/system32/WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/Microsoft.Powershell.LocalAccounts.dll\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"1.0.0.0\" found in string \"ile:///C:/WINDOWS/system32/WindowsPowerShell/v1.0/Modules/Microsoft.PowerShell.LocalAccounts/1.0.0.0/Microsoft.Powershell.LocalAccounts.dll\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"1.0.0.0\" found in string \"C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.LocalAccounts\\1.0.0.0\\Microsoft.Powershell.LocalAccounts.dll\""},{"type":"linebreak"},{"type":"text","value":"\"1.0.0.0\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":3,"name":"Found potential URL in binary/memory","description":"$67","description_v2":["Heuristic match: \"*runtime.name\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil\"","Pattern match: \"pathfleetdeck.io/prototype3/agent_installermodfleetdeck.io/prototype3/agent_installer(devel)depfleetdeck.io/prototype3/go-libs/fsutilv0.0.0-00010101000000-000000000000=\"","Heuristic match: \"__x86.get_pc_thunk.ax\"","Heuristic match: \"__x86.get_pc_thunk.cx\"","Heuristic match: \"__x86.get_pc_thunk.si\"","Heuristic match: \"runtime.(*functype).in\"","Heuristic match: \"runtime.(*bucket).mp\"","Heuristic match: \"runtime.(*polldesc).info\"","Heuristic match: \"runtime.name.name\"","Pattern match: \"eq.sync/atomic.bool\"","Pattern match: \"eq.sync/atomic.uint64\"","Heuristic match: \"internal/reflectlite.name.name\"","Heuristic match: \"internal/reflectlite.(*rtype).name\"","Heuristic match: \"sync.(*once).do\"","Pattern match: \"eq.sync/atomic.pointer\"","Heuristic match: \"unicode.to\"","Heuristic match: \"reflect.(*functype).in\"","Heuristic match: \"reflect.name.name\"","Heuristic match: \"reflect.(*rtype).name\"","Heuristic match: \"reflect.(*rtype).in\"","Heuristic match: \"reflect.flag.ro\"","Heuristic match: \"reflect.value.int\"","Heuristic match: \"reflect.(*functype).name\"","Heuristic match: \"reflect.(*ptrtype).name\"","Pattern match: \"eq.io/fs.patherror\"","Heuristic match: \"syscall.errno.is\"","Heuristic match: \"os.(*file).name\"","Heuristic match: \"os.(*filestat).name\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/fsutil.createdirifnonexistant\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/logutil.logfile\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/logutil.initlogging\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/logutil.paniclogger\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msiopendatabase\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msidatabasegeneratetransform\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msicreatetransformsummaryinfo\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msiviewclose\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.modifyrecord\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.modifyrecord.func2\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.modifyrecord.func1\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msiclosehandle\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msisetinternalui\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msiinstallproduct\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msigetproductcode\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msilocatecomponent\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msiconfigureproduct\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.asktouninstall\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.uninstall\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.init\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/logutil.logfilewriter\"","Heuristic match: \"ocsp.sectigo.com\"","Heuristic match: \"get /mfewtzbnmeswstajbgurdgmcgguabbsde3gf41waic8uh9lf92%2bijqh5qwqumuusmv81lkgvkebccca2kvwxheycedpxckirqfmz4qw70zm5rw4%3d http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/10.0host: ocsp.sectigo.com\"","Heuristic match: \"get /mfiwudbomewwsjajbgurdgmcgguabbrd0jozuyxmqqw4y4zjtrlcmcrskaqugtksqssozubixklgkjks7eippxqceqc94xtxfo2ez6abd%2fn9%2bl69 http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/10.0host: ocsp.sectigo.com\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/fsutil@v0.0.0-00010101000000-000000000000/fsutils.go\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/logutil@v0.0.0-00010101000000-000000000000/logdir_windows.go\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/logutil@v0.0.0-00010101000000-000000000000/logutil.go\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil@v0.0.0-00010101000000-000000000000/msiutil.go\"","Pattern match: \"fleetdeck.io/prototype3/agent_installer/agent_installer.go\"","Pattern match: \"fleetdeck.io/prototype3/agent_installer/w32.go\"","Pattern match: \"fleetdeck.io/prototype3/agent_installer/msidata_gen.go\"","Pattern match: \"fleetdeck.io/prototype3/agent_svc\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/agentcommon\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/fsutil\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/logutil\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/retryutil\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/robustdns\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/svcutil\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/updater\"","Pattern match: \"fleetdeck.io/prototype3/go-libs/updaterversion\"","Pattern match: \"github.com/miekg/dns\"","Pattern match: \"golang.org/x/sys\"","Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","Pattern match: \"microsoft.net/framework64/v4.0.30319/\"","Heuristic match: \"microsoft-windows-client-features-package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Heuristic match: \"microsoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Pattern match: \"http://go.microsoft.com/fwlink/?linkid=42127\"","Pattern match: \"crl.comodoca.com/aaacertificateservices.crl06\"","Pattern match: \"crl.comodo.net/aaacertificateservices.crl0\"","Pattern match: \"http://repository.swisssign.com/0\"","Pattern match: \"www.digicert.com1\"","Pattern match: \"www.microsoft\"","Heuristic match: \"\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Heuristic match: \"ntrust.net\"","Heuristic match: \"stem.management.automation.re\"","Heuristic match: \"??\\c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Pattern match: \"www.digicert.com1$0\"","Pattern match: \"crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^\"","Pattern match: \"www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0\"","Pattern match: \"http://cybertrust.omniroot.com/repository.cfm0\"","Pattern match: \"http://ocsp.omniroot.com/baltimoreroot0\"","Pattern match: \"cdp1.public-trust.com/crl/omniroot2025.crl0\"","Pattern match: \"www.verisign.com/cps\"","Pattern match: \"https://www.verisign.com/cps04\"","Pattern match: \"http://crl.verisign.com/pca3.crl0\"","Pattern match: \"www.digicert.com1+0\"","Pattern match: \"www.microsoft.com/pkiops/docs/repository.htm\"","Pattern match: \"http://logo.verisign.com/vslogo.gif0\"","Pattern match: \"http://cert.startcom.org/sfsca-crl.crl0+\"","Pattern match: \"http://crl.startcom.org/sfsca-crl.crl0\"","Pattern match: \"http://cert.startcom.org/policy.pdf05\"","Pattern match: \"http://cert.startcom.org/intermediate.pdf0\"","Pattern match: \"http://cert.startcom.org/policy.pdf0\"","Pattern match: \"7www.entrust.net/cps_2048\"","Pattern match: \"http://crl.globalsign.net/root-r2.crl0\"","Pattern match: \"http://crl.securetrust.com/stca.crl0\"","Pattern match: \"http://www.certplus.com/crl/class2.crl0\"","Pattern match: \"www.entrust.net/legal-terms1907\"","Pattern match: \"0www.entrust.net/cps\"","Pattern match: \"www.digicert.com1!0\"","Pattern match: \"crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0\"","Pattern match: \"www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0\"","Pattern match: \"crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z\"","Pattern match: \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07\"","Pattern match: \"http://www.microsoft.com0\"","Pattern match: \"www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a\"","Pattern match: \"www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0\"","Pattern match: \"crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z\"","Pattern match: \"http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0\"","Pattern match: \"https://wdcp.microsoft.com/wdcp.svc/submitreport\"","Pattern match: \"go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&\"","Pattern match: \"http://www.microsoft.com/windows\"","Pattern match: \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0\"","Pattern match: \"www.microsoft.com/pki/docs/cps/default.htm0@\"","Heuristic match: \"ystem.windows.fo\"","Heuristic match: \"ft.net\"","Heuristic match: \":\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Pattern match: \"microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll\"","Heuristic match: \"??\\c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Heuristic match: \":\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Pattern match: \"http://schemas.microsoft.com/windows/2004/02/mit/task\"","Heuristic match: \"tupes.ps\"","Pattern match: \"crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x\"","Pattern match: \"http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0\"","Pattern match: \"crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z\"","Pattern match: \"http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0\"","Heuristic match: \"icrolist.com\"","Heuristic match: \"micrlistt.co\"","Pattern match: \"www.micr\"","Pattern match: \"http://www.microsoft.com/windows0\"","Pattern match: \"http://www.validationtest.contoso.com/test%d.html\"","Heuristic match: \"cim_system.name\"","Heuristic match: \"??\\c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Heuristic match: \"dows.firewall.co\"","Heuristic match: \"bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Heuristic match: \"microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Heuristic match: \".0.16299.15.ca\"","Pattern match: \"http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0\"","Heuristic match: \"tomation.re\"","Pattern match: \"https://go.microsoft.com/fwlink/?linkid=285219\"","Heuristic match: \"5.cat\"","Heuristic match: \"23.ck\"","Pattern match: \"oft.com/9tf_p\"","Pattern match: \"www.microsoft.com/p\"","Heuristic match: \"icrosoft.management.in\"","Pattern match: \"crl.microsoft.com/pki/crl/pr\"","Pattern match: \"http://www.microsoft.com/pki/cer\\\"","Pattern match: \"http://www.microxa3\\.i\"","Pattern match: \"www.microsoft.com/\""],"description_v3":[{"type":"text","value":"Heuristic match: \"*runtime.name\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"pathfleetdeck.io/prototype3/agent_installermodfleetdeck.io/prototype3/agent_installer(devel)depfleetdeck.io/prototype3/go-libs/fsutilv0.0.0-00010101000000-000000000000=\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"__x86.get_pc_thunk.ax\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"__x86.get_pc_thunk.cx\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"__x86.get_pc_thunk.si\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"runtime.(*functype).in\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"runtime.(*bucket).mp\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"runtime.(*polldesc).info\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"runtime.name.name\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"eq.sync/atomic.bool\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"eq.sync/atomic.uint64\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"internal/reflectlite.name.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"internal/reflectlite.(*rtype).name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"sync.(*once).do\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"eq.sync/atomic.pointer\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"unicode.to\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"reflect.(*functype).in\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"reflect.name.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"reflect.(*rtype).name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"reflect.(*rtype).in\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"reflect.flag.ro\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"reflect.value.int\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"reflect.(*functype).name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"reflect.(*ptrtype).name\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"eq.io/fs.patherror\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"syscall.errno.is\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"os.(*file).name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"os.(*filestat).name\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/fsutil.createdirifnonexistant\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/logutil.logfile\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/logutil.initlogging\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/logutil.paniclogger\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msiopendatabase\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msidatabasegeneratetransform\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msicreatetransformsummaryinfo\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msiviewclose\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.modifyrecord\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.modifyrecord.func2\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.modifyrecord.func1\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msiclosehandle\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msisetinternalui\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msiinstallproduct\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msigetproductcode\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msilocatecomponent\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.msiconfigureproduct\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.asktouninstall\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.uninstall\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil.init\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/logutil.logfilewriter\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ocsp.sectigo.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"get /mfewtzbnmeswstajbgurdgmcgguabbsde3gf41waic8uh9lf92%2bijqh5qwqumuusmv81lkgvkebccca2kvwxheycedpxckirqfmz4qw70zm5rw4%3d http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/10.0host: ocsp.sectigo.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"get /mfiwudbomewwsjajbgurdgmcgguabbrd0jozuyxmqqw4y4zjtrlcmcrskaqugtksqssozubixklgkjks7eippxqceqc94xtxfo2ez6abd%2fn9%2bl69 http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/10.0host: ocsp.sectigo.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/fsutil@v0.0.0-00010101000000-000000000000/fsutils.go\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/logutil@v0.0.0-00010101000000-000000000000/logdir_windows.go\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/logutil@v0.0.0-00010101000000-000000000000/logutil.go\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/msiutil@v0.0.0-00010101000000-000000000000/msiutil.go\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/agent_installer/agent_installer.go\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/agent_installer/w32.go\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/agent_installer/msidata_gen.go\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/agent_svc\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/agentcommon\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/fsutil\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/logutil\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/retryutil\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/robustdns\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/svcutil\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/updater\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"fleetdeck.io/prototype3/go-libs/updaterversion\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"github.com/miekg/dns\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"golang.org/x/sys\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/xmlschema-instance\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"microsoft.net/framework64/v4.0.30319/\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"microsoft-windows-client-features-package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"microsoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://go.microsoft.com/fwlink/?linkid=42127\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.comodoca.com/aaacertificateservices.crl06\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.comodo.net/aaacertificateservices.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://repository.swisssign.com/0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ntrust.net\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"stem.management.automation.re\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"??\\%WINDIR%\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1$0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://cybertrust.omniroot.com/repository.cfm0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.omniroot.com/baltimoreroot0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"cdp1.public-trust.com/crl/omniroot2025.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.verisign.com/cps\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.verisign.com/cps04\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.verisign.com/pca3.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1+0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pkiops/docs/repository.htm\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://logo.verisign.com/vslogo.gif0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://cert.startcom.org/sfsca-crl.crl0+\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.startcom.org/sfsca-crl.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://cert.startcom.org/policy.pdf05\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://cert.startcom.org/intermediate.pdf0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://cert.startcom.org/policy.pdf0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"7www.entrust.net/cps_2048\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.globalsign.net/root-r2.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.securetrust.com/stca.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.certplus.com/crl/class2.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.entrust.net/legal-terms1907\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"0www.entrust.net/cps\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1!0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://wdcp.microsoft.com/wdcp.svc/submitreport\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/windows\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pki/docs/cps/default.htm0@\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.windows.fo\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ft.net\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \":\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"??\\c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \":\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package0011~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://schemas.microsoft.com/windows/2004/02/mit/task\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"tupes.ps\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"icrolist.com\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"micrlistt.co\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.micr\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/windows0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.validationtest.contoso.com/test%d.html\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"cim_system.name\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"??\\c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"dows.firewall.co\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \".0.16299.15.ca\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"tomation.re\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://go.microsoft.com/fwlink/?linkid=285219\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"5.cat\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"23.ck\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"oft.com/9tf_p\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/p\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"icrosoft.management.in\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/pr\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/pki/cer\\\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microxa3\\.i\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"memorydump-2","type":20,"relevance":1,"name":"Found potential URLs in memory dumps","description":"$68","description_v2":["Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp\")","Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp\")","Found URL \"http://repository.swisssign.com/02z\" - Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")","Found URL \"http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl00vemkidmroot\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?!m5c3il\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")","Found URL \"http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")","Found URL \"http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")","Found URL \"http://cert.startcom.org/policy.pdf0)startcom\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*lcrosoft\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*l;\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")","Found URL \"https://wdcp.microsoft.com/wdcp.svc/submitreport:\\programdata\\microsoft\\windows\" - Source: \"00000000-00002636.00000000.228765.6DB20000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft\" - Source: \"00000000-00002636.00000000.228765.6DB20000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00002636.00000000.228765.6DB20000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00002636.00000000.228765.6DB20000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1\" - Source: \"00000000-00002636.00000000.228765.6DB20000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06\" - Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\\l!09;kp^-kwashington1redmond1microsoft\" - Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>\" - Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","Found URL \"http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan\" - Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")","Found URL \"http://repository.swisssign.com/02z\" - Source: \"00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")","Found URL \"http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl00vemkidmroot\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?!m5c3il\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")","Found URL \"http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")","Found URL \"http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")","Found URL \"http://cert.startcom.org/policy.pdf0)startcom\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00002636.00000001.229385.6D6AB000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*lcrosoft\" - Source: \"00000000-00002636.00000001.229385.6D6AB000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0'6*l:\" - Source: \"00000000-00002636.00000001.229385.6D6AB000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00002636.00000001.229385.6D6FA000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0^\" - Source: \"00000000-00002636.00000001.229385.6DC20000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0,\" - Source: \"00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06\" - Source: \"00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\\l!8.ek@26vtlp0xr!s4zs9_>$vkt7\" - Source: \"00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0@;'k.com/pkiops/certs/micwinprop11_2011-10-19.crt0cj1+ppqqm\" - Source: \"00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0abq]\\dqc\\i11202335q\" - Source: \"00000000-00002636.00000001.229385.6DD14000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0,\" - Source: \"00000000-00002636.00000001.229385.6DD14000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/cer\\\" - Source: \"00000000-00002636.00000001.229385.6DD66000.00000004.mdmp\")","Found URL \"http://www.microxa3\\.ilambda_methodtimstapca_2010-07-01.crt0\" - Source: \"00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0,\" - Source: \"00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/rl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0kh!y,\" - Source: \"00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft\" - Source: \"00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>bldrr1-40500root\\standardcimv2__parametersabstractreturnvalueuint32uint32bldrr1-40500root\\standardcimv2__parametersabstractreturnvalueuint32uint32__parametersabstractreturnvalueuint32uint32p7rml$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hh\" - Source: \"00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")","Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00003924.00000000.228373.02CB0000.00000004.mdmp\")","Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00003924.00000001.230292.02CB0000.00000004.mdmp\")","Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00003924.00000002.230420.02CB0000.00000004.mdmp\")","Found URL \"https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\\?\\volume\" - Source: \"00000000-00004540.00000000.229712.0E668000.00000002.mdmp\")","Found URL \"https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\\definition\" - Source: \"00000000-00004540.00000000.229712.0E668000.00000002.mdmp\")","$6b","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0u\" - Source: \"00000000-00004540.00000000.229712.360D0000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0qi&>@'uh?iwashington1redmond1microsoft\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")","Found URL \"http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?!m5c3rszysil\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")","Found URL \"http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")","Found URL \"http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")","Found URL \"http://cert.startcom.org/policy.pdf0)startcom\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windows\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windowsx>gpp>gpxdgppdgpxggppggp0>gpx>gph5t[u8?gp']qqx?gpf89b8@gpx@gpessmlhistoryencodeexpigpencoderecipientid8agp3k*jpagpwvtasn1spcsiginfoencode8bgpxbgpgz;\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00004540.00000000.229712.50AD0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00004540.00000000.229712.50AD0000.00000004.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=528806'redmond1microsoft\" - Source: \"00000000-00004540.00000000.229712.50AD0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1\" - Source: \"00000000-00004540.00000000.229712.50AD0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00004540.00000000.229712.50CD3000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>pvapd6@\" - Source: \"00000000-00004540.00000000.229712.50CD3000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windows\" - Source: \"00000000-00004540.00000000.229712.50CD3000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windowsv\\n?+q^p;v^pkv^p+q^p;v^pkv^p+q^p;v^pkv^pudm?\" - Source: \"00000000-00004540.00000000.229712.50CD3000.00000004.mdmp\")","Found URL \"https://github.com/lzybkr/psreadline/issues/new-----------------------------------------------------------------------last\" - Source: \"00000000-00004540.00000000.229712.50F02000.00000002.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=528808-microsoft.powershell.psconsolereadlineoptionspsreadlineoptionhelpuri-http://go.microsoft.com/fwlink/?linkid=528811\" - Source: \"00000000-00004540.00000000.229712.50F02000.00000002.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=528810position\" - Source: \"00000000-00004540.00000000.229712.50F02000.00000002.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=528807(microsoft.powershell.keyhandlerremovepsreadlinekeyhandlerhelpuri-http://go.microsoft.com/fwlink/?linkid=528809count\" - Source: \"00000000-00004540.00000000.229712.50F02000.00000002.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0u\" - Source: \"00000000-00004540.00000001.230288.360D0000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0qi&>@'uh?iwashington1redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")","Found URL \"http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?!m5c3rszysil\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")","Found URL \"http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")","Found URL \"http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")","Found URL \"http://cert.startcom.org/policy.pdf0)startcom\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")","Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00004540.00000001.230288.50626000.00000004.mdmp\")","$6c","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt008ipar')xxxxxxxxi\\o\\\\30\" - Source: \"00000000-00004540.00000001.230288.50664000.00000004.mdmp\")","Found URL \"http://go.microsoft.com/fwlink/?linkid=528806'redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.50B1D000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1;n/\" - Source: \"00000000-00004540.00000001.230288.50B1D000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00004540.00000001.230288.50B1D000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0,\" - Source: \"00000000-00004540.00000001.230288.50B1D000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windows&of?washington1redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.50C29000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windows3.6.1.\" - Source: \"00000000-00004540.00000001.230288.50C29000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0_>n?t9s>;9j>\" - Source: \"00000000-00004540.00000001.230288.50C29000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windowspk]\\ffobg88v-movnen%v\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0,\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.comfhttp://www.microsoft.com/pki/cerp(9iheappca_nu,3p6washington1redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4z\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>1l0j\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windows\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1microsoft\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windowsroot\\standardcimv2cim_policysetcim_policycim_managedelementcim_policyruleumlpackagepathcim::policylocalecaptionstringmaxlencommonnamestringconditionlisttypeuint16valuemapcreationclassnamestringmaxlendescriptionstringelementnamestringenableduint16valuemapexecutionstrategyuint16valuemapinstanceidstringmandatorybooleandeprecatedno\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0,\" - Source: \"00000000-00004540.00000001.230288.50D97000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windowswashington1redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.50D97000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://repository.swisssign.com/02z\" - Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl00vemkidmroot\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?!m5c3il\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cert.startcom.org/policy.pdf0)startcom\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*lcrosoft\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*l;\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00002636.00000000.228765.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://wdcp.microsoft.com/wdcp.svc/submitrepor%ALLUSERSPROFILE%\\microsoft\\windows\" - Source: \"00000000-00002636.00000000.228765.6DB20000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft\" - Source: \"00000000-00002636.00000000.228765.6DB20000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00002636.00000000.228765.6DB20000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00002636.00000000.228765.6DB20000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1\" - Source: \"00000000-00002636.00000000.228765.6DB20000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06\" - Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\\l!09;kp^-kwashington1redmond1microsoft\" - Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>\" - Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan\" - Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u\" - Source: \"00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://repository.swisssign.com/02z\" - Source: \"00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl00vemkidmroot\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?!m5c3il\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cert.startcom.org/policy.pdf0)startcom\" - Source: \"00000000-00002636.00000001.229385.6D640000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00002636.00000001.229385.6D6AB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*lcrosoft\" - Source: \"00000000-00002636.00000001.229385.6D6AB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0'6*l:\" - Source: \"00000000-00002636.00000001.229385.6D6AB000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00002636.00000001.229385.6D6FA000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0xl0j0hhttp://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0^\" - Source: \"00000000-00002636.00000001.229385.6DC20000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0,\" - Source: \"00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06\" - Source: \"00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0^k*y-g&ui\\l!8.ek@26vtlp0xr!s4zs9_>$vkt7\" - Source: \"00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0@;'k.com/pkiops/certs/micwinprop11_2011-10-19.crt0cj1+ppqqm\" - Source: \"00000000-00002636.00000001.229385.6DCDE000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0abq]\\dqc\\i11202335q\" - Source: \"00000000-00002636.00000001.229385.6DD14000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0,\" - Source: \"00000000-00002636.00000001.229385.6DD14000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/cer\\\" - Source: \"00000000-00002636.00000001.229385.6DD66000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microxa3\\.ilambda_methodtimstapca_2010-07-01.crt0\" - Source: \"00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0,\" - Source: \"00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/rl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0kh!y,\" - Source: \"00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft\" - Source: \"00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>bldrr1-40500root\\standardcimv2__parametersabstractreturnvalueuint32uint32bldrr1-40500root\\standardcimv2__parametersabstractreturnvalueuint32uint32__parametersabstractreturnvalueuint32uint32p7rml$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hhl$0ht$8ld$@ll$hh\" - Source: \"00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00003924.00000000.228373.02CB0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00003924.00000001.230292.02CB0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00003924.00000002.230420.02CB0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\\?\\volume\" - Source: \"00000000-00004540.00000000.229712.0E668000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\\definition\" - Source: \"00000000-00004540.00000000.229712.0E668000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"$6f"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0u\" - Source: \"00000000-00004540.00000000.229712.360D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0qi&>@'uh?iwashington1redmond1microsoft\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?!m5c3rszysil\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cert.startcom.org/policy.pdf0)startcom\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windows\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windowsx>gpp>gpxdgppdgpxggppggp0>gpx>gph5t[u8?gp']qqx?gpf89b8@gpx@gpessmlhistoryencodeexpigpencoderecipientid8agp3k*jpagpwvtasn1spcsiginfoencode8bgpxbgpgz;\" - Source: \"00000000-00004540.00000000.229712.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00004540.00000000.229712.50AD0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00004540.00000000.229712.50AD0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://go.microsoft.com/fwlink/?linkid=528806'redmond1microsoft\" - Source: \"00000000-00004540.00000000.229712.50AD0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1\" - Source: \"00000000-00004540.00000000.229712.50AD0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00004540.00000000.229712.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>pvapd6@\" - Source: \"00000000-00004540.00000000.229712.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windows\" - Source: \"00000000-00004540.00000000.229712.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windowsv\\n?+q^p;v^pkv^p+q^p;v^pkv^p+q^p;v^pkv^pudm?\" - Source: \"00000000-00004540.00000000.229712.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://github.com/lzybkr/psreadline/issues/new-----------------------------------------------------------------------last\" - Source: \"00000000-00004540.00000000.229712.50F02000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://go.microsoft.com/fwlink/?linkid=528808-microsoft.powershell.psconsolereadlineoptionspsreadlineoptionhelpuri-http://go.microsoft.com/fwlink/?linkid=528811\" - Source: \"00000000-00004540.00000000.229712.50F02000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://go.microsoft.com/fwlink/?linkid=528810position\" - Source: \"00000000-00004540.00000000.229712.50F02000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://go.microsoft.com/fwlink/?linkid=528807(microsoft.powershell.keyhandlerremovepsreadlinekeyhandlerhelpuri-http://go.microsoft.com/fwlink/?linkid=528809count\" - Source: \"00000000-00004540.00000000.229712.50F02000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0u\" - Source: \"00000000-00004540.00000001.230288.360D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0qi&>@'uh?iwashington1redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0m&5upqt4ja^\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cybertrust.omniroot.com/repository.cfm060402&http://ocsp.omniroot.com/baltimoreroot0;09071http://cdp1.public-trust.com/crl/omniroot2025.crl0&+;fbo&e\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif0\\:oj?!m5c3rszysil\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://cert.startcom.org/policy.pdf0)startcom\" - Source: \"00000000-00004540.00000001.230288.505E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00004540.00000001.230288.50626000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"$70"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt008ipar')xxxxxxxxi\\o\\\\30\" - Source: \"00000000-00004540.00000001.230288.50664000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://go.microsoft.com/fwlink/?linkid=528806'redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.50B1D000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1;n/\" - Source: \"00000000-00004540.00000001.230288.50B1D000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00004540.00000001.230288.50B1D000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0,\" - Source: \"00000000-00004540.00000001.230288.50B1D000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windows&of?washington1redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.50C29000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windows3.6.1.\" - Source: \"00000000-00004540.00000001.230288.50C29000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0_>n?t9s>;9j>\" - Source: \"00000000-00004540.00000001.230288.50C29000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windowspk]\\ffobg88v-movnen%v\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0(vyvhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0/r$u,ev$f9]mwyprg?j?\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt06\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0,\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.comfhttp://www.microsoft.com/pki/cerp(9iheappca_nu,3p6washington1redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0o0m0kehttp://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4z\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>1l0j\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windows\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1microsoft\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windowsroot\\standardcimv2cim_policysetcim_policycim_managedelementcim_policyruleumlpackagepathcim::policylocalecaptionstringmaxlencommonnamestringconditionlisttypeuint16valuemapcreationclassnamestringmaxlendescriptionstringelementnamestringenableduint16valuemapexecutionstrategyuint16valuemapinstanceidstringmandatorybooleandeprecatedno\" - Source: \"00000000-00004540.00000001.230288.50CD3000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0,\" - Source: \"00000000-00004540.00000001.230288.50D97000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windowswashington1redmond1microsoft\" - Source: \"00000000-00004540.00000001.230288.50D97000.00000004.mdmp\")"}],"origin":"Memory Dumps","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-72","type":7,"relevance":3,"name":"GETs files from a web server (HTTPS)","description":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com\n\n GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com\n","description_v2":["GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1","Connection: Keep-Alive","Accept: */*","User-Agent: Microsoft-CryptoAPI/10.0","Host: ocsp.sectigo.com","","GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1","Connection: Keep-Alive","Accept: */*","User-Agent: Microsoft-CryptoAPI/10.0","Host: ocsp.sectigo.com",""],"description_v3":[{"type":"text","value":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Connection: Keep-Alive"},{"type":"linebreak"},{"type":"text","value":"Accept: */*"},{"type":"linebreak"},{"type":"text","value":"User-Agent: Microsoft-CryptoAPI/10.0"},{"type":"linebreak"},{"type":"text","value":"Host: ocsp.sectigo.com"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1"},{"type":"linebreak"},{"type":"text","value":"Connection: Keep-Alive"},{"type":"linebreak"},{"type":"text","value":"Accept: */*"},{"type":"linebreak"},{"type":"text","value":"User-Agent: Microsoft-CryptoAPI/10.0"},{"type":"linebreak"},{"type":"text","value":"Host: ocsp.sectigo.com"}],"origin":"Network Traffic","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-78","type":7,"relevance":1,"name":"HTTP requests contain custom Base62 strings","description":"$71","description_v2":["Contains base62 string in header \"MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE\" in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\"","Contains base62 string in header \"2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kV\" in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\"","Contains base62 string in header \"MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\"","Contains base62 string in header \"JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQS\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\"","Contains base62 string in header \"sozUbIxKLGKjkS7EipPxQCEQC94xtxFO2\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""],"description_v3":[{"type":"text","value":"Contains base62 string in header \"MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE\" in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""},{"type":"linebreak"},{"type":"text","value":"Contains base62 string in header \"2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kV\" in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""},{"type":"linebreak"},{"type":"text","value":"Contains base62 string in header \"MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""},{"type":"linebreak"},{"type":"text","value":"Contains base62 string in header \"JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQS\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""},{"type":"linebreak"},{"type":"text","value":"Contains base62 string in header \"sozUbIxKLGKjkS7EipPxQCEQC94xtxFO2\" in header \"GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEQC94xtxFO2ez6ABD%2FN9%2Bl69 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com\""}],"origin":"Network Traffic","attck_id":"T1132","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1132","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-735","type":2,"relevance":3,"name":"Identified known pipe name","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00003924-00000CCE-2555213143\")","description_v2":["Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00003924-00000CCE-2555213143\")"],"description_v3":[{"type":"text","value":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00003924-00000CCE-2555213143\")"}],"origin":"File/Memory","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"summary-27","type":15,"relevance":2,"name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","description_v2":["Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network"],"description_v3":[{"type":"text","value":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network"}],"origin":"Indicator Combinations","attck_id":"T1119","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1119","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Pattern Matching","identifier":"yara-103","type":13,"relevance":5,"name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00002548\"","description_v2":["YARA signature for AES encryption matched on process \"00000000-00002548\""],"description_v3":[{"type":"text","value":"YARA signature for AES encryption matched on process \"00000000-00002548\""}],"origin":"YARA Signature","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Pattern Matching","identifier":"yara-140","type":13,"relevance":2,"name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"sample.bin\"","description_v2":["YARA signature matched on embedded PE in file \"sample.bin\""],"description_v3":[{"type":"text","value":"YARA signature matched on embedded PE in file \"sample.bin\""}],"origin":"YARA Signature","attck_id":"T1027.009","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/009","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Pattern Matching","identifier":"yara-208","type":13,"relevance":7,"name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00004540\"","description_v2":["YARA signature for encryption algorithm process \"00000000-00004540\""],"description_v3":[{"type":"text","value":"YARA signature for encryption algorithm process \"00000000-00004540\""}],"origin":"YARA Signature","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Ransomware/Banking","identifier":"string-553","type":2,"relevance":1,"name":"Contains ability to modify file system redirection (API string)","description":"file/memory contains long string with (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"zoom.exe\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"zoom.exe\")","description_v2":["file/memory contains long string with (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"zoom.exe\")","Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"zoom.exe\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"zoom.exe\")"}],"origin":"File/Memory","attck_id":"T1070","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Remote Access Related","identifier":"string-531","type":2,"relevance":1,"name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE783B55CC3E91CA02CE3B0D534BCF]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLE60EE93F3053ED6C701DB3716DE07]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE60EE93F3053ED6C701DB3716DE07]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")","description_v2":["Found string \"+ncalrpc:[OLE783B55CC3E91CA02CE3B0D534BCF]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")","Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")","Found string \"B+ncalrpc:[OLE60EE93F3053ED6C701DB3716DE07]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")","Found string \"+ncalrpc:[OLE60EE93F3053ED6C701DB3716DE07]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"+ncalrpc:[OLE783B55CC3E91CA02CE3B0D534BCF]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"B+ncalrpc:[OLE60EE93F3053ED6C701DB3716DE07]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002636.00000001.229385.6B2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"+ncalrpc:[OLE60EE93F3053ED6C701DB3716DE07]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1090","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1090","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-868","type":2,"relevance":1,"name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6DD14000.00000004.mdmp, 00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")\n Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")","description_v2":["Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6DD14000.00000004.mdmp, 00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")","Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002636.00000000.228765.6B2D0000.00000004.mdmp, 00000000-00002636.00000001.229385.6DC20000.00000004.mdmp, 00000000-00002636.00000001.229385.6DD14000.00000004.mdmp, 00000000-00002636.00000001.229385.6DD6F000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"kerberosclient\" (Indicator: \"kerberos\"; Source: \"00000000-00002636.00000001.229385.B57D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1558","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1558","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-78","type":2,"relevance":1,"name":"Able to capture screen (API string)","description":"$72","description_v2":["Found reference to API \"\" (Indicator: \"GetDC\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"GetDC\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"BitBlt\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")","Found reference to API \"\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"\" (Indicator: \"GetDC\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"GetDC\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateDC\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"BitBlt\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp, 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1113","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1113","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-86","type":2,"relevance":1,"name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetNtVersionNumbers\"; File: \"zoom.exe\")\n Found reference to API \",,RtlGetNtProductType,NTDLL.dll,\"00:59:29.40\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp\n 00000000-00002548.00000001.230295.035E0000.00000004.mdmp\"), Found reference to API \"15738\n4320\n3024\n\nRtlGetVersion\nNTDLL.dll\n\"00:59:29.437\"\nRX=0\nPX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp\"), Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")","description_v2":["file/memory contains long string with (Indicator: \"RtlGetNtVersionNumbers\"; File: \"zoom.exe\")","Found reference to API \",,RtlGetNtProductType,NTDLL.dll,\"00:59:29.40\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp","00000000-00002548.00000001.230295.035E0000.00000004.mdmp\"), Found reference to API \"15738","4320","3024","","RtlGetVersion","NTDLL.dll","\"00:59:29.437\"","RX=0","PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp\"), Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"RtlGetNtVersionNumbers\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \",,RtlGetNtProductType,NTDLL.dll,\"00:59:29.40\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00002548.00000001.230295.035E0000.00000004.mdmp\"), Found reference to API \"15738"},{"type":"linebreak"},{"type":"text","value":"4320"},{"type":"linebreak"},{"type":"text","value":"3024"},{"type":"linebreak"},{"type":"linebreak"},{"type":"text","value":"RtlGetVersion"},{"type":"linebreak"},{"type":"text","value":"NTDLL.dll"},{"type":"linebreak"},{"type":"text","value":"\"00:59:29.437\""},{"type":"linebreak"},{"type":"text","value":"RX=0"},{"type":"linebreak"},{"type":"text","value":"PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002548.00000000.228697.035E0000.00000004.mdmp\"), Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002636.00000001.229385.2DFD2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-836","type":2,"relevance":3,"name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")","description_v2":["Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002636.00000000.228765.6DCDE000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1213","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1213","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-229","type":2,"relevance":1,"name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKey (in long string)\" in file \"zoom.exe\"\n Found registry query API: \"RegQueryValue (in long string)\" in file \"zoom.exe\"\n Found registry query API: \"syscall.RegOpenKeyEx\" in file \"zoom.exe\"\n Found registry query API: \"syscall.RegQueryValueEx\" in file \"zoom.exe\"\n Found registry query API: \"syscall.RegEnumKeyEx\" in file \"zoom.exe\"\n Found registry query API: \"RegOpenKeyExW\" in file \"zoom.exe\"\n Found registry query API: \"RegEnumKeyExW\" in file \"zoom.exe\"\n Found registry query API: \"RegEnumValueW\" in file \"zoom.exe\"\n Found registry query API: \"RegQueryInfoKeyW\" in file \"zoom.exe\"\n Found registry query API: \"RegQueryValueExW\" in file \"zoom.exe\"","description_v2":["Found registry query API: \"RegOpenKey (in long string)\" in file \"zoom.exe\"","Found registry query API: \"RegQueryValue (in long string)\" in file \"zoom.exe\"","Found registry query API: \"syscall.RegOpenKeyEx\" in file \"zoom.exe\"","Found registry query API: \"syscall.RegQueryValueEx\" in file \"zoom.exe\"","Found registry query API: \"syscall.RegEnumKeyEx\" in file \"zoom.exe\"","Found registry query API: \"RegOpenKeyExW\" in file \"zoom.exe\"","Found registry query API: \"RegEnumKeyExW\" in file \"zoom.exe\"","Found registry query API: \"RegEnumValueW\" in file \"zoom.exe\"","Found registry query API: \"RegQueryInfoKeyW\" in file \"zoom.exe\"","Found registry query API: \"RegQueryValueExW\" in file \"zoom.exe\""],"description_v3":[{"type":"text","value":"Found registry query API: \"RegOpenKey (in long string)\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegQueryValue (in long string)\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"syscall.RegOpenKeyEx\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"syscall.RegQueryValueEx\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"syscall.RegEnumKeyEx\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegOpenKeyExW\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegEnumKeyExW\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegEnumValueW\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegQueryInfoKeyW\" in file \"zoom.exe\""},{"type":"linebreak"},{"type":"text","value":"Found registry query API: \"RegQueryValueExW\" in file \"zoom.exe\""}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-121","type":2,"relevance":1,"name":"Able to retrieve usernames and/or user information (API string)","description":"file/memory contains long string with (Indicator: \"GetUserName\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"LookupAccountSid\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"GetTokenInformation\"; File: \"zoom.exe\")\n file/memory contains long string with (Indicator: \"NetGetJoinInformation\"; File: \"zoom.exe\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; File: \"zoom.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"zoom.exe\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"zoom.exe\")\n Found reference to API \"194,3588,3219,,LookupAccountNameW,advapi32.dll,\"00:59:43.968\",RX=0,PX=0\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00002636.00000001.229385.6DD14000.00000004.mdmp\")","description_v2":["file/memory contains long string with (Indicator: \"GetUserName\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"LookupAccountSid\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"GetTokenInformation\"; File: \"zoom.exe\")","file/memory contains long string with (Indicator: \"NetGetJoinInformation\"; File: \"zoom.exe\")","Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; File: \"zoom.exe\")","Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"zoom.exe\")","Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"zoom.exe\")","Found reference to API \"194,3588,3219,,LookupAccountNameW,advapi32.dll,\"00:59:43.968\",RX=0,PX=0\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00002636.00000001.229385.6DD14000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"GetUserName\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"LookupAccountSid\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"GetTokenInformation\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"NetGetJoinInformation\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"zoom.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"194,3588,3219,,LookupAccountNameW,advapi32.dll,\"00:59:43.968\",RX=0,PX=0\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00002636.00000001.229385.6DD14000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"module-19","type":10,"relevance":3,"name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"zoom.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 72F10000","description_v2":["\"zoom.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 72F10000"],"description_v3":[{"type":"text","value":"\"zoom.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 72F10000"}],"origin":"Loaded Module","attck_id":"T1589.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1589/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-102","type":6,"relevance":5,"name":"Calls an API typically used for searching a directory for files","description":"$73","description_v2":["\"fleetdeck_agent_svc.exe\" called \"FindFirstFileW\" with parameter %PROGRAMFILES%\\(x86)\\FleetDeck Agent\\* (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"FindNextFileW\" with parameter deployment.json (UID: 00000000-00002548)","\"fleetdeck_agent_svc.exe\" called \"FindNextFileW\" with parameter fleetdeck_agent_svc.exe (UID: 00000000-00002548)","\"powershell.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\Microsoft.NET\\Framework64\\\\* (UID: 00000000-00002636)","\"powershell.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00002636)","\"powershell.exe\" called \"FindNextFileW\" with parameter sbscmp10.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"FindNextFileW\" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"FindNextFileW\" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"FindNextFileW\" with parameter SharedReg12.dll (UID: 00000000-00002636)","\"powershell.exe\" called \"FindNextFileW\" with parameter v2.0.50727 (UID: 00000000-00002636)","\"powershell.exe\" called \"FindNextFileW\" with parameter v3.0 (UID: 00000000-00002636)","\"powershell.exe\" called \"FindNextFileW\" with parameter v3.5 (UID: 00000000-00002636)","\"powershell.exe\" called \"FindNextFileW\" with parameter v4.0.30319 (UID: 00000000-00002636)","\"powershell.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\* (UID: 00000000-00002636)","\"powershell.exe\" called \"FindNextFileW\" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00002636)","\"powershell.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\* (UID: 00000000-00002636)","\"powershell.exe\" called \"FindNextFileW\" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00002636)","\"powershell.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\* (UID: 00000000-00002636)","\"powershell.exe\" called \"FindNextFileW\" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00002636)"],"description_v3":[{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"FindFirstFileW\" with parameter %PROGRAMFILES%\\(x86)\\FleetDeck Agent\\* (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"FindNextFileW\" with parameter deployment.json (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"FindNextFileW\" with parameter fleetdeck_agent_svc.exe (UID: 00000000-00002548)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\Microsoft.NET\\Framework64\\\\* (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindNextFileW\" with parameter sbscmp10.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindNextFileW\" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindNextFileW\" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindNextFileW\" with parameter SharedReg12.dll (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindNextFileW\" with parameter v2.0.50727 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindNextFileW\" with parameter v3.0 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindNextFileW\" with parameter v3.5 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindNextFileW\" with parameter v4.0.30319 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\* (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindNextFileW\" with parameter fe2524177eb3088c77be666722039f52 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\* (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindNextFileW\" with parameter b5ba37e1558ced178a99011a1d659b52 (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindFirstFileW\" with parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\* (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindNextFileW\" with parameter e43dd9c73ab5615e461bf5109c3facd6 (UID: 00000000-00002636)"}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-103","type":6,"relevance":3,"name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"zoom.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"fleetdeck_agent_svc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","description_v2":["\"zoom.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}","\"fleetdeck_agent_svc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}","\"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}"],"description_v3":[{"type":"text","value":"\"zoom.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"fleetdeck_agent_svc.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-327","type":6,"relevance":7,"name":"Calls an API typically used to enumerate Windows drive types","description":"\"zoom.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00003924)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00002636)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00004540)","description_v2":["\"zoom.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00003924)","\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00002636)","\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00004540)"],"description_v3":[{"type":"text","value":"\"zoom.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00003924)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00004540)"}],"origin":"API Call","attck_id":"T1680","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1680","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-141","type":6,"relevance":2,"name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00002636)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00004540)","description_v2":["\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00002636)","\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00004540)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00002636)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00004540)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-108","type":6,"relevance":3,"name":"Calls an API typically used to retrieve information about the current system","description":"\"zoom.exe\" called \"