26:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/23qlsjvno4-wq.js","/_next/static/chunks/11pkz44bx8x1b.js","/_next/static/chunks/04k_7k5p4krw4.js"],"ReportDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 25:T518,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.Crysis — Falcon Sandbox Report — Score 100/100 — Sample ded0bf44a335…","description":"Malicious verdict for sandbox report 5dd577d5cfe2…. Malware family: Trojan.Ransom.Crysis. Threat score 100/100. 5 malicious and 12 suspicious behavioral indicators across 33 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/ded0bf44a335e57387902f0ef102f95eefed714bbcfb2434847c8cd24f222813/5dd577d5cfe28a634f06dcfe","keywords":["Malicious","Trojan.Ransom.Crysis","sandbox report","malware analysis","MITRE ATT\u0026CK","ded0bf44a335e57387902f0ef102f95eefed714bbcfb2434847c8cd24f222813"],"about":{"@type":"SoftwareApplication","name":"adamsCopy.vexe","applicationCategory":"PE32 executable (GUI) Intel 80386, for MS Windows","identifier":"ded0bf44a335e57387902f0ef102f95eefed714bbcfb2434847c8cd24f222813","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.Crysis","sandboxEnvironment":"Windows 7 32 bit","behavioralIndicators":{"malicious":5,"suspicious":12,"totalSignatures":33},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==28:T4ac,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\ransomware.exe" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ransomware.exe" "" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ransomware.exe" "" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ransomware.exe" "" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\ransomware.exe" "cmd.exe" touched file "C:\Windows\Branding\Basebrd\basebrd.dll" "cmd.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "cmd.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "cmd.exe" touched file "C:\Windows\System32\mode.com" "cmd.exe" touched file "C:\Windows\System32\vssadmin.exe" "mode.com" touched file "C:\Windows\System32\en-US\ulib.dll.mui" "vssadmin.exe" touched file "C:\Windows\System32\en-US\vssadmin.exe.mui" "vssadmin.exe" touched file "C:\Windows\System32\rsaenh.dll" "vssadmin.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"29:T7e6,"C:\ransomware.exe" marked "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml" for deletion "C:\ransomware.exe" marked "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml" for deletion "C:\ransomware.exe" marked "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml" for deletion "C:\ransomware.exe" marked "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml" for deletion "C:\ransomware.exe" marked "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml" for deletion "C:\ransomware.exe" marked "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml" for deletion "C:\ransomware.exe" marked "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml" for deletion "C:\ransomware.exe" marked "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml" for deletion "C:\ransomware.exe" marked "C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml" for deletion "C:\ransomware.exe" marked "C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml" for deletion "C:\ransomware.exe" marked "C:\$Recycle.Bin\S-1-5-21-2092356043-4041700817-663127204-1001\desktop.ini" for deletion "C:\ransomware.exe" marked "C:\autoexec.bat" for deletion "C:\ransomware.exe" marked "C:\config.sys" for deletion "C:\ransomware.exe" marked "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml" for deletion "C:\ransomware.exe" marked "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml" for deletion "C:\ransomware.exe" marked "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Setup.xml" for deletion "C:\ransomware.exe" marked "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.xml" for deletion "C:\ransomware.exe" marked "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml" for deletion2a:T914,"" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab" with delete access "" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlookMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\Proof.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\$Recycle.Bin\S-1-5-21-2092356043-4041700817-663127204-1001\desktop.ini" with delete access "" opened "C:\autoexec.bat" with delete access "" opened "C:\config.sys" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab" with delete access "" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab" with delete access2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2c:Tc16c,iVBORw0KGgoAAAANSUhEUgAABEwAAAJYCAIAAAD39ORaAACAAElEQVR42uydf6zVZZ7fP6GUGEIooYYaQolLWENcaghrrbXGUmqNocYYY+nGGmupw1LWWJe4rMswjoiIigzjMLOuZfyBiMgYQ4mZWGutg4w7yzKMtawhxDGGEGOIMYYQYwghlK6pfd7v59zPOc89l8u93Nc7rz8u9/vreZ7v93I/L845H+KMJppynRI7lV8JC0KYrsReYXKU3HmncPXVQpVPFUJGdv7wDxv4zneE++4THnhA+MEPhOeeE156SbCtmzcLTzwhfPe7wp/8ibB8uXD77cL11wv/+l8L/+JfCP/0nwq///vCP/pHwu/+bsY//IfCP/gHwt//+8KkScIllwizZgkzZwpz5wr/5J8INqMFC4RFi4R/+S+F667LmD1b+J3fEaZOFS66SPi7f1cYY/lFHxmZM3oozZm/irHFrl3nBX65EXKeg+QQguQgOUgOkoPkIDlIDiFIDpJDCJKD5CA5SA6Sg+QgOYQgOUgOIUgOkoPkIDlIDpJDCEFykByC5CA5SA6Sg+QgOUgOIWTMxX5ZR2wRJkaJVW6mXmvXClbYRGwocT+8NEps6zPPREl15lPCzCi5+GLBapXjxwUb5P79UVJdd3uJDTLGKTrBuFLR69qpbAoRryoyfd95vHDsmBBxpyJntp3tzNWpFpccORIl3e7gBkWGcfJklPT1LwvnLn/n7wiXXipcc43wb/6N8Ed/JDz4oLBhg/CTnwh//ufC888Lzz4r/PSnwn/5L8Jf/IXw9NOC3ULbumWLYDvbme265oeGTTAfs+1sf2H9+MeCraSN2WZk2PRtYW2rjdm22jDyUdmF8mW3rbawdip7VJquO/rzW0JGcyhlCUFykBwkB8lBcpAcJAfJIUgOIUgOkoPkIDlIDpKD5CA5hCA5hCA5SA6Sg+QgOUgOkoPkEILkEILkIDlIDpKD5CA5SA6SQwiSQ0ZC1AHcELx0y+zCyr59+wQ/1ZQQ0rK+KiiljZtt/eAD4eBBwcrNNWsE25rP1wa5bp0QE4TDhwWLnWrGDCG/C9Zey27orbcKcZmig3TJabllNsE9e4SYK9jO1bJvKzElMBGN2KfYA7xG0DHbk5M/SHb3bQqGPXVmca7leenWVBRaMfrCC0LTmW3r1q3Ciy8KdiHbat5ig8yFwerpvLzOlcCONZ3IVcSmsGOHsH27YN5i2Kh++ENh40bh0UeFp54S7Fg7s13Xbmguk9Z5z3a2e5SvVW5xdgfz250/OfkTa4+onpkSkxAk55v02TKxbLrYy6kGatI4kps3IjlIDpKD5CA5SA6Sg+QQQoZAcnpv3d6jGwx0wq6H9371plPVOyM5SA6Sg+QgOUgOkoPkIDmEXOCS06MA9C45Hf+I5CA5SA6Sg+QgOUgOkoPkEELOm+TU3xzoxZmur9h0lJz6wPzVpMTE8lMNdFo8B8lBcpAcJAfJQXKQHCSHkLEuOQOZT9cPzNTf7/HAHl8d6nqqXqyJDCJvKZq8CLbuWxatia2wsypw7lzhyy+FmCNUTbGyxlZV1XsgRY61Qa5fL9ioTFTmzxdsrayerhrEyYzszEePCj5fvykrS7pcd5aiw7A6fts2IS4R3Fu0M1u3LnZ2yyS5mRj+xJqn6dIdOhQlNoX33hMmTxaqZV+kyIx8vlaaP/mkYHWtFcHWuOxHPxKsRmxqTpV3DMtbddmMbJD27wFWx9vWH/xAsDo+d7y8M1s+faOpJZq5h7Fpk2A31OabT9DugtmF/YjaHbSiP7+/hi2OXdcEybDrGmYmdqzNKFcvu792y3RhKTEJGaWfyekoJ72LRy8n7P39bD0eguQgOUgOkoPkIDlIDpKD5BCC5PT0wstAe3b0mYH84RxJTtcxIDlIDpKD5CA5SA6Sg+QgOYQgOZ3fpdbjx1qGWXIG16UAyUFykBwkB8lBcpAcJAfJIWSMSk7eUaCXd6MN7oM0PXpLL2OguxqSg+QgOUgOkoPkIDlIDiF8JqdLH7Om7mo9tkTreP5eXpzpOoZB/I89pHuOHxfsV6pXY1rWe3l9tkou6HIqJa96q65fct2qRF6tbFM+KLFjH39csK0mOXnDNNM2m+/p08L+/UK3CZ5SdpdUvvRUyfjxURLKpEmCtTXrckN9VKtK8lHZqazlXXUhjTZMc0Ey95iuWGYL1uPOflLsaTdOnBAitgvmWlbnWQVpBbQ9o/aT8/DDgu38ve8Jf/ZnwurVwhNPCFapm8bYIPO2ZrkhmKfZznkzLntG7VQ2qtwQrNq2rXasTSHvU5d3orOteVlvj0punrY4NirTp3xGtjj5MOwO2s52qvzMee8129muaxPUh4ESk5ARLjlNr/Ocx3T9v0qH+TxIDpKD5CA5SA6Sg+QgOYSQ0Sc5yABBcpAcJAfJQXKQHCQHySHkApEcXu4gSA6Sg+QgOUgOkoPkIDmEXJhvVyMEyUFykBwkB8lBcpAcJIcQJIeMiaR9n9L+WtZvysoti5W527cLMVmohqGiYjWlRwwhL82rC0kxakW/TSE3sUrMstZzli7HdrllWS+yXCatJLb52lbzh3vvFW67Tahu2TrF2qnJViunP/hAcPeIrYqplxlvLpPatU9vmRWfvjg63z17BJ+vzdC6b5ldWPctq+OtFZs9SXnLrPwJtpLxsccEMyLDZmSiYlOwVmxGvjhNp7K2ZoZdKG/ylhbQPio7lV3I7mDTqQybrz2j1sTPjrWFtVHlNzTvCNekXrbVLmTYWtkU7P4iOYQgOQTJQXKQHCQHyUFykBwkhxByviSn7LDM1+f3ayQHyUFykBwkB8lBcpAcQgiv5BAkB8lBcpAcJAfJQXKQHEKQHEKQHCQHyUFykBwkB8lBcghBcgjJYnXe7NlCbghWfXrJOE+oCsq83Mwkp5IrrSCth5jX0wuVzB+aHMAapl18sdClnraeYFqp27FV47JjgnZ1q64rXc6qU2n3vEujxHZet07IzbNyvE0l1tbMnquIGwU9lVVfpiJNQlitht4jfSatbV3+o3HypOCSk3fuypti2da83ZZ5S94TLL+QFaM2o7wYtVHZsXm1bafKy1wzBLuQ0bRW+c62dHm/OHOPvJtcvnT25Bh2rG21QdrOdvdz98h10e6R7Ww3NB+kkevTc8+VUGISMpIl50waSneC5CA5SA6Sg+QgOUgOkkPImJOcHvfveGacCslBcpAcJAfJQXKQHCSHEDISJce+yHfr+k2C5CA5SA6Sg+QgOUgOkkMIOW+SY/t888devonkIDlIDpKD5CA5SA6Sg+QQQkaN5ORfIDkXptVY+VW1+dL6MhYrWfXZpayPD0psZ/vd3a1T2S2KtNuyGVlt6vPVM5uoVK26vhDUxHI/9J9YFTOviRcoKiq+sLpzdRfWluRd3axSr3bW1bg6Suy61UrKmPO/v7q1nstOZStpGjNnjlAlU83KxKy3oGBdCtu6UeXVZ959Ky8obWfrn2YWa05v7dSsk5X9O4Sduamdmq2VVb15Rzita50XXhCef16wna1itmHk7eMM29kszlbSlt12zp8Nu7+287PPNmAPUq5AuVvasWaPdlPsR8PukR2bu6XeMkpMQpAcPpOD5CA5SA6Sg+QgOUgOkkMIGd2S8+2Z+UwOkoPkIDlIDpKD5CA5SA4hhLerESQHyUFykBwkB8lBcpAcQsh5kpyBNAbJQXKQHCQHyUFykBwkB8khhIxiyak/aUN3tQs/9kvTumBdc02U5JWc1+LuAFr1aX1psuHV5SmhS+cujzRMs1OtWSOYEXktPlPxiDDkndnee0+IuKNk0qQosbZm1V2QdbYf/oULo8Qal0VsL7H5Vn+PyOJUWz8ssWrTZ6Sx61bt8syHs2fDJmjLfvSoYM/Gvn1R4kJod19vymWXCTFByWMtpKxGzHuRGbbuVvbZqcwfrHK18tpKZCuvzUys6M/LzbT67NIELJccK81tYa1Etq12XVORXBfzQdpdsKI/v4O5mNlK5j3uzD3sp+673xVWrxZMU236ucXZTcnNpKlrnz2ieWc2PRUlJiEjWXIIQXKQHCQHyUFykBwkB8khBMkhBMlBcpAcJAfJQXKQHEIIkkOQHCQHyUFykBwkB8lBcgghSA5BcpAcJAfJQXKQHCQHySGEIDlkmCKGUBX9stUKSq9cLxasCK76em1VslF16aRxnaJFv9mUDaMqvk+XWE187JiQ19O2czUFKdwPHoySXAgtp08LdqHqWBMGWavqHmmfurPfKah8SfLmm4IZoA3Dd54o2KhWrRJyBZo7V7CSyZ7nfOlsq525+scCGVX+EHbpgWY68eSTQt6aLO9UZlutcrVhWMlo9aWVqlbImk5s3Sq8+KKwbZuwfbtgxxomKjl5eW2jymeUq4jtbE+h3d/ciGyrHWsOYHcwFzN7GPJR2Xzzu2/qleuiTWH9esEeUfNwm4JttQvpMCgxCUFyCJKD5CA5SA6Sg+QgOUgOIQTJIUgOkoPkIDlIDpKD5CA5hBAkhyA5SA6Sg+QgOUgOkoPkEILkEILkIDlIDpKD5CA5SA6SQwiSQ8Z8rFWXF/1a1x4+LFQFdN7lTKzGisIjR4SIlcL4ELSRV9XG7VZlu6K5VIlVyrqSygGkkLWtU6cKVWzMu0rsVDm2OLbV7tH+/YKVWxZvLqdrVUmOdCqLcSF0uWWfK5nx2kNY3RQZhm2tVPPZkt27oyTimCJj3rMnSmKeYIPcuVOw8tJvg9XiVsdbQy3Dyms7lZWbeQOxnLwWtwuZP9ggbYJ5AzHD/MEuZMV33ootb3pmW+3YpqWzxcnbqdmMbPq2dC+9JNhWc4+89ZwNw9Y5H0b+AJs9msTaFF5+WbCdbeuOHcIrrwh2Zh0kJSYhSA5BcpAcJAfJQXKQHCQHySGEjBrJyd4N1NuevZ+BIDlIDpKD5CA5SA6Sg+QQQoZDcuyL1j17PwNBcpAcJAfJQXKQHCQHySGE/HZ4DKf8Y+/fTL5PkBwkB8lBcpAcJAfJQXIIISNFcvIvkJwLJNZgymLFmTmPW82UKDl0SKhEJeufZlWgF4VdIlZjFmcZP17o0gUr7lWWK1LHdyuvsyZgphM+jJnKwG8n7ZpKRU6V5FIXcZciErt2bZTs2yf4MNLnqmpcZrlfkdh184ZpNl/rNFjdQZmvbbWnzh/C6UreMst6r1nxbRWz1aa55Fjx/cQTgrVxs9tgba9sq3Wy+tGPBBuVuZZh881dyyZo2KlsnU1jDJuRLY418rL5msbYBPPObLbVZmRTsMXJtc2OtTHbzoZNP28PmDfiyzvgmYnlam0L2yKTlJiEIDlIDpKD5CA5SA6Sg+QgOUgOIWR0S863JVPvOoTkIDlIDpKD5CA5SA6Sg+QQQnglhyA5SA6Sg+QgOUgOkoPkEILkDEt3td6/SXc1JAfJQXKQHCQHyUFykBxCyIiTHCvAEofh/8m5YFN1OcsKaBMk+yVSmYk4wMSJUWJVYFVea/etqSFo26vq2BYTU0HKq/yqNZlcyLZaRWGL433MvK9XQ6yst2X3hni6Grazl/W6s53KpzBRsFOdPh0lvs7KgQOCt8ubGRkuZtnzvHdvlDTlvvuEiKUleQs4r8aszstLZKs+rVRtKoJtZ+vrlQ/DilErZO26ViI/9phgwmA/KlZAm2vlnrZhg2DztQnmTc+aKvW82s5l0mZkU7Ct+bG2sPmZjVyB7FGxZyN3eBuzPQwPPyzYVls6m5E9Kql4U2IScmFLDiFIDpKD5CA5SA6Sg+QQQpAcguQgOUgOkoPkIDlIDpJDCEFyCJKD5CA5SA6Sg+QgOUgOIQTJIUgOkoPkIDlIDpKD5CA5hCA5hPSQqvySnlEnT0bJunWCV5BWMXvLrEXKkNXTuXr5BK8WqgI6a5nVrZ7WyjVd57zZmmXFCsG1LdYKC6IkL6+PHYsSW2fb2qVS17z3ntDkD3bdygDXleSDrNZZnrpcUydNihL7WfBRzRFsGO6W9oOTd4Wyitm6b5ldGGYXVqpaUyyrPvNmXPmx+VYrN3MHeOEFIbepvJ2aFe6PPirY32550Z+3JjN7tLtgozIHsOnbfG2rzdccwFoc2lazC1Mg8webr43ZHmC7ZS++KGzbJrzyimDH2v211bAfDds511QVM0pMQpAcguQgOUgOkoPkIDlIDpJDCEFyCJKD5CA5SA6Sg+QgOUgOIQTJIUgOkoPkIDlIDpKD5CA5hCA5hCA5SA6Sg+QgOUgOkoPkEILkEDJOsOLMePNNwWJVoO1s/dNmzBDMLuy3c5WGYrQqzSX2ezCvp0297MzWX8uvmxbBNgXPpYItzrJlwgMPCHGRYuW1ntl6go0fHyXVSq4psWXv5mkSVyD1NOutN4QLa7f7ww8Fm+DBg1FiW+fOjRJXehV+M0D3lrxXlZXIVkDnhV1eI+a+ZGzdKlgha6WqTdC22jDyRoSmE7kf2koatjj5Oufko8qdJxekpmZ6hi2dnbmpQVz+5Bi2zrnjNbUHNLnKV9KOtenrTwolJiEjW3LOpJyrDPRv0F3/bZogOUgOkoPkIDlIDpKD5BCC5Ayr5OSW8u3WIZScjm/bSd7RU3+/66gIkoPkIDlIDpKD5CA5SA4hvJIzfK/k1CaT/DF3GyQHyUFykBwkB8lBcpAcJIeQMS05HV3CLCJ5zaTjiy0dD0/co6OftBoUkoPkIDlIDpKD5CA5SA6SQwiS011yur5mMtDX+Q5IzsiJVr2aXDasrE/ea3g2lSBJby4v+3p41e/bVMW3VOrdfGnwsQI6t6l8kPnWyhD0ls2LEv+HBy2vrbNRvtVumRugHmtbbUbWyalqTCfWmq+kdc9bv16I2Fbi143bS3xrKoQ2qkrqrOWdpOqupsmrQCvOrDWZlX15e7G8y5lh/bWsN9cTTwh5L7Im7Mx5E7C8J5iRX7ep25gdm2/N18oW1k5ldzC3ONtqT07uWmZT9lzl+pRvtRnZwtqxNqp8RrbVjs1/rHQrJSYhF/Db1ZJ3fHUUhoG2dj281U+6vkyE5CA5SA6Sg+QgOUgOkoPkEILktElO00f8B3olJ3/HWp8ihOQgOUgOkoPkIDlIDpKD5BCC5LRJziBeqGnyjV5ECMlBcpAcJAfJQXKQHCQHySEEyWnrrtbLazV9fianqzv1/lY3uqshOUgOkoPkIDlIDpKD5BCC5AxScs51d7WuLxnx/+Sc2+zfL1hzJqvzbGtT4zKrAu334OHDQoxX9NiqvnyqxEZ1/LiQD7KakUzf6nifoJXI2orNim8zBLtufhfMEB56SDB7tPlaj7t8GFYSHzki2E3Zvj1K7ELVwuZWI6328o5/NoVjx4RcNc3S9+3LWLBAsCfWXMseleqJPSZYnffoo8Ijjwjf/75gBXRuCHZH89ZkTfpkgmQXaipG7dj8QoatpNXTphN5SzSbvv1M2s621UaVN8Szwt12tmHkrcnyfmJ2F6wlWt7yrqm7mp3q+ecF2zlf2HyCtjimfHZd6wf40ksllJiEjGzJIQTJQXKQHCQHyUFykBwkhxAkhxAkB8lBcpAcJAfJQXIIIUgOQXKQHCQHyUFykBwkB8khhCA5BMlBcpAcJAfJQXKQHCSHEILkkOHIpYqX5ttLrJLznlHeMmu7sq7Eyj6XnJkpEwQrKK02jXFK2jKrMoS3BNUYr1yt4I4bFVkN68yWt4AzYagqZs00oVKgA8pWxbJRsZ1PKY+X2MJW7cVWKLLs1QQXl7in6XPlN9SfSY1vVRH1hmlC1Vow665mHm5jjueeE6ygNLZsEfJyMy8o8+rTLmTVp221wt2qT9s51yfb2aZva5XP1+paK77tVLYauZjZStqY7cyGDePFF4WXXxZ27hSsAaItjs3XZmTH2nVtVHZm84d8RrYatlZ2Knuu8hnZqYy89ZxdiO5qhCA5BMlBcpAcJAfJQXKQHCSHEILkECQHyUFykBwkB8lBcpAcQgiSQ5AcJAfJQXKQHCQHyUFyCEFyCEFykBwkB8lBcpAcJAfJIQTJISSv87T8ijVC2tfLatO9e4WILxSptq1ktN/s3iFNTczr2kmKlsh2Xe8YZqLiiyPHntFY8W2YiVVnXipoc7lKVLJ6Otc267ZlU/DVcOPNLyT2aF37bGH9hupWW6ujR4VcRWxU3ZoH7lckNsi8QVxlcVmPOxckq8YM65GVd/2y+tKqTytzrZ42tP2U18T9uIdNMO+vZTtbIWvttqxhWt4/Lb+uTdCWrh99ys2z6e7bhfqRHNs5X6umW2YraXcwb/GX+1JTvzhbKz0zJSYhI1pyzqScv5wtnJq+T5AcJAfJQXKQHCQHyUFyCEFyhkByBqEc+SHfbh1CyfmmDOv4zXxT76NCcpAcJAfJQXKQHCQHySGE8ErO8L2SU5tM8sfcbZAcJAfJQXKQHCQHyUFykBxCxsorOd98Ya+BdHQJs4jkNZOOL7Z0PDxxj46DaTUoJAfJQXKQHCQHyUFykBwkh5CxKDm1ReSS0/U1k4G+zndAcoYpx44JXuZ6pJC13zje9sr6tqWnivhVSV4yWhFsJaPJ1bRpglWuXotr5ZpfaPt2wYrgvM2Xr5XqxKxZgjV5s2W3Cx04IHQZlV7Xzrxpk2DN5ayLnVUyuQK55HjPN4tpqnZ1mxdCamJdeq9p175KVMwtbatMITciU02vL/NeVXnXr7SFlCuBFaN2obxUtXraKkj72TB9ytuLWS1ui5N3/Wryh82bBXvcbesPfiA8+aSwYYPw2GOCbTX1ygv3tDT3Y02BTJByUcnFzO6RYaOyZ8N2znsJ2gNsU8iNKL/dNiq9LiUmIWPnlZxe3uiVC8MgTjg4P+n6MhGSg+QgOUgOkoPkIDlIDpJDCJLTJjlNH/Ef6JWc/B1rfYoQkoPkIDlIDpKD5CA5SA6SQwiS0yY5g3ihpsk3ehEhJAfJQXKQHCQHyUFykBwkhxAkp0FyBvq4ztB+JqerOzWNlu5qSA6Sg+QgOUgOkoPkIDmEIDmDkZxz3V2t60tG/D85/Tb5Tm/Ah4rUavY7xZuAacssL/u0Ys6L0ZyqYpbq08zE5nv33VHihaw1W9NK3RTIpu8ak67Gnj2CuYcrn+Idw/RY7+qmx/rWicpVgg3Sj/Wmdiqx4yJh/XqhWwNA6a5mlm5Yxz+7+4cPR4ktTuXhm5XcajJBWrs2Srw0z0u3vOi3rTmmQHbdvK1Z0yANcx4zorwmzrt+WZWf75z35rLFMUxUTJB++EPBjCgv3G2QubbZqUzMzGlzT8s70dkdzI0ob9NnW62Tpu1sz4ZttWGYHptLp9pGiUnIiJYcQpAcJAfJQXKQHCQHyUFyCEFyCEFykBwkB8lBcpAcJIcQguQQJAfJQXKQHCQHyUFykBxCCJJDkBwkB8lBcpAcJAfJQXIIIUgOGY54iRxPlVh5XTU925BQuYfUplVBua7EitEuPbL8VFJQWiHbpQXcNCW1Gh+GcqYldiHrcWdTsIX1YcxR0mrbHMDcw5q8ffSR8NVXwtGjgk2wehhWluQzMlatEuyZtEFGbC2xZnouOZa09VzEPkWStwf061pxlleQhpV91kLKSuS8N5cV/Vbm2qly8r5teResvKtbU7O1/FT5mPOyvqnpmS2sqYjpk3mabc0VKO+Pl9/fXJ+MvBOd7WzXtQmaXFljOvv3APO0vLWgXdcWR5eOEpMQJIcgOUgOkoPkIDlIDpKD5BBCkByC5CA5SA6Sg+QgOUgOkkMIQXIIkoPkIDlIDpKD5CA5SA4hSA4hSA6Sg+QgOUgOkoPkIDmEIDmEWHWunazuvVdwJVigWGuyNNZQy4tgP7MOWate6yFkxzbtHLG9pJvULS3Jd7auX75Wk6OkccxSQJvFVaPaX3IuV1IzSzDZsPpqxgwhd8vc03JbttvdrdNg9mzYmG01/C7YD11uNdZgysg7SlkRnNe1dqz5ktWIVkHm5WZeIm/cKDzxhGBNwAw7dsMGwU5lBbTtbFutQ5qV5v10wMvFzC7UhC17rqm5mNlW0xgbc24XuXnmO9sw7EFqsmWbvt4jSkxCRrLknP2FnEAIkoPkIDlIDpKD5CA5SA4hSM7QpGO1kBQS9fe//foMuobkIDlIDpKD5CA5SA6SQwiSMwIlJ/lj7jZIDpKD5CA5SA6Sg+QgOUgOIUhOr5LzzS/0jr/cO/7ST/bvKDADmUwiP7ySg+QgOUgOkoPkIDlIDpJDCJLTl+QM9CpK169b/QTJGdnK41XgyZIlS6Jk925h8mRhzRqhak4lzda8CpyqaIkcE5R4S9AK0mZkJeJ77wlz5wpWMVtpXq2VKZC4R9VeLHOA6lQSK/rtQj6q8YpfSLqcXXFFlNiprNGR3yM91alTUWL+cPp0lHz5pRAXZ7iKqJb7BHX63W6ZZOpUIXf4Luqli+PDMLswbzFeflmwrfZ82875sYb1bbMz52JmgvTii4LtbCVyXgRbtW2Sk2P/smJY5y7DxMwU31qE2SBz97C/GXNhsEo99yU7s4moTcHs8fHHBVtJM0A7c9rHrK3nW94hLX/qcmnXx5sSk5AL/pWcrl7R9fs9+kny6hCSg+QgOUgOkoPkIDlIDpJDCJIzgiSnVJc+RQjJQXKQHCQHyUFykBwkB8khBMkZWa/kdPoPD5EcJAfJQXKQHCQHyUFykBxCyPmWnIG+7kVyWgWJ7mpIDpKD5CA5SA6Sg+QgOYQgOedWcnr8/EzH/+4mf02G/ydnpMTs4sQJ4euvhU8+EcwBDDvWi9EpyjTFqk/bOZ4qsV/leQctm28lDBsS7Pe+j0rlyrqcxUWCDaPbFNaVWJXvF9JR7dsndKny9VgrAiNuLLFT2eIcPiz43ddHxaZg1ZfVVz4F6/gXW0uq5nLbFPUWnX4+weqZPFBix1qFHPGFYHZhVaBVkNYxLO9FZt2orNw0rArMW4SZ5NipbMx5IWs7myHY2tkEm3qg5Z27ctmwM9t1865u+ZhNkGw17A42NXnLu6vZ/bUbarc79xbbmvfWs/naT3s+X5ugjdmsJnc8nQIlJiEjWXIIQXKQHCQHyUFykBwkB8khBMkhBMlBcpAcJAfJQXKQHEIIkkOQHCQHyUFykBwkB8lBcgghSA5BcpAcJAfJQXKQHCQHySGEIDlkWGKFrP1eOHhQuPdeIa5WtBav6um1JdVWLTdVGGyQy5YJeTu1qr60nCrxpljexk2UYOHCKPGuX1dFyaRJwqxZgtXivjjXCitWCOYPZ1pi3eRskJdckmHPRpcWcDrIGTOEyy9voGmC+ZityVvTqfKd7cyGL11eq1m5aRWkKUFeBFudl5eMuRHZMKxyzVuiWZVvOxvWme1nPxPyfnFmNTYMq6dtVIZ5iynvY48J69YJDz2U8b3vCQ8+KNipbGt+5j/7s4xVqwTb+sd/LNxzT8YDDwjf/75gbRkffVQwP7S/r22d7S5YBzzzpVwm1TwpMQlBcgiSg+QgOUgOkoPkIDlIDiEEySFIDpKD5CA5SA6Sg+QgOYQQJIcgOUgOkoPkIDlIDpKD5BCC5BCC5CA5SA6Sg+QgOUgOkkMIkkPGfKyCtOLb6nir1axEtlrcKuYlS4S8vrSiv5+61kTFRmXH2q9jazdlhbtNP5+RLez8+cI11wh2qvwe3XqrYMfafO0emWwM4T0yx2u6Rzaq/B4Zdo+atM3uQuXh0rctb8VmUpdbq5fIViPmfPe7wp/+qWBbrQjOz2w7W7Vt5WZe5a9ZI9iFrMq3atu22qgeeUSw6z78sJDvbPW07WxjNkOwQdrOq1cLdqxttTHb0hm2Grl62b8V2U9OPmZ7kFauFOyWmYnlU8inbzMySzfTNqc1LTelVygxCUFy+skv/jb9nyT/ftdLDMkwkBwkB8lBcpAcJAfJQXIIIcMhOb+oMjhhOHeSM4QyM2jJGf6JIzlIDpKD5CA5SA6Sg+QQQgYvOefOOoZZcs7dKzlIDpKD5CA5SA6Sg+QgOUgOIaNecr75vr28U7/gU+420D7160UdL12PpN6hPEPHq+RX7GUkyYtaeA6Sg+QgOUgOkoPkIDlIDiGjW3I6+kNH8ej4x65fD0Jy8q97v3T9db4DkuPx8ksbplV13raSQ4eiJK/kfGteI+rWr74SbGvEgZJqzD8R8uvOE6wMiHhK8GFIEXz4cJRYjh0TrG+b9XyzmsF2tikcPy7EOGWaYtfV0tyEwcac9+UzTFReey1KrPNe06lsYXfuFJpOZU3PJk8WGkclM7r++iixY710y1uiWU8wI28gZg2mrDmV9bnauFGw1lV5wzTrkaWdrPzRsarXhMEq9byhli2dVb221W6DNaaztTLszFu2CHYqq8XzYdjOuUyaEphsWA+0u+4SFi8W/t2/E+64I+Pf//sMu5Ade+edwn/4D8Ldd2fYme3Y//gfBevC+Yd/KHznOyWUmISM0s/kDFTf53V/61H5G8b6kZwhGQaSg+QgOUgOkoPkIDlIDpJDyIX2drUxKDlJGwYkB8lBcpAcJAfJQXKQHCSHECTnFz3qysh8JYfP5CA5SA6Sg+QgOUgOkoPkEILktH0Yput/QdNVbM7dZ3KSKxIkB8lBcpAcJAfJQXIIIRfUZ3KS3Zq6q/XiD4OTnHPRXQ3JkdhvWGuo5Zkj9FNBTpkidCsZ71EaKkjj1Cmhys6SfibYWBMfUM7VBKdOFfJTNd2yfIJXXBEl/Uzw5EnBYkXvED6T+anMCNokR+str8asVjPsWMN2/k//KcOOXbpUyI817Fib0R/9kbB8eUY/E8yPbZpgvux2KpuCncq25muVn+p8TdAGaVsNE5WmZzK/UNOp0lFRYhIywiVnJPx3N7nkjAS7GCHDQHKQHCQHyUFykBwkB8khhIwCyUEekBwkB8lBcpAcJAfJQXIIIReI5PDyCJKD5CA5SA6Sg+QgOUgOIWS0Sg5BcpAcJAfJQXKQHCQHySGEIDlk9EjO118LVaey7Ngqb5VYt7Gqype+bR98ECXW9ct2jnhVOVZip7Ix2wTvuy/DukBNmiTYqexC1m7Kjo1LBKvjq3XWlmjjo8R6oHmztbR/ms3Xl32SYMf6IHVGNki/ZZdGiT8bE6LEtuZN3qZNE+we7d0r2CNqpzI/zNupXXNNlNipTpwQ4o//WFi9WnjkEcG2Wn8t65BmPdCMvBeZ8fzzgjUQM7m0HxVrU2jN1qxjmJ0qb9RmredsVDbBfMx5GzcbhkmtbX38ccFOlR+bt9p79llh27YMu2Xbtwuvvir81/8q7NghvPCC8LOfCXaql18WXnxRsE50NiM7lWHDsJ8rO5U9wPajofeIEpMQJIcgOUgOkoPkIDlIDpKD5BBChk9yynbJfH1+v0ZykBwkB8lBcpAcJAfJIYTwSg5BcpAcJAfJQXKQHCQHySEEySEEyUFykBwkB8lBcpAcJIcQJIcQiVWBuQNYJWeVjG21KrCLEc1TrI53zGokS5YI1c5yKpug2YVhO1tNnJ+5Wsl1JdXiyJi7nUo6wlkd6zbVzXkVmZH7UvxEkTHbs1G1RDtZYmJmEzRNraafLXs3H76/5MiRKOm27FtLbHHyKfjzvG6dYNWY1eJ5Wf/TnwpW5ublpj06Tzwh2Kjywj3HZvTjHws/+pFgE7RCNq9r7VQ2ZjtzLoQ2yKefFvLC/bnnMmznpjreTrV1q2Bb7cx2KpuCkeuiPZOGrVU+I5uCaZttNezxtoff0AlSYhIyoiXn938/Yxjz//5ZcxTnApgCkoPkIDlIDpKD5CA5SA4hSE7oOy/62mcYJKTjHwf6fv+XQHKQHCQHyUFykBwkB8khhIxKycnr+/L7iecMv+Sci0sjOUgOkoPkIDlIDpKD5BBCRrfkDOI1kI77dDxPaUQdXwuqPsGbvXbU8TvJ9/PrlpvGqOcgOUgOkoPkIDlIDpJDCEFymiRnoNd/+vy66e1qvZxzaN/tNrryofK4Ynah0aZY1m6rKgpPKVtKqiJYKkirEa05VZfmYzrBm2+OkvM1QZuRNeOyijmfoJ3KqoL8urkuRpxWtmVoK7Yzabr15RNbttWwCtliomKxOxixpsR6Ys2YIVx0kRDjhC+/FGw17FT2bLRVkFZtW1lvkmMVpK27nSrXJyv6basVsrZzbjX5MJomaCuZi4opkGFjzk+Vr0a+OHaqfuTKrMbKepMcw9bZ7sIPfyiY8eaN6WxhbUZ5+zjTGGsQZ5jk2ARtNV56qYQSkxAkp/UNYz3+caR9H8lBcpAcJAfJQXKQHCSHEDK2JKf3rgPJe896fGWmdX8kB8lBcpAcJAfJQXKQHCSHECSnrb5v8p8eT9ujhAzbK0JIDpKD5CA5SA6Sg+QgOYSQUS85A5X+fX5Wp+tHdAb3mZkh/ExOjyNHcpAcJAfJQXKQHCQHySGEjErJGaj/WP7msd4lZ0i6q9X90Oq3tzV1VxvrkpOXyHGtovGd055gEdtLvFRVncjbqe3bFyVWm+7ZI9hvyS4ts+YosVKYHIJW+dYiK2JxiQ3SHvpNm6Kk+pFQfTpbYRd4/7RLhLyvV64iVtbnZlLZhVzI+qdVozJlOqZkomIKZBeqOsKJXRw9GiW29cYbo8RWw26ouXS11Z5nlZy8K1TejMvK3NwBbGera22rDcPObNip7FnJL5Q3H7Mf4Ly7mh1rF7Jq28pr2znvCWYzsjv4yiuC1tM+I1tJu5D91WA6Yc+ZbX3kEeHRRwVrgPjkk4L9BW1Ll7dTM5oehrQHWpeH0B4G22r3SO8CJSYhI1pyRkzy/yp0EG+BGxVTQHKQHCQHyUFykBwkB8khhFywkjM4qQiC5CA5SA6Sg+QgOUgOkkMIkoPkECQHyUFykBwkB8lBcpAcQpAcQpAcJAfJQXKQHCQHyUFyCEFyyNiJV8xxu6AFtMV+aX78sdBUT9cuVmJl7rhxgme8EjeUVF3dsgvlzbgi3izp1opNLhRnRabAzlwpwc0llRFJAW3KN368kBuvlebVfLcqWrhPiJK8aUn11O0uWbs2SoZ0CtpcTu2xumVyqkqfxOFtGJ9/Lhw6JLRZTd4yKy+g7cy21Tpo5VhNbCtr3beeeEJYv16wY628tsZlNmabft59y/5VJq16nabGZUO4NS/cm7bamW01zMTy58qWLl/JXGJtkOaWJqK2deNGwYTQmrzZVj2WEpMQJIcgOUgOkoPkIDlIDpKD5BBCkByC5CA5SA6Sg+QgOUgOkkMIQXIIkoPkIDlIDpKD5CA5SA4hSA4hSA6Sg+QgOUgOkoPkIDmEIDlkzKeqPqVy9aJQq8DDh4W8+5al8oe3FS2gp4TgkcZWNkjLxImCNePq4lo+DCnrq/Jakveaq/qJmT9YpDS3e2TaVt3f+0tsVN3uoMy38kNJ5QASK2y6tLxTu7Aa2JY9v79VZJ1nzIgSU5FqvvLUVfP9vMQG6Tclr9UMm79VcnYqw8zEjs1PZf217Fmxhlp5qWqnshlt3iyY5DRdyOrpvHA3BzCsJ5iNysb84x8L+c75BO1UNkG7C3Yqm29uF7Y1t4t8GLbV1CtfZ1OvnTuFHTsEk1jbatpmF9KnjhKTkBEtOQ89lDHsNfOQnGd4LoTkIDlIDpKD5CA5SA6SQwi5MCUneS/JAMXwIOVkqCQn+F9EkRwkB8lBcpAcJAfJQXIIQXJ6EYZEcoZKTpAcJAfJQXKQHCQHyUFykBxCyLmVHLOFjvIwOOvo+MrPQK8IDfRiUfIKEp6D5CA5SA6Sg+QgOUgOkkMIkjN4yenlLW0DfWym/GJIvkZyhib268lus1e9lyoaN4RxipaqJgxWI9ow7r8/SqwINtdyAfpQyN2jKq+9d5ciJbKN2Spm22oXyne2EtnWKheVL78ULFZR2C2zJlgRNwkqkwcPCvYw5M9VfgcjDijZVusmZ8OwQVoqjZEzv/VWlNhNsbtgnQbNebpIzmOPCdaazKTWmp7lNXHexi3HStUtWwRzgLz4tkHaFOxYu5BhEzRDsK02DLuQFf05NgybUZPG2DBsnc3ErKy3tmb5XbCtTZ33bCVtvvni5I3pXn5ZyCdo3pIfa0uXLg4lJiFjXHJ6+dD/IF4RGuhtcl2/j+QgOUgOkoPkIDlIDpKD5BCC5AyZ5LQKTJ+Sk7yIhOQgOUgOkoPkIDlIDpKD5BCC5Iw+yaH3AJKD5CA5SA6Sg+QgOUgOIUjO0HRXS77u5WM5Q/6ZnGRIBMlBcpAcJAfJQXKQHCSHECQnunY867ErWtfeA+eouxqSMwSpeoItK9m/P0rOpMl9KeKtkkonpGOY1aZWfVpNbBe6774o8cpV5cqGceqUkBtR7i0udVrmmk40aZvdsm7t1GQYVfFtg3xVsa1bFO0Ipwvb5GnvvSc0PWbeW+/iELq0T9lWMmFClJjF2SDzznv2AFc/ZTpmq3rzZlxWQdqxhvUxs9rUsJ1tGFbm5liJbKVqUxGcNwGzna0JWO48ttXG3M+pzEvtDm7YIFjLu9xabb62sPnS5W3NbPqmBDYFe1TydnnWHtAc3v4ppQlbSTuzbbXmgXRXI2QUSc4I60h8IV0IyUFykBwkB8lBcpAcJIcQMqYlhyA5SA6Sg+QgOUgOkoPkEEKQHILkIDlIDpKD5CA5SA6SQwiSQwiSg+QgOUgOkoPkIDlIDiFIDiFVLlFURRYtipKIfSUXXxwl1tgqYk1JXrlOmhQll18u5FW+V65am3YpcxdESSUq20usB5rFpmBlbn7miMMl8+dHie3cZfq6s7e8S/vF+SDHK7FQkTGPGxclXZbdnzot+nvukdLpY3kyKmuwNH68kPfWszZmltmzhXwYVub5FKzMtQtbYWeV3Nq1wqpVwoMPCnYqu5BVgVYj5liDuLy+NAcwbGcr+q3atnradrbi225Dvuw2BVvnfDXsujYqw6Zgo8rvfv6o2Fbj0UcF61b0/e8L3/tehj1m3/2uYDuvXp1hD7BttQvZIA27ZQ8/LOipKDEJQXIIkoPkIDlIDpKD5CA5SA4hBMkhSA6Sg+QgOUgOkoPkIDmEECSHIDlIDpKD5CA5SA6Sg+QQguQQguQgOUgOkoPkIDlIDpJDCJJDxnzmzhUsViLn9WXTzqYEVcuszGqszVe11SIdtGJSlFhrMitzbWs+SBMGM0Dr+bZtm2AXsuZj9pvd25p5SzSZbyVXsnS5mUScKrF1tjN3u/tbBW0uZzvbqXLZyNv0HTsWJbY4+SM6c6Zgp8on6GN28ZZHxetLIy8K7eGw9nl5N6q8nZq1F7N+YiYbeaM2w36Qmq5rXb+sgZh1GzNeeEF46SXBhNh2tl5kNgzrF2cTtMZledMzax/X1CHNRpWvc94Qz2aUd5OzW2bH5n3bbGfbamfOnw3bao9o2oeQEpOQES05v/51xjBmgH9d7euE/R875KNCcpAcJAfJQXKQHCQHySGEjHTJSd8A0rbPkFvTkByL5CA5SA6Sg+QgOUgOkoPkEDLmJCeXAft+j7shOUgOkoPkIDlIDpKD5CA5hJDzIDm9CMzg9hmohOj6/a6i0suZexQzJAfJQXKQHCQHyUFykBxCCJLTIDkdv+76yZnki/zMyedwkJyOkbIvLwq76IT6Q8SGkry7Wl7XdutUprlU0WFEnC6xYZhsmKh0aVPno5Lr2pmr7mr5OkvLu337omT3bqGKDCPvt5Q3xLPzTp8u5OZpi5M/SFVHOPGWalTamW1KlPjOU0PwmC7msTuYDdJmZHfQazWrTa3sy3fOj7Vy0+ppO7NVn1ZPmxKYTpjE285mFzYMG3NeuNuYrY43ucr7tuXrbGfOm7xZvzhrmGaqmfe4s2PturYauQKZL9n9NZpMzO6vYTvbQ2jrbNO3+eaN6fpQL0pMQsa45PTymZz8PF2PSsSpxzMPbgBIDpKD5CA5SA6Sg+QgOYQQXskZzD4Dvdmsq+TU36+LZCQHyUFykBwkB8lBcpAcJIcQJOe8SU6P3+/9lZw+X0pCcpAcJAfJQXKQHCQHySGEXGiSk3z0pZ/uar18JqfrPl2PSj7VQ3c1JAfJQXKQHCQHyUFykBxCxrTk5J3Nov3/yemlu9pAhwx5dzUkZ6BIEdzFH7SQrfwhL+ulCrTfzlXVe7ykGtVepaGxVV592s65t9jWqvdatlZvvx0lVpp3qdT1zNOmRYmLmZ5q3TrBlt222mpU7vFUSe4ttla5PlmsBdwVVwg23/37hU2bMqqHNntTrN8Xe1ouUcymdOcZMwQvv/IuWLbV2ppZFWhVvs3fCkrbavWlkRf9ebO1jRszrFS1M1vlmltc3nws781lE0x7c3Xp62U3xbbmz2h+B22dbcz2V5LtbFPIn7r8Icx3tgvlT6w9k0beDzDv22YPg26lxCRkREvOiEnXz9ic91ERJAfJQXKQHCQHyUFykBxCkJzBqwUKgeQgOUgOkoPkIDlIDpJDCEFyCJKD5CA5SA6Sg+QgOUgOIUgOIUgOkoPkIDlIDpKD5CA5hCA5hFS1+PQosWZrr74qHDggRCwusRqxKoLlupMmRUnV1kwEyWrEI0cEq6dtClap79kj5E3evK7VUe3aFSU33SRUHcRyf5COYatWRYmX5j6qwSufdyrTe3T4cJTEOKXlMbN7dPy40EWBZiramG7NmiixtbIH2J6cLs30tGtfbp5V2zoz3mcEq8asU9kLLwhWq1mnMttqx+Z9zPKWWfkwzC5ybcu9xbBK3c5sY7ZB5qOy6Vs/MaPpVLkSWNGfu1ZTNzkbVX6qXJDyC+W2bN6S21R+F/KH0O5+7rTpPaLEJATJIUgOkoPkIDlIDpKD5CA5hBAkhyA5SA6Sg+QgOUgOkoPkEEKQHILkIDlIDpKD5CA5SA6SQwiSQwiSg+QgOUgOkoPkIDlIDiFIDiFaqe/dGyVe12pBaTtbFVh1snpVkbLPS0Y9VcT2EvMlu5CVueYP9kszJgp5ee2roYO0innuXKFq1CbTt2NtzDaq9eujpOrqJpkwQbCl27FDyLNtm3DokGCikjemizigyHPlsjFHcbmSZ8OPNQPUY22Q1ZjtiZVB2rLv3ClEfFDSRZ9yJch7RllRaFWg3TMbtF3IWlc1qYjVxHljKxtz2vbKyS+Ul+Y2ffOWfJ3t2LwVW24mts4mG3bmvKtb3kyvSQjtb8b8ltla2XyN3ADzZnr5LbMZ2dZcrnTZKTEJQXJGbH7xtxn0sef6EkgOkoPkIDlIDpKD5CA5hJDBSM4vNAN9f6BKfaBjh9BDzqnkDPq6yYIM5xSQHCQHyUFykBwkB8lBcghBcroU5d/+sZfSvJ9jR7jkDPpYJAfJQXKQHCQHyUFykBxCyIUjOQO9tvPNF99+Z6ArlsfmpxpotPmxvUy84yA7vqJV7t/1ohek5yA5SA6Sg+QgOUgOkkMIGSuS0/GcyZvZzBDyYfRybEfbGfQgBzpVsv8wvx51fnLypDBrlrB7t1D1jJJS1Sq5ffuELgWlW43VlzeUmNWsWydY7EJW5edt3M6ksV5kduYujcvOTrkklpa4t0xRVBhsCvPnC/v3C5Yug9Tr2s62sNYfr7Iay40lNl+TSeuAZ/7QpRVbnFQ08xQdsz3tdqHqycmW7pZbBP85euqpDCtkrQi2YjQvVa1v28svC9u3C2bAdqzpU97nyurpJprKa9uat9vKtc2EIRdC+yvJ7qCd2ep4q8XzCebuYTQ1prOtuXrZfO2B3rAhI3fpvCVaU/c8m76tsw6DEpMQPpPTu6j07mCDc6EhPHM/s0BykBwkB8lBcpAcJAfJIYQM3ys5/dTlg1OOcyQ5XQ0NyUFykBwkB8lBcpAcJAfJIQTJGU2SM+j36SE5SA6Sg+QgOUgOkoPkIDmEjF3J6f/NY8knXlqP7f1TQAOdrZdPCg1Cci7M7mpIDpKD5CA5SA6Sg+QQQkaj5PTzmZzEB2yH5MCu3+nlEj3+Zzi99HzrUXLO3f8aNIJipXleq1WVa77zVkWaU9mvxWoYWS1uzccq9cokJ+KWkm4aI1PwC2nnrrxS72YXDaV5vhqWFSsEL82121h1KmkBt2pVlNgt+/hjwYqxfJ3zG5q3j7O2ZuPGCd3WOf9Z+EBZq+jDH48rqeOZ0ucNtfKtVnwbeROwvH+albl2XdtqZb0VwTlPPilYEfyDHwh2rI3KOnflM8qXzh673HnyHmi2c94SLZ+RnSr34Xzp8q35fJuUzyTHukM+8YRgW5uOfewxId/50UdLKDEJGeGSM5aTK9CQvItvEJdAcpAcJAfJQXKQHCQHySGEIDnn3IUucGNBcpAcJAfJQXKQHCQHySEEyRmbr/lgOEgOkoPkIDlIDpKD5CA5hCA5BMlBcpAcJAfJQXKQHCSHEILkkJEfa11Vlbl5J6t3Sqp+U15DllQ7W0G5pqQSlZUldiorke3YW28VbKtN386cU3WEO11y5EiUWGM6665m9bQNcs0aobopW5TtJbldWEURsbzElq56VBrGbFu//lqwlTx2LEryLnbdZvRpyYQJUVLdQVHc/FGJM4I9hLZ0EW8JeZ1nxajtbFtzQ7Ai2LDK1Vp1Wd+2l14SrNmaNWqzNm6vvJJhXd3yFnC21UZlHeHsWNv5Zz8TbBi2Nd85H1W+VrbOtrO1F7MJ2ta8x11+rA0j35r3fLOmZ7bVzmxrZeTXzfvypW36KDEJQXIIkoPkIDlIDpKD5CA5SA4hZPgkxzoy8/V5/BrJQXKQHCQHyUFykBwkhxDCKzkEyUFykBwkB8lBcpAcJIcQJIcQJAfJQXKQHCQHyUFykBxCkBxCJPZbIy5RtCVaXlBaJVc5gHaj8gtJaV4VhVJuWpm7erVgJeIQ9k+rXMtqYlmrqlXXkhLra9VP87Fu3eSkzVd+3SG8kLdEs35iXYxXFLcaxpclJ09GiQ2jcktRPrtHV18tVBM8VZLfMuut1+WfEvIqMK/kbKthZ7b2YsbGjRnmS/nWHDvWuqsZ5qlGvrNdKD/WBpmPKu8ml/dPy1Uz91KbUd6ZLW8BZ38X5O3UrE+d/Xgbtjh2oRx7Ju3MuXg/91zGT3+aQIlJyEiWnF+koZIvu++yCEgOkoPkIDlIDpKD5CA5hFz4ktOx9C+/2fG/muj6X1AMtKnrf1zR8RAkB8lBcpAcJAfJQXKQHCSHECSnQXKs+i+/U2/Kv9/RkXrZDclBcpAcJAfJQXKQHCQHySEEyTkPktOLijRtapWcgV4I6uX7vbw81XFBkBwkB8lBcpAcJAfJQXIIIaPv7WrmISNTcsy+enm5adBfj5FYW7OtiqTJW/IiuKpNJV7XThby6tN+LVY7HytZsiRKjh8X/Fh1HitscmHwol+Xbu3aKHF9mhIlt9wi7N8vjB8vdOuPZ1kkjAtBx1x1VxPHs6Vraolmj0reTc62+jOpzJ8fJabW1TMpx1ZLJ4Nsmq8/V1Zy/cVfNGC1aV5f5tW2HWs7533brDbV1lU+Qdtq5E3AjLzdll3Xql4zQKvjbb621e6CTcG2ml0YdqytZH4qUxG73XZD7cx2rG3NL2RntgfJjrW/+/J1tgvZ9JtOlT/8aq2UmISMWcnJX/RolZweP5PT6d/ce323Wy/vqevx+0gOkoPkIDlIDpKD5CA5hJBRLDmt71IbtOT085mcgeRnoLel5a/wdN0fyUFykBwkB8lBcpAcJIcQguScc8np5TyDfsUGyUFykBwkB8lBcpAcJIcQckFJzpC84+ucdlcb6C1z9Us6TZ+94ZUcJAfJQXKQHCQHyUFyCCFjSHJG2v+T07WLWrL/ID5odMFH6rxZs6Ikb2u2dKlQ1fFNcrVGsawuyRtbWdG/eLGQHztjRpTcc49gtakdm3fQqp7CfSWrVkVJXiKfPh0ltrWq1LcrO0u6FN9pbz3L3LlRYmJmY45rBNtq3nLihJAvzqj8ETRhMHu2rXmPLKs+rZ+YyfRDDwn2FFrXwgcfFKyJoV0oLzfzytWmYCpiSpA3ELNeZHlLNJvCY48JeYM4O3PuAHasXcgWdt064ZFHMuxY+7cim2+ux7bVxvz97wv/+T8Ld9whXH+98Hu/J/y9vyecp1BiEjKSJYcQJAfJQXKQHCQHyUFyzrPknP1r6FsoXglBcgiSg+QgOUgOkoPkIDlIDiFIDiFIDpKD5CA5SA6Sg+QgOYQgOYQgOUgOkoPkIDlIDpKD5BCC5BBCzm/WtLBM0a1TQ5irqHtE3KasGRmsVZ5V9iofK5ZPFGnTd999UbJ7tzBunLBwoRALhE8+ERYsEEiWSZOE6dOF3/3djHnzhH/1r4SbbxZuuEH45/9csJ3/7b8VvvMd4e67BfPDvF2eGZEda4P8x/9YqNpfNsT+gefaawXzFvNhU81XXhHeekv45S8z/vIvhb/+a+H994W/+ZuhghJzqPI/CRlU+F1HCJKD5CA5SA6Sg+QgOReI5ET89lvqPxIkhxCC5CA5SA6Sg+QgOUgOkkOQHEIIkoPkIDlIDpKD5CA5SA5BcgghSA6Sg+QgOUgOkkOQHILkkJGfhSXWj6cqc08o+0vsd9kXXwgxS7Baxbp+3XhjlEyZIli9EXFHybZtUWKtm+y3c1yrxKGSI0eixNp8WTemiKeF66LEauKIr0qWLImSlSuFGC9YxXzllYJNIeIu5bWSq66KEmuCFfG6InZhrbmsJdqcOULEaeWocHkIsVGYGcJs4dAh4cMPBXs2In6urFSkE93nn0fJRx8JVhPu3Cls3Sp8/bUQcUAYulrNOXhQsM50VjL+5jfCr38tWNdCO5Vd6NzNaAjJV8Omv2+f8O67DZz9/V3yi19kvPOOYMfaVqPpVNYO0o7Nt779doZdyLbmo8r5H/8jw34D5cPQrYSQkSw5D6UZLdX2CGkAO1r70CI5SA6Sg+QgOUgOkoPkEILk1MV9x/9qouP3O/7vFF3/y4qBjhqEXXQcJ5KD5CA5SA6Sg+QgOUgOkkMIktOhsm/9unc9yHdAcpAcJAfJQXKQHCQHyUFyCEFyhkZyBirrE5EYQsnpeM6u/4l5LjkDHd7L97ue55uvR/F/sI7kIDlIDpKD5CA5SA6SQwiSM8ySU78FrnVsA33dun/TkEZp8yIlHlC2CRNDuEj4+c8FE8fx46MkrlC0CLYqf/58IeL6kqlTo8SrfO8YdreyuWTFiigxm7I6J8YJy5cLVm3feadg+nT0qGDVl/lSTBfcSyco3m3sYIkt7OuvCxG3K7JWVqtYY6dduwSzOMOavFXapj3QdNnN06xDWsSmkmXLosQ8zdqpRdxUYs5z7JhgvdfsR8NaVbm25QVlP1WvnTknL75zWgpK32q16X//78Kbb2ZYmdtUQNswhnCC+T1qKutzQcrvfm4Ituz5jJoehqYntulUuS/1oW2UmIQgObUYnKPP5AxkI8mpepGZHoWt9ftIDpKD5CA5SA6Sg+QgOYQQXsnp6ZWcrr7Uo4AN9PazHl/h6bo/koPkIDlIDpKD5CA5SA4hBMnpLjn9NB7ocTqDfsUGyUFykBwkB8lBcpAcJIcQMtIl5/x2V8s/k9P7tboeXr+k0/TZG17JQXKQHCQHyUFykBwkhxAymiRnEP9Pzqjurpbs32N3tQsmNwvausqaUy1cGCWvvSbYL00rCmOBEm8o75dYryrrJxaxXlBPW7BAsEZtEQ8KWoxar7nPPouSmCfs3StUjelWKSJXlbZpP7G4RXBPu19Ip191orP+ePeW3H13lJi2WTO9mBIl5mn2MHjrOa3ybem8L18sF1SP779fsCZ+M2cKlcOLtpk9TpwouJhpP8CNG6PEeq+5p+nT3qVXVVM93dScKr9QU6+qJk/L7aLJ0+yH0Lb203ysaSVNzGzp/tt/E2znvGNY0yCbnGcIm571I4RNNyV/gPPVsGdDO+BRYhIykiWHECQHyUFykBwkB8lBcpAcQpAcQpAcJAfJQXKQHCQHySGEIDkEyUFykBwkB8lBcpAcJIcQguQQJAfJQXKQHCQHyUFykBxCCJJDhiX33CNEbFCkV5X1BIt4p6RqTnVPyUUXRUnEshJrTrVpkxBxV4mNedw4YelSoTIE6Rhm2hbxtvKB4J72ofJpiXVIqzxtS8m0aVFinejMWyLWKAsTtm+PEusYdsMNUVJ52r6SAweiZNs2IeK2ko8/jpJbbhEivlBE21avjpJbbxUqT/uo5JprouSrrwTzNGviF/FmiT2EVrjaIK2CqjxtV4m3j8vrvKaGWnm52dTYKheGpnq6n9ZkTY3a8gZiTUrQtBp54d4kZvmFmobRtLC2Vrmn5WLW5B5ND9IQyrNCiUkIkkOQHCQHyUFykBwkB8lBcgghSA5BcpAcJAfJQXKQHCQHySGEIDkEyUFykBwkB8lBcpAcJIcQJIcQJAfJQXKQHCQHyUFykBxCkBxC4j5Bm1NdfrkQyhnN9OlR8tBDwtatQsSXivSqsj5XGzYI3pxKheHaa6PEytzK00TqrrgiSk6dEkzbXIG021jladLHLKZGyXvvCe5psbuk2rq9ZNmyKInLFM3Jk0KlbT8pWbw4SmzZDx6MElvnSlTM046UrF0bJXGpYNq2fr3wzDOCedqaNVESZ4RZswTztFWrhIiVwsUhxI2K9ANctChKulSBeResXFRy58lr06YuZ/l1mwrZJm0z8kHmF2pSgqbGZU1SN4TCkN+jpmXPz2zapo3L2hy+Hx9uamqnWykxCRnJknPmrzJGY87WzBfw5ZAcJAfJQXKQHCQHyUFyCCHDITnfFquDsIIhl4SOJ6y/OVTXRXKQHCQHyUFykBwkB8khhFxoklNW+b1U/OfaCpAcJAfJQXKQHCQHyUFykBxCkJzBS04iD1bH1t/s6Ej1i0LffN3xxaJk/ybJ6XieHr/fNH4kB8lBcpAcJAfJQXKQHELIqJecjl+37t/RYZLznPdxJuO/cPL++4L1qorJIcRXJVVzKvWl2KYcK7HmVGfr7RJrthYzFO1VZb25rKw3T9u8WYg4XnL99VFinjZhgmBC+MADQsTpkqNHo8S7fo1XtAeaCcOllwpz5woRjyurS6ZOjZKIX5VY6RKxuMTqDesmF2cXpGDKFOGzz4S4TolXS6wRX/WobCzZuTNKbOclS4SITYpGb2jMVFStr746SiJ+rojVmPHaw9BW11pRmBffTXbR5DxN1XaTpzVV6lZPW7X9y18Kf/mXwr59wv79g+fXv86wvoS/+Y2Qb7W/oP/6rzP+6q+EfGcbpK3Gr34l2NLZ1nxnG5VdyHa2f++xMzfNyBY2XWdKTELGrOSc0+/3eN2Or730IjPnaF5IDpKD5CA5SA6Sg+QgOYQQJOdML28z6/OVnK5vP+vxFZ4ex4PkIDlIDpKD5CA5SA6SQwhBcs7h29WausC1vmKD5CA5SA6Sg+QgOUgOkkMIGU2Sk3RXG8LPunSViv5fyWk6fz+fHUJykBwkB8lBcpAcJAfJIYSMdMnppfVZx/eANXVXy9+u1s8rOb10UevlbXJN3d4uhNx4oxCxrKTqviU18aRJURLxdIn9elq4ULAOWuPHC3fcIVRdv94umTMnSm6/XXjjDcHafD3/vBDxibKkxNRryxbB6tq4Kko+/FCIaYK1Jps5UzAxs/ZiEZ+VTJ4cJXZDI1YoexW1xyujxEtz9WGr+u65R5g/X5g3T7jsMsG8xbVtQZTYdStP0w548XWJPaLmaTfdJFSPyrOCapsV2xF7FPG0LtWYlW55iZwX31Yx/6//JdjWfOemYVhdm5eqRj4j25ovXb7O+ZjzSt3GbGfOV7LpLhj5FPKVzMnXqknMbOdczHLsJzafb36sbqXEJGQkS84w/381BMlBcpAcJAfJQXKQHCSHEILkECQHyUFykBwkB8lBcpAcQgiSQ5AcJAfJQXKQHCQHyUFyCEFyCEFykBwkB8lBcpAcJAfJIQTJIWM2lyuxRvDuatKcqqqnrcHUKmVhif0eXLNGiKsV84f4vOTLL6PEynorza28roRBPC3mRompSMRrJaZtVS8ybQGnnhZxuzAvSsymzNM++EBYsECIuE25t8TcY/Zs4ZlnBNM26zZmzmOeZtXIp58KETtKqudKn8l4QJgSgmrbsWNRUt0F7SWoa2V30LzFHqTqVLsVs/SjQt6rKscaiFlzqryfWFOvKitkc8lpsosmT8vr6X4MwS5kq9GPpzWtc5NsNIlZk0w2Ga/9HdSkbefL0+iuRgiSQ5AcJAfJQXKQHCQHyUFyCCFIDkFykBwkB8lBcpAcJAfJIYQgOQTJQXKQHCQHyUFykBwkhxAkhxAkB8lBcpAcJAfJQXKQHEKQHEIkzz4rWOk2caJQ9ao6UHLVVVFizakiTij7S6ZNi5KqOZUUhVdcESXWyMu07fXXBfsN6/X0DCXuKdm2LUrsVG++KVi1GdcIJipXXilEvKl8UWLaduedwmefCeZpVbu860tOn46SytOOl3zxRZR8/rlg2nbNNVES8XGJ1UhLlggbNwo33yyYp0VsKbGqb8UKIWJ5iTXis+f54osFK6gi3imxboHuadNDyJtx5UVhUzcq29pPc6pcn2xrP55mO9uF8ik0LWyTAuVbh83TTCfysr5J25pkwyaYM2zalq+z/qVDiUnISJacM7t2JYyRcn2g/9KH/+oHyUFykBwkB8lBcpAcJIeQsSg5Z4oMiWP0rxZnOgXJQXKQHCQHyUFykBwkB8khBMnZNTx+cu5cosczIzlIDpKD5CA5SA6Sg+QgOYQgOd01YKBXUeyb9W7l/h1P8s3Xg3uJZqATJhcaqheskBwkB8lBcpAcJAfJQXIIIaNYcmqN6fh1/nJQLyfpKlq9/LGXEQ509bGb3buFiCMlVXOqlSVz5kSJ1eJVX69FwtnKr8SbU21WjivPl5inRbwnaKO2U6eEiM9Kli6NksrTrEeWaNu110bJoUOCedpbb0VJTBS+/lowT7Prbt4cJR99JLi2XaxotzHzNG95N0247Tah8rTHS+zMhmnMpk3C4cPC/fcLlbaJl1qTN3uQZs2KkgcfFGK2YJ5mo4o4XXL11VFi2mZy1dacqqnLWT+9qlqaU3XZalNoKmRz18or9aY+dXah3OLyUeU97pq0LV/YnKa+bXbssHlaU7O1fnrcpd3zKDEJGYOfyUl0oncVaf1+6/vNer/QkH9qCMlBcpAcJAfJQXKQHCSHEDJyJSd5bSR/K9p5kZxeRjXQKzm8Yw3JQXKQHCQHyUFykBwkh5AxLTm9v7QybJIz6AthNUgOkoPkIDlIDpKD5CA5hIzRz+R0/djMUH0mp3/Jaf3UUI+fAkJykBwkB8lBcpAcJAfJIYRcmJ/J6b27Wsd+a4P7wE/T29WSd6PRXa2nVOWXNKe67rooiTNKHCux5lQR95Z8/HGU3H23EHOEd94RIlaXrF8fJd6rSkdlojJhghCxs+Srr6LkhhsE61RmvlTp4gbh7LUKrIvdHXcIcZVijqfFd8RPFLmDcUUIsVDRLFD6yKuvClU+UZ5RLO8rHysHlX2KnXmHckyx7Fe2K3nWKesVPXNeQeZb89o0b5iWF4V2qrw2bSqR82P/9/8W/uZvRgE2o7O/sEvsh+GZZ4SHHxa+8x3Bmgmaav+zfyZcf72wbJmwcqWwYYNg/1jyk5808MMfZjz5pGB/fdtW48//XHjuOWHrVuHFFwXbaqd67LESSkxCRrLkEILkIDlIDpKD5CA5SA6SQ4YyZ+LMt9R/bNp5ZP6xnykgOQTJQXKQHCQHyUFykBwkhyA5SA6SQ5AcJAfJQXKQHCQHyUFyCJKD5BCC5CA5SA6Sg+QgOUgOkkOQHCSHECs3yYUd6cxm3fOmTBEinlbUEOaFoDu7tsVSQdXL2k1ZbTZunHDihBCTBO/4N0VxSz8guBCa5LyR8OGHURKxq8S13M78J38i3H67YJXr7/2eMGmSQEZCfud3BPth+NM/FZ56SnjlFeHttwVr1JaTt3Ez423a2k+XsyYPtz51Tfzyl0La8o46fkzlBTLywu8NguQQJAfJQXKQHCQHySFIDpJDCJJDkBwkhyA5SA6SQ5AcJIcgOQTJQXKQHILkIDkEySFIDkFyCJKD5CA5BMlBcgiSQ5AcMgLy+OOCNz2LN0usQ5q1NbNf1tZtbO1awZqArVoVJXGlog21vvgiSqwtUNU/bZEijdqsnZrNaLoScVPJ/PlRUi3dLcrdJa+/HiVWBFthE3FDyY03Rkk1X+nrNX58lHz5pRBxa8nnn0dJxOfKkZKlS6MkYmWJd+27SLAayezinnuELVsEG+Ts2ULEpyWVAiwrueSSKIn4eYndo4jbFenMNm1alNiTs2OHENcpVtidO6zLWVMxeuCAkO+cY8c2Vcx5tW3zHcKiv5+dbRj5IK00z7fm7fLyu2A31J6NnPzMNn3bmt+Ufh7vpodQocQkZCRLzm/TUMkTJAfJQXKQHCQHyUFykBxCxq7knDlzZnDV8qAPJEgOkoPkIDlIDpKD5CA5hCA5SA5BcpAcJAfJQXKQHCQHySEEyelNVL5N8k3zmTMaxAHJQXKQHCQHyUFykBwkhxAycl/JMbepPWcg8yGjI1WN+H6J1dMRN5ZUHaU2CleFEKdL3n8/SiKeKVmwIEoiDpVcdlmUmAJZlR/xWokZkTnAXXcJEV+V3HRTlETcqawoOX48Si6+WLCauKq2n1LEl8zxjhwRrK/Xq69GSYxT4ouS06ejxDqV3XKLELG2ZOvWKHnoISHiYMmnn0bJihVCxEnlAcWWfZUiYjZrVpTEZGHiRMG6ui1aJJjzXHutUPVb05+FWFJiF/Jy07CCzIrCpnZbTVg9/e67wt69Qn5sfqq8R1ZeExtW5ec754bQZGJ5WZ9fqMnxclFpepCajCi3i6aFzY/N735uNU0zUm2jxCRkzEpOxz8iOUgOkoPkIDlIDpKD5CA5hJBR/EpO8jY2PpOD5CA5SA6Sg+QgOUgOkkMIGcWv5PTykg5BcpAcJAfJQXKQHCQHySGEnGfJSV6QGejlGiQHyUFykBwkB8lBcpAcJIcQMmokZxDd1ToeSEZF3iup3OMPSubNi5KI4yXWe23nTiHiaUEVaNs2oaqnpUPaAw9EScQnJZW27S6p2outKbn33iiZOlWwTnS2ONabK+JXgtrFiROC3YWqu5po25VXRknE3pKrroqSSgmWC+48mbdY07PKPQ4rcss2bYoS63Jm5UfE8yX33Rcl7i0qz1WDuLuU9xRREZN2u/sR75RU7+LdqWwt8VFdrTQVo/100Mq7YOXVttWXVozm6pX3ImtSkbyAzivmfL65qKQlcl9nzu9vXtbnHdL6aT1nW5tENL/7TZgeN7Xaa9E2SkxCRrLkEILkIDlIDpKD5CA5SA6SQwiSQwiSg+QgOUgOkoPkIDmEECSHIDlIDpKD5CA5SA6Sg+QQQpAcguQgOUgOkoPkIDlIDpJDCEFyyDBlQ4m1kIoZgrUIs75e8+cL1rrq6aeFU6eEiFPChChZu1awDmlWfcacKLFi1Crmiy4S4grFvUXKei9z7dh5wo4dwu23C8uXC9YS7Y47BDPAr78WrrlGMPO0dnlLlwrWiW7XrigxM7H7W7Wee7xkyZIoiYmKNj2zdTarWbxYqK5rzdYeLPnssyiJM4K1U7OiyBriWce/SZOixKZw661REnGTkFefVlBa2Wc7W9Oz3C6a2nzlp2rSmKYyt6lSz7faqfKtTQ3Tmqr8psZluQIZ5jz9tIBrenKaLmQmNoQPYdMzqVBiEoLkECQHyUFykBwkB8lBcpAcQgiSQ5AcJAfJQXKQHCQHyUFyCCFIDkFykBwkB8lBcpAcJAfJIQTJIQTJQXKQHCQHyUFykBwkhxAkh5CLFO379MknQsQXJVdfHSURtyhSbnpTLK0vx48XrJ7evTtKLr1U8E5llynxgXD25CXame2yy6LEfhVee60QcWvJihVRUnVIk+ZjK1dGydy5QsT9JVVHuJ8Is6Pk008Fu2ULFkRJxOslXovPEqz1nNXx1pfvnXcE63I2eXKUmBDazna73S3tWB1zxL6SjRujJCYJdgdNzKy1oFnNddcJEW8pJ0tmzoyStsZWeS+yvM7Ly7686M9r07yTVV7m/uY3Qt4RLp9RvjhNPd+aqu28U5nRpASGncqM1zDjNd59V9izR8hnlN+FIXyA7VEx8m6BLQ8/JSYhI1ly/meaIayI/7ZXKkFykBwkB8lBcpAcJAfJIYSMGcnBgpAcJAfJQXKQHCQHyUFyCCFIDkFykBwkB8lBcpAcJAfJIQTJOWeS842l/L//xTu+/br4r72j/v5A3xnomwTJQXKQHCQHyUFykBwkhxAkZ/gkp1aUjl93fAFnoO/zOs8ITWUXz5QcPBglGzYIEWtLqj5XS0qsGVfEsZLjx6Mk4j1lTUl1IZGNqvfa8yXe5kv7iVmjNmvFFvF+iWub2tSqVVFiPdC6Ld0iYWoIsankkkuiJOLLkjlzoqRygE+V+xXpkGY937wxXSwuMeeJuKPEusn5IGOdslyR233DDVFipZo7fJxQTMul6dnjj0fJ3XcLl18uRHxVYms1e7bgjpdXkE31pZW5/ShBP6NqOrMVwU0d0nIVsZo4bz6WV8z5fPNhNC1sXqnn2pYLQy5XTTPKTaxpYfNj81Hl+tTyxFJiEjKmXslptZSBJIc3syE5SA6Sg+QgOUgOkoPkEEJGjeR0fBtbrTEDvduNIDlIDpKD5CA5SA6Sg+QQguSMIMnh7WpIDpKD5CA5SA6Sg+QgOYSQkSs59vrMQB/RGegVm14+q1N/2ocgOUgOkoPkIDlIDpKD5BCC5JwHyemlu5q9ktPLbmTkZGeJ/daIuFeRZlxWx9svoKefFux3WcT2kjfeiBKzqdtuE2KGEhuUPyjZti1KrPi26tPq2pgsfPaZEPFzRYcxJUpsgjFRiYUlVrg//7wQcVzZrSxRNpZ88UWURHykyM4mV4cOCVbWP/VUlERsU8xb1igrlI9LfOmuU3TMrou+85fKoZKqMd3+kmXLosRE1J4r+9eBatnV4fOOUnlrsrxGbKrUm4zItua1aV6aN5HPt6mOz5ut5RPMLzSEd6Gf7nn2qOTDaDKE/FT5w5A3TMtb7TXJswl/ujMlJiEjWXIIQXKQHCQHyUFykBwkB8khBMkhBMlBcpAcJAfJQXKQHEIIkkOQHCQHyUFykBwkB8lBcgghSA5BcpAcJAfJQXKQHCQHySGEIDlkWHLZZcLnnwsLFwoRJ0teey1K4krh8GHB2qmZXK1YESXmD+vXR0mlXlqauz/sKZk6NUrcarRw/+ijKDlyRDhxQoj4TJG1uvnmKPGdvenZ9SW33holU6YIf/AHgk0h4tWSRYuixE5VrfMyQRe2ur97lKXK3SlbS958M0oiDpTYHbz+emH7dmHaNME0ZudOwXuvzY4Sq67t2ahEdHWJ3aOPPxa6VNtNLaTyIripgZhdNx9kXubmXc5ybcvHnE8/b+SVkw+yn85s+cI2tY/Lr9uPAeaikj9X+XXz1nP50pm35CtpO6frTIlJCJJDkBwkB8lBcpAcJAfJQXIIIUgOQXKQHCQHyUFykBwkB8khhCA5BMlBcpAcJAfJQXKQHCSHECSHECQHyUFykBwkB8lBcpAcQpAcQrxTmbWfkmo75oUQ25WjJbt3R4l3lIr7S6ZPj5KYpMxR4jbl5hJzjz17hNtvFyLuKfFhuE1J4b5rV5TY9GfNipKqvZhW+T5BXfaLQrhYibcUGeTq1VHy4YfCtdcK1j5uzhwhxgnWbM10wszz8sujZONGIWKXYpHbfdddURLXKvFAydq1UWIPwxmNSezkycJFFwn2k2Knikui5IorBG8919TlzKrAvLDLBSlvepZvzcvcvCNc3vWrqTNbk9XkVX5TU7vcefIpNN2jIRSGXJCM3HnyR6XpptiFcjPJfxZskC0uTYlJyEiWnHMnSP/39zVBcpAcJAfJQXKQHCQHySGEjB3JwYKQHCQHyUFykBwkB8lBcgghSA5BcpAcJAfJQXKQHCQHySEEyRlGyfHf152+P9B3BvomQXKQHCQHyUFykBwkB8khhJwfyakdpuMrNl2/z+s8oyPW9csbplk1NjdKHnhAyPuYRaxUXldWKHcq65W3S6xBnEmO/Uq14nvBgiixoj/i9pLNm6PEHMD8IeJN5XTJwYNRYkI4d64Q8bVygyJW422+ZipxRFlSYte1Z2PNGuGhh4Tx44WbbhJigvD664Kd2ao+62MW8xX3wz9Q7ipx2ZgsmOTMny/cf78Q8b6g/fGs+rL7u26d4OVXUyWX01Tl9+NaTc3H8orZbn8+jLzXXL5z07H59HMjypc9P1XebSwfZD/XberMlu/cz/Pc1D6uqXsekkPIWJWcXixlIMnhzWxIDpKD5CA5SA6Sg+QgOYSQUSM5Hd/GVmvMQO92I0gOkoPkIDlIDpKD5CA5hJARJDm8XQ3JQXKQHCQHyUFykBwkhxAyaiSnfrkm/0xOL5/Vsd0IkoPkIDlIDpKD5CA5SA4h5PxITi/d1eyVnF52IyM2yxW1i+khxPPKQkWMyJpT3XKLEPG54E3eNpdYffnGG4KpV8RNJQsXRomV5t64zFvAbSq59NIoue02wRvT+aiWKreWfPBBlFgBbX3MrDSPWFSydGmUxNWK3+4blQ0l99wTJRGLS+yvCfPDVauEGC/ceacQ8VHJJ59ESSwQrKmd31Dry6cTNAOsLP1BQW3Kxmz/HDBpkmDTP3lS8GVvamxlO7e0kGqTHKunzT2MvGOY8e67Qj8d4fIx53V8U/80W+f8VE1KkLtHP7es6Q7mNIlo/oj2s1b5T0o+/dSXKDEJGcmSQwiSg+QgOUgOkoPkIDlIDiFIDiFIDpKD5CA5SA6Sg+QQQpAcguQgOUgOkoPkIDlIDpJDCEFyCJKD5CA5SA6Sg+QgOUgOIQTJIcMSq9Q3bRIirld2lHi/qXnCypWC9fXyPldxsMSGYb/4rEacPj1KrM3XrFnCxRcLEVtKzIjWrxciTpVYeW0KFLFauCqEy4W9ewWTyR07osTugvUEizghTI2Szz8XrBZftEjYuVN49VXB29apLl5yiWBmcuyYEHFAkZsybVqU2P2NOKpYJ7qnlDuUT0pmz46SiGcUyYoVwtGjwoMPCtbzzRanrZFXU9Gf97kyrJA18uvazk2NvPKqt6kmtmE0KVDT4piY5dfNV8PIlaBpzLZWuQDbdZtMLH9ybFS5xNrC5newn8dbT0WJSQiSQ5AcJAfJQXKQHCQHyUFyCCFIDkFykBwkB8lBcpAcJAfJIYQgOQTJQXKQHCQHyUFykBwkhxAkhxAkB8lBcpAcJAfJQXKQHEKQHDLmM2+eYDXxkiXCsmXCWUUSxoUwU9H2YmYmCxYIH30kWF27fbtgVb51Klu3TqjK3BUlldWcLNm9O0puvlnwllmqMXahiA9KvvwySkwnZswQTHJsVHGxsHy54E3eTL1ip7JFsd56rynSEK9qlycqsmZNlJhpb94s2B3cskWonklpTGenqjTm5yWnT0eJaXnE2yVm6dXDIPfX5Nm62HlhZ8qbF3b9FKNNzbia2po16UTuS3nFnPtS3oyrnyk0KV/TjHLH66ermw3SHrO8f1reTC8/VT7BpvmaieXki6NQYhIykiXnTJxJoJInSA6Sg+QgOUgOkoPkIDmEjD7JGcSm/7/PmWESoWG7EEFykBwkB8lBcpAcJAfJIeRCkJyOr+EgOQTJQXKQHCQHyUFykBwkh5CxKznl/2Be/rHc0/bpuMnOfKZKfRS6geQgOUgOkoPkIDlIDpJDCJJzTiSn46suZkGD+7p+JSfZRIYrswST0TvuiBJv82V1vPbXimuEt98WrMyNeFbRenp6lFS9yJaXPP98lHz8sRBxT8mnn0aJNUz74gthyhQh4lclVQ+0ZYI7z+ISU02TnGuvFdx5VFQef1yYO1ewvl6LFwvWMeyuuwQTpKpDmvUi+6zEHqR77hGs5d3SpYKZyY03CtbHzHa26ZuY3XRTlNjS2ZjfeEMwLY9piv5YVS3gNHlh19Sbq6mP2RAaglWNuZjlzpO3zMoL9yZhaFKvpk5lTSKaD9Iu1NSIL59RfmzTWuUzapq+zbefTnR2KgPJIQTJSXfo5/uIDZKD5CA5SA6Sg+QgOUgOIUjOBSg5vF0NyUFykBwkB8lBcpAcJIcQJOdCkxxe1UFykBwkB8lBcpAcJAfJIQTJOYctpM/FZ3J6fLsakoPkIDlIDpKD5CA5SA6SQwiSIybTz38G2io5rd3Vkjen8Xa185zbbxes7Is4UfL551ESsbbEatOYr8TqEvttdcstgp8qDpVcc02UWLcxU4KvvhIqm5LC3fRp1qwMqxki7lYOlphOeC+yOKx8qLyh/ETZrhwo2bQpSqx9nPVMsq3ebWyeot3Gjh+Pkoh9ymLlkCIt0ax7XnXd4yV2F+68U7BbdvCgsGiREPGRslswb7lWsB8cE9GVKwW/UN6bywpKu2e21Y7Ny02rEX/zG6FJgfJuY7kC5c3HmppxNQ0jd4AmE2taq7xwz1WkiaZh5I9Z3l3NaNKnfsiXzsacPmaUmISMZMkZtmAjSA6Sg+QgOUgOkoPkIDmEECSHIDlIDpKD5CA5SA6Sg+QQQpAcguQgOUgOkoPkIDlIDpJDCJJDCJKD5CA5SA6Sg+QgOUgOIUgOGduxujZiXclrr0XJqlXCrbcKd98tXHSREPF0ibWuiriz5L77oqTqVbVSmBFCrCi54YYoMUGy0vzyywUrAiPeEyZHSbWSd5QcPRoldqEPPhDO3paStWujJGJPSXVdcQBvxRaflthqTJokbN4sROwtefPNKImLBdPUhQsFF2BtPWddztx5dBhxZQgLlInCyZOCNQC0pTMjitgqXBclJ04I06cLEdeXWKnmJZfVannnrrwKbGovlrtH09amDlr9dAxrqvLt57mpRM6nb1W+HWv/dpKvVe5pQ9g/rWnpmtyyqbtaPoxc+PMz27Hpvw5QYhKC5BAkB8lBcpAcJAfJQXKQHEIIkkOQHCQHyUFykBwkB8lBcgghSA5BcpAcJAfJQXKQHCQHySEEySEEyUFykBwkB8lBcpAcJIcQJIcQz7KSqivUjYrIxquvRsmuXcKnnwrWnMocIOLNkrffjpKInYqN6qCiNbHa1JIlUfLQQ0LVA+2tEqvFTYGsX5y1gLMJ7tgRJTZB6xhWdcDbpXxV8uCDUWLdxqzn2xVXCOY8pqnuLdqnzjuzaZXvD0M8UDJhQpREvKZ8LJwdWIHVOVVXN2lbZ3c/Yk3J8uVRsnOnEPGlcNZkSlTbXBevUPLCrp9eZLnVNDU9y8/cVMjm7cXyZlx5Ad3UXa2pb1vTSjZNfwgXNm+JlncbywUpX6umdmr5026DfPddwXTR3LLJ8XRUlJiEjGzJ+W3K0Od8/Yc5Z/42qAiSg+QgOUgOkoPkIDlIDiFjQXIGsUnM4ducL8npek70BslBcpAcJAfJQXKQHCSHkLEmOR1fw/ltq1304hJIDpKD5CA5SA6Sg+QgOUgOIWTUSI59p+OLPAO9+JP4UtfXi7795jdf2J71sa2vPhEkB8lBcpAcJAfJQXKQHEKQnKilouvXTefpunMtP72fkHSP9UC77jphzhwhZipmF9rJKi5VrMrXre+/L0TsL6l0QtqL2S8+69v28cfC7NlCxKslx47F/2nv/EN3ztf8f6VZ6ZMkTZo0aZKmSZIkaVZWVpKVZK0kSZKsJEmfpMmOrCRJkiRZSZKVrKyVJMt0Op3OmZEkaZImSZIkSZJm1bdvez2f7zmXebnN7lkejx5/nfv+3Pf7l3E9xrhONuJg9tGjyNoZ2TIu3wlmFydmq8YZVfbFWXn29Ym28i7ivCofFQNCjMui7UCLY6LWRcRcVWJy2bLIRiwT/eLIYYwcGdnOF63I2lqzzoa0Tarl8b6sbcCzLI+Yk719O7K2adB6KWKDWC8Ba9qfVk/5Teu26u+1DWlNp1CPyPUQbHNtbb2bq57ym3bc1Xu96tHcxvr61XJF2Fvub1MtN6VmffdrmyK2qZfqi6NXgxET4KONnN/0f3/nD3mH/8QOiBwih8ghcogcIofIIXIAiBz/b8yIHCKHyCFyiBwih8ghcogcAPig/iTnrY1B5BA5RA6RQ+QQOUQOkUPkAMB7jJx3XyFdbwto+rs6b/1rM79y8QB/J4fIIXKIHCKHyCFyiBwiB+Ajj5x3/z8DrfeeNW1Xs61ovWxX+zX/O9vVeuXJE9Fm085iqwfqM/Wo+lgcHqJusoqBIX4mDh8u2gIx2whn29U++yyydhid4VvneN2uZpNrZwmYdIvFxt274oQJov3evXOnePiwaKm5bp0Y8VB9mh0yJLLWtFaAp06JNqp17oLVlN2Ua6ptwLPnSh5Cu+yde6RfpGG2f7/YqeW76lpRH8LJk8WIPVn/1wHxvWq79TaLdYrYXGtvrofRenGZTZD1AF1/bz1P1yfYlF7/W59cF0L95l62yTUlbtNHNe2aqy+dvbkO4PqTm/a29XLL9GlnxAT4y46c/2OQJUQOkUPkEDlEDpFD5BA5AETOhxM2/NkLkUPkEDlEDpFD5BA5RA4AfCB/ksN/XUbkEDlEDpFD5BA5RA6RAwAf5n+uBkQOkUPkEDlEDpFD5BA5AEQOwG/CAlX2TQ0dGln73er6dTEGiYMHi2vWiNYely6JMV6cPl28eFEcNky06TOmRfb5c9E2d3WWvG3NjhsXWZtc7VXLCa843Z+2bVtkbTObbQybM0eMOJRdujSyEd+o87NXrkQ24n72yy8je++eOHOmaEEYsSvbaemZ6neibt6bOFG0BXHTpkU24idVmSiuXCnaLZs1Szx5UozoVzXa9cmZNy+yEdNFy8e6aprG63ror3dVNe25qnev1UOwrduqR+Smwb1p3VYv1g1Qv1pvhKuXy5WD+1selaaIrR+G+rnqJYDr5YFNvxZKGTEBiBwgcogcIofIIXKIHCKHyAEAIgeIHCKHyCFyiBwih8ghcgCAyAEih8ghcogcIofIIXKIHAAiB4DIIXKIHCKHyCFyiBwiB4DIgY+eRYvEiMXq9eytW5G1YdR+9vPPIxuxOmuT66RJom3fsga4fVt88EC0MffrryPb1yceOiSeOCF2ZvHD4oAQtQ/jzVlkY4e6LWtrzSIOiKMia7N4p3lscdnBrA3ull52f22t2e7dYsR2dV52wIDIHj8u2mHYJ9+8KfpT5zfllrpc3a3aXbB9gFImVkQRm8SvQtRqtWV6EX/I2gPcNpA1TZ9N29XqUdVSpI6NpgViTadQB1I9Tze1R9OVtLqwFLFX64htWpjWy+q5+mGo75F9VB0bTYvams6o/t76Vf03C4yYAH/JkfNzKQCRQ+QQOUQOkUPkEDlEDsD/vch5h5f++z0d3vr+dx6qm77o13wX/9eiRA6RQ+QQOUQOkUPkEDkAH2zk/OKf4fzKyGkNlV4i5/0mCpFD5BA5RA6RQ+QQOUQOkQNA5PzaTvh//7v9qUv3z2F+8W1/7pOLN/zin/DU39L0h0JA5BA5RA6RQ+QQOUQOkQNA5FS98Ytve+fI6aZL8YbiYKCVber57Nq1kd27Vxw0SJw7VzxyRJwyRbTR/NUr8elTcfhwMUaLGzeKdhh2CraLbMuWyNrvg/bJEa/VI9llyyK7fbvYqbinWV8uZ/Xom9keZu2Y7dLZPbKPmjpVjLiWte1qtiLs9GnRctGwZXpbt4rxqRor1TOqhMqpU5GNqaId1SefiHfuiBH7S7WX7KZMEGfMEPv7Re/DertavV/L3mz78uyTm6bApqm3ftU+uU6Cehavj7mXLWdN83Q9mtsZNR1kfXHq+2tvru1hF1nbRrhernP98DftEixlxAT4sCPnF/+qTBEkv7Jbfv3fyXnrhzR9CxA5RA6RQ+QQOUQOkUPkAPAnOQ1/f6bHyHm37yJyiBwih8ghcogcIofIIXIAiJz/ncjJf3+GyCFyiBwih8ghcogcIofIAYB3j5xeVki/98j5lZ/55/5iD5FD5BA5RA6RQ+QQOUQOkQPwsUdOL/9noO/wd3KKtzWF0587jF9fVmxX6xFdxuUL036X/fTTyNpgE/Eoa2+OOCt+FmKsyXY2hs3NLlwY2YiF6n31mPhm0E9u2iSOGiXGCHHzZtEqznagDRsmjh8v2vlaatqIfPasaFcjpkR29mzRltpFHFfnZ69di2xnndol0f4xM0TVxWU//hjZmCY+eSJOnix29sXp6cfe7M6dkbUTtFVs9ojaLRs5UrR4XrxYtGqNeK5eyHq01zvB6mVc9SBbj4xNX9Q0jPayqayeXOsvqne+1SVmp1/3Qx2i9urVq5XWLfaqfa+9Wn9v0z1qsuk699KW9SNql65OoPLhZ8QE+EuOnL9AqA4ih8ghcogcIofIIXKIHAD4cCKHwiFyiBwih8ghcogcIofIAYAPJHL4L8eIHCKHyCFyiBwih8ghcgDgw/zP1YDIIXKIHCKHyCFyiBwiBwCIHPifZ7I4ZIgYX4nWHgMGiGvWiBGrsosWRXbXLjFGqpZA48SxY8X4RNX5cunSyG7YIHaG4OmirnGL2CMOjeyjR6LN0zdvRvbMGdGmfNv6tWeP2NcnRqzN7tsX2c75Hsx61Gl7eJdOimxdcZ2rsSh79GhkLRenTRNtcZmNLrYfz5bL2aI2exjsHj14ENmITdn58yNrNzS+Fm/dEqNPtLV1b2mApkm9Hijrmbhe89XLTFynV1M+Nc3E9Rk1XY33ONbXjdfLgrimyKmT4E9/qrTz/f57semJtZ9tujh1ebY8KoyYAEQOEDlEDpFD5BA5RA6RQ+QAAJEDRA6RQ+QQOUQOkUPkEDkAQOQAkUPkEDlEDpFD5BA5RA4AkQNA5BA5RA6RQ+QQOUQOkQNA5AC71W6ItlLIZtP9+yNr3WJvjlisnsvajLh8uWj70w4eFF+/FiM2q7pOLW6r97K2T+zbb8WIi6omUMzMnjsX2RcvxEOHxIjr2VWrIvvwodhZmPY6a6l56ZJ4+LBoU/7q1WLn0m1U5fRtB5oP/doPETfV2aJmzKtXYsQh9a6qX6R5/PKlaM3TWcX2JHvyZGQjTmRt95pt3us8/IdV+bXwljm+3q9lNs15Nm429VJTXdQNUJ+vXRz7J5RZz/F1AzTlUz3HNw39puVEnYv11ahvit2F+u7XH1U/V/Wb65tSH6Rpl66+C3pUjJgARA4QOUQOkUPkEDlEDpFD5AAAkQNEDpFD5BA5RA6RQ+QQOQBA5ACRQ+QQOUQOkUPkEDlEDgCRA0DkEDlEDpFD5BA5RA6RA0DkwEePzXnjxom2jMvqYvt28dgx0eZa+yL7zStiR3bJkshGrFePZ0+fjqxN6rdvR3biRDFinirH/OxZZG0TnS8u01fPnhU7OfF9dsSIyNqarwMHxIit2c5SO0tNobNsbY56XZUU6bSlcURdoD5Wv1OlH6zTLBfv3RMtvQYOjGwncfuzU6dG1nf6xaXs48eRnTVLtB13Eeuyw4dH9s0vO9F+MdjYZ3NtPX3WSdA05vayTq1eilVv/TKt4q5cEesVYfa99dRbT/lmvXysaRZvKsB689573NvWtCGtlzc3tVb9iPawl48RE4DIASKHyCFyiBwih8ghcogcACBygMghcogcIofIIXKIHCIHAIgcIHKIHCKHyCFyiBwih8gBIHIAiBwih8ghcogcIofIIXIAiBz46Jk0SYwxYmeSe5C10TzignpUlR1onU/en+3vj+ydO+K+faJN6jYi/qw8fRrZzvatXaJu/Yqh4syZos3iEY+yfsxjRduBNn++GAPVYWpcydr+NKsLG/Nu3RKXLRO3bBHt0lniWkxGLM329UXWTn/PHrGDFNG8eZFdu1a0Z9Le/MUXosVG53m+ocpWN4tYe8ys0ocOFT2u6tVV9YxYT8y9zNNNR1VP+b188m93+vUsXp9grf0yM+ujatpx1xQbTYFkhdDUtOUes57uQp1tdQKV38uICUDkAJFD5BA5RA6RQ+QQOUQOABA5QOQQOUQOkUPkEDlEDpEDAEQOEDlEDpFD5BA5RA6RQ+QAEDkARA6RQ+QQOUQOkUPkEDkARA5AnFEPqNPVa9mvvoqsr736QrT2sFn822/FvXtFm8V37RIvXhRtgrL5cvJk0SJnxQrRZuLly8WIZ9khQyJr+7WsEOyofCWaXjq7KbZfKsar8Uf1nKo70D6P7Nat4qpVYodvRD1mu4MRz7N29zdtEiOeZC29rPGGqbaozQ7DtpwdOiTGcNGeDWvaiG1ZWx4YcT5ri+k2bhTbRuR6Nq2H0Xq+NOvDuHZNtFd7WdTWy/o4W7Zmr9o/g+yT7ZibyqRpcO9lJ5idQq19VNPP1tat1bTkrb6/TZ3W9NSxXQ2AyAEih8ghcogcIofIIXKIHAAgcoDIIXKIHCKHyCFyiBwiBwCIHCByiBwih8ghcogcIofIASByAIgcIofIIXKIHCKHyCFyAIgcAONH1VaibVGXZ/fvj2xMVeNU1rZgWSH4IKubrCJeZW352M2bYsR2dUf22bPIRjxUL6s/qWuztl7Mpt5OPdqVXKOuVfvFzyI7cqRo+eSH8WUU2j6xM2fE69dFy7ZjxyLrG8NGqXFffa5uyn76aWQ9zOIPqlzJxYsj22kPebynT4/s3btiDFZjlToze/9+ZFevFiMWZm2Z3lumsV7WfDWt26qH7zpFmta4lePmW76otj7fpk+2N9f9YKfQtBKtvr9N5dn0MDTdhaYurTOm/t76wtZdWq/4K/9lASMmAJEDRA6RQ+QQOUQOkUPkEDkAQOQAkUPkEDlEDpFD5BA5RA4AEDlA5BA5RA6RQ+QQOUQOkQNA5AAQOUQOkUPkEDlEDpFD5AAQOfDRc+CAGEPU2KyuyE6bFtn+fjHikqpTvm6yitifXbcusmPHihGHsgMHRjZGqo6M1z7XjlG1xOz3bjsF2662YYMY8V120KDILlwo2la3+mdPnqyMeCR6e8iGtMePI2sr72y3nt1um/IjdmUHD45sZxOdPWbyqNjdt6izYBg/XoyhomWbV7r2oVVcjBVtteDDh2In2u3XgnZaPZzVI2M9QdrI2DTH97KprCmQ6p+tV4TVE3NTPjVtOWua8uu66GXXXNMdrG9KrX1yU7XWC+Lqu29fVP9sfXHKAGbEBCBygMghcogcIofIIXKIHCIHAIgcIHKIHCKHyCFyiBwih8gBACIHiBwih8ghcogcIofIIXIAiBwAIofIIXKIHCKHyCFyiBwAIgc+ek6dEseMERctEn2P2WQ1XmZHj46sfbIt1LKZ2HagHT8uRtzMWuR4EQ1SY6l6XdQ3246sUaNEe/PevaJtV1u+PLI2Iu/eLW7eLFrURTzIXrkSWU++uK2uzt67F9nOvrgF2U2bImtj/cyZ4vnzovWwrXGz+2sf5fvi3lRf8uhRceNGsbMS7WTWb6iuU7O7YPVoNzRiSdb60HvJFgA2LRBr2mRlI6M9K/XGMBuR64Gy/tl6NrV8qjeV1Tat26qP2a7V1auiHbP97HtcXGaWK8LeksdNl67p1aYObwqkek1f/WrLZWfEBCBygMghcogcIofIIXKIHCIHAIgcIHKIHCKHyCFyiBwih8gBACIHiBwih8ghcogcIofIIXIAiBwAIofIIXKIHCKHyCFyiBwAIgc+eoYOFT1FdFPZ5MlijFZ1/dTPyrZtke0M7juzNkF2fnavujU7d25kr10TL10SbfnY6dORjfg++9NPkY2Boq35unhRfJOTWVsfZ6cQMUe9mN21K7IRx7I+uE8Rhw8XI1aqL1VZp7Z+fWTt0n3zTWS//FL0XXO+AU8O486dyEZsUB+L4yJ765ZoU9DixaI9z5MmiQ8eiPZR1jwHD4pWvHZUEWvFXlaE2fRZj8hN+7Xsk+0wbOivd6DVwVC3VtPysfp86zVf9embdV3YR1lr1aHStMatlyen6dWmai33mLUdRn1hm/bjlbebEROAyAEih8ghcogcIofIIXKIHAAgcoDIIXKIHCKHyCFyiBwiBwCIHCByiBwih8ghcogcIofIASByAIgcIofIIXKIHCKHyCFyAIgcgCHili3ijBlixFlVVnXZbyIR+7P2O13E/ay1lk2utpvLBspHj0RjzhxxwgTRMmbhwshGLMoOGRLZHTvEL74QIy6pMprfuBFZO0gz4m527drIRsxXZ6p7VLkptiPKrsbs2ZH1xI2D2QsXItu5zstVe5DkBJcsiezKlaL1sK1xGzFCjNiSnTgxsjFV7OsTP/tMHDRItO15tuTNKt0K0B6ktwyFTUux6rG+3nNls3jTYqvaOhh66Yd66q0/qj5mS5G6LpquhlmvgKvfXN+y+tmwf17XWuTUm/eaNv41rZ6rL47dMvOHH0R9lRETgMgBIofIIXKIHCKHyCFyiBwAIHKAyCFyiBwih8ghcogcIgcAiBwgcogcIofIIXKIHCKHyAEgcgCIHCKHyCFyiBwih8ghcgCIHID4g7pDVXSdmo2MK1aItlHq8mUxol+9Lg6OrE2Qtrlr1iyxM7j/lB02LLJbt4rxhar90GkP6Qcbr8+dE20Vm23fsvZ4+jSyu3eLEXOznY+So9q5M7K2bM148kT0Nw8QOzdU1sd5045R42nWnpyI16Ju7Zs/X4y4qVanP3q02FnTp/rDcCC7bFlkbQGgLfE7e1aMeCU2DWf1mFvPl/V6sXoItl9XTbvIzDrb6g1pdXo1HUbdAHa+73FSry97HQxNnfYe27KpW5oewnpDWv3m+mfrEmO7GgCRA0QOkUPkEDlEDpFD5BA5AEDkAJFD5BA5RA6RQ+QQOUQOABA5QOQQOUQOkUPkEDlEDpEDQOQAEDlEDpFD5BA5RA6RQ+QAEDkAws/Ks2eRtcVlpg12PkHqTPzwoRjxTdZGxosXxVevxHv3RDsMW8U2cKAYcTu7YUNkrZdGjhSdoeKpU2LE7OzYsZG1zWzeePEie+xYZCPWqbPVFdk7dyL7+LFo18rW5dlHRaxSbX3cOfW8qNdq1y7x2jUx4mj2+PHIPnggrlolnjgh7tkjRtzJWofbwxDxe3F4iHrZbclbxKxsZ0HcNrGe5GxErufp327arg/Swqze+tW0Xqzpk+tjbqq4q1fFpuVjvVzYplNoerUuhPoEeznmutPshjY9z/XOt/oUiBwAIgeIHCKHyCFyiBwih8ghcgCAyAEih8ghcogcIofIIXKIHAAgcoDIIXKIHCKHyCFyiBwiB4DIASByiBwih8ghcogcIofIASByAIQFC8SZM8WIneph9bK6UBwX2UOHxIhDWft9MOJadt68yFq39PeLr1+Lvj/NNoYNU+OgeiP74kVk7Yus02bMEA0vok/FoUNFWxBnR7VpU2QnTRIjHqq6uOxNuSXtOkdsVheLunzMvnfqVHH1anHwYNFCxR6zvr7IRkxXz6gSsfv3R9ZuWcTpbOfhf5LtbLGTxjt4MLIRc7L25NgvOp/U6zLpJYHqj+pl3VZ9GDZ818u46gSqr1W9Pq5uj/pq1BvD6qtR11R9VPZRdS5aENZvbtrMVj9IdjXqjGn65KYntn6AyzvIiAlA5ACRQ+QQOUQOkUPkEDlEDgAQOUDkEDlEDpFD5BA5RA6RAwBEDhA5RA6RQ+QQOUQOkUPkABA5AEQOkUPkEDlEDpFD5BA5AEQOfPQcPSpG9Ks3xa8iu3SpaIva7Pfu27fFiPnqgqyNARFLsp9/HtmJE0WbXO2obEfWV1+J06eL48aJEUvV26ptOZunLlOfqBuzfsx62WOS6lO+4PvThqgjVM2ny5cj22G7+GWIY1S/3Sey9+9HthNmhgTw8+eR3b1bjFguakzam20D3vLl4unTYvys6uo52563YoXoj3e9nKqePu3VH34Q69Vk9UxcT5C1TelVLz2zlVlNddGUQPVqsqYTbArCpkVt9dDfFCpNPVz/7HtctlanV/3kmPbLzH5Wv5cRE4DIASKHyCFyiBwih8ghcogcACBygMghcogcIofIIXKIHCIHAIgcIGS7z+wAABDKSURBVHKIHCKHyCFyiBwih8gBIHIAiBwih8ghcogcIofIIXIAiBwA3TZ2/Lho7WErs6wQzp0TI06qz9V16hpRN3fFQNVH8/vqg+wnn0Q2YpuowWAn+OqVGF+rsS87fHhkfatb7FAfZW0MiAHi7Nmi/Wx9j2xG8tayfIr92REjImup6b2kQ7/loq2esy+KmJG17Xl2j2z1XGcv3xX1seh9uCFrO98iXqpy+n7L4lnWHobPPhP9wtqcV0+fvSwQqyfmOq4skOppu5dBtv7eOszqw6gXlzX1Q70xrGnNV30Y9Rxfh1n9IPWypq8prppOv+nhb6rW8hQYMQGIHCByiBwih8ghcogcIofIAQAiB4gcIofIIXKIHCKHyCFyAIDIASKHyCFyiBwih8ghcogcACIHgMghcogcIofIIXKIHCIHgMgBiOvZTqjszNqo+uyZePKkGHFQnBhi3BMnh6j4IDtejaPi1BDLBIrYm71zJwptu9r+/ZG1Mffevch2FrX9KNrpf65qEtiYZxPzhQtixJHs9euRjWHi69fimwufPX8+sp2IvaRuza5cGdmIFVk7qs2bRUs+u862xu3BA9HWuPX1RTZijmiX3R4kf4C3qLvU06psz5s1K7Jt26jeo/X2LdO2ftVLwOpXm+xlUm/KCTvmpjm+nqebTsHeXC+Xqy97LwnUFAx1ATYlUC9vru+vvVn/McqICUDkAJFD5BA5RA6RQ+QQOUQOABA5QOQQOUQOkUPkEDlEDpEDAEQOEDlEDpFD5BA5RA6RQ+QAEDkARA6RQ+QQOUQOkUPkEDkARA5A3FZvZK151q8XbZGXJcGGDaJ9sn3UtWtixPfZ5csjO22a2BmgX6iyfMzLRHups4pNBlk734iL2cmTIxtxKFsvpouYlT1yJLKdmrqbffEisp2oOyAOiuzDh6KFiu0Ei1itypK3H3+M7LZtYsRu9XV25MjI2gq4nxU7jI0bIztokHjihDhxonj2rBh9ol2c1atFu8725NgX2cS4ZIn4lvVT9djXFCpNi7x6Gc2bFpc1JUF9kHXF1RNz02jeFFd1t/SyAa9pF1nT6rm6PHvZCGf/ksYue219y5pW3qmMmABEDhA5RA6RQ+QQOUQOkUPkAACRA0QOkUPkEDlEDpFD5BA5AEDkAJFD5BA5RA6RQ+QQOUQOAJEDQOQQOUQOkUPkEDlEDpEDQOTAR8/ly6INwRMmiP39om39mj8/shFrRZ0g164VfRWbbu56/jyyly6JNjHbQq2IHdnt2yNro/mqVeLCheKmTeKAAaKtNetM+etUWS736lVk/dLZ5q6BIeqFHTxYtOtsS97s/tpHefLpqxEbVNkXd+tWZK2IrC1HjRI7n2yLy/6YvXEjsrYAMOKV2q/qjrtYKepB2kPY6UNd8Wf3aLT43XdiWxLYyGifZa/W66d62XNVD/1N83Q9izc1QNNR1RvS7Kjqwb1uj/rNdhj14G6F0HQH6xtan0JTTNav2hnVd7Bpm5y9ar80TP1eRkwAIgeIHCKHyCFyiBwih8ghcgCAyAEih8ghcogcIofIIXKIHAAgcoDIIXKIHCKHyCFyiBwiB4DIASByiBwih8ghcogcIofIASByAGJN1ka3zn6tLeqKrE2BEduyPtjFreyjR5E9cEA8dUq0ErOq+fbbyPp6sXEh6sT84EFkbevX69eibdDqbDn7vWqryb7LXrwYWdsIF7FKlVdt9dyOHeK+fWLEUvVUdsWKyNoJdvphfnbBgsjaUV25Ilpd2FBkm/fedhh7s50n9g/qhez165GN2JS1dXn2eJ8+LT57JtqmwZcvRa/0pkKoh8KmFKk3szWNub2sgKsH2aYlb/VaM/vkulvq8qzPt361/qKmXurlo5qsv7fp9Ov0qqOuaeVdy/Y8RkwAIgeIHCKHyCFyiBwih8ghcgCAyAEih8ghcogcIofIIXKIHAAgcoDIIXKIHCKHyCFyiBwiB4DIASByiBwih8ghcogcIofIASByACaJ48eLJ0+Kt2+LU6aIEXdUyZiYHKLuT7Ppc8aMyNpKtJio6phrM7GtgKt/0zxyRPSlZ5+KK1eKEfeztvXL1qn5Iq94kv3888hG3MiuWRNZS83HjyNrJxjxQD2v7snOnh1Zu5L+USMi2zmF0+q+rIWZbVezfXH2qKxeHVlbAWfx3FkQZ1fjqaqpqRvSImaol9TF4vDIetM2TXJNr9bLuJpqyqwXW9Vl0rRNro46O8FykHXrIuqlAXpZTdZ06Zq259WpWQdSveOu6ZjrJ7b+2feYQGxXAyBygMghcogcIofIIXKIHCIHAIgcIHKIHCKHyCFyiBwih8gBACIHiBwih8ghcogcIofIIXIAiBwAIofIIXKIHCKHyCFyiBwAIgfAuJs9fjyyY8aIEQ+zCxdGtq9PjNiRPXYssjb079kTWUsvm/I7p7BHlXHT1l7NnSuOGiVGLMmuXRtZL5NPImthZgu1bG/bhAmirTWzJLCfvXBBrJeedYbvC6qGaMxVz2QPH47snDlifCZu2SLacjm7KRFH1OuqbKJbsiSydoJ2fyOuZW0lmh1zxDL1bLaTi7/Ldnb6ydJCW6dmu9feMtbXK8LszfW0Xe/IqifXejWZvWoJZG+2V23xor25LrGmbWM29dZF1MtSu/rN9T2qM6Y+5qYebrIpnuu27KW06y5t+rWgTywjJgCRA0QOkUPkEDlEDpFD5BA5AEDkAJFD5BA5RA6RQ+QQOUQOABA5QOQQOUQOkUPkEDlEDpEDQOQAEDlEDpFD5BA5RA6RQ+QAEDnw0TNzprhvn/izEjEnO2lSZGOAGhvVbapM28uXR7bTLbIEzHa+2Sxuy9bu3YtsxOGsDe6mrRezJWDjxokRm7JffhnZiLXioMh+843oQ3D8pD7L+go4ndRtIZ516dGjYkxT9YvsIDt34Ypqi8ssY06JurbOLo6foL5qoWID1blzosWGb+0bIk6fLkYcyL54EdmYoA4TLYGePhXbCqFpsGtaa9YUDHUC1b1ko6pNzE0b4eqjql+tj6punvriWIrU+9Pq+9uUXk0naK/W17mXxXRNfVgXUX1h69QsLzsjJgCRA0QOkUPkEDlEDpFD5BA5AEDkAJFD5BA5RA6RQ+QQOUQOABA5QOQQOUQOkUPkEDlEDpEDQOQAEDlEDpFD5BA5RA6RQ+QAEDnw0eOhonvMVq+OrK1Eiziprhdt7NO6iCkhasZYTthmtg0bxBguDhggxijx9WsxYnvWFpdF/FH0M3qZPXUqsjbm+mgeB1VNIG+8RaJ+sk3Mo0eLti7Pt6vZFjs75i/Fzkq0paLeBc/jkZF99Ei087Vp5No1ccEC0UI0Yp0qZXL5cmQjVqnyZltq1/miQ1m/+7a3rU/0PmwaRpu6pV5OVY/XtU0DpX1vvajNfrYp+epOqwf3pmVrdRLUw3fT/W365Lqmrl4VbamdvWo25XF995tqqmlRW32Q5VPHiAlA5ACRQ+QQOUQOkUPkEDlEDgAQOUDkEDlEDpFD5BA5RA6RAwBEDhA5RA6RQ+QQOUQOkUPkABA5AEQOkUPkEDlEDpFD5BA5AEQOfPScPi1a1cyYIZ49K8ZUNfqzgwZF9vFjMeK6ul/dKdrIGE+ydswbN4oRy0U9ZvtNM+Ju1n5btL1tNm2vWiVGXFK3il+HOFRctEi0xXTr10f2q69Em6eHDxfXrRNtXZ61h6+PsyLSJIi4nO3sXpPE7e+P7Jw5YsSK7M6dkbWjsqtx6JA4d65o2+Sspe3N1nj2qFgv2Qo4u+x2+v5c1bvI6qm3qWp62UXWtD/NPqopVOrIaRqRm/a2NR1V03VuSpFetNO3V63i7GrUOWE/+x53r9WtZY9ZUwHaq+WbGTEBiBwgcogcIofIIXKIHCKHyAEAIgeIHCKHyCFyiBwih8ghcgCAyAEih8ghcogcIofIIXKIHAAiB4DIIXKIHCKHyCFyiBwiB4DIAYjfZTdvjmzEAvV+1vaYffKJeOWKGPGH7KxZkbWdYL6bK86qZ7K2MM3G3Ijn2ZkzI2tLsVasEK1bOpPrbvX77PPnkZ06VYyYrr5UN6rzsitXRvZNqGZfvoysb3UbrMadrJWJNe3XX1fevi0uWyYuXCja6OLr8uJV9ptvImuPWcQa9bk6Q3wTgUl7VOyWdTrNbrd0+NatkXW0PG2XYNs2qnrBVL0DrR4366VnFhvvMa7q8bplVG3bU9dLt9Rb3ZrKpKk86zf3soivTr46NuqKsxv6ww9iU2vVmVovDywfJEZMACIHiBwih8ghcogcIofIIXIAgMgBIofIIXKIHCKHyCFyiBwAIHKAyCFyiBwih8ghcogcIgeAyAEgcogcIofIIXKIHCKHyAEgcgB0ChwzJrJHjogRN8UhkbWZePJk0X57inid3bs3shFHszYix2jRPtlWhNlMvGePaNkWn4cYf8zatH3zpmif7J02LLInTogRi8SBkb1zR/z2W9Fi0tZ82do66zQb6589E+0eeWrqnrqlS8Xjx8VRo8ROiErjDRsW2YiF2YkTIzttmtg5Zlkf95YUaeO22sQFsWnqrZeP1TvQbOxrsh7rbWqsJ9d6CK5n8fqM6myrT6H+qPowmnKivqFNK8LqT64br466+pbZz9qb//M/xX/7N/Ff/kXctUv8p38S16wR/+EfRPtXVn/7t5V//dfi3/xNlhETgMgBIofIIXKIHCKHyCFyiBwAIHKAyCFyiBwih8ghcogcIgcAiBwgcogcIofIIXKIHCKHyAEgcgCIHCKHyCFyiBwih8ghcgCIHIA2bJNVhQ2jtk7txg0xvlZ1v9bgwZG1jXARv1cvZe337vhUPH9ePHxYNFavFtevF+0U7JMj7mXtd+cJE0TbRBeTQ4wXWWtL21Q2YoQY8TA7dmxkz50TvTy/UOOuKpc9xoWoSbB2bWSnTBH7+kS/KZrWMUXVIursbbuiHhNt9Zw+Kpcvi3ZhbeiNT8TOQrzl4t/9nThnjvj3fy/a2PfP/yweOCD+67+K//Efop3Sn/4kWqjYq01726wf6t1cNjHb99brtuzN9RnZR9lB1hvD6kVedQLV7dF0F5pWz9Wv1nehPgx7tQ5Cy3IroqtXxaaYbNrMpkveGDEBiBwAIofIIXKIHCKHyCFyAIDIASKHyCFyiBwih8ghcogcACBygMghcogcIofIIXKIHCIHgMgBIHKIHCKHyCFyiBwih8gBIHLgo2fbNtG2jdnKrM2bRdugZeu2Ip6o/aqEyvTpkY34TpWPstns0iXRSswaIOKiOClEmz5jpwrwG1CPjDqNveVVG+zqZVy19c/2srnLJtd//3fxze92Wfsn1D/+o2hBOH68OHSo+Fd/JQL8fxgxgQYAIHKIHAAih8gBIgeAyAEgcogcACKHyAEiB4DIASByiBwgcogcIgeIHAB+kQIQOUQOEDlEDpEDRA4QOQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8Y/wUoPfL6KLJWeQAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"job_id":"5dd577d5cfe28a634f06dcfe","environment_id":100,"environment_description":"Windows 7 32 bit","size":94720,"type":"PE32 executable (GUI) Intel 80386, for MS Windows","type_short":["peexe","executable"],"type_short_id":"exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"adamsCopy.vexe","md5":"3cf00a8ac1a075f16660247eee4533e3","sha1":"cdcb3fcf3be18de2f47300bba2d710b319808ca0","sha256":"ded0bf44a335e57387902f0ef102f95eefed714bbcfb2434847c8cd24f222813","sha512":"f3bc74d1732bf87d94cd647adb2b97f23226baeff8befa5a6686c1c07087e7fd914d66a6577033d398dd8614e62e36a6b2e7a9b4429c50984f11ef4b7e0765fb","ssdeep":"1536:mBwl+KXpsqN5vlwWYyhY9S4AgsiSO9PEC/3F/2nzn/VJenz6mHO/8:Qw+asqN5aW/hLRiS5C/F/2nzn/VJe2/8","imphash":"f86dec4a80961955a89e7ed62046cc0e","entrypoint":"0x40a9d0","entrypoint_section":".text","image_base":null,"subsystem":null,"image_file_characteristics":[],"dll_characteristics":[],"major_os_version":null,"minor_os_version":null,"av_detect":85,"vx_family":"Trojan.Ransom.Crysis","url_analysis":false,"analysis_start_time":"2019-12-24T18:39:40+00:00","threat_score":100,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[],"is_certificates_valid":false,"certificates_validation_message":"No signature was present in the subject. (0x800b0100)","domains":[],"compromised_hosts":[],"hosts":[],"total_network_connections":0,"total_processes":4,"total_signatures":33,"extracted_files":[],"file_metadata":{"file_compositions":["1 .OBJ Files (COFF) linked with LINK.EXE 10.10 (Visual Studio 2010) (build: 40219)","11 .C Files (with LTCG) compiled with CL.EXE 16.00 (Visual Studio 2010) (build: 40219)"],"imported_objects":["3 .LIB Files generated with LIB.EXE 9.00 (Visual Studio 2008) (build: 30729)"],"file_analysis":["File appears to contain raw COFF/OMF content","File was optimized using LTCG and/or POGO","File is the product of a medium codebase (11 files)"],"total_file_compositions_imports":10},"processes":[{"uid":"00061900-00003776","parentuid":null,"name":"ransomware.exe","normalized_path":"C:\\ransomware.exe","command_line":null,"sha256":"ded0bf44a335e57387902f0ef102f95eefed714bbcfb2434847c8cd24f222813","av_label":"Trojan.Ransom.Crysis","av_matched":69,"av_total":81,"pid":"3776","icon":"$27","process_flags":[{"name":"Multiscan Match","data":"69/81"}]},{"uid":"00062021-00002204","parentuid":"00061900-00003776","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":null,"sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2204","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00062026-00003152","parentuid":"00062021-00002204","name":"mode.com","normalized_path":"%WINDIR%\\System32\\mode.com","command_line":"mode con cp select=1251","sha256":"efc11f8fcdd0a8649ebee758b105db10536e895ea6d586a07b61f68b1e5dbd20","av_label":null,"av_matched":0,"av_total":68,"pid":"3152","icon":null,"process_flags":[]},{"uid":"00062363-00003252","parentuid":"00062021-00002204","name":"vssadmin.exe","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","command_line":"vssadmin delete shadows /all /quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","av_label":null,"av_matched":null,"av_total":null,"pid":"3252","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]}],"mitre_attcks":[{"tactic":"Execution","technique":"Service Execution","attck_id":"T1035","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Opened the service control manager"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attck_id":"T1215","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Opens the Kernel Security Device Driver (KsecDD) of Windows"],"parent":null},{"tactic":"Persistence","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attck_id":"T1060","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies auto-execute functionality by setting/creating a value in the registry"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Writes data to a remote process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Privilege Escalation","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1107","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","malicious_identifiers_count":1,"malicious_identifiers":["Deletes volume snapshots (often used by ransomware)"],"suspicious_identifiers_count":1,"suspicious_identifiers":["Marks file for deletion"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Writes data to a remote process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Credential Access","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":3,"suspicious_identifiers":["Reads information about supported languages","Reads the active computer name"],"informative_identifiers_count":1,"informative_identifiers":["Reads the cryptographic machine GUID"],"parent":null},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attck_id":"T1120","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Queries volume information of an entire harddrive","Queries volume information"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Queries process information"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"api-10","type":6,"relevance":6,"name":"Queries kernel debugger information","description":"\"vssadmin.exe\" at 00062363-00003252-00000105-18643774649","description_v2":["\"vssadmin.exe\" at 00062363-00003252-00000105-18643774649"],"description_v3":[{"type":"text","value":"\"vssadmin.exe\" at 00062363-00003252-00000105-18643774649"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-11","type":6,"relevance":2,"name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6731675553\n \"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6738009864\n \"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6884637072\n \"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6947238810\n \"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6981611513\n \"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-7115766841","description_v2":["\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6731675553","\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6738009864","\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6884637072","\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6947238810","\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6981611513","\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-7115766841"],"description_v3":[{"type":"text","value":"\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6731675553"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6738009864"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6884637072"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6947238810"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6981611513"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-7115766841"}],"origin":"API Call","attck_id":"T1120","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-39","type":6,"relevance":8,"name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6731675553\n \"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6738009864\n \"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6884637072\n \"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6947238810\n \"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6981611513\n \"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-7115766841","description_v2":["\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6731675553","\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6738009864","\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6884637072","\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6947238810","\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6981611513","\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-7115766841"],"description_v3":[{"type":"text","value":"\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6731675553"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6738009864"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6884637072"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6947238810"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-6981611513"},{"type":"linebreak"},{"type":"text","value":"\"\" queries volume information of \"C:\\\" at 00061900-00003776-0000010C-7115766841"}],"origin":"API Call","attck_id":"T1120","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":10,"name":"Reads the cryptographic machine GUID","description":"\"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-7","type":2,"relevance":1,"name":"Contains PDB pathways","description":"\"C:\\crysis\\Release\\PDB\\payload.pdb\"","description_v2":["\"C:\\crysis\\Release\\PDB\\payload.pdb\""],"description_v3":[{"type":"text","value":"\"C:\\crysis\\Release\\PDB\\payload.pdb\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_13063IA\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_13063IU\"\n \"Global\\syncronize_13063IU\"\n \"Global\\syncronize_13063IA\"","description_v2":["\"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_13063IA\"","\"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_13063IU\"","\"Global\\syncronize_13063IU\"","\"Global\\syncronize_13063IA\""],"description_v3":[{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_13063IA\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_13063IU\""},{"type":"linebreak"},{"type":"text","value":"\"Global\\syncronize_13063IU\""},{"type":"linebreak"},{"type":"text","value":"\"Global\\syncronize_13063IA\""}],"origin":"Created Mutant","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-72","type":3,"relevance":3,"name":"Overview of unique CLSIDs touched in registry","description":"\"vssadmin.exe\" touched \"VSSCoordinator Class\" (Path: \"HKCU\\CLSID\\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\")\n \"vssadmin.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{F2C2787D-95AB-40D4-942D-298F5F757874}\")","description_v2":["\"vssadmin.exe\" touched \"VSSCoordinator Class\" (Path: \"HKCU\\CLSID\\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\")","\"vssadmin.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{F2C2787D-95AB-40D4-942D-298F5F757874}\")"],"description_v3":[{"type":"text","value":"\"vssadmin.exe\" touched \"VSSCoordinator Class\" (Path: \"HKCU\\CLSID\\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}\")"},{"type":"linebreak"},{"type":"text","value":"\"vssadmin.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{F2C2787D-95AB-40D4-942D-298F5F757874}\")"}],"origin":"Registry Access","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-25","type":9,"relevance":3,"name":"Spawns new processes","description":"Spawned process \"cmd.exe\" (UID: 00062021-00002204)\n Spawned process \"mode.com\" with commandline \"mode con cp select=1251\" (UID: 00062026-00003152)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00062363-00003252)","description_v2":["Spawned process \"cmd.exe\" (UID: 00062021-00002204)","Spawned process \"mode.com\" with commandline \"mode con cp select=1251\" (UID: 00062026-00003152)","Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00062363-00003252)"],"description_v3":[{"type":"text","value":"Spawned process \"cmd.exe\""},{"type":"process","process_uid":"00062021-00002204","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"mode.com\" with commandline \"mode con cp select=1251\""},{"type":"process","process_uid":"00062026-00003152","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\""},{"type":"process","process_uid":"00062363-00003252","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-103","type":9,"relevance":3,"name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" (UID: 00062021-00002204)\n Spawned process \"mode.com\" with commandline \"mode con cp select=1251\" (UID: 00062026-00003152)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00062363-00003252)","description_v2":["Spawned process \"cmd.exe\" (UID: 00062021-00002204)","Spawned process \"mode.com\" with commandline \"mode con cp select=1251\" (UID: 00062026-00003152)","Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00062363-00003252)"],"description_v3":[{"type":"text","value":"Spawned process \"cmd.exe\""},{"type":"process","process_uid":"00062021-00002204","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"mode.com\" with commandline \"mode con cp select=1251\""},{"type":"process","process_uid":"00062026-00003152","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\""},{"type":"process","process_uid":"00062363-00003252","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"api-16","type":6,"relevance":1,"name":"Connects to LPC ports","description":"\"mode.com\" connecting to \"\\ThemeApiPort\"","description_v2":["\"mode.com\" connecting to \"\\ThemeApiPort\""],"description_v3":[{"type":"text","value":"\"mode.com\" connecting to \"\\ThemeApiPort\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"api-55","type":6,"relevance":7,"name":"Touches files in the Windows directory","description":"$28","description_v2":["\"\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\"","\"\" touched file \"C:\\Windows\\System32\\ransomware.exe\"","\"\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ransomware.exe\"","\"\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ransomware.exe\"","\"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ransomware.exe\"","\"\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ransomware.exe\"","\"cmd.exe\" touched file \"C:\\Windows\\Branding\\Basebrd\\basebrd.dll\"","\"cmd.exe\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\"","\"cmd.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"","\"cmd.exe\" touched file \"C:\\Windows\\System32\\mode.com\"","\"cmd.exe\" touched file \"C:\\Windows\\System32\\vssadmin.exe\"","\"mode.com\" touched file \"C:\\Windows\\System32\\en-US\\ulib.dll.mui\"","\"vssadmin.exe\" touched file \"C:\\Windows\\System32\\en-US\\vssadmin.exe.mui\"","\"vssadmin.exe\" touched file \"C:\\Windows\\System32\\rsaenh.dll\"","\"vssadmin.exe\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\""],"description_v3":[{"type":"text","value":"\"\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\System32\\ransomware.exe\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ransomware.exe\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ransomware.exe\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ransomware.exe\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ransomware.exe\""},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" touched file \"C:\\Windows\\Branding\\Basebrd\\basebrd.dll\""},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\""},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\""},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" touched file \"C:\\Windows\\System32\\mode.com\""},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" touched file \"C:\\Windows\\System32\\vssadmin.exe\""},{"type":"linebreak"},{"type":"text","value":"\"mode.com\" touched file \"C:\\Windows\\System32\\en-US\\ulib.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"vssadmin.exe\" touched file \"C:\\Windows\\System32\\en-US\\vssadmin.exe.mui\""},{"type":"linebreak"},{"type":"text","value":"\"vssadmin.exe\" touched file \"C:\\Windows\\System32\\rsaenh.dll\""},{"type":"linebreak"},{"type":"text","value":"\"vssadmin.exe\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"api-37","type":6,"relevance":10,"name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"vssadmin.exe\" opened \"\\Device\\KsecDD\"","description_v2":["\"vssadmin.exe\" opened \"\\Device\\KsecDD\""],"description_v3":[{"type":"text","value":"\"vssadmin.exe\" opened \"\\Device\\KsecDD\""}],"origin":"API Call","attck_id":"T1215","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Detection/Stealthyness","identifier":"api-9","type":6,"relevance":4,"name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00061900-00003776-00000105-6617567291\n \"\" queried SystemProcessInformation at 00061900-00003776-00000105-6759252582","description_v2":["\"\" queried SystemProcessInformation at 00061900-00003776-00000105-6617567291","\"\" queried SystemProcessInformation at 00061900-00003776-00000105-6759252582"],"description_v3":[{"type":"text","value":"\"\" queried SystemProcessInformation at 00061900-00003776-00000105-6617567291"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00061900-00003776-00000105-6759252582"}],"origin":"API Call","attck_id":"T1057","capec_id":"CAPEC-573","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"static-6","type":0,"relevance":10,"name":"PE file has unusual entropy sections","description":".rdata\n .data with unusual entropies 7.78504061339\n 7.98071295242","description_v2":[".rdata",".data with unusual entropies 7.78504061339","7.98071295242"],"description_v3":[{"type":"text","value":".rdata"},{"type":"linebreak"},{"type":"text","value":".data with unusual entropies 7.78504061339"},{"type":"linebreak"},{"type":"text","value":"7.98071295242"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"api-77","type":6,"relevance":10,"name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)","description_v2":["\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)"],"description_v3":[{"type":"text","value":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)"}],"origin":"API Call","attck_id":"T1035","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"api-6","type":6,"relevance":4,"name":"Reads configuration files","description":"\"\" read file \"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini\"","description_v2":["\"\" read file \"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini\""],"description_v3":[{"type":"text","value":"\"\" read file \"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistance","identifier":"registry-0","type":3,"relevance":8,"name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"RANSOMWARE.EXE\"; Value: \"%WINDIR%\\System32\\ransomware.exe\")","description_v2":["\"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"RANSOMWARE.EXE\"; Value: \"%WINDIR%\\System32\\ransomware.exe\")"],"description_v3":[{"type":"text","value":"\"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"RANSOMWARE.EXE\"; Value: \"%WINDIR%\\System32\\ransomware.exe\")"}],"origin":"Registry Access","attck_id":"T1060","capec_id":"CAPEC-270","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistance","identifier":"api-0","type":6,"relevance":6,"name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 80)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 80)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 80)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 76)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 76)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 76)","description_v2":["\"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 80)","\"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 80)","\"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 80)","\"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 76)","\"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 76)","\"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 76)"],"description_v3":[{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 80)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 80)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 80)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 76)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 76)"}],"origin":"API Call","attck_id":"T1055","capec_id":"CAPEC-242","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Destruction","identifier":"api-26","type":6,"relevance":10,"name":"Marks file for deletion","description":"$29","description_v2":["\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\autoexec.bat\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\config.sys\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml\" for deletion","\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml\" for deletion"],"description_v3":[{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\autoexec.bat\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\config.sys\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\Setup.xml\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"C:\\ransomware.exe\" marked \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\Setup.xml\" for deletion"}],"origin":"API Call","attck_id":"T1107","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Destruction","identifier":"api-25","type":6,"relevance":7,"name":"Opens file with deletion access rights","description":"$2a","description_v2":["\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml\" with delete access","\"\" opened \"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini\" with delete access","\"\" opened \"C:\\autoexec.bat\" with delete access","\"\" opened \"C:\\config.sys\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi\" with delete access","\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab\" with delete access"],"description_v3":[{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.msi\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PptLR.cab\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.xml\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.msi\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PublisherMUI.xml\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\Setup.xml\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlkLR.cab\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\Setup.xml\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\OutlookMUI.xml\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.es\\Proof.xml\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proofing.xml\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\OneNoteMUI.xml\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Setup.xml\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\$Recycle.Bin\\S-1-5-21-2092356043-4041700817-663127204-1001\\desktop.ini\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\autoexec.bat\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\config.sys\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelLR.cab\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0018-0409-0000-0000000FF1CE}-C\\PowerPointMUI.msi\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"\" opened \"C:\\MSOCache\\All Users\\{90140000-0019-0409-0000-0000000FF1CE}-C\\PubLR.cab\" with delete access"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-1","type":0,"relevance":1,"name":"Imports suspicious APIs","description":"GetProcAddress\n LoadLibraryA","description_v2":["GetProcAddress","LoadLibraryA"],"description_v3":[{"type":"text","value":"GetProcAddress"},{"type":"linebreak"},{"type":"text","value":"LoadLibraryA"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"hooks-8","type":11,"relevance":10,"name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"bcce447585de4475d0c4447541ec4475d0721a7700d0447510731a77b2c4447588ea447500000000\" to virtual address \"0x0040B000\" (part of module \"RANSOMWARE.EXE\")\n \"\" wrote bytes \"c04e197720541a77e0651a77b5381b770000000000d0447500000000c5ea44750000000088ea447500000000e9682c7582281b77ee291b7700000000d2692c75000000007dbb44750000000009be2c7500000000ba18447500000000\" to virtual address \"0x761B1000\" (part of module \"NSI.DLL\")","description_v2":["\"\" wrote bytes \"bcce447585de4475d0c4447541ec4475d0721a7700d0447510731a77b2c4447588ea447500000000\" to virtual address \"0x0040B000\" (part of module \"RANSOMWARE.EXE\")","\"\" wrote bytes \"c04e197720541a77e0651a77b5381b770000000000d0447500000000c5ea44750000000088ea447500000000e9682c7582281b77ee291b7700000000d2692c75000000007dbb44750000000009be2c7500000000ba18447500000000\" to virtual address \"0x761B1000\" (part of module \"NSI.DLL\")"],"description_v3":[{"type":"text","value":"\"\" wrote bytes \"bcce447585de4475d0c4447541ec4475d0721a7700d0447510731a77b2c4447588ea447500000000\" to virtual address \"0x0040B000\" (part of module \"RANSOMWARE.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote bytes \"c04e197720541a77e0651a77b5381b770000000000d0447500000000c5ea44750000000088ea447500000000e9682c7582281b77ee291b7700000000d2692c75000000007dbb44750000000009be2c7500000000ba18447500000000\" to virtual address \"0x761B1000\" (part of module \"NSI.DLL\")"}],"origin":"Hook Detection","attck_id":"T1179","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"\"mode.com\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","description_v2":["\"mode.com\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"],"description_v3":[{"type":"text","value":"\"mode.com\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"avtest-3","type":12,"relevance":10,"name":"Sample was identified as malicious by a large number of Antivirus engines","description":"18/22 Antivirus vendors marked sample as malicious (81% detection rate)\n 60/69 Antivirus vendors marked sample as malicious (86% detection rate)","description_v2":["18/22 Antivirus vendors marked sample as malicious (81% detection rate)","60/69 Antivirus vendors marked sample as malicious (86% detection rate)"],"description_v3":[{"type":"text","value":"18/22 Antivirus vendors marked sample as malicious (81% detection rate)"},{"type":"linebreak"},{"type":"text","value":"60/69 Antivirus vendors marked sample as malicious (86% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"External Systems","identifier":"avtest-0","type":12,"relevance":8,"name":"Sample was identified as malicious by at least one Antivirus engine","description":"18/22 Antivirus vendors marked sample as malicious (81% detection rate)\n 60/69 Antivirus vendors marked sample as malicious (86% detection rate)","description_v2":["18/22 Antivirus vendors marked sample as malicious (81% detection rate)","60/69 Antivirus vendors marked sample as malicious (86% detection rate)"],"description_v3":[{"type":"text","value":"18/22 Antivirus vendors marked sample as malicious (81% detection rate)"},{"type":"linebreak"},{"type":"text","value":"60/69 Antivirus vendors marked sample as malicious (86% detection rate)"}],"origin":"External System","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Pattern Matching","identifier":"yara-0","type":13,"relevance":10,"name":"YARA signature match","description":"YARA signature \"dharma_ransomware\" classified file \"ransomware.exe.bin\" as \"dharma,crysis,ransomware\" based on indicators: \"C:\\crysis\\Release\\PDB\\payload.pdb\" (Author: Marc Rivero | Hybrid Analysis)","description_v2":["YARA signature \"dharma_ransomware\" classified file \"ransomware.exe.bin\" as \"dharma,crysis,ransomware\" based on indicators: \"C:\\crysis\\Release\\PDB\\payload.pdb\" (Author: Marc Rivero | Hybrid Analysis)"],"description_v3":[{"type":"text","value":"YARA signature \"dharma_ransomware\" classified file \"ransomware.exe.bin\" as \"dharma,crysis,ransomware\" based on indicators: \"C:\\crysis\\Release\\PDB\\payload.pdb\" (Author: Marc Rivero | Hybrid Analysis)"}],"origin":"YARA Signature","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Ransomware/Banking","identifier":"target-4","type":9,"relevance":10,"name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00062363-00003252)","description_v2":["Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00062363-00003252)"],"description_v3":[{"type":"text","value":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\""},{"type":"process","process_uid":"00062363-00003252","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1107","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"System Destruction","identifier":"target-4","type":9,"relevance":10,"name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00062363-00003252)","description_v2":["Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00062363-00003252)"],"description_v3":[{"type":"text","value":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\""},{"type":"process","process_uid":"00062363-00003252","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1107","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":false,"allow_sample_tampering":false,"network_mode":"default","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":180,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 7","windows_version_edition":"Professional","windows_version_service_pack":"Service Pack 1","windows_version_version":"6.1 (build 7601)","windows_version_bitness":"32","custom_date_time":null,"sandbox_version":"8.30","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[{"name":"Ransomware","details":["Deletes volume snapshots (often used by ransomware)"]},{"name":"Spyware","details":["Deletes volume snapshots (often used by ransomware)"]},{"name":"Persistence","details":["Modifies auto-execute functionality by setting/creating a value in the registry"]},{"name":"Fingerprint","details":["Queries process information","Reads the active computer name"]},{"name":"Evasive","details":["Marks file for deletion"]}],"icon":"$2b","visualization":"$2c","classification":["38.4% (.DLL) Win32 Dynamic Link Library (generic)","26.3% (.EXE) Win32 Executable (generic)","11.8% (.EXE) OS/2 Executable (generic)","11.6% (.EXE) Generic Win/DOS Executable","11.6% (.EXE) DOS Executable Generic"],"dns_requests":[],"contacted_hosts":[],"contacted_countries":{"countries":[],"coordinates":[]},"port_infos":[],"extracted_strings":{"all":[{"value":"ISIjJCUmJygpKissLS4vMDEyM0BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OSsv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJccmFuc29td2FyZS5leGU=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JiZMajY2bFo/P35B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JkxqJjZsWjY/fkE/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LG1JRyVjMWh2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ==","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDAwNjAxMDEuMDAwNjAxMDE=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OUFCQ0RFRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MjA4MUZCNUQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"OzIyZFY6OnRO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PWomJkxaNjZsQT8/fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"P19fXz92P19fXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"P19fX19fPz9fX3EwXz9fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"QEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQD5AQEA/NDU2Nzg5Ojs8PUBAQEBAQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMEQzOC0tMTYxODAzODAyMi00OTEzODg3MjUtODk3MTUxNTE0LTgxMTM2OTUwMi0xNTA2MDQ4NTU3MjE1NTE1MTgyNjE3NzU4NjQ4NTIzNzQzNTQ1","type":"Unicode","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"X18wX19fX19fcV8/","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fX19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YWRtX25fX3JhdDBy","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljb2RlRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YXZhX2xhYmxl","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"YzBtcHV0ZXI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"QzpcY3J5c2lzXFJlbGVhc2VcUERCXHBheWxvYWQucGRi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q0VJUEVuYWJsZQ==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29kZSBwYWdlOiAgICAgIDEyNTE=","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29sdW1uczogICAgICAgIDgw","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIFN0YXJ0dXA=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGF0RGxs","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJOYW1l","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1dESWxsZWdhbEluRExMU2VhcmNo","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGYiIlR+Kio7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUVuZ2luZQ==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUxvY2FsT3ZlcnJpZGU=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVzZXJNb2RlQ2FsbGJhY2tGaWx0ZXI=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVN0cmluZw==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2Vzc2lvbg==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aSggcmdVWXBMZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkFuZFNwaW5Db3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"S2V5Ym9hcmQgZGVsYXk6IDE=","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2V5Ym9hcmQgcmF0ZTogIDMx","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVhdmVDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGlicmFyeVBhdGg=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGluZXM6ICAgICAgICAgIDMwMA==","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGomJmxaNjZ+QT8/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVRocm90dGxpbmc=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW11bUFsbG93ZWRBbGxvY2F0aW9uU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bW9kZSAgY29uIGNwIHNlbGVjdD0xMjUx","type":"Ansi","source":"Process Commandline","process":null,"filename":"mode.com","compromised":null,"detection_total":null,"total":null},{"value":"bW9kZSBjb24gY3Agc2VsZWN0PTEyNTF2c3NhZG1pbiBkZWxldGUgc2hhZG93cyAvYWxsIC9xdWlldEV4aXQ=","type":"Ansi","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TXlwQGN1Pmdr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZVNwYWNlX0NhbGxvdXQ=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV4dF9DYXRhbG9nX0VudHJ5X0lE","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnVtX0NhdGFsb2dfRW50cmllcw==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"byUlSnIuLlwk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T2ZVO1Bdd1tpPGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T09CRUluUHJvZ3Jlc3M=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFja2VkQ2F0YWxvZ0l0ZW0=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJZA==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJPcmRlcg==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJQYXRo","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cmFuc29td2FyZS5leGU=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZU11dGV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlUnBjRGxs","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cmVzMGx2X25n","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZVByb2Nlc3NTZWFyY2hNb2Rl","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VyaWFsX0FjY2Vzc19OdW0=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3Nzc3Nic3Nz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3RhdHVzIGZvciBkZXZpY2UgQ09OOg==","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3lfZW1ldmVuXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU2V0dXBJblByb2dyZXNz","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhlbWVBcGlDb25uZWN0aW9uUmVxdWVzdA==","type":"Unicode","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGhlV19uZDB3cw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dnNzYWRtaW4gIGRlbGV0ZSBzaGFkb3dzIC9hbGwgL3F1aWV0","type":"Ansi","source":"Process Commandline","process":null,"filename":"vssadmin.exe","compromised":null,"detection_total":null,"total":null},{"value":"dnNzYWRtaW4gMS4xIC0gVm9sdW1lIFNoYWRvdyBDb3B5IFNlcnZpY2UgYWRtaW5pc3RyYXRpdmUgY29tbWFuZC1saW5lIHRvb2woQykgQ29weXJpZ2h0IDIwMDEtMjAwNSBNaWNyb3NvZnQgQ29ycC4=","type":"Ansi","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyTnVtSGFuZGxlQnVja2V0cw==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyU3BpbkNvdW50","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1UjPHAkXEw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eCVKbyUuXHIu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eHhKbyUlXHIuLjgk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null}],"interesting":[{"value":"ISIjJCUmJygpKissLS4vMDEyM0BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OSsv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JVdJTkRJUiVcU3lzdGVtMzJccmFuc29td2FyZS5leGU=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"LS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ==","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQD5AQEA/NDU2Nzg5Ojs8PUBAQEBAQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMEQzOC0tMTYxODAzODAyMi00OTEzODg3MjUtODk3MTUxNTE0LTgxMTM2OTUwMi0xNTA2MDQ4NTU3MjE1NTE1MTgyNjE3NzU4NjQ4NTIzNzQzNTQ1","type":"Unicode","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QzpcY3J5c2lzXFJlbGVhc2VcUERCXHBheWxvYWQucGRi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIFN0YXJ0dXA=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGF0RGxs","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJOYW1l","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUxvY2FsT3ZlcnJpZGU=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"S2V5Ym9hcmQgZGVsYXk6IDE=","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2V5Ym9hcmQgcmF0ZTogIDMx","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cmFuc29td2FyZS5leGU=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZU11dGV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlUnBjRGxs","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZVByb2Nlc3NTZWFyY2hNb2Rl","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhlbWVBcGlDb25uZWN0aW9uUmVxdWVzdA==","type":"Unicode","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dnNzYWRtaW4gMS4xIC0gVm9sdW1lIFNoYWRvdyBDb3B5IFNlcnZpY2UgYWRtaW5pc3RyYXRpdmUgY29tbWFuZC1saW5lIHRvb2woQykgQ29weXJpZ2h0IDIwMDEtMjAwNSBNaWNyb3NvZnQgQ29ycC4=","type":"Ansi","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null}],"targets":[{"name":"ransomware.exe.bin","strings":[{"value":"ISIjJCUmJygpKissLS4vMDEyM0BAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3eHl6MDEyMzQ1Njc4OSsv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLiQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JiZMajY2bFo/P35B","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JkxqJjZsWjY/fkE/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LG1JRyVjMWh2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MDEyMzQ1Njc4OUFCQ0RFRg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OzIyZFY6OnRO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PWomJkxaNjZsQT8/fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQD5AQEA/NDU2Nzg5Ojs8PUBAQEBAQEA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QzpcY3J5c2lzXFJlbGVhc2VcUERCXHBheWxvYWQucGRi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGYiIlR+Kio7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aSggcmdVWXBMZXI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbkFuZFNwaW5Db3VudA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGVhdmVDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGomJmxaNjZ+QT8/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TXlwQGN1Pmdr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"byUlSnIuLlwk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T2ZVO1Bdd1tpPGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmVsZWFzZU11dGV4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c3Nzc3Nic3Nz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V1UjPHAkXEw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eCVKbyUuXHIu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eHhKbyUlXHIuLjgk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"ransomware.exe.bin","compromised":null,"detection_total":null,"total":null}]},{"name":"ransomware.exe:3776","strings":[{"value":"JVdJTkRJUiVcU3lzdGVtMzJccmFuc29td2FyZS5leGU=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MDAwNjAxMDEuMDAwNjAxMDE=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljb2RlRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0VJUEVuYWJsZQ==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tbW9uIFN0YXJ0dXA=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGF0RGxs","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJOYW1l","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1dESWxsZWdhbEluRExMU2VhcmNo","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUVuZ2luZQ==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUxvY2FsT3ZlcnJpZGU=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVzZXJNb2RlQ2FsbGJhY2tGaWx0ZXI=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVN0cmluZw==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGlicmFyeVBhdGg=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bW9kZSBjb24gY3Agc2VsZWN0PTEyNTF2c3NhZG1pbiBkZWxldGUgc2hhZG93cyAvYWxsIC9xdWlldEV4aXQ=","type":"Ansi","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmFtZVNwYWNlX0NhbGxvdXQ=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV4dF9DYXRhbG9nX0VudHJ5X0lE","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TnVtX0NhdGFsb2dfRW50cmllcw==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T09CRUluUHJvZ3Jlc3M=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFja2VkQ2F0YWxvZ0l0ZW0=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJZA==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJPcmRlcg==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJQYXRo","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cmFuc29td2FyZS5leGU=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VyaWFsX0FjY2Vzc19OdW0=","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU2V0dXBJblByb2dyZXNz","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyTnVtSGFuZGxlQnVja2V0cw==","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyU3BpbkNvdW50","type":"Unicode","source":"Runtime Data","process":"ransomware.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"mode.com:3152","strings":[{"value":"LS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ==","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXENvbnNvbGVMUEMtMHgwMDAwMEQzOC0tMTYxODAzODAyMi00OTEzODg3MjUtODk3MTUxNTE0LTgxMTM2OTUwMi0xNTA2MDQ4NTU3MjE1NTE1MTgyNjE3NzU4NjQ4NTIzNzQzNTQ1","type":"Unicode","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29kZSBwYWdlOiAgICAgIDEyNTE=","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29sdW1uczogICAgICAgIDgw","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2V5Ym9hcmQgZGVsYXk6IDE=","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S2V5Ym9hcmQgcmF0ZTogIDMx","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGluZXM6ICAgICAgICAgIDMwMA==","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RhdHVzIGZvciBkZXZpY2UgQ09OOg==","type":"Ansi","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhlbWVBcGlDb25uZWN0aW9uUmVxdWVzdA==","type":"Unicode","source":"Runtime Data","process":"mode.com","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"vssadmin.exe:3252","strings":[{"value":"MjA4MUZCNUQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2Vzc2lvbg==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVRocm90dGxpbmc=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW11bUFsbG93ZWRBbGxvY2F0aW9uU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlUnBjRGxs","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZVByb2Nlc3NTZWFyY2hNb2Rl","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dnNzYWRtaW4gMS4xIC0gVm9sdW1lIFNoYWRvdyBDb3B5IFNlcnZpY2UgYWRtaW5pc3RyYXRpdmUgY29tbWFuZC1saW5lIHRvb2woQykgQ29weXJpZ2h0IDIwMDEtMjAwNSBNaWNyb3NvZnQgQ29ycC4=","type":"Ansi","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"screen_0.png","strings":[{"value":"P19fXz92P19fXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"P19fX19fPz9fX3EwXz9fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X18wX19fX19fcV8/","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X19fX19fX19fX18=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"YWRtX25fX3JhdDBy","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"YXZhX2xhYmxl","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"YzBtcHV0ZXI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"cmVzMGx2X25n","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"c3lfZW1ldmVuXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"dGhlV19uZDB3cw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null}]},{"name":"mode.com","strings":[{"value":"bW9kZSAgY29uIGNwIHNlbGVjdD0xMjUx","type":"Ansi","source":"Process Commandline","process":null,"filename":"mode.com","compromised":null,"detection_total":null,"total":null}]},{"name":"vssadmin.exe","strings":[{"value":"dnNzYWRtaW4gIGRlbGV0ZSBzaGFkb3dzIC9hbGwgL3F1aWV0","type":"Ansi","source":"Process Commandline","process":null,"filename":"vssadmin.exe","compromised":null,"detection_total":null,"total":null}]}],"image":[]},"http_requests":[],"ftp_requests":[],"irc_requests":[],"strings_resources":["C:\\crysis\\Release\\PDB\\payload.pdb"],"tags_details":[],"sample_flags":["Multi-Process","User Comment"],"suricata_alerts":[],"version_info":[],"apk_info":null,"apps_info":[{"name":"Access","product":null,"version":null},{"name":"Acrobat Reader","product":"Adobe Acrobat Reader DC","version":"18.11.20038.267465"},{"name":"Chrome","product":null,"version":null},{"name":"Excel","product":"Microsoft Office 2010","version":"14.0.4756.1000"},{"name":"Firefox","product":"Firefox","version":"57.0.1"},{"name":"Flash","product":"Shockwave Flash","version":"27,0,0,187"},{"name":"Hancom Office Hancell","product":"Hancom Office Hancell 2010","version":"8, 5, 8, 1207"},{"name":"Internet Explorer","product":"Internet Explorer","version":"11.00.9600.16428"},{"name":"Java","product":"Java(TM) Platform SE 8","version":"8.0.1510.12"},{"name":"OneNote","product":"Microsoft OneNote","version":"14.0.4763.1000"},{"name":"PowerPoint","product":"Microsoft Office 2010","version":"14.0.4754.1000"},{"name":"Word","product":"Microsoft Office 2010","version":"14.0.4762.1000"}],"architecture":"32 Bit","document":{"author":null,"creator":null,"producer":null,"title":null,"subject":null,"pages":0},"packer":null,"file_imports":[{"module":"KERNEL32.dll","functions":["CloseHandle","EnterCriticalSection","GetLastError","GetProcAddress","InitializeCriticalSectionAndSpinCount","LeaveCriticalSection","LoadLibraryA","ReleaseMutex","WaitForSingleObject"]}],"osint_tags":[],"osint_references":[],"memory_forensics":[],"language":null,"authentihash":"6328ef79059cb3b4b84f0acb58db5b33b820ce8fe6d56ca411498bfb02ed908c","entrypoint_bytes":null,"pdb_timestamp":"2017-03-02T23:49:06+00:00","pdb_pathway":"C:\\crysis\\Release\\PDB\\payload.pdb","pdb_guid":"906D7E2596FC42438EC387236B61A492","file_sections":[{"name":".text","entropy":5.96530622924,"virtual_address":"0x1000","virtual_size":"0x9c25","raw_size":"0x9e00","md5":"fbdfbbcd720021a23c9e78b5511496b0","characteristics":[]},{"name":".rdata","entropy":7.78504061339,"virtual_address":"0xb000","virtual_size":"0x2636","raw_size":"0x2800","md5":"bbeae82a2350eeb7334fa155ebec76d2","characteristics":[]},{"name":".data","entropy":7.98071295242,"virtual_address":"0xe000","virtual_size":"0xaad5","raw_size":"0xa800","md5":"0812c95cdc215f82bbeeee56a0eee20e","characteristics":[]}],"file_exports":[],"error":null,"yara_hits":[],"intelligence_mitre_mappings":[],"entrypoint_preview_count":0,"entrypoint_preview_instructions":[],"file_resources":[],"file_permissions":[],"file_activities":[],"file_receivers":[],"file_data_directories":[],"elf_headers":[],"elf_static_symbols":null,"vba_macros":[],"verdict_source":null,"user_comments":[{"_id":"5e98de1cd8def722f560d935","content":"#Crysis #Dharma *.[jackadams@airmail.cc].abc","user":{"_id":"56c292a9aac2eded787b23c6","name":"safety"},"created_at":"2019-11-21T02:42:36+00:00"}],"email_headers":null,"classification_tags":["dharma"],"tags":["Crysis","dharma"],"submissions":[{"submission_id":"5dd577d5cfe28a634f06dcfd","filename":"adamsCopy.vexe","url":null,"created_at":"2019-11-20T17:28:53+00:00"}],"crowdstrike_ai":{"executable_process_memory_analysis":[],"analysis_related_urls":[]},"warnings":["Enforcing malicious verdict, as a reliable source indicates high confidence","Not all sources for indicator ID \"api-25\" are available in the report"],"report_related_files":{"report_json":{"file_name":"report.json","download_url":"/bff/report/5dd577d5cfe28a634f06dcfe/download/files/report_json","file_size":202710},"memory_strings":{"file_name":"mstrings.zip","download_url":"/bff/report/5dd577d5cfe28a634f06dcfe/download/files/memory_strings","file_size":2173},"certificate":null,"network_pcap":{"file_name":"network.pcap","download_url":"/bff/report/5dd577d5cfe28a634f06dcfe/download/files/network_pcap","file_size":5626},"memory_dumps":null},"system_resource_monitor":{"cpu_usage":[{"x":0,"y":98.6571},{"x":1,"y":96.8019},{"x":2,"y":87.9471},{"x":3,"y":78.125},{"x":4,"y":71.875},{"x":5,"y":64.5639},{"x":6,"y":92.9907},{"x":7,"y":91.1856},{"x":8,"y":94.081},{"x":9,"y":83.7754},{"x":10,"y":68.2031}],"memory_usage":[{"x":0,"y":16.8635},{"x":1,"y":17.0784},{"x":2,"y":17.4286},{"x":3,"y":23.6596},{"x":4,"y":23.3573},{"x":5,"y":23.4675},{"x":6,"y":24.3047},{"x":7,"y":24.0109},{"x":8,"y":24.1025},{"x":9,"y":24.042},{"x":10,"y":23.8404}],"disk_read":[{"x":0,"y":18975700},{"x":1,"y":3642350},{"x":2,"y":15824800},{"x":3,"y":15705200},{"x":4,"y":15092500},{"x":5,"y":9523510},{"x":6,"y":16913500},{"x":7,"y":11515100},{"x":8,"y":19468900},{"x":9,"y":14962100},{"x":10,"y":77495500}],"disk_write":[{"x":0,"y":21971800},{"x":1,"y":15936300},{"x":2,"y":23644600},{"x":3,"y":35111900},{"x":4,"y":33185800},{"x":5,"y":36507300},{"x":6,"y":22763200},{"x":7,"y":24168500},{"x":8,"y":51814100},{"x":9,"y":25138200},{"x":10,"y":154994000}],"network_packets":[{"x":0,"y":12.3369},{"x":1,"y":3.79551},{"x":2,"y":2.96799},{"x":3,"y":18.9787},{"x":4,"y":4.73931},{"x":5,"y":10.3391},{"x":6,"y":22.0425},{"x":7,"y":4.01107},{"x":8,"y":6.47335},{"x":9,"y":3.9178},{"x":10,"y":6.11859}],"page_file":[{"x":0,"y":275005000},{"x":1,"y":273584000},{"x":2,"y":273011000},{"x":3,"y":271757000},{"x":4,"y":265507000},{"x":5,"y":268603000},{"x":6,"y":272867000},{"x":7,"y":265437000},{"x":8,"y":263496000},{"x":9,"y":263430000},{"x":10,"y":262271000}]},"external_reports":null,"available_buttons":{"report_false_positive":true},"hashes_to_context_check":["ded0bf44a335e57387902f0ef102f95eefed714bbcfb2434847c8cd24f222813","17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","efc11f8fcdd0a8649ebee758b105db10536e895ea6d586a07b61f68b1e5dbd20","e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10"]}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Ransom.Crysis — Falcon Sandbox Report — Score 100/100 — Sample ded0bf44a335… | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sandbox report 5dd577d5cfe2…. Malware family: Trojan.Ransom.Crysis. Threat score 100/100. 5 malicious and 12 suspicious behavioral indicators across 33 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ded0bf44a335e57387902f0ef102f95eefed714bbcfb2434847c8cd24f222813/5dd577d5cfe28a634f06dcfe"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Ransom.Crysis — Falcon Sandbox Report — Score 100/100 — Sample ded0bf44a335… | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sandbox report 5dd577d5cfe2…. Malware family: Trojan.Ransom.Crysis. Threat score 100/100. 5 malicious and 12 suspicious behavioral indicators across 33 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ded0bf44a335e57387902f0ef102f95eefed714bbcfb2434847c8cd24f222813/5dd577d5cfe28a634f06dcfe"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Ransom.Crysis — Falcon Sandbox Report — Score 100/100 — Sample ded0bf44a335… | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sandbox report 5dd577d5cfe2…. Malware family: Trojan.Ransom.Crysis. Threat score 100/100. 5 malicious and 12 suspicious behavioral indicators across 33 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]