24:I[10321,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/3xfwong8gg51p.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 95:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ef,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 682f1077421f… — Score 100/100 — Sample 810d4850ee21…","description":"Malicious verdict for sandbox report 682f1077421f…. Threat score 100/100. 13 malicious and 13 suspicious behavioral indicators across 344 signatures. Detonated in Windows 10 64 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c/682f1077421fe9a5d3046379","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c"],"about":{"@type":"SoftwareApplication","name":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c","applicationCategory":"PE32+ executable (GUI) x86-64, for MS Windows, 7 sections","identifier":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c","additionalType":"Malicious sample"},"threatScore":100,"sandboxEnvironment":"Windows 10 64 bit","behavioralIndicators":{"malicious":13,"suspicious":13,"totalSignatures":344},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Td98,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp")26:T6f3,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp")27:T56c,file/memory contains long string with (Indicator: "ConvertFrom-StringData"; File: "AMSI") Found string "Format-Custom" (Indicator: "Format-Custom"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Format-List" (Indicator: "Format-List"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Format-Table" (Indicator: "Format-Table"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Format-Wide" (Indicator: "Format-Wide"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Convert-Path" (Indicator: "Convert-Path"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Export-Alias" (Indicator: "Export-Alias"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Export-Csv" (Indicator: "Export-Csv"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Export-ModuleMember" (Indicator: "Export-ModuleMember"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Export-Console" (Indicator: "Export-Console"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "file, use Export-Console in Windows PowerShell." (Indicator: "Export-Console"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp")28:Tbc4,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp")29:Tcd6,Found reference to "SHA384" (Indicator: "SHA384"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") file/memory contains long string with (Indicator: "HMAC"; File: "edge_history_temp.db") Found reference to "RC2-CBC" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "RC2-64-CBC" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "RC2-40-CBC" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "HMAC routines" (Indicator: "HMAC"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "RC2-ECB" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "RC2-CFB" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "RC2-OFB" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "PBE-SHA1-RC2-64" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "pbeWithSHA1AndRC2-CBC" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "pbeWithSHA1And3-KeyTripleDES-CBC" (Indicator: "TripleDES"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "pbeWithSHA1And2-KeyTripleDES-CBC" (Indicator: "TripleDES"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "PBE-SHA1-RC2-128" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "pbeWithSHA1And128BitRC2-CBC" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "PBE-SHA1-RC2-40" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "pbeWithSHA1And40BitRC2-CBC" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "PBE-MD2-RC2-64" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "pbeWithMD2AndRC2-CBC" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "PBE-MD5-RC2-64" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "pbeWithMD5AndRC2-CBC" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "id-smime-alg-ESDHwithRC2" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "id-smime-alg-RC2wrap" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "id-smime-alg-CMSRC2wrap" (Indicator: "RC2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to "RSA-SHA384" (Indicator: "SHA384"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c")2a:Tae8,Found string "powershell -Command "Compress-Archive -Path '" (File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c"), Found string "%WINDIR%\system32\cmd.exe /c powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -Destin" (Source: "00000000-00005044-00000C46-115678154006"), Found string "powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -DestinationPath 'C:\Users\9ZUGU2u\Ap" (Source: "00000000-00002124-00000C46-2145653981"), Found string "%ALLUSERSPROFILE%\Oracle\Java\javapath\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18067102196"), Found string "%WINDIR%\system32\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18067896614"), Found string "%WINDIR%\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18068913663"), Found string "%WINDIR%\System32\Wbem\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18069482699"), Found string "%WINDIR%\System32\WindowsPowerShell\v1.0\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18070263797"), Found string "%LOCALAPPDATA%\Programs\Python\Python311\Scripts\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18071291077"), Found string "%LOCALAPPDATA%\Programs\Python\Python311\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18072149549"), Found string "%LOCALAPPDATA%\Microsoft\WindowsApps\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18072942545"), Found string "%PROGRAMFILES%\mitmproxy\bin\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18073509013"), Found string "Compress-Archive -Path 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime\*' -DestinationPath 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime.zip' -Force" (File: "AMSI"), Found string "/c powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -DestinationPath '%TEMP%\runtime.zip' -Force"" (File: "cmd.exe"), Found string "powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -DestinationPath '%TEMP%\runtime.zip' -Force"" (File: "powershell.exe"), Found string "powershell -Command "Compress-Archive -Path '" (Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "powershell -Command "Compress-Archive -Path 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime\*' -DestinationPath 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime.zip' -Force"" (Source: "00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp") Found string "Compress-Archive -Path 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime\*' -DestinationPath 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime.zip' -Force" (Source: "00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp, 00000000-00006864.00000000.115762.5B460000.00000004.mdmp, 00000000-00006864.00000000.115762.5CB00000.00000004.mdmp, 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp")2b:T857,Found string "powershell -Command "Compress-Archive -Path '" (File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c"), Found string "%WINDIR%\system32\cmd.exe /c powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -Destin" (Source: "00000000-00005044-00000C46-115678154006"), Found string "powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -DestinationPath 'C:\Users\9ZUGU2u\Ap" (Source: "00000000-00002124-00000C46-2145653981"), Found string "%ALLUSERSPROFILE%\Oracle\Java\javapath\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18067102196"), Found string "%WINDIR%\system32\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18067896614"), Found string "%WINDIR%\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18068913663"), Found string "%WINDIR%\System32\Wbem\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18069482699"), Found string "%WINDIR%\System32\WindowsPowerShell\v1.0\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18070263797"), Found string "%LOCALAPPDATA%\Programs\Python\Python311\Scripts\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18071291077"), Found string "%LOCALAPPDATA%\Programs\Python\Python311\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18072149549"), Found string "%LOCALAPPDATA%\Microsoft\WindowsApps\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18072942545"), Found string "%PROGRAMFILES%\mitmproxy\bin\Compress-Archive.*" (Source: "00000000-00006864-00000C2D-18073509013"), Found string "Compress-Archive -Path 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime\*' -DestinationPath 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime.zip' -Force" (File: "AMSI"), Found string "/c powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -DestinationPath '%TEMP%\runtime.zip' -Force"" (File: "cmd.exe"), Found string "powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -DestinationPath '%TEMP%\runtime.zip' -Force"" (File: "powershell.exe"), Found string "powershell -Command "Compress-Archive -Path '" (Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp")2c:T1feb,Assembly shows XOR instruction xor byte ptr [rcx] bl in Stream UID: 11021-3090-000000014051C0C0 Assembly shows XOR instruction xor byte ptr [rax] al in Stream UID: 11021-3090-000000014051C0C0 Assembly shows XOR instruction xor al 2Ch in Stream UID: 11021-4879-00000001404E1AE0 Assembly shows XOR instruction xor dword ptr [rbx] 56h in Stream UID: 11021-6122-00000001404BDD08 Assembly shows XOR instruction xor al 2Fh in Stream UID: 11021-6654-00000001404995C0 Assembly shows XOR instruction xor r13d dword ptr [r8] in Stream UID: 11021-6654-00000001404995C0 Assembly shows XOR instruction xor ebp dword ptr [rax] in Stream UID: 11021-6654-00000001404995C0 Assembly shows XOR instruction xor al 2Fh in Stream UID: 11021-6664-00000001404992C0 Assembly shows XOR instruction xor r13d dword ptr [r8] in Stream UID: 11021-6664-00000001404992C0 Assembly shows XOR instruction xor ebp dword ptr [rax] in Stream UID: 11021-6664-00000001404992C0 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8335-000000014041EF60 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8335-000000014041EF60 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8335-000000014041EF60 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8335-000000014041EF60 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8393-0000000140417FE0 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8393-0000000140417FE0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8393-0000000140417FE0 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8393-0000000140417FE0 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8395-00000001403BF160 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8395-00000001403BF160 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8395-00000001403BF160 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8395-00000001403BF160 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8397-0000000140417460 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8397-0000000140417460 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8397-0000000140417460 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8397-0000000140417460 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8398-00000001403BE1C0 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8398-00000001403BE1C0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8398-00000001403BE1C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8398-00000001403BE1C0 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8403-0000000140417890 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8403-0000000140417890 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8403-0000000140417890 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8403-0000000140417890 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8533-00000001403FDA70 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8533-00000001403FDA70 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8533-00000001403FDA70 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8533-00000001403FDA70 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8540-00000001403FCC60 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8540-00000001403FCC60 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8540-00000001403FCC60 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8540-00000001403FCC60 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8550-00000001403FC5F0 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8550-00000001403FC5F0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8550-00000001403FC5F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8550-00000001403FC5F0 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8558-00000001403FC150 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8558-00000001403FC150 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8558-00000001403FC150 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8558-00000001403FC150 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8607-000000014041DFB0 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8607-000000014041DFB0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8607-000000014041DFB0 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8607-000000014041DFB0 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8625-00000001403EFC60 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8625-00000001403EFC60 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8625-00000001403EFC60 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8625-00000001403EFC60 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8628-00000001403EFF70 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8628-00000001403EFF70 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8628-00000001403EFF70 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8628-00000001403EFF70 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8641-00000001403EEE50 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8641-00000001403EEE50 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8641-00000001403EEE50 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8641-00000001403EEE50 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8649-00000001403ECF40 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8649-00000001403ECF40 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8649-00000001403ECF40 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8649-00000001403ECF40 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8740-00000001403E0850 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8740-00000001403E0850 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8740-00000001403E0850 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8740-00000001403E0850 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8809-0000000140410A40 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8809-0000000140410A40 Assembly shows XOR instruction xor edx eax in Stream UID: 11021-8809-0000000140410A40 Assembly shows XOR instruction xor eax edi in Stream UID: 11021-8809-0000000140410A40 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8809-0000000140410A40 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8809-0000000140410A40 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8819-00000001403D3830 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8819-00000001403D3830 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8819-00000001403D3830 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8819-00000001403D3830 Assembly shows XOR instruction xor rax rsp in Stream UID: 11021-8831-00000001403CE540 Assembly shows XOR instruction xor eax esp in Stream UID: 11021-8831-00000001403CE540 Assembly shows XOR instruction xor rcx rsp in Stream UID: 11021-8831-00000001403CE540 Assembly shows XOR instruction xor ecx esp in Stream UID: 11021-8831-00000001403CE540 Assembly shows XOR instruction xor rax rbp in Stream UID: 11021-9689-00000001402FD2F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 11021-9689-00000001402FD2F0 Assembly shows XOR instruction xor rcx rbp in Stream UID: 11021-9689-00000001402FD2F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 11021-9689-00000001402FD2F02d:Tf33,Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptExportKey" (Indicator: "CryptExportKey"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptHashData" (Indicator: "CryptHashData"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptEncrypt" (Indicator: "CryptEncrypt"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptGetUserKey" (Indicator: "CryptGetUserKey"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptGetProvParam" (Indicator: "CryptGetProvParam"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptImportKey" (Indicator: "CryptImportKey"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptSignHashW" (Indicator: "CryptSignHash"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptGetHashParam" (Indicator: "CryptGetHashParam"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptEnumProvidersW" (Indicator: "CryptEnumProviders"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CertGetNameStringW" (Indicator: "CertGetNameString"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CertOpenSystemStoreW" (Indicator: "CertOpenSystemStore"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptDecodeObjectEx" (Indicator: "CryptDecodeObject"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "schannel: CryptDecodeObjectEx() returned no alternate name information." (Indicator: "CryptDecodeObject"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "schannel: CertGetNameString() returned no certificate name information" (Indicator: "CertGetNameString"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c")2e:Te25,Found string "(TEST_ENG_OPENSSL_PKEY)Loading Private key %s" (Indicator: "private key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "invalid dsa public key blob magic number" (Indicator: "public key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "invalid public key blob" (Indicator: "public key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "invalid rsa public key blob magic number" (Indicator: "public key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "unsupported public key algorithm" (Indicator: "public key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Set list options (1=summary,2=friendly name, 4=full printout, 8=PEM output, 16=XXX, 32=private key info)" (Indicator: "private key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "No Private Key" (Indicator: "private key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Private Key Info:" (Indicator: "private key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "X509v3 Private Key Usage Period" (Indicator: "private key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "X509v3 Subject Alternative Public Key Info" (Indicator: "public key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "ANY PRIVATE KEY" (Indicator: "private key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "PUBLIC KEY" (Indicator: "public key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "PRIVATE KEY" (Indicator: "private key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "ENCRYPTED PRIVATE KEY" (Indicator: "private key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Public Key" (Indicator: "public key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Subject Public Key Info:" (Indicator: "public key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "%12sPublic Key Algorithm:" (Indicator: "public key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "%12sUnable to load Public Key" (Indicator: "public key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "unknown public key type" (Indicator: "public key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "unsupported public key type" (Indicator: "public key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "wrong public key type" (Indicator: "public key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "private key too large" (Indicator: "private key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "failed making public key" (Indicator: "public key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "invalid private key" (Indicator: "private key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "missing private key" (Indicator: "private key"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c")2f:T647,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to use AES encryption instructions Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: Imports crypto-related APIs Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Contains key cryptographic functions of the CryptoAPI Matched sigs: YARA signature match - AES encryption30:T784,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp")31:Tabe,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000080edf2b73d00000000000000000000000000000000000000b8ecf2b73d0000000000000000000000000000000000000070fb1071fc7f00000900000009000000000000000000000019553f55fc7f00000000000000000000180000003d00000028eef2b73d000000704609b02402000020eef2b73d000000f0edf2b73d000000f5408860fc7f000080001040000000009c00009c0000000000000000000000009c00009c000000000000000000000000000000000000000000000000000000000100000000000000010000000000000020eef2b73d000000f0edf2b73d00000038eef2b73d000000707f55d51ac100003c711e6783f4000001000000 (UID: 00000000-00005044)32:T443,Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp")33:T6f5,Found string "SET NULL" (Indicator: "set "; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "SET DEFAULT" (Indicator: "set "; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "set list" (Indicator: "set "; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Set CSP by index" (Indicator: "set "; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Set CSP name, (default CSP used if not specified)" (Indicator: "set "; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Set CSP type, (default RSA_PROV_FULL)" (Indicator: "set "; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Set list options (1=summary,2=friendly name, 4=full printout, 8=PEM output, 16=XXX, 32=private key info)" (Indicator: "set "; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Set key lookup method (1=substring, 2=friendlyname, 3=container name)" (Indicator: "set "; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "set default property failure" (Indicator: "set "; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "set filename failed" (Indicator: "set "; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "set filter for listen socket fd=%qd ip=%s:%d" (Indicator: "set "; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "set timeouts for state %d; Total % lld, retry %d maxtry %d" (Indicator: "set "; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c")34:T5bd,Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp")35:T4c5,Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "RtlNtStatusToDosError" (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp")36:T443,Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetSystemTime" (Indicator: "GetSystemTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetSystemTimePreciseAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTime"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp")37:Tb0a,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp")38:T1323,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\runtime.zip" at 00000000-00005044-00000C17-823987253 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002116-00000C17-804774347 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002116-00000C17-805852020 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00002116-00000C17-805878737 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00002116-00000C17-806365352 "powershell.exe" queries volume information of "C:\" at 00000000-00002116-00000C17-806779899 "powershell.exe" queries volume information of "C:\share" at 00000000-00002116-00000C17-806781616 "powershell.exe" queries volume information of "C:\share" at 00000000-00002116-00000C17-806874925 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00002116-00000C17-807778711 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006864-00000C17-816194195 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006864-00000C17-817267023 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00006864-00000C17-817272879 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00006864-00000C17-817781802 "powershell.exe" queries volume information of "C:\" at 00000000-00006864-00000C17-818290822 "powershell.exe" queries volume information of "C:\share" at 00000000-00006864-00000C17-818292671 "powershell.exe" queries volume information of "C:\share" at 00000000-00006864-00000C17-818395166 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006864-00000C17-819303475 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006864-00000C17-819420618 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006864-00000C17-819474835 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006864-00000C17-819546993 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006864-00000C17-819736887 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006864-00000C17-819806280 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006864-00000C17-819897614 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006864-00000C17-820043527 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00006864-00000C17-82015859339:Ta03,"powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")3a:T50b,"powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "powershell.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")3b:T558,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CopyFileA" to copy C:\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe to new location %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\default\Login Data to new location chrome_Data.db (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\default\Login Data to new location edge_Data.db (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Google\Chrome\User Data\Default\History to new location chrome_history_temp.db (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CopyFileW" to copy %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\History to new location edge_history_temp.db (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CopyFileW" to copy %APPDATA%\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite to new location firefox_profile_temp.db (UID: 00000000-00005044)3c:T75f,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateDirectoryW" with parameter C:\Users\9ZUGU2u (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateDirectoryW" with parameter %TEMP%\runtime (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateDirectoryW" with parameter %TEMP%\runtime\passwords (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateDirectoryW" with parameter %TEMP%\Runtime (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateDirectoryW" with parameter %TEMP%\Runtime\history (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateDirectoryW" with parameter %TEMP%\runtime\clipboard (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateDirectoryA" with parameter %TEMP%\Runtime (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateDirectoryA" with parameter %TEMP%\Runtime\pic (UID: 00000000-00005044)3d:Tb5e,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c wmic diskdrive get model,serialnumber" - (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c wmic path Win32_Keyboard get Description,DeviceID" - (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID" - (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID" - (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c wmic get name" - (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c powershell -command "(Get-ItemProperty 'HKCU:\Control Panel\Desktop').Wallpaper"" - (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateProcessW" with parameter "%WINDIR%\system32\cmd.exe /c powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -Destin" - (UID: 00000000-00005044), "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "CreateProcessW" with parameter ""C:\util.bat"" - (UID: 00000000-00005044), "cmd.exe" called "CreateProcessW" with parameter "wmic diskdrive get model serialnumber" - (UID: 00000000-00007612), "cmd.exe" called "CreateProcessW" with parameter "wmic path Win32_Keyboard get Description DeviceID" - (UID: 00000000-00002092), "cmd.exe" called "CreateProcessW" with parameter "wmic path Win32_PointingDevice get Description PNPDeviceID" - (UID: 00000000-00004448), "cmd.exe" called "CreateProcessW" with parameter "wmic path Win32_PointingDevice get Description PNPDeviceID" - (UID: 00000000-00003012), "cmd.exe" called "CreateProcessW" with parameter "wmic path Win32_DesktopMonitor get Description PNPDeviceID" - (UID: 00000000-00007884), "cmd.exe" called "CreateProcessW" with parameter "wmic get name" - (UID: 00000000-00002920), "cmd.exe" called "CreateProcessW" with parameter "powershell -command "(Get-ItemProperty 'HKCU:\Control Panel\Desktop').Wallpaper"" - (UID: 00000000-00007200), "cmd.exe" called "CreateProcessW" with parameter "powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -DestinationPath 'C:\Users\9ZUGU2u\Ap" - (UID: 00000000-00002124) "cmd.exe" called "CreateProcessW" with parameter "timeout /t 2 /nobreak" - (UID: 00000000-00008036)3e:T84ad,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005044) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007612) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007612) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007612) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007612) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007984) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007984) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007984) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007984) "WMIC.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00007984) "WMIC.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00007984) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002092) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002092) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002092) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002092) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004104) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004104) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004104) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004104) "WMIC.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004104) "WMIC.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004104) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004448) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004448) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004448) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004448) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004276) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004276) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004276) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004276) "WMIC.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004276) "WMIC.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00004276) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003012) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003012) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003012) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003012) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000796) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000796) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000796) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000796) "WMIC.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00000796) "WMIC.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00000796) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007884) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007884) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007884) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007884) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005688) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005688) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005688) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005688) "WMIC.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005688) "WMIC.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005688) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002920) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002920) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002920) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002920) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007968) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007968) "WMIC.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007968) "WMIC.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007968) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007200) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007200) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007200) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007200) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00002116) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00002116) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002124) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002124) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002124) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002124) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.IO.Cb3b124c8#\1e72628c6f64bbea2f27e20f9f2cf3b4\System.IO.Compression.ni.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.IO.Cf61e09c5#\fa3056c0895561a08f7cf15a33efbbbd\System.IO.Compression.FileSys (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrcompression.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006864) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006864) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008036) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008036) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008036) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008036)3f:T1fc6,"SELECT*FROM"%w".%s WHERE %s ORDER BY rowid" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select*from"%w".%s where %s order by rowid") "SELECT 1 FROM "%w".sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, %d, %Q, %d)=NULL" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select 1 from "%w".sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, %d, %q, %d)=null"), "SELECT 1 FROM temp.sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, 1, %Q, %d)=NULL" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select 1 from temp.sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, 1, %q, %d)=null"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_quotefix(%Q, sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_quotefix(%q, sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_quotefix('temp', sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update temp.sqlite_master set sql = sqlite_rename_quotefix('temp', sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, %d) WHERE (type!='index' OR tbl_name=%Q COLLATE nocase)AND name NOT LIKE 'sqliteX_%%' ESCAPE 'X'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, %d) where (type!='index' or tbl_name=%q collate nocase)and name not like 'sqlitex_%%' escape 'x'"), "UPDATE %Q.sqlite_master SET tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update %q.sqlite_master set tbl_name = %q name = case when type='table' then %q when name like 'sqlitex_autoindex%%' escape 'x' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q collate nocase and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_sequence set name = %q where name = %q"), "UPDATE sqlite_temp_schema SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, 1) tbl_name = CASE WHEN tbl_name=%Q COLLATE nocase AND sqlite_rename_test(%Q, sql, type, name, 1, 'after rename', 0) THEN %Q ELSE tbl_name END WHERE type IN ('view', 'trigger')" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update sqlite_temp_schema set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, 1) tbl_name = case when tbl_name=%q collate nocase and sqlite_rename_test(%q, sql, type, name, 1, 'after rename', 0) then %q else tbl_name end where type in ('view', 'trigger')"), "SELECT raise(ABORT,%Q) FROM "%w"."%w"" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select raise(abort,%q) from "%w"."%w""), "UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = printf('%%.%ds, ',sql) || %q || substr(sql,1+length(printf('%%.%ds',sql))) where type = 'table' and name = %q"), "SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*' OR quick_check GLOB 'non-* value in*'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select case when quick_check glob 'check*' then raise(abort,'check constraint failed') when quick_check glob 'non-* value in*' then raise(abort,'type mismatch on default') else raise(abort,'not null constraint failed') end from pragma_quick_check(%q,%q) where quick_check glob 'check*' or quick_check glob 'null*' or quick_check glob 'non-* value in*'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, %d) WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND (type != 'index' OR tbl_name = %Q)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, %d) where name not like 'sqlitex_%%' escape 'x' and (type != 'index' or tbl_name = %q)"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, 1) WHERE type IN ('trigger', 'view')" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update temp.sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, 1) where type in ('trigger', 'view')"), "UPDATE "%w".sqlite_master SET sql = sqlite_drop_column(%d, sql, %d) WHERE (type=='table' AND tbl_name=%Q COLLATE nocase)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_drop_column(%d, sql, %d) where (type=='table' and tbl_name=%q collate nocase)"), "CREATE TABLE %Q.%s(%s)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "create table %q.%s(%s)"), "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "delete from %q.%s where %s=%q"), "SELECT tbl idx stat FROM %Q.sqlite_stat1" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select tbl idx stat from %q.sqlite_stat1"), "CREATE TABLE" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "create table"), "UPDATE %Q.sqlite_master SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update %q.sqlite_master set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "CREATE TABLE %Q.sqlite_sequence(name,seq)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "create table %q.sqlite_sequence(name,seq)"), "SELECT*FROM"%w"."%w"" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select*from"%w"."%w""), "UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d"), "DELETE FROM %Q.sqlite_sequence WHERE name=%Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "delete from %q.sqlite_sequence where name=%q"), "DELETE FROM %Q.sqlite_master WHERE tbl_name=%Q and type!='trigger'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "delete from %q.sqlite_master where tbl_name=%q and type!='trigger'")40:T870,"SELECT 1 FROM "%w".sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, %d, %Q, %d)=NULL" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select 1 from "%w".sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, %d, %q, %d)=null"), "SELECT 1 FROM temp.sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, 1, %Q, %d)=NULL" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select 1 from temp.sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, 1, %q, %d)=null"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_quotefix(%Q, sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_quotefix(%q, sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_quotefix('temp', sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update temp.sqlite_master set sql = sqlite_rename_quotefix('temp', sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, %d) WHERE (type!='index' OR tbl_name=%Q COLLATE nocase)AND name NOT LIKE 'sqliteX_%%' ESCAPE 'X'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, %d) where (type!='index' or tbl_name=%q collate nocase)and name not like 'sqlitex_%%' escape 'x'"), "UPDATE %Q.sqlite_master SET tbl_name = %Q41:Tb9e,tbl_name = case when tbl_name=%q collate nocase and sqlite_rename_test(%q, sql, type, name, 1, 'after rename', 0) then %q else tbl_name end where type in ('view', 'trigger')"), "SELECT raise(ABORT,%Q) FROM "%w"."%w"" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select raise(abort,%q) from "%w"."%w""), "UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = printf('%%.%ds, ',sql) || %q || substr(sql,1+length(printf('%%.%ds',sql))) where type = 'table' and name = %q"), "SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*' OR quick_check GLOB 'non-* value in*'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select case when quick_check glob 'check*' then raise(abort,'check constraint failed') when quick_check glob 'non-* value in*' then raise(abort,'type mismatch on default') else raise(abort,'not null constraint failed') end from pragma_quick_check(%q,%q) where quick_check glob 'check*' or quick_check glob 'null*' or quick_check glob 'non-* value in*'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, %d) WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND (type != 'index' OR tbl_name = %Q)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, %d) where name not like 'sqlitex_%%' escape 'x' and (type != 'index' or tbl_name = %q)"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, 1) WHERE type IN ('trigger', 'view')" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update temp.sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, 1) where type in ('trigger', 'view')"), "UPDATE "%w".sqlite_master SET sql = sqlite_drop_column(%d, sql, %d) WHERE (type=='table' AND tbl_name=%Q COLLATE nocase)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_drop_column(%d, sql, %d) where (type=='table' and tbl_name=%q collate nocase)"), "CREATE TABLE %Q.%s(%s)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "create table %q.%s(%s)"), "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "delete from %q.%s where %s=%q"), "SELECT tbl42:T870,"SELECT 1 FROM "%w".sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, %d, %Q, %d)=NULL" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select 1 from "%w".sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, %d, %q, %d)=null"), "SELECT 1 FROM temp.sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, 1, %Q, %d)=NULL" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select 1 from temp.sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, 1, %q, %d)=null"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_quotefix(%Q, sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_quotefix(%q, sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_quotefix('temp', sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update temp.sqlite_master set sql = sqlite_rename_quotefix('temp', sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, %d) WHERE (type!='index' OR tbl_name=%Q COLLATE nocase)AND name NOT LIKE 'sqliteX_%%' ESCAPE 'X'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, %d) where (type!='index' or tbl_name=%q collate nocase)and name not like 'sqlitex_%%' escape 'x'"), "UPDATE %Q.sqlite_master SET tbl_name = %Q43:Tb9e,tbl_name = case when tbl_name=%q collate nocase and sqlite_rename_test(%q, sql, type, name, 1, 'after rename', 0) then %q else tbl_name end where type in ('view', 'trigger')"), "SELECT raise(ABORT,%Q) FROM "%w"."%w"" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select raise(abort,%q) from "%w"."%w""), "UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = printf('%%.%ds, ',sql) || %q || substr(sql,1+length(printf('%%.%ds',sql))) where type = 'table' and name = %q"), "SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*' OR quick_check GLOB 'non-* value in*'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select case when quick_check glob 'check*' then raise(abort,'check constraint failed') when quick_check glob 'non-* value in*' then raise(abort,'type mismatch on default') else raise(abort,'not null constraint failed') end from pragma_quick_check(%q,%q) where quick_check glob 'check*' or quick_check glob 'null*' or quick_check glob 'non-* value in*'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, %d) WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND (type != 'index' OR tbl_name = %Q)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, %d) where name not like 'sqlitex_%%' escape 'x' and (type != 'index' or tbl_name = %q)"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, 1) WHERE type IN ('trigger', 'view')" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update temp.sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, 1) where type in ('trigger', 'view')"), "UPDATE "%w".sqlite_master SET sql = sqlite_drop_column(%d, sql, %d) WHERE (type=='table' AND tbl_name=%Q COLLATE nocase)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_drop_column(%d, sql, %d) where (type=='table' and tbl_name=%q collate nocase)"), "CREATE TABLE %Q.%s(%s)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "create table %q.%s(%s)"), "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "delete from %q.%s where %s=%q"), "SELECT tbl44:T820,Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") file/memory contains long string with (Indicator: "CreateFile"; File: "AMSI") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp")45:T15967,Found reference to API (Indicator: "RegCloseKey"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptDecrypt"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptCreateHash"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptSetHashParam"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "ReportEventW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptExportKey"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptHashData"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptAcquireContextW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "RegSetValueExW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptGenRandom"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptEncrypt"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptGetUserKey"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "RegisterEventSourceW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptGetProvParam"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptImportKey"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptReleaseContext"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptSignHashW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptGetHashParam"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "RegCreateKeyExW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptEnumProvidersW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptDestroyKey"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "DeregisterEventSource"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptDestroyHash"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CertOpenStore"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CertAddCertificateContextToStore"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CertFreeCertificateChainEngine"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CertGetNameStringW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CertGetCertificateContextProperty"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "PFXImportCertStore"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptStringToBinaryW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CertGetCertificateChain"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CertOpenSystemStoreW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptDecodeObjectEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptQueryObject"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptUnprotectData"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CertFindCertificateInStore"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CertCreateCertificateChainEngine"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CertFreeCertificateChain"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CertCloseStore"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CertFindExtension"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CertDuplicateCertificateContext"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "BitBlt"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreateCompatibleDC"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "DeleteDC"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SelectObject"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "DeleteObject"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetProcessHeap"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "LCMapStringEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "UnlockFile"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "HeapValidate"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "LoadLibraryA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FindNextFileW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "TlsSetValue"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "OpenProcess"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetCommandLineA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetFileSizeEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetSystemTime"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FlsSetValue"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FindClose"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "TlsAlloc"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SetLastError"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetStartupInfoW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "HeapCreate"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetFileSize"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "DeleteFileW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "InitializeSListHead"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "MapViewOfFile"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "ReleaseSRWLockShared"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetModuleHandleW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetStdHandle"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "IsValidLocale"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "LocalFree"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetDateFormatW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "VerSetConditionMask"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "Process32NextW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreateProcessW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "HeapSize"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetLocaleInfoW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "OutputDebugStringA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SetConsoleMode"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "AreFileApisANSI"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "PeekNamedPipe"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CloseHandle"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetLastError"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "LoadLibraryExW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreateDirectoryA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "MultiByteToWideChar"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "InitializeSRWLock"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetTempPathW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetCurrentProcess"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FindFirstFileExW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetFileAttributesExW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CopyFileA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetModuleFileNameA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "Sleep"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "RaiseException"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "MoveFileExW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FlsFree"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "DeleteCriticalSection"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FlushFileBuffers"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetTempPathA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "Process32FirstW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "ReadConsoleA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetExitCodeThread"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "ReadFile"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "IsDebuggerPresent"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "ReleaseSemaphore"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SetFilePointer"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FindFirstFileW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetCPInfo"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "HeapFree"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetFileAttributesW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "ExitProcess"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CompareStringW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "DecodePointer"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GlobalLock"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "WideCharToMultiByte"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "TerminateProcess"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "InitializeCriticalSection"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "LeaveCriticalSection"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "LoadLibraryW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "LCMapStringW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FlsAlloc"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "HeapDestroy"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "DuplicateHandle"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FormatMessageW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "HeapReAlloc"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "EncodePointer"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "HeapCompact"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FormatMessageA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "ReadConsoleW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "WaitForSingleObject"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreateDirectoryW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FlsGetValue"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "VirtualProtect"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SetEndOfFile"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreateThread"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetFullPathNameW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "RtlCaptureContext"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetProcAddress"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetModuleFileNameW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetSystemInfo"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "HeapAlloc"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "EnterCriticalSection"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "LockFile"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "DeleteFileA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreateFileMappingW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetCurrentProcessId"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreateMutexW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetTimeFormatW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "IsValidCodePage"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetDriveTypeW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreateSemaphoreA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "OutputDebugStringW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetCurrentThreadId"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SetStdHandle"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetFileInformationByHandleEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreateFileW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CompareStringEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetFileAttributesA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "AcquireSRWLockShared"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetTickCount"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "WriteFile"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetStringTypeW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreatePipe"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CopyFileW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SleepEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "WriteConsoleW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetFullPathNameA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreateFileA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetExitCodeProcess"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetDiskFreeSpaceA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetModuleHandleA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetCommandLineW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "TlsGetValue"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FlushViewOfFile"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetACP"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetModuleHandleExW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "TlsFree"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "UnlockFileEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "RtlUnwind"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "UnmapViewOfFile"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetConsoleMode"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "LockFileEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetOEMCP"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SetFilePointerEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "VirtualFree"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetFileType"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FreeLibrary"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GlobalUnlock"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "ExitThread"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "ShellExecuteA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SHGetFolderPathA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "SHGetSpecialFolderPathA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetClipboardData"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "OpenClipboard"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "ReleaseDC"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "MessageBoxW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CloseClipboard"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetDC"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetSystemMetrics"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetProcessWindowStation"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "inet_addr"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "gethostbyname"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "WSASetLastError"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "getpeername"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "ntohs"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "getsockopt"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "gethostname"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "WSAStartup"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "getservbyname"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "getsockname"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "gethostbyaddr"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "WSAGetLastError"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "ioctlsocket"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "__WSAFDIsSet"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "WSACleanup"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "htonl"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "closesocket"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "recvfrom"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "WSAIoctl"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "getservbyport"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "htons"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "inet_ntoa"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "BCryptGenRandom"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CharLowerW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CharUpperW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreateFileMappingA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetVersionExA"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetVersionExW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreateEventExW"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CreateFile2"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetTickCount64"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "UuidCreate"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "UuidCreateSequential"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "Module32First"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "Module32Next"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "AddDllDirectory"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "RtlVerifyVersionInfo"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "InitializeSecurityContext"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "QueryContextAttributes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "EncryptMessage"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "DecryptMessage"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetDateFormatEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetTimeFormatEx"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "IsValidLocaleName"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "LCIDToLocaleName"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "LocaleNameToLCID"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "HeapCompact"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "UnlockFileEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreateFile2"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "UuidCreateSequential"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "Module32First"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "Module32Next"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "RtlVerifyVersionInfo"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "AcquireCredentialsHandle"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityContext"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "QueryContextAttributes"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "EncryptMessage"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "DecryptMessage"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeThread"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyKey"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptSetHashParam"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptGetProvParam"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptGetUserKey"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptSignHashW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptEnumProvidersW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderPathA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CertGetCertificateContextProperty"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptStringToBinaryW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "PFXImportCertStore"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptDecodeObjectEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CertFindExtension"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CertGetNameStringW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptQueryObject"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CertCreateCertificateChainEngine"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateChainEngine"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CertGetCertificateChain"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateChain"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00006864.00000000.115762.B822A000.00000002.mdmp")46:T10f8,Found string "%WINDIR%\system32\cmd.exe /c wmic diskdrive get model,serialnumber" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005044-00000C46-2412053458") Found string "%WINDIR%\system32\cmd.exe /c wmic diskdrive get model,serialnumber" (Indicator: "cmd.exe /c"; Source: "00000000-00005044-00000C46-2412053458") Found string "%WINDIR%\system32\cmd.exe /c wmic path Win32_Keyboard get Description,DeviceID" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005044-00000C46-16681831658") Found string "%WINDIR%\system32\cmd.exe /c wmic path Win32_Keyboard get Description,DeviceID" (Indicator: "cmd.exe /c"; Source: "00000000-00005044-00000C46-16681831658") Found string "%WINDIR%\system32\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005044-00000C46-31025008696") Found string "%WINDIR%\system32\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID" (Indicator: "cmd.exe /c"; Source: "00000000-00005044-00000C46-31025008696") Found string "%WINDIR%\system32\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005044-00000C46-59868927018") Found string "%WINDIR%\system32\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (Indicator: "cmd.exe /c"; Source: "00000000-00005044-00000C46-59868927018") Found string "%WINDIR%\system32\cmd.exe /c wmic get name" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005044-00000C46-74155484504") Found string "%WINDIR%\system32\cmd.exe /c wmic get name" (Indicator: "cmd.exe /c"; Source: "00000000-00005044-00000C46-74155484504") Found string "%WINDIR%\system32\cmd.exe /c powershell -command "(Get-ItemProperty 'HKCU:\Control Panel\Desktop').Wallpaper"" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005044-00000C46-88337136890") Found string "%WINDIR%\system32\cmd.exe /c powershell -command "(Get-ItemProperty 'HKCU:\Control Panel\Desktop').Wallpaper"" (Indicator: "cmd.exe /c"; Source: "00000000-00005044-00000C46-88337136890") Found string "%WINDIR%\system32\cmd.exe /c powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -Destin" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005044-00000C46-115678154006"), Found string "%WINDIR%\system32\cmd.exe /c powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -Destin" (Indicator: "cmd.exe /c"; Source: "00000000-00005044-00000C46-115678154006") Found string "C:\WINDOWS\system32\cmd.exe /c wmic diskdrive get model,serialnumber" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp") Found string "C:\WINDOWS\system32\cmd.exe /c wmic diskdrive get model,serialnumber" (Indicator: "cmd.exe /c"; Source: "00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp") Found string ":\WINDOWS\system32\cmd.exe /c wmic get name" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found string ":\WINDOWS\system32\cmd.exe /c wmic get name" (Indicator: "cmd.exe /c"; Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found string "C:\WINDOWS\system32\cmd.exe /c wmic get name" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found string "C:\WINDOWS\system32\cmd.exe /c wmic get name" (Indicator: "cmd.exe /c"; Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found string "C:\WINDOWS\system32\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found string "C:\WINDOWS\system32\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID" (Indicator: "cmd.exe /c"; Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found string "C:\WINDOWS\system32\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found string "C:\WINDOWS\system32\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (Indicator: "cmd.exe /c"; Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp")47:T4c8,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "WSASetLastError" (Indicator: "SetLastError"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp")48:T1050,"Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00002116.00000000.115026.14E70000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00002116.00000000.115026.14E70000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00002116.00000000.115026.17190000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp "System\CurrentControlSet\Control\MiniNT" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp "Software\Microsoft\PowerShell\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp "Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp "Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp "HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp49:Tce1,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135]4a:T4cc0,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc75e20000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc75e20000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc75e20000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "KERNEL32" at base 7ffc78ca0000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc4ee20000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffc75e20000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffc75e20000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffc75e20000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffc75e20000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "NTDLL.DLL" at base 7ffc78f00000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "KERNEL32.DLL" at base 7ffc78ca0000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "RPCRT4.DLL" at base 7ffc776e0000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc73890000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 7ffc553f0000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "WINDOWSCODECS.DLL" at base 7ffc710b0000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "SECUR32.DLL" at base 7ffc6b790000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "IPHLPAPI.DLL" at base 7ffc74860000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffc75370000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffc74ae0000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffc75250000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffc6cda0000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffc6d3c0000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "SSPICLI.DLL" at base 7ffc75180000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffc745d0000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffc71650000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "SHELL32.DLL" at base 7ffc77800000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7ffc60150000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffc77800000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "USER32.DLL" at base 7ffc773b0000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7ffc69c30000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "MSISO.DLL" at base 7ffc63ae0000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffc75e20000 "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffc753f0000 "cmd.exe" loaded module "KERNEL32" at base 7ffc78ca0000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffc75e20000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffc75e20000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffc75e20000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffc78e40000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc75e20000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc75e20000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc75e20000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc4ee20000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffc78ca0000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffc78f00000 "WMIC.exe" loaded module "KERNEL32" at base 7ffc78ca0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffc75e20000 "WMIC.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffc75e20000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffc75e20000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffc78e40000 "WMIC.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc75e20000 "WMIC.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc75e20000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc75e20000 "WMIC.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc4ee20000 "WMIC.exe" loaded module "RPCRT4.DLL" at base 7ffc776e0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffc75e20000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffc6a5b0000 "WMIC.exe" loaded module "SSPICLI.DLL" at base 7ffc75180000 "WMIC.exe" loaded module "KERNEL32.DLL" at base 7ffc78ca0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7ffc64770000 "WMIC.exe" loaded module "USER32.DLL" at base 7ffc773b0000 "WMIC.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7ffc75e20000 "WMIC.exe" loaded module "MSISO.DLL" at base 7ffc63ae0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc73890000 "WMIC.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSOXMLMF.DLL" at base 7ffc62310000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffc68d70000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffc75e20000 "WMIC.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffc75e20000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffc685c0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffc68590000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\XML\WMI2XML.DLL" at base 7ffc62040000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ffc47bd0000 "WMIC.exe" loaded module "AMSI.DLL" at base 7ffc61c70000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffc6c590000 "WMIC.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffc61550000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\82845NH2.DLL" at base 7ffc5a290000 "WMIC.exe" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSOXMLMF.DLL" at base 7ffc6e530000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\XML\WMI2XML.DLL" at base 7ffc62310000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ffc5a240000 "WMIC.exe" loaded module "AMSI.DLL" at base 7ffc62040000 "WMIC.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffc6ae90000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\82845NH2.DLL" at base 7ffc6ae40000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\XML\WMI2XML.DLL" at base 7ffc6ae90000 "WMIC.exe" loaded module "AMSI.DLL" at base 7ffc6ae70000 "WMIC.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffc6ae50000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\82845NH2.DLL" at base 7ffc5a1f0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\VBSCRIPT.DLL" at base 7ffc607d0000 "WMIC.exe" loaded module "%WINDIR%\SYSTEM32\82845NH2.DLL" at base 7ffc62f70000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc75e20000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc75e20000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc75e20000 "powershell.exe" loaded module "KERNEL32" at base 7ffc78ca0000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc4ee20000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffc78ca0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffc77300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffc620d0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffc76f90000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffc75250000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffc6c590000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffc471a0000 "powershell.exe" loaded module "USER32.DLL" at base 7ffc773b0000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffc75e20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffc63a30000 "powershell.exe" loaded module "NTDLL" at base 7ffc78f00000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffc763e0000 "powershell.exe" loaded module "PSAPI.DLL" at base 227150f0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffc776e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffc45ba0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 7ffc77110000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffc763e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffc76be0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffc44f30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffc444b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffc607c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffc74690000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffc75370000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffc42440000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffc763e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffc763e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffc78f00000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffc77800000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffc75b40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffc75b40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffc75c50000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffc75c50000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffc6e530000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffc6c590000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffc6ae90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\82845NH2.DLL" at base 7ffc6ae40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffc60720000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffc54c00000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffc422d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffc41a20000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffc410b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffc62f60000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffc40d40000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffc75e20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffc40bf0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffc5a270000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffc40b10000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffc409d0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffc5a220000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffc6b790000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffc75180000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 7ffc742b0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc73890000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffc408f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffc78ca0000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffc75150000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffc77300000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffc763e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffc406b0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffc679e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 7ffc74db0000 "powershell.exe" loaded module "PSAPI.DLL" at base 1dd5cad0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffc3fbe0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffc3f9a0000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffc772d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.IO.CB3B124C8#\1E72628C6F64BBEA2F27E20F9F2CF3B4\SYSTEM.IO.COMPRESSION.NI.DLL" at base 7ffc5a1e0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.IO.CF61E09C5#\FA3056C0895561A08F7CF15A33EFBBBD\SYSTEM.IO.COMPRESSION.FILESYSTEM.NI.DLL" at base 7ffc736e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRCOMPRESSION.DLL" at base 7ffc62f30000 "powershell.exe" loaded module "OLEAUT32" at base 7ffc76be0000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc6e6500004b:T1fc6,"SELECT*FROM"%w".%s WHERE %s ORDER BY rowid" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select*from"%w".%s where %s order by rowid") "SELECT 1 FROM "%w".sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, %d, %Q, %d)=NULL" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select 1 from "%w".sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, %d, %q, %d)=null"), "SELECT 1 FROM temp.sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, 1, %Q, %d)=NULL" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select 1 from temp.sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, 1, %q, %d)=null"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_quotefix(%Q, sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_quotefix(%q, sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_quotefix('temp', sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update temp.sqlite_master set sql = sqlite_rename_quotefix('temp', sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, %d) WHERE (type!='index' OR tbl_name=%Q COLLATE nocase)AND name NOT LIKE 'sqliteX_%%' ESCAPE 'X'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, %d) where (type!='index' or tbl_name=%q collate nocase)and name not like 'sqlitex_%%' escape 'x'"), "UPDATE %Q.sqlite_master SET tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update %q.sqlite_master set tbl_name = %q name = case when type='table' then %q when name like 'sqlitex_autoindex%%' escape 'x' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q collate nocase and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_sequence set name = %q where name = %q"), "UPDATE sqlite_temp_schema SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, 1) tbl_name = CASE WHEN tbl_name=%Q COLLATE nocase AND sqlite_rename_test(%Q, sql, type, name, 1, 'after rename', 0) THEN %Q ELSE tbl_name END WHERE type IN ('view', 'trigger')" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update sqlite_temp_schema set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, 1) tbl_name = case when tbl_name=%q collate nocase and sqlite_rename_test(%q, sql, type, name, 1, 'after rename', 0) then %q else tbl_name end where type in ('view', 'trigger')"), "SELECT raise(ABORT,%Q) FROM "%w"."%w"" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select raise(abort,%q) from "%w"."%w""), "UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = printf('%%.%ds, ',sql) || %q || substr(sql,1+length(printf('%%.%ds',sql))) where type = 'table' and name = %q"), "SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*' OR quick_check GLOB 'non-* value in*'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select case when quick_check glob 'check*' then raise(abort,'check constraint failed') when quick_check glob 'non-* value in*' then raise(abort,'type mismatch on default') else raise(abort,'not null constraint failed') end from pragma_quick_check(%q,%q) where quick_check glob 'check*' or quick_check glob 'null*' or quick_check glob 'non-* value in*'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, %d) WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND (type != 'index' OR tbl_name = %Q)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, %d) where name not like 'sqlitex_%%' escape 'x' and (type != 'index' or tbl_name = %q)"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, 1) WHERE type IN ('trigger', 'view')" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update temp.sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, 1) where type in ('trigger', 'view')"), "UPDATE "%w".sqlite_master SET sql = sqlite_drop_column(%d, sql, %d) WHERE (type=='table' AND tbl_name=%Q COLLATE nocase)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_drop_column(%d, sql, %d) where (type=='table' and tbl_name=%q collate nocase)"), "CREATE TABLE %Q.%s(%s)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "create table %q.%s(%s)"), "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "delete from %q.%s where %s=%q"), "SELECT tbl idx stat FROM %Q.sqlite_stat1" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select tbl idx stat from %q.sqlite_stat1"), "CREATE TABLE" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "create table"), "UPDATE %Q.sqlite_master SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update %q.sqlite_master set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "CREATE TABLE %Q.sqlite_sequence(name,seq)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "create table %q.sqlite_sequence(name,seq)"), "SELECT*FROM"%w"."%w"" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select*from"%w"."%w""), "UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d"), "DELETE FROM %Q.sqlite_sequence WHERE name=%Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "delete from %q.sqlite_sequence where name=%q"), "DELETE FROM %Q.sqlite_master WHERE tbl_name=%Q and type!='trigger'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "delete from %q.sqlite_master where tbl_name=%q and type!='trigger'")4c:T870,"SELECT 1 FROM "%w".sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, %d, %Q, %d)=NULL" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select 1 from "%w".sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, %d, %q, %d)=null"), "SELECT 1 FROM temp.sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, 1, %Q, %d)=NULL" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select 1 from temp.sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, 1, %q, %d)=null"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_quotefix(%Q, sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_quotefix(%q, sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_quotefix('temp', sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update temp.sqlite_master set sql = sqlite_rename_quotefix('temp', sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, %d) WHERE (type!='index' OR tbl_name=%Q COLLATE nocase)AND name NOT LIKE 'sqliteX_%%' ESCAPE 'X'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, %d) where (type!='index' or tbl_name=%q collate nocase)and name not like 'sqlitex_%%' escape 'x'"), "UPDATE %Q.sqlite_master SET tbl_name = %Q4d:Tb9e,tbl_name = case when tbl_name=%q collate nocase and sqlite_rename_test(%q, sql, type, name, 1, 'after rename', 0) then %q else tbl_name end where type in ('view', 'trigger')"), "SELECT raise(ABORT,%Q) FROM "%w"."%w"" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select raise(abort,%q) from "%w"."%w""), "UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = printf('%%.%ds, ',sql) || %q || substr(sql,1+length(printf('%%.%ds',sql))) where type = 'table' and name = %q"), "SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*' OR quick_check GLOB 'non-* value in*'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select case when quick_check glob 'check*' then raise(abort,'check constraint failed') when quick_check glob 'non-* value in*' then raise(abort,'type mismatch on default') else raise(abort,'not null constraint failed') end from pragma_quick_check(%q,%q) where quick_check glob 'check*' or quick_check glob 'null*' or quick_check glob 'non-* value in*'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, %d) WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND (type != 'index' OR tbl_name = %Q)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, %d) where name not like 'sqlitex_%%' escape 'x' and (type != 'index' or tbl_name = %q)"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, 1) WHERE type IN ('trigger', 'view')" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update temp.sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, 1) where type in ('trigger', 'view')"), "UPDATE "%w".sqlite_master SET sql = sqlite_drop_column(%d, sql, %d) WHERE (type=='table' AND tbl_name=%Q COLLATE nocase)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_drop_column(%d, sql, %d) where (type=='table' and tbl_name=%q collate nocase)"), "CREATE TABLE %Q.%s(%s)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "create table %q.%s(%s)"), "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "delete from %q.%s where %s=%q"), "SELECT tbl4e:T870,"SELECT 1 FROM "%w".sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, %d, %Q, %d)=NULL" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select 1 from "%w".sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, %d, %q, %d)=null"), "SELECT 1 FROM temp.sqlite_master WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%' AND sqlite_rename_test(%Q, sql, type, name, 1, %Q, %d)=NULL" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select 1 from temp.sqlite_master where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%' and sqlite_rename_test(%q, sql, type, name, 1, %q, %d)=null"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_quotefix(%Q, sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_quotefix(%q, sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_quotefix('temp', sql)WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND sql NOT LIKE 'create virtual%%'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update temp.sqlite_master set sql = sqlite_rename_quotefix('temp', sql)where name not like 'sqlitex_%%' escape 'x' and sql not like 'create virtual%%'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, %d) WHERE (type!='index' OR tbl_name=%Q COLLATE nocase)AND name NOT LIKE 'sqliteX_%%' ESCAPE 'X'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, %d) where (type!='index' or tbl_name=%q collate nocase)and name not like 'sqlitex_%%' escape 'x'"), "UPDATE %Q.sqlite_master SET tbl_name = %Q4f:Tb9e,tbl_name = case when tbl_name=%q collate nocase and sqlite_rename_test(%q, sql, type, name, 1, 'after rename', 0) then %q else tbl_name end where type in ('view', 'trigger')"), "SELECT raise(ABORT,%Q) FROM "%w"."%w"" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select raise(abort,%q) from "%w"."%w""), "UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = printf('%%.%ds, ',sql) || %q || substr(sql,1+length(printf('%%.%ds',sql))) where type = 'table' and name = %q"), "SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') WHEN quick_check GLOB 'non-* value in*' THEN raise(ABORT,'type mismatch on DEFAULT') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*' OR quick_check GLOB 'non-* value in*'" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "select case when quick_check glob 'check*' then raise(abort,'check constraint failed') when quick_check glob 'non-* value in*' then raise(abort,'type mismatch on default') else raise(abort,'not null constraint failed') end from pragma_quick_check(%q,%q) where quick_check glob 'check*' or quick_check glob 'null*' or quick_check glob 'non-* value in*'"), "UPDATE "%w".sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, %d) WHERE name NOT LIKE 'sqliteX_%%' ESCAPE 'X' AND (type != 'index' OR tbl_name = %Q)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, %d) where name not like 'sqlitex_%%' escape 'x' and (type != 'index' or tbl_name = %q)"), "UPDATE temp.sqlite_master SET sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, 1) WHERE type IN ('trigger', 'view')" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update temp.sqlite_master set sql = sqlite_rename_column(sql, type, name, %q, %q, %d, %q, %d, 1) where type in ('trigger', 'view')"), "UPDATE "%w".sqlite_master SET sql = sqlite_drop_column(%d, sql, %d) WHERE (type=='table' AND tbl_name=%Q COLLATE nocase)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "update "%w".sqlite_master set sql = sqlite_drop_column(%d, sql, %d) where (type=='table' and tbl_name=%q collate nocase)"), "CREATE TABLE %Q.%s(%s)" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "create table %q.%s(%s)"), "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: "delete from %q.%s where %s=%q"), "SELECT tbl50:T10d9,Found string "powershell -Command "Compress-Archive -Path '" (Indicator: "Compress-Archive"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c"), Found string "Compress-Archive -Path 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime\*' -DestinationPath 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime.zip' -Force" (Indicator: "Compress-Archive"; File: "AMSI"), Found string "/c powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -DestinationPath '%TEMP%\runtime.zip' -Force"" (Indicator: "Compress-Archive"; File: "cmd.exe"), Found string "powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -DestinationPath '%TEMP%\runtime.zip' -Force"" (Indicator: "Compress-Archive"; File: "powershell.exe"), Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "powershell -Command "Compress-Archive -Path '" (Indicator: "Compress-Archive"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp"), Found string "powershell -Command "Compress-Archive -Path 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime\*' -DestinationPath 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime.zip' -Force"" (Indicator: "Compress-Archive"; Source: "00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp"), Found string "Compress-Archive -Path 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime\*' -DestinationPath 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime.zip' -Force" (Indicator: "Compress-Archive"; Source: "00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp 00000000-00006864.00000000.115762.5B460000.00000004.mdmp 00000000-00006864.00000000.115762.5CB00000.00000004.mdmp 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp")51:T1029,Found string "powershell -Command "Compress-Archive -Path '" (Indicator: "Compress-Archive"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c"), Found string "Compress-Archive -Path 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime\*' -DestinationPath 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime.zip' -Force" (Indicator: "Compress-Archive"; File: "AMSI"), Found string "/c powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -DestinationPath '%TEMP%\runtime.zip' -Force"" (Indicator: "Compress-Archive"; File: "cmd.exe"), Found string "powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -DestinationPath '%TEMP%\runtime.zip' -Force"" (Indicator: "Compress-Archive"; File: "powershell.exe"), Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "powershell -Command "Compress-Archive -Path '" (Indicator: "Compress-Archive"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp"), Found string "powershell -Command "Compress-Archive -Path 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime\*' -DestinationPath 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime.zip' -Force"" (Indicator: "Compress-Archive"; Source: "00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp"), Found string "Compress-Archive -Path 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime\*' -DestinationPath 'C:\Users\9ZUGU2u\AppData\Local\Temp\runtime.zip' -Force" (Indicator: "Compress-Archive"; Source: "00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp52:T101b,Found string "powershell -Command "Compress-Archive -Path '" (Indicator: "Compress-Archive"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c"), Found string "Compress-Archive -Path '%TEMP%\runtime\*' -DestinationPath 'C:\Users\%USERNAME%\AppData\Local\Temp\runtime.zip' -Force" (Indicator: "Compress-Archive"; File: "AMSI"), Found string "/c powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -DestinationPath '%TEMP%\runtime.zip' -Force"" (Indicator: "Compress-Archive"; File: "cmd.exe"), Found string "powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -DestinationPath '%TEMP%\runtime.zip' -Force"" (Indicator: "Compress-Archive"; File: "powershell.exe"), Found string "powershell_ise.exe" (Indicator: "powershell_ise.exe"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Join-Path" (Indicator: "Join-Path"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Always resolve file paths using Resolve-Path -Relative." (Indicator: "Resolve-Path"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet.ater than $ConfirmPreference. If $ConfirmPreference is None, actions will only be confirmed when Confirm is specified." (Indicator: "Send-MailMessage"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Press Enter to continue...me of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmd" (Indicator: "Send-MailMessage"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Variable to contain the name of the email server. This can be used instead of the HostName parameter in the Send-MailMessage cmdlet." (Indicator: "Send-MailMessage"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Resolve-Path" (Indicator: "Resolve-Path"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Write-Output" (Indicator: "Write-Output"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Show-Command" (Indicator: "Show-Command"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Trace-Command" (Indicator: "Trace-Command"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Pop-Location" (Indicator: "Pop-Location"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Push-Location" (Indicator: "Push-Location"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Select-String" (Indicator: "Select-String"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Test-ModuleManifest" (Indicator: "Test-ModuleManifest"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Enter-PSHostProcess" (Indicator: "Enter-PSHostProcess"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Exit-PSHostProcess" (Indicator: "Exit-PSHostProcess"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "Save-Help" (Indicator: "Save-Help"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp"), Found string "powershell -Command "Compress-Archive -Path '" (Indicator: "Compress-Archive"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp"), Found string "powershell -Command "Compress-Archive -Path 'C:\Users\%USERNAME%\AppData\Local\Temp\runtime\*' -DestinationPath 'C:\Users\%USERNAME%\AppData\Local\Temp\runtime.zip' -Force"" (Indicator: "Compress-Archive"; Source: "00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp"), Found string "Compress-Archive -Path 'C:\Users\%USERNAME%\AppData\Local\Temp\runtime\*' -DestinationPath 'C:\Users\%USERNAME%\AppData\Local\Temp\runtime.zip' -Force" (Indicator: "Compress-Archive"; Source: "00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp53:Tb94,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "WMIC.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "WMIC.exe" touched "Free Threaded XML DOM Document 6.0" (Path: "HKCU\CLSID\{88D96A06-F192-11D4-A65F-0040963251E5}\TREATAS") "WMIC.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WMIC.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WMI Object Factory" (Path: "HKCU\CLSID\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\TREATAS") "WMIC.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "WMIC.exe" touched "WbemQuery" (Path: "HKCU\CLSID\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}\TREATAS") "WMIC.exe" touched "XSL Template 6.0" (Path: "HKCU\CLSID\{88D96A08-F192-11D4-A65F-0040963251E5}\TREATAS") "WMIC.exe" touched "VB Script Language" (Path: "HKCU\CLSID\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\TREATAS") "WMIC.exe" touched "Component Categories Manager" (Path: "HKCU\CLSID\{0002E005-0000-0000-C000-000000000046}\TREATAS") "WMIC.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32")54:T7ce,Observed system executable string:"%WINDIR%\System32\cmd.exe" [Source: 00000000-00005044-00000BC0-763447693] Observed system executable string:"%WINDIR%\system32\cmd.exe" [Source: 00000000-00005044-00000C46-2412053458] Observed system executable string:"%WINDIR%\system32\cmd.exe /c wmic diskdrive get model,serialnumber" [Source: 00000000-00005044-00000C46-2412053458] Observed system executable string:"%WINDIR%\system32\cmd.exe /c wmic path Win32_Keyboard get Description,DeviceID" [Source: 00000000-00005044-00000C46-16681831658] Observed system executable string:"%WINDIR%\system32\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID" [Source: 00000000-00005044-00000C46-31025008696] Observed system executable string:"%WINDIR%\system32\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID" [Source: 00000000-00005044-00000C46-59868927018] Observed system executable string:"%WINDIR%\system32\cmd.exe /c wmic get name" [Source: 00000000-00005044-00000C46-74155484504] Observed system executable string:"%WINDIR%\system32\cmd.exe /c powershell -command "(Get-ItemProperty 'HKCU:\Control Panel\Desktop').Wallpaper"" [Source: 00000000-00005044-00000C46-88337136890] Observed system executable string:"%WINDIR%\system32\cmd.exe /c powershell -Command "Compress-Archive -Path '%TEMP%\runtime\*' -Destin" [Source: 00000000-00005044-00000C46-115678154006], Observed system executable string:"%WINDIR%\System32\wbem\WMIC.exe" [Source: 00000000-00007612-00000BC0-764352274], Observed system executable string:"%WINDIR%\System32\Wbem\WMIC.exe" [Source: 00000000-00007612-00000C46-1976778904], Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00007200-00000BC0-800129871], Observed system executable string:"%WINDIR%\System32\timeout.exe" [Source: 00000000-00008036-00000BC0-826851749], Observed system executable string:"%WINDIR%\system32\timeout.exe" [Source: 00000000-00008036-00000C46-1581919611]55:Tbda,Process "cmd.exe" (UID: 00000000-00007612) was launched with new environment variables: "USERDNSDOMAIN="lb6ws07SE5TLjxf"" Process "cmd.exe" (UID: 00000000-00007612) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "WMIC.exe" (UID: 00000000-00007984) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00002092) was launched with missing environment variables: "PROMPT" Process "WMIC.exe" (UID: 00000000-00004104) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00004448) was launched with missing environment variables: "PROMPT" Process "WMIC.exe" (UID: 00000000-00004276) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00003012) was launched with missing environment variables: "PROMPT" Process "WMIC.exe" (UID: 00000000-00000796) was launched with new environment variables: "PROMPT="$P$G"" Process "WMIC.exe" (UID: 00000000-00000796) was launched with modified environment variables: "PSModulePath, Path, PATHEXT, NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00007884) was launched with modified environment variables: "PSModulePath, Path, PATHEXT, NUMBER_OF_PROCESSORS" Process "cmd.exe" (UID: 00000000-00007884) was launched with missing environment variables: "PROMPT" Process "WMIC.exe" (UID: 00000000-00005688) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00002920) was launched with missing environment variables: "PROMPT" Process "WMIC.exe" (UID: 00000000-00007968) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00007200) was launched with missing environment variables: "PROMPT" Process "powershell.exe" (UID: 00000000-00002116) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00002124) was launched with missing environment variables: "PROMPT" Process "powershell.exe" (UID: 00000000-00006864) was launched with new environment variables: "PROMPT="$P$G"" Process "cmd.exe" (UID: 00000000-00008036) was launched with missing environment variables: "PROMPT" Process "timeout.exe" (UID: 00000000-00005028) was launched with new environment variables: "PROMPT="$P$G"" Process "svchost.exe" (UID: 00000000-00001060) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "svchost.exe" (UID: 00000000-00001060) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles, NUMBER_OF_PROCESSORS" Process "svchost.exe" (UID: 00000000-00001060) was launched with missing environment variables: "USERDNSDOMAIN" Process "cmd.exe" (UID: 00000000-00007552) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "cmd.exe" (UID: 00000000-00007552) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432"56:Tf7e,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007984-00000C2A-765859497] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00002116-00000C2A-800894708] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00002116-00000C2A-801222452] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00002116-00000C2A-801330834] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00002116-00000C2A-801418287] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00002116-00000C2A-801742686] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00002116-00000C2A-801799645] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00002116-00000C2A-801897289] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00002116-00000C2A-801993092] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00002116-00000C2A-802159516] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00002116-00000C2A-802249479] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00002116-00000C2A-802410558] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00002116-00000C2A-802780340] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00002116-00000C2A-802916136] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00002116-00000C2A-803171867] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00002116-00000C2A-803285172] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00002116-00000C2A-803528196] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00002116-00000C2A-803943132] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00002116-00000C2A-804377191] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00002116-00000C2A-804439884] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00002116-00000C2A-804485549] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00002116-00000C2A-804633742] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00002116-00000C2A-804896566] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00002116-00000C2A-805353239] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00002116-00000C2A-805388194]57:Tbfe,Spawned process "cmd.exe" with commandline "/c wmic diskdrive get model,serialnumber" (UID: 00000000-00007612) Spawned process "WMIC.exe" with commandline "wmic diskdrive get model,serialnumber" (UID: 00000000-00007984) Spawned process "cmd.exe" with commandline "/c wmic path Win32_Keyboard get Description,DeviceID" (UID: 00000000-00002092) Spawned process "WMIC.exe" with commandline "wmic path Win32_Keyboard get Description,DeviceID" (UID: 00000000-00004104) Spawned process "cmd.exe" with commandline "/c wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00004448) Spawned process "WMIC.exe" with commandline "wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00004276) Spawned process "cmd.exe" with commandline "/c wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00003012) Spawned process "WMIC.exe" with commandline "wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00000796) Spawned process "cmd.exe" with commandline "/c wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (UID: 00000000-00007884) Spawned process "WMIC.exe" with commandline "wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (UID: 00000000-00005688) Spawned process "cmd.exe" with commandline "/c wmic get name" (UID: 00000000-00002920) Spawned process "WMIC.exe" with commandline "wmic get name" (UID: 00000000-00007968) Spawned process "cmd.exe" with commandline "/c powershell -command "(Get-ItemProperty 'HKCU:\\Control Panel\ ..." (UID: 00000000-00007200) Spawned process "powershell.exe" with commandline "powershell -command "(Get-ItemProperty 'HKCU:\\Control Panel\\D ..." (UID: 00000000-00002116) Spawned process "cmd.exe" with commandline "/c powershell -Command "Compress-Archive -Path '%TEMP%\\runtime\ ..." (UID: 00000000-00002124), Spawned process "powershell.exe" with commandline "powershell -Command "Compress-Archive -Path '%TEMP%\\runtime\\* ..." (UID: 00000000-00006864), Spawned process "cmd.exe" with commandline "/c ""C:\\util.bat" "" (UID: 00000000-00008036), Spawned process "timeout.exe" with commandline "timeout /t 2 /nobreak" (UID: 00000000-00005028), Spawned process "cmd.exe" with commandline "/c wmic diskdrive get model serialnumber" (UID: 00000000-00007552), Spawned process "WMIC.exe" with commandline "wmic diskdrive get model serialnumber" (UID: 00000000-00000692), Spawned process "cmd.exe" with commandline "/c wmic path Win32_Keyboard get Description DeviceID" (UID: 00000000-00002024), Spawned process "WMIC.exe" with commandline "wmic path Win32_Keyboard get Description DeviceID" (UID: 00000000-00001260), Spawned process "cmd.exe" with commandline "/c wmic path Win32_PointingDevice get Description PNPDeviceID" (UID: 00000000-00005676), Spawned process "WMIC.exe" with commandline "wmic path Win32_PointingDevice get Description PNPDeviceID" (UID: 00000000-00006364), Spawned process "cmd.exe" with commandline "/c wmic path Win32_PointingDevice get Description PNPDeviceID" (UID: 00000000-00006804)58:Tbfe,Spawned process "cmd.exe" with commandline "/c wmic diskdrive get model,serialnumber" (UID: 00000000-00007612) Spawned process "WMIC.exe" with commandline "wmic diskdrive get model,serialnumber" (UID: 00000000-00007984) Spawned process "cmd.exe" with commandline "/c wmic path Win32_Keyboard get Description,DeviceID" (UID: 00000000-00002092) Spawned process "WMIC.exe" with commandline "wmic path Win32_Keyboard get Description,DeviceID" (UID: 00000000-00004104) Spawned process "cmd.exe" with commandline "/c wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00004448) Spawned process "WMIC.exe" with commandline "wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00004276) Spawned process "cmd.exe" with commandline "/c wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00003012) Spawned process "WMIC.exe" with commandline "wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00000796) Spawned process "cmd.exe" with commandline "/c wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (UID: 00000000-00007884) Spawned process "WMIC.exe" with commandline "wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (UID: 00000000-00005688) Spawned process "cmd.exe" with commandline "/c wmic get name" (UID: 00000000-00002920) Spawned process "WMIC.exe" with commandline "wmic get name" (UID: 00000000-00007968) Spawned process "cmd.exe" with commandline "/c powershell -command "(Get-ItemProperty 'HKCU:\\Control Panel\ ..." (UID: 00000000-00007200) Spawned process "powershell.exe" with commandline "powershell -command "(Get-ItemProperty 'HKCU:\\Control Panel\\D ..." (UID: 00000000-00002116) Spawned process "cmd.exe" with commandline "/c powershell -Command "Compress-Archive -Path '%TEMP%\\runtime\ ..." (UID: 00000000-00002124), Spawned process "powershell.exe" with commandline "powershell -Command "Compress-Archive -Path '%TEMP%\\runtime\\* ..." (UID: 00000000-00006864), Spawned process "cmd.exe" with commandline "/c ""C:\\util.bat" "" (UID: 00000000-00008036), Spawned process "timeout.exe" with commandline "timeout /t 2 /nobreak" (UID: 00000000-00005028), Spawned process "cmd.exe" with commandline "/c wmic diskdrive get model serialnumber" (UID: 00000000-00007552), Spawned process "WMIC.exe" with commandline "wmic diskdrive get model serialnumber" (UID: 00000000-00000692), Spawned process "cmd.exe" with commandline "/c wmic path Win32_Keyboard get Description DeviceID" (UID: 00000000-00002024), Spawned process "WMIC.exe" with commandline "wmic path Win32_Keyboard get Description DeviceID" (UID: 00000000-00001260), Spawned process "cmd.exe" with commandline "/c wmic path Win32_PointingDevice get Description PNPDeviceID" (UID: 00000000-00005676), Spawned process "WMIC.exe" with commandline "wmic path Win32_PointingDevice get Description PNPDeviceID" (UID: 00000000-00006364), Spawned process "cmd.exe" with commandline "/c wmic path Win32_PointingDevice get Description PNPDeviceID" (UID: 00000000-00006804)59:T789,The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 8B:AA:E2:A3:48:3C:0E:62:9D:B5:49:3A:BD:47:60:BA:AD:18:AA:8D; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group Inc.", C=US" (SHA1: 34:0B:28:80:F4:46:FC:C0:4E:59:ED:33:F5:2B:3D:08:D6:24:29:64; see report for more information) The input sample is signed with a certificate issued by "OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group Inc.", C=US" (SHA1: 27:96:BA:E6:3F:18:01:E2:77:26:1B:A0:D7:77:70:02:8F:20:EE:E4; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft Corporation" (SHA1: 02:49:73:49:72:A7:2C:8C:7A:49:A8:3E:AB:A5:D7:28:5D:5D:69:15; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B6:C8:AF:83:4D:4E:53:B6:73:C7:68:72:AA:8C:95:0C:7C:54:DF:5F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA, O="DigiCert Inc.", C=US" (SHA1: DB:D3:85:EE:62:DB:D2:3E:7B:E4:F6:71:48:50:87:24:D5:86:5B:45; see report for more information)5a:T712,Found string "Add-Content" (Indicator: "Add-Content"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Import-Alias" (Indicator: "Import-Alias"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Import-Csv" (Indicator: "Import-Csv"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "New-Alias" (Indicator: "New-Alias"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "New-PSDrive" (Indicator: "New-PSDrive"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "New-Variable" (Indicator: "New-Variable"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "New-Module" (Indicator: "New-Module"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Add-PSSnapIn" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Add-History" (Indicator: "Add-History"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "New-ModuleManifest" (Indicator: "New-ModuleManifest"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "New-PSRoleCapabilityFile" (Indicator: "New-PSRoleCapabilityFile"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "New-PSTransportOption" (Indicator: "New-PSTransportOption"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Register-ArgumentCompleter" (Indicator: "Register-ArgumentCompleter"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Add-PSSnapin" (Indicator: "Add-PSSnapIn"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp")5b:Tb75,"svchost.exe.bin" has type "PE32+ executable (GUI) x86-64 for MS Windows 7 sections"- [targetUID: N/A] "svchost.exe" has type "PE32+ executable (GUI) x86-64 for MS Windows 7 sections"- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe]- [targetUID: 00000000-00005044] "util.bat" has type "DOS batch file ASCII text with CRLF line terminators"- Location: [C:\util.bat]- [targetUID: 00000000-00005044] "firefox_profile_temp.db" has type "SQLite 3.x database user version 52 last written using SQLite version 3025001 page size 32768 writer version 2 read version 2 file counter 5 database pages 39 cookie 0x21 schema 4 UTF-8 version-valid-for 5"- Location: [C:\firefox_profile_temp.db]- [targetUID: 00000000-00005044] "ss.png" has type "PNG image data 1280 x 1024 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\runtime\pic\ss.png]- [targetUID: 00000000-00006864] "runtime.zip" has type "Zip archive data at least v2.0 to extract compression method=deflate"- Location: [%TEMP%\runtime.zip]- [targetUID: 00000000-00006864] "edge_history_temp.db" has type "SQLite 3.x database last written using SQLite version 3039003 file counter 17 database pages 41 cookie 0x39 schema 4 UTF-8 version-valid-for 17"- Location: [C:\edge_history_temp.db]- [targetUID: 00000000-00005044] "chrome_history_temp.db" has type "SQLite 3.x database last written using SQLite version 3044002 file counter 1 database pages 40 cookie 0x21 schema 4 UTF-8 version-valid-for 1"- Location: [C:\chrome_history_temp.db]- [targetUID: 00000000-00005044] "edge_Data.db" has type "SQLite 3.x database last written using SQLite version 3038005 page size 2048 file counter 2 database pages 27 cookie 0x10 schema 4 UTF-8 version-valid-for 2"- Location: [C:\edge_Data.db]- [targetUID: 00000000-00005044] "chrome_Data.db" has type "SQLite 3.x database last written using SQLite version 3044002 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1"- Location: [C:\chrome_Data.db]- [targetUID: 00000000-00005044] "history.txt" has type "ASCII text with very long lines (1728) with CRLF line terminators"- Location: [%TEMP%\runtime\history\history.txt]- [targetUID: 00000000-00006864] "debug_log.txt" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\runtime\browser\debug_log.txt]- [targetUID: 00000000-00006864] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002116] "clipboard.txt" has type "ASCII text with no line terminators"- Location: [%TEMP%\runtime\clipboard\clipboard.txt]- [targetUID: 00000000-00006864] "svchost.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A] "tokens.txt" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\runtime\browser\tokens.txt]- [targetUID: 00000000-00006864]5c:Tee3,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "")5d:T1315,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "")5e:T787,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to touch file "C:\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to touch file "C:\810D4850EE216DF639648A37004A0D4D1275A194924FA53312D3403BE97EDF5C.EXE.LOCAL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to touch file "C:\Windows\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_46b9c4e9edf1cfa5\GdiPlus.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to touch file "C:\BCRYPT.DLL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to touch file "C:\Windows\System32\bcrypt.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to touch file "C:\Windows\System32\ucrtbase.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to touch file "C:\Windows\System32\msasn1.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to touch file "C:\Windows\System32\crypt32.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to touch file "C:\Windows\System32\win32u.dll"5f:T533,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe:Zone.Identifier" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe:Zone.Identifier" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Windows\System32\CatRoot" "powershell.exe" touched file "C:\Windows\System32\catroot2" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive" "powershell.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive"60:Tb89,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\BCRYPT.DLL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\FLTLIB.DLL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\DPAPI.DLL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\DPAPI.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\WINDOWSCODECS.DLL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\WindowsCodecs.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\CLDAPI.DLL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\CLDAPI.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\AEPIC.DLL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\AEPIC.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\PROPSYS.DLL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\PROPSYS.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\EDPUTIL.DLL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\edputil.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\URLMON.DLL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\urlmon.dll" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\iertutil.dll" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\IPHLPAPI.DLL" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\FRAMEDYNOS.DLL" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\SSPICLI.DLL" "WMIC.exe" trying to access non-existent file "C:\Windows\System32\wbem\FLTLIB.DLL"61:T91b,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\810D4850EE216DF639648A37004A0D4D1275A194924FA53312D3403BE97EDF5C.EXE.LOCAL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\CHROME_DATA.DB-JOURNAL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\CHROME_DATA.DB-WAL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\EDGE_DATA.DB-JOURNAL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\EDGE_DATA.DB-WAL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\CHROME_HISTORY_TEMP.DB-JOURNAL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\CHROME_HISTORY_TEMP.DB-WAL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\EDGE_HISTORY_TEMP.DB-JOURNAL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\EDGE_HISTORY_TEMP.DB-WAL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\FIREFOX_PROFILE_TEMP.DB-JOURNAL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\FIREFOX_PROFILE_TEMP.DB-WAL" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\FIREFOX_PROFILE_TEMP.DB-SHM" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\runtime\HISTORY" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\runtime\CLIPBOARD" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DISCORD" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\DISCORDCANARY"62:T8f8,Found string "id-on-SmtpUTF8Mailbox" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Smtp UTF8 Mailbox" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "othername: SmtpUTF8Mailbox" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "othername:SmtpUTF8Mailbox:%.*s" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "smtp." (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "smtps" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "cr-smtp-eob" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "SMTPUTF8" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Got unexpected smtp-server response: %d" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "smtp_done(status=%d, premature=%d) -> %d" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "smtp_perform(), start" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "smtp_perform() -> %d, connected=%d, done=%d" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "smtp_do() -> %d, done=%d" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "smtp_disconnect(), finished" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "smtp_doing() -> %d, done=%d" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "smtp_regular_transfer() -> %d, done=%d" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "smtp_setup_connection() -> %d" (Indicator: "smtp"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c")63:T4af,Potential IP "1.3.101.110" found in string "X25519:1.3.101.110" Potential IP "1.3.101.111" found in string "X448:1.3.101.111" Potential IP "1.3.101.112" found in string "ED25519:1.3.101.112" Potential IP "1.3.101.113" found in string "ED448:1.3.101.113" "1.2.0.4" Potential IP "127.0.0.1" found in string "127.0.0.1/" "127.0.0.1" "2.5.29.17" "2.5.4.3" "2.5.4.4" "2.5.4.5" "2.5.4.6" "2.5.4.7" "2.5.4.8" "2.5.4.9" "2.5.4.10" "2.5.4.11" "2.5.4.12" "2.5.4.13" "2.5.4.17" "2.5.4.41" "2.5.4.42" "2.5.4.43" "2.5.4.44" "2.5.4.45" "2.5.4.46" "2.5.4.65" "2.5.4.72" "2.5.29.18" "2.5.29.19" "2.5.29.37" "2.5.29.35" "192.168.0.2" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.31" "2.5.29.14" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.32" "2.5.29.15" "2.5.29.1" "2.5.29.10" "2.5.29.16" "1.1.0.1" "3.0.0.0" Potential IP "1.0.0.0" found in string "icrosoft.Management.Infrastructure,1.0.0.0,,31bf3856ad364e35"64:T1ea0,Pattern match: "support.mozilla.org/en-us/products/firefoxgro.allizom.troppus.inzda42ct3f8+https://app.vssps.visualstudio.com/_signin?realm=my.visualstudio.com&reply_to=https%3a%2f%2fmy.visualstudio.com%2fbenefits%3fwt.mc_id%3do~msft~vscom~nav%26campaign%3do~msft~vscom~na" Pattern match: "cd.-m.rpwy/l2=szgdvi&i@n'?@_+'o{8a" Pattern match: "8t.ni/n8k&-4a=f]3s\zu9i8;h{8ft2" Pattern match: "www.msn.com/http://www.msn.com/application/pdfapplication/pdf1g==6d0c0e84-9621-41fc-a654-a231247bd648c:\users\hapubws\downloads\chromesetup.exec:\users\hapubws\downloads\chromesetup.exe.6ghttps://www.google.com/https://www.google.com/chrome/bsem/download/e" Pattern match: "https://www.msn.com/en-ca" Pattern match: "www.instagram.com/justinbieber" Heuristic match: "api.telegram.org" Pattern match: "https://curl.se/docs/http-cookies.html#" Heuristic match: "ftp@example.com" Pattern match: "https://curl.se/docs/alt-svc.html#" Pattern match: "https://curl.se/docs/hsts.html#" Heuristic match: ".onion" Pattern match: "https://api.telegram.org/bot" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "http://www.microsoft.com0" Pattern match: "www.digicert.com1$0" Pattern match: "http://www.microsoft.com/windows" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0" Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0" Heuristic match: ".0.0.0.net" Heuristic match: "c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Heuristic match: ":\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "??\c:\windows\system32\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "ntrust.net" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0" Pattern match: "http://www.microsoft.com/windows0" Pattern match: "microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225750" Pattern match: "https://go.microsoft.com/fwlink/?linkid=113316" Pattern match: "https://go.microsoft.com/fwlink/?linkid=160712" Pattern match: "http://schemas.microsoft.com/powershell/microsoft.powershell" Heuristic match: "set-location $myinvocation.mycommand.name" Pattern match: "https://go.microsoft.com/fwlink/?linkid=225747" Heuristic match: "get-content $file | more.com" Pattern match: "microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "lg.hk" Pattern match: "https://curl.se/docs/http-cookies.html" Pattern match: "https://curl.se/docs/alt-svc.html" Pattern match: "https://curl.se/docs/hsts.html" Heuristic match: "ystem.ni" Heuristic match: "data.ad" Heuristic match: "00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" Heuristic match: "icrosoft.powershell.co" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings"65:T49a3,Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00002116.00000000.115026.14E70000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00002116.00000000.115026.151B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002116.00000000.115026.151B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002116.00000000.115026.151B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e,czc%wvf[(;1:w$=jwdecdgreater" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigi)h" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris$vkt7" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>decd%lkcvuqiudecdwashington1redmond1microsoft" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>n+" - Source: "00000000-00002116.00000000.115026.17190000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=225750" - Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=113316')]param(" - Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=160712" - Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found URL "https://curl.se/docs/http-cookies.html" - Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found URL "https://curl.se/docs/alt-svc.html" - Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found URL "https://curl.se/docs/hsts.html" - Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found URL "https://api.telegram.org/boterror" - Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006864.00000000.115762.5B460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006864.00000000.115762.5B460000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcjy" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0p:/]uz_](t.]mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0qst*&pj>e" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>km7]rm7]wn7]yo7]pf/](x7]" - Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp")66:T5b8,Found string "installing subfilter for HTTP/1.1" (Indicator: "HTTP/1.1"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Forcing HTTP/1.1 for NTLM" (Indicator: "HTTP/1.1"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "HTTP/1.0 connection set to keep alive" (Indicator: "HTTP/1.0"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "HTTP/1.0 proxy connection set to keep alive" (Indicator: "HTTP/1.0"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "HTTP/1.1 proxy connection set close" (Indicator: "HTTP/1.1"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "installing subfilter for HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "Forcing HTTP/1.1 for NTLM" (Indicator: "HTTP/1.1"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "HTTP/1.0 connection set to keep alive" (Indicator: "HTTP/1.0"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "HTTP/1.0 proxy connection set to keep alive" (Indicator: "HTTP/1.0"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "HTTP/1.1 proxy connection set close" (Indicator: "HTTP/1.1"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp")67:Tdbd,Found string "A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision." (Indicator: "libcurl"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "A libcurl function was given a bad argument" (Indicator: "libcurl"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "An unknown option was passed in to libcurl" (Indicator: "libcurl"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "libcurl lacks IDN support" (Indicator: "libcurl"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "# Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support." (Indicator: "libcurl"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "# Your alt-svc cache. https://curl.se/docs/alt-svc.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "# Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Unrecognized content encoding type. libcurl understands %s content encodings." (Indicator: "libcurl"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "CLIENT libcurl 8.11.0-DEVMATCH %s %s %sQUIT" (Indicator: "libcurl"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "CLIENT libcurl 8.11.0-DEVDEFINE %s %sQUIT" (Indicator: "libcurl"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "CLIENT libcurl 8.11.0-DEV%sQUIT" (Indicator: "libcurl"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision." (Indicator: "libcurl"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "A libcurl function was given a bad argument" (Indicator: "libcurl"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "An unknown option was passed in to libcurl" (Indicator: "libcurl"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "libcurl lacks IDN support" (Indicator: "libcurl"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support." (Indicator: "libcurl"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "Unrecognized content encoding type. libcurl understands %s content encodings." (Indicator: "libcurl"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found string "CLIENT libcurl 8.11.0-DEV" (Indicator: "libcurl"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp")68:Taaf,Found string "Exit-PSSession" (Indicator: "Exit-PSSession"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "New-PSSessionConfigurationFile" (Indicator: "New-PSSessionConfigurationFile"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Import-PSSession" (Indicator: "Import-PSSession"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Export-PSSession" (Indicator: "Export-PSSession"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Connect-PSSession" (Indicator: "Connect-PSSession"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Disconnect-PSSession" (Indicator: "Disconnect-PSSession"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "New-PSSession" (Indicator: "New-PSSession"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-PSSession" (Indicator: "Get-PSSession"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Remove-PSSession" (Indicator: "Remove-PSSession"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Enter-PSSession" (Indicator: "Enter-PSSession"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Receive-PSSession" (Indicator: "Receive-PSSession"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Disable-PSSessionConfiguration" (Indicator: "Disable-PSSessionConfiguration"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Enable-PSSessionConfiguration" (Indicator: "Enable-PSSessionConfiguration"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-PSSessionCapability" (Indicator: "Get-PSSessionCapability"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "New-PSSessionOption" (Indicator: "New-PSSessionOption"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Register-PSSessionConfiguration" (Indicator: "Register-PSSessionConfiguration"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Set-PSSessionConfiguration" (Indicator: "Set-PSSessionConfiguration"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Test-PSSessionConfigurationFile" (Indicator: "Test-PSSessionConfigurationFile"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Unregister-PSSessionConfiguration" (Indicator: "Unregister-PSSessionConfiguration"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp")69:Tb2a,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter ywzu7870.default (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter addons.json (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter addonStartup.json.lz4 (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter AlternateServices.txt (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter blocklist.xml (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter bookmarkbackups (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter bookmarks-2018-07-17_14_h9TF3aB2ySWViawDed7AOw==.jsonlz4 (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter bo (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter cert9.db (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter compatibility.ini (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter containers.json (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter content-prefs.sqlite (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter cookies.sqlite (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter crashes (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter events (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter store.json.mozlz4 (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter st (UID: 00000000-00005044) "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" called "FindNextFileW" with parameter datareporting (UID: 00000000-00005044)6a:Tdec,Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "CHACHA20_POLY1305" (Indicator: "chacha"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aesni_init_key" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "crypto\evp\e_aes.c" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aesni_gcm_init_key" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aesni_xts_init_key" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aesni_ccm_init_key" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aesni_ocb_init_key" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aes_init_key" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aes_gcm_init_key" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aes_gcm_tls_cipher" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aes_xts_init_key" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aes_xts_cipher" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aes_ccm_init_key" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aes_wrap_init_key" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aes_wrap_cipher" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aes_ocb_init_key" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aes_ocb_cipher" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "AES-256-CTR" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "id-smime-alg-CMS3DESwrap" (Indicator: "3des"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "blowfish" (Indicator: "blowfish"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "CAST5-CBC" (Indicator: "cast5"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "id-aes128-wrap" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "id-aes128-wrap" (Indicator: "aes128"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aes128-wrap" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "aes128-wrap" (Indicator: "aes128"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "id-aes128-wrap-pad" (Indicator: "aes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "id-aes128-wrap-pad" (Indicator: "aes128"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c")6b:T45a,Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetDC" (Indicator: "GetDC"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp")6c:T5f9,Found string "Select-Object" (Indicator: "Select-Object"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Measure-Object" (Indicator: "Measure-Object"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Microsoft.PowerShell.Core\Where-Object {$_.Name -match '^Verbs.'} |" (Indicator: "Where-Object"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Select-Object @{" (Indicator: "Select-Object"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "$allVerbs | Microsoft.PowerShell.Core\Where-Object { $_.Verb -like $v }" (Indicator: "Where-Object"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "ForEach-Object" (Indicator: "ForEach-Object"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Where-Object" (Indicator: "Where-Object"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Compare-Object" (Indicator: "Compare-Object"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Group-Object" (Indicator: "Group-Object"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Sort-Object" (Indicator: "Sort-Object"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Tee-Object" (Indicator: "Tee-Object"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp")6d:Tf00,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "Module32First" (Indicator: "Module32First"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "Module32Next" (Indicator: "Module32Next"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "Module32First" (Indicator: "Module32First"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp")6e:T4fa,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp")6f:Te79,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp")70:Tde5,Found string "(Get-ItemProperty 'HKCU:\Control Panel\Desktop').Wallpaper" (Indicator: "Get-ItemProperty"; File: "AMSI") Found string "/c powershell -command "(Get-ItemProperty 'HKCU:\Control Panel\Desktop').Wallpaper"" (Indicator: "Get-ItemProperty"; File: "cmd.exe") Found string "powershell -command "(Get-ItemProperty 'HKCU:\Control Panel\Desktop').Wallpaper"" (Indicator: "Get-ItemProperty"; Source: "00000000-00002116.00000000.115026.14E70000.00000004.mdmp") Found string "(Get-ItemProperty 'HKCU:\Control Panel\Desktop').Wallpaper" (Indicator: "Get-ItemProperty"; Source: "00000000-00002116.00000000.115026.14E70000.00000004.mdmp, 00000000-00002116.00000000.115026.15040000.00000004.mdmp, 00000000-00002116.00000000.115026.151B0000.00000004.mdmp, 00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-Command" (Indicator: "Get-Command"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-Module" (Indicator: "Get-Module"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-FormatData" (Indicator: "Get-FormatData"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-Help" (Indicator: "Get-Help"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string ".FORWARDHELPTARGETNAME Get-Help" (Indicator: "Get-Help"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-Help @PSBoundParameters | more" (Indicator: "Get-Help"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Microsoft.PowerShell.Utility\Get-Member -type Properties -static |" (Indicator: "Get-Member"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-PSBreakpoint" (Indicator: "Get-PSBreakpoint"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-Variable" (Indicator: "Get-Variable"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-Content $file | more.com" (Indicator: "Get-Content"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-Verb" (Indicator: "Get-Verb"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "$null = Read-Host '" (Indicator: "Read-Host"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "$null = Read-Host 'Press Enter to continue...'" (Indicator: "Read-Host"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-Alias" (Indicator: "Get-Alias"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-Content" (Indicator: "Get-Content"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-ChildItem" (Indicator: "Get-ChildItem"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-PSDrive" (Indicator: "Get-PSDrive"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-PSCallStack" (Indicator: "Get-PSCallStack"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-History" (Indicator: "Get-History"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-Location" (Indicator: "Get-Location"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Get-Member" (Indicator: "Get-Member"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp")71:T549,Found reference to API "getsockname" (Indicator: "getsockname"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "getsockname error" (Indicator: "getsockname"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "getsockname truncated address" (Indicator: "getsockname"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "getsockname() failed with errno %d: %s" (Indicator: "getsockname"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "getsockname() failed: %s" (Indicator: "getsockname"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found reference to API "getsockname error" (Indicator: "getsockname"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "getsockname truncated address" (Indicator: "getsockname"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "getsockname() failed with errno %d: %s" (Indicator: "getsockname"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp") Found reference to API "getsockname() failed: %s" (Indicator: "getsockname"; Source: "00000000-00005044.00000001.114529.BDF04000.00000002.mdmp")72:Td0b,Found string "secretBag" (Indicator: "secret"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "secretary" (Indicator: "secret"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "password based MAC" (Indicator: "password"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "invalid secret" (Indicator: "secret"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "invalid secret length" (Indicator: "secret"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "bad password read" (Indicator: "password"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "problems getting password" (Indicator: "password"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "no password" (Indicator: "password"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "missing pbm secret" (Indicator: "secret"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "missing secret" (Indicator: "secret"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "ossl_pw_set_pem_password_cb" (Indicator: "password"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "No password method specified" (Indicator: "password"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "hexsecret" (Indicator: "secret"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "PEM password callback wrapper" (Indicator: "password"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "shared_secret" (Indicator: "secret"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "secretsz invalid" (Indicator: "secret"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "derive_secret" (Indicator: "secret"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "*secretlen too small" (Indicator: "secret"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "empty password" (Indicator: "password"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "maybe wrong password" (Indicator: "password"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "No password part in the URL" (Indicator: "password"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Bad password" (Indicator: "password"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "Excessive password length for proxy auth" (Indicator: "password"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "password" (Indicator: "password"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c") Found string "schannel: Failed to import cert file %s, password is bad" (Indicator: "password"; File: "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c")73:Tc7c,Found string "%WINDIR%\system32\cmd.exe /c wmic path Win32_Keyboard get Description,DeviceID" (Indicator: " Win32_Keyboard"; Source: "00000000-00005044-00000C46-16681831658") Found string "%WINDIR%\system32\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID" (Indicator: " Win32_PointingDevice"; Source: "00000000-00005044-00000C46-31025008696") Found string "%WINDIR%\system32\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (Indicator: " Win32_Desktop"; Source: "00000000-00005044-00000C46-59868927018") Found string "%WINDIR%\system32\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (Indicator: " Win32_DesktopMonitor"; Source: "00000000-00005044-00000C46-59868927018") Found string "wmic path Win32_Keyboard get Description,DeviceID" (Indicator: " Win32_Keyboard"; Source: "00000000-00002092-00000C46-1867756336") Found string "wmic path Win32_PointingDevice get Description,PNPDeviceID" (Indicator: " Win32_PointingDevice"; Source: "00000000-00004448-00000C46-1966431293") Found string "wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (Indicator: " Win32_Desktop"; Source: "00000000-00007884-00000C46-1955230033") Found string "wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (Indicator: " Win32_DesktopMonitor"; Source: "00000000-00007884-00000C46-1955230033") Found string "/c wmic path Win32_Keyboard get Description,DeviceID" (Indicator: " Win32_Keyboard"; File: "cmd.exe") Found string "/c wmic path Win32_PointingDevice get Description,PNPDeviceID" (Indicator: " Win32_PointingDevice"; File: "cmd.exe") Found string "/c wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (Indicator: " Win32_Desktop"; File: "cmd.exe") Found string "/c wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (Indicator: " Win32_DesktopMonitor"; File: "cmd.exe") Found string "wmic path Win32_Keyboard get Description,DeviceID" (Indicator: " Win32_Keyboard"; Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found string "wmic path Win32_PointingDevice get Description,PNPDeviceID" (Indicator: " Win32_PointingDevice"; Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found string "wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (Indicator: " Win32_Desktop"; Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found string "wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (Indicator: " Win32_DesktopMonitor"; Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found string "C:\WINDOWS\system32\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID" (Indicator: " Win32_PointingDevice"; Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found string "C:\WINDOWS\system32\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (Indicator: " Win32_Desktop"; Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found string "C:\WINDOWS\system32\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (Indicator: " Win32_DesktopMonitor"; Source: "00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp")74:T464,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002116.00000000.115026.14E70000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002116.00000000.115026.14E70000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Indicator: "\Device\"; Source: "00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp")75:T693,Observed string: "shutdown" (Indicator: "shutdown") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c Observed string: "Shutdown send direction error: %d. Broken server? Proceeding as if everything is ok." (Indicator: "shutdown ") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c Observed string: "shutdown and remove SSL, start" (Indicator: "shutdown ") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c Observed string: "shutdown and remove SSL, done -> %d" (Indicator: "shutdown ") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c Observed string: "shutdown timeout" (Indicator: "shutdown ") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c Observed string: "shutdown -> %d, done=%d" (Indicator: "shutdown ") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c Observed string: "Shutdown send direction error: %d. Broken server? Proceeding as if everything is ok." (Indicator: "shutdown ") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp Observed string: "shutdown and remove SSL, start" (Indicator: "shutdown ") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp Observed string: "shutdown and remove SSL, done -> %d" (Indicator: "shutdown ") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp Observed string: "shutdown timeout" (Indicator: "shutdown ") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp Observed string: "shutdown -> %d, done=%d" (Indicator: "shutdown ") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp76:Tcb3,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "9F13E4094BCBDB0100000000000000000000000002000000") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "1F74700D4BCBDB0100000000000000000000000002000000") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "E736FF104BCBDB0100000000000000000000000002000000") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "275C90144BCBDB0100000000000000000000000002000000") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "70A828184BCBDB0100000000000000000000000002000000") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C108B51B4BCBDB0100000000000000000000000002000000") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "C4423A1F4BCBDB0100000000000000000000000002000000") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "��EK") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CMD.EXE"; Value: "5EAAFCA74BCBDB0100000000000000000000000002000000") "cmd.exe" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\TIMEOUT.EXE"; Value: "9D7D71A84BCBDB0100000000000000000000000002000000")77:Tc79,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "ALLOWUNQUALIFIEDQUERY"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "APPENDTOMULTILABELNAME"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENBADTLDS"; Value: "") "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "SCREENUNREACHABLESERVERS"; Value: "")78:T58f,Found string "Set-StrictMode" (Indicator: "Set-StrictMode"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Set-Variable" (Indicator: "Set-Variable"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Enable-PSBreakpoint" (Indicator: "Enable-PSBreakpoint"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Set-PSBreakpoint" (Indicator: "Set-PSBreakpoint"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Set-Location $MyInvocation.MyCommand.Name" (Indicator: "Set-Location"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Set-Location .." (Indicator: "Set-Location"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Set-Location \" (Indicator: "Set-Location"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Set-Alias" (Indicator: "Set-Alias"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Set-Location" (Indicator: "Set-Location"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Set-PSDebug" (Indicator: "Set-PSdebug"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp") Found string "Update-Help" (Indicator: "Update-Help"; Source: "00000000-00002116.00000000.115026.172D0000.00000004.mdmp")79:T962,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" opened "C:\chrome_Data.db" with delete access "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" opened "C:\edge_Data.db" with delete access "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" opened "C:\chrome_history_temp.db" with delete access "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" opened "C:\edge_history_temp.db" with delete access "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" opened "C:\firefox_profile_temp.db" with delete access "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\runtime.zip" with delete access "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\runtime\browser\debug_log.txt" with delete access "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\runtime\browser\tokens.txt" with delete access "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\runtime\clipboard\clipboard.txt" with delete access "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\runtime\history\history.txt" with delete access "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\runtime\passwords\saved_passwords.txt" with delete access "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\runtime\pic\ss.png" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_imlewv1x.12r.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_l04mmsfz.sj5.psm1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_5ivwbmzb.yo5.ps1" with delete access "powershell.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\__PSScriptPolicyTest_vifhufyw.rdv.psm1" with delete access "cmd.exe" opened "C:\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" with delete access "cmd.exe" opened "C:\util.bat" with delete access7a:T40a,RegCloseKey CryptEncrypt RegCreateKeyExW GetSystemDirectoryA LoadLibraryA FindNextFileW OpenProcess GetCommandLineA GetFileSizeEx GetStartupInfoW GetFileSize DeleteFileW MapViewOfFile GetModuleHandleW Process32NextW CreateProcessW OutputDebugStringA LoadLibraryExW CreateDirectoryA GetTempPathW FindFirstFileExW GetFileAttributesExW CopyFileA UnhandledExceptionFilter GetModuleFileNameA Sleep GetTempPathA Process32FirstW IsDebuggerPresent FindFirstFileW GetFileAttributesW TerminateProcess LoadLibraryW CreateDirectoryW VirtualProtect CreateThread GetProcAddress GetModuleFileNameW GetSystemInfo DeleteFileA CreateFileMappingW GetDriveTypeW OutputDebugStringW CreateToolhelp32Snapshot CreateFileW GetFileAttributesA GetTickCount WriteFile CopyFileW SleepEx CreateFileA GetSystemDirectoryW GetModuleHandleA GetCommandLineW GetModuleHandleExW ExitThread ShellExecuteA GetClipboardData accept bind recv WSAStartup connect closesocket listen recvfrom sendto send socket7b:T1329,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AVAST SOFTWARE\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SLIMJET\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UR BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\360BROWSER\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\AVAST SOFTWARE\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\COCCOC\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Login Data" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\EPIC PRIVACY BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%APPDATA%\OPERA SOFTWARE\OPERA STABLE\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%APPDATA%\OPERA SOFTWARE\OPERA GX STABLE\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\SLIMJET\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\UR BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\VIVALDI\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\LOGIN DATA"7c:T1de4,"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AVAST SOFTWARE\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Local State" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\MAXTHON5\USERS\GUEST\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA GX STABLE\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SLIMJET\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\WATERFOX\PROFILES\*\LOGINS.JSON" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\History" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\History" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\places.sqlite" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT\HISTORY" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\HISTORY" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.ldb" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000006.ldb" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000007.log" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\LOCAL STORAGE\LEVELDB" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA\DEFAULT" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SLIMJET\USER DATA\DEFAULT" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\MAXTHON5\USERS\GUEST" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA\DEFAULT" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AVAST SOFTWARE\BROWSER\USER DATA\DEFAULT" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\LOCAL STORAGE\LEVELDB" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\360BROWSER\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\AVAST SOFTWARE\BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOGIN DATA" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data" "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" trying to open a file "%LOCALAPPDATA%\Google\Chrome\User Data\Local State"7d:T1288,Spawned process "810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe" (UID: 00000000-00005044) Spawned process "cmd.exe" with commandline "/c wmic diskdrive get model,serialnumber" (UID: 00000000-00007612) Spawned process "WMIC.exe" with commandline "wmic diskdrive get model,serialnumber" (UID: 00000000-00007984) Spawned process "cmd.exe" with commandline "/c wmic path Win32_Keyboard get Description,DeviceID" (UID: 00000000-00002092) Spawned process "WMIC.exe" with commandline "wmic path Win32_Keyboard get Description,DeviceID" (UID: 00000000-00004104) Spawned process "cmd.exe" with commandline "/c wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00004448) Spawned process "WMIC.exe" with commandline "wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00004276) Spawned process "cmd.exe" with commandline "/c wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00003012) Spawned process "WMIC.exe" with commandline "wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00000796) Spawned process "cmd.exe" with commandline "/c wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (UID: 00000000-00007884) Spawned process "WMIC.exe" with commandline "wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (UID: 00000000-00005688) Spawned process "cmd.exe" with commandline "/c wmic get name" (UID: 00000000-00002920) Spawned process "WMIC.exe" with commandline "wmic get name" (UID: 00000000-00007968) Spawned process "cmd.exe" with commandline "/c powershell -command "(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper"" (UID: 00000000-00007200) Spawned process "powershell.exe" with commandline "powershell -command "(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper"" (UID: 00000000-00002116) Spawned process "cmd.exe" with commandline "/c powershell -Command "Compress-Archive -Path '%TEMP%\\runtime\\*' -DestinationPath '%TEMP%\\runtime.zip' -Force"" (UID: 00000000-00002124) Spawned process "powershell.exe" with commandline "powershell -Command "Compress-Archive -Path '%TEMP%\\runtime\\*' -DestinationPath '%TEMP%\\runtime.zip' -Force"" (UID: 00000000-00006864) Spawned process "cmd.exe" with commandline "/c ""C:\\util.bat" "" (UID: 00000000-00008036) Spawned process "timeout.exe" with commandline "timeout /t 2 /nobreak" (UID: 00000000-00005028) Spawned process "svchost.exe" (UID: 00000000-00001060) Spawned process "cmd.exe" with commandline "/c wmic diskdrive get model,serialnumber" (UID: 00000000-00007552) Spawned process "WMIC.exe" with commandline "wmic diskdrive get model,serialnumber" (UID: 00000000-00000692) Spawned process "cmd.exe" with commandline "/c wmic path Win32_Keyboard get Description,DeviceID" (UID: 00000000-00002024) Spawned process "WMIC.exe" with commandline "wmic path Win32_Keyboard get Description,DeviceID" (UID: 00000000-00001260) Spawned process "cmd.exe" with commandline "/c wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00005676) Spawned process "WMIC.exe" with commandline "wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00006364) Spawned process "cmd.exe" with commandline "/c wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00006804) Spawned process "WMIC.exe" with commandline "wmic path Win32_PointingDevice get Description,PNPDeviceID" (UID: 00000000-00006688) Spawned process "WMIC.exe" with commandline "wmic path Win32_DesktopMonitor get Description,PNPDeviceID" (UID: 00000000-00002596) Spawned process "cmd.exe" with commandline "/c wmic get name" (UID: 00000000-00005476) Spawned process "WMIC.exe" with commandline "wmic get name" (UID: 00000000-00002976) Spawned process "cmd.exe" with commandline "/c powershell -command "(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper"" (UID: 00000000-00007808) Spawned process "powershell.exe" with commandline "powershell -command "(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper"" (UID: 00000000-00001036) Spawned process "cmd.exe" with commandline "/c powershell -Command "Compress-Archive -Path '%TEMP%\\runtime\\*' -DestinationPath '%TEMP%\\runtime.zip' -Force"" (UID: 00000000-00005244) Spawned process "powershell.exe" with commandline "powershell -Command "Compress-Archive -Path '%TEMP%\\runtime\\*' -DestinationPath '%TEMP%\\runtime.zip' -Force"" (UID: 00000000-00007088) Spawned process "cmd.exe" with commandline "/c ""%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\util.bat" "" (UID: 00000000-00008116) Spawned process "timeout.exe" with commandline "timeout /t 2 /nobreak" (UID: 00000000-00003924)7e:T113ac,iVBORw0KGgoAAAANSUhEUgAABLAAAAJYCAIAAAD9hIhNAACAAElEQVR4Xuy9f8huZZ3vfyEiIiIREhES+0gMIUPEnOFLDEPIMISn7xARQwxxmCMS0QmJjjV7zFHTtj/zR/bD01RnZmxK0/yVNh1PRJRIiHQiIiLEb4SEiIiESISE7K973/tZz+f9uu513c+z9/Pcjz6+Xrz/uO9rXWut61prPXt9XnfjNa21r2aC55+PPPdcpP1lpl0aOdBqfvzjSGufy/ws8uZW8/OfR1o7lHlf5qeZJzMgOv/+960Gw2jnZngicEMkD3XWWZHWvlzDrbnvD34QOfPMyNlnRziMHDNPlDflrrtaTXfZPxZ5W4vkjHitTmoRPoTPRXL6X/ta5PHHI3hULroo8uijkaefjtxwQ+Q3v4lgRocOtZrWPhTJMWP6PPJ//++R178+8rnPjfKlL0Uwh9tui9x6a+Rf/iVyyy0RdL7qqshNN0VuvjmCzgcPRi6/PPLxj0c+/enIv/975LOfjVx9dQRTwNX4xjcin/98BPPF1muvjfyP/xFB5//5PyNf+EIEF+crX4n8279Frrgi8pnPRDAqDOPrX4/80z9FsPXGGyN4cj75yQjuPu4ROuNq3H57BMPAPcLVuPPOyPjS4Tpfd10kL+zh+++v+f9EZL1MlZOI7BUK4WYUQoVQIVQIFUI+OQqhiOwmU+UkInuFQrgZhVAhVAgVQoWQT45CKCK7yVQ5icheoRBuRiFUCBVChVAh5JOjEIrIbjJVTiKyVyiEm1EIFUKFUCFUCPnkKIQisptMlZOI7A0PPxxBifhXfxV5+9sjHY9mzqu58spWQxWhIdxb05lJgn3PzZyeaY/XoDS/997IBRdEcCIowW9/G2lnRN797sj110fa2zMHIlA+yAZqswMHIhgzzgt7xNX49a8jqNxau6CGMzolk8OAW+K8OBRq/iefjLT2VzXwI166N2b4q0Qa71DqfvjDVoN9Mcjf/S5CPYbG/Ou/RmDAKILxyOIPGIaAq4PzQjbwV4egcP/mNyN33BH553+OYEYwBJwIW3FezOieeyIPPBDB1rvvjkAYIN74a8cfAy47bArBjLAvLh1OhEuHfb/1rcj990dw6XAoBDcUw0BgYjgRbuj48YbiXnNNBP8WQPnGwb4ZFqcisl6aiOwtCqFCqBAqhAqhQhhRCEVkjTQR2VsUQoVQIVQIFUKFMKIQisgaaSKytyiECqFCqBAqhAphRCEUkTXSRGRvUQgVQoVQIVQIFcKIQigia6SJyF4TtelPf9pqXnopgs5Yw69b0PLLmSi+USR0h4qFQ1F+PPtsBAtLonJ74YXIaadFcF4sWdkV/e+uwRSeeSbS2pWZEAZcWKzmSo2BPzAX1VDM8kp21/n8yLkt0n5f0x35sUxMsCWcEV3r6UjaI+p2LFeLUcHEsCIr6ufW/pC5uuZ732s13ZhBPO3f/36r4cU5rUWwriaeYAS1LLZiUcr/9b8iUBHU4ijrcbGwFWU9OuO843UmoTHQCfzx47wIlruEiY1nhK34U/nEJyKwRxgvbArTxz8c47uACeJqQHG//OXIZZdFcCLcBYwZh8INRcamDS3HeTGj8Vb8+oV7hAl+9asR3KP8rYTFqYisF75R944f/ehHbNoOPzrK9LluWkrtX5lrf9VyeJg94PDhvTnvK5mwC4VQIVQIFcIlgjQWFXTGeRVChVAhFJF5+EbtWAjSBDcXxlsn5g64cvdxh+M+VN+5b3k100vgtoXw8AbccFzs1HH2E2EXCqFCqBAqhEsEaSwq6IzzKoQKoUIoIvPwjdoBOxrI0mBTZe6AK3cfd6hbxz3bqs59y6uZXgK3J4TV33bE5XbkIPuMsAuFUCFUCBXCJYI0FhV0xnkVQoVQIRSRefhG7YAdLb72jZWl7bVx+ly/os/EXEsFjfVrv2NtqUy7LPrUr69megnchhD28rZoQfv0dfrfEnuNnBqxCf3r1v7rfiXsQiFUCBVChXCJII1FBZ1xXoVQIVQIRWQevlE7lprSFhunFnw+1iO/znXuO/Rg09zuSw+FfRcsbXx1UvWvzwp6H+ulrjZWr1v6eepcP9SvSxv3OY8+GoHUYQ0/vGFZ5r6h1dABTsnkGpUf+ECrwTA6MfuXTJT1Tz3VamAIMF7si9Kltd9kwsSwNibS2q2ZpzKjQ2EKv/99hEJIUYGWR+e/ymVjH3kkgpqQa2Omp9Etz4nA09CZPzTkIqtPPx2B0uPIPFROH6Upr+ThTHu2Bid64xsj7UAEXvbRj0bwlwKnpYrAH3DoseTgT/TmmyOwC5T1qKexBilW3bzzzsh9940Cx4O24bw4EawGy07CpT/5yQi2wpYvvzzyT/8UwXnR+VOfiuAfSjzucHhsvfHGCExs7Ief/WwEvoS7jxuK4GHAQ4hRIV/4QgT3F/KMxWzxZ4YpILjOt94a+eIXIxgVOudqrixORWS9tFUsPGqits99GH89dqANlnaYGgftlS3usrR96WGXNr46Qb3F8mtM72O9zvUfttgO+v5zPfcbCqFCqBAqhAqhQqgQishe0Vax0qn6D9NXsLTbxFyHufbKYBeADvg8sbTx1QnqLZZfY3ol622tfgDo0H8d98eO+xaFUCFUCBVChVAhVAhFZK9oq4Aa9Sq11LL6rxMr2+eOM7dj6zat3KW2L+2ztPHVCeotll9jeiXrba3/ANA+179+XXyeO+B+QyFUCBVChVAhVAgVQhHZK9oq5lxr8XlgVnNb0W2idpj7vPiwlLp16e5o7xsHLa9mUG+x/FpJ72n1K7Yu7dzv1bf3+2Kv/YxCqBAqhAqhQqgQKoQisle0VSycaqLfWj+jz9SCxulzZSs7oqWCnvVzv+PSDku3vvpBvcXyayss9Kw3tL5x6lnb+z7189R50G3fE4t/wtPoHu36GlQjWNERFTMXtGzPRf6iRWhiY67MhHpdeWWrgWycemrkj3+MtPbemumJWYB9kda+kIkZ/eEPrQalC1bdxEp7Z50V+clPIrgp3VqvcQchKnQe7PuOFmlfzcR8YTH424fFtFOH4TMZ54VNQK2hXjjvSSdFOsIP25+0SHtPDcpa3F/8lZ1+equhbMBb8ARDclAxj8trHBnlNep4qEiuyshA+eClmCCeUTz9EJXxIKHH0FRsHWtMGgJPBJ3AFKB8MBP8AWNUuM64dPA0BH4Il8YwsC+uFe4g7gLmixmNLx0eFQzyK1+J3H9/BD/R3Xtv5PbhkqSYEf5JykGyOBWR9cLX7zZ55bgTpO642anjyAmiECqECmG3r0KoEM5FIVQI5y6dQigiq+DrdzsoTrJLvKZssCmECqFCqBAucS2FsEYhrMGMxpdOIRSRVfD1uzX8n9Fkl1jU+Wzd7yiECqFCqBB2rqUQ1iiENZjR+NIphCKyCr5+RWTtKIQKoUKoEHaupRDWKIQ1mNH40imEIrIKvn5FZN1wjcrzMt+LsFIPzj470trHMgDKB2/5u8y1g/zt37YaykZ7MvPHTJwX/tDOzbRHM0G33CVcOv3wpFy083UZymQoEFbOhNXAiLDW63nnRTqJxS37Wg0XHW33R/gg4YbeVHPOOa2mtRdrKJN5KFhrNypMAb93vDdyRqvBhcVvBy/f4cwlmXyeF/dxIxdeGOHfEZznn/85AkOATqDoR4mMWhwVM1aSxDDgS7ApHApWg1GNh4Ejw2nHw4DkYGlQLBwKqYOZ4Gpg8U9sxcqZWHQUo4IvYUa47NdeGzl4MAIxw6OCCWIrZoQ1SDFm3AWsjIox43bj4mBUeBjwxI51cTxBDAPzRXJGLE5FZL1MpZSI7BGs4xVChXCKQqgQzpiYQqgQTsHtVghFZJtMpdQci/9ccPFfDPp5bz/LPoV1vEKoEE5RCBXCGRNTCBXCKbjdCqGIbJOplBKRPYJ1vEKoEE5RCBXCGRNTCBXCKbjdCqGIbJOplBKRPYJ1vEKoEE5RCBXCGRNTCBXCKbjdCqGIbJOplBKRvSLWmWx/1iKnjPLIIxHWxFnH40UP52HxTbv4m0xU+U891Wqwb2cXIAT4F79oNe1tGVgcnSeAXXR+GHYByWntx5nfR6jlcJ7cN8c8LsUffzzCQ+UKpc8+22pQQLb29UxcZ9yjF16IYMlGDAPGi62YEU07g2eDD1Ku9YoTff/7rQZb8beAore1iyL4DQPDwpXFsqqo41Fto3CHA2DrVVdFsJwp/oBRi19zTQSF+21H3XUKDgXXggPgyBgVpjAeJPaF5GCQuCm4zhgkpgCHx1qguEcQlW9+M4Ij41CY/qWXRvDHgDHD4XHL8MhiuVpMAUfGqNAZFwf/JGEr5BnKh4uDYFS4v2npLE5FZL1slE7LwRrvgL1F5LhQCBVChVAhVAhzkAphjUIoIrvJRum0HCpgwt7L2GL/2m3qubRRZP+hECqECqFCqBDmIBXCGoVQRHaTjdJpOVAywN7LmLqN+y/durRRZP+hECqECqFCqBDmIBXCGoVQRHaTjdJpOSmAhL070GfxdSuNC5Y2iuw/FEKFUCFUCBXCHKRCWKMQishuslE6LafqXw97d6DP9HXwobK0UWS/8b3vRf7kTyKtfSiCkjoN4Sc/aTXtHZFHH410a3L+uKb+qb/MD37QajBI1CrtzzPtJzW//nWrGdtFO6dFqF4hOW95S6t58cXIb38beeKJCM/brsyEXdDhSXSGtOOyj6f/1re2Gk6fegziULBH3EFcnHY4w8s+uqGtvbsGPzTw1wFOIZ/2dkENHm/84eCy42nvOueMUOZCY1Aif/e7kbvuiqCsx6HuvDMCfYI/IFjfclypI5/5TGQsDDjRvfdGUOXDAXBkDAOOB+fBdUZwNb797Qgs/bZ0D9yFBx+MYJDoDAPEqMYWhzHjduOmYAo4MgaJe4St3/hGBLcMInrLLRHcwfEw0BnPJJ52HCr3ZXEqIuslyocO1ISAvTvQZ/q69ENl0Ciy31AIB0akECqECuGxKIQ1CqFCKCI7R5QPHagJAXt3oE/9iiMsPdrSRpH9hkI4MCKFUCFUCI9FIaxRCBVCEdk5onzoQE0I2LsDfaavgw+VpY0i+w2FcGBECqFCqBAei0JYoxAqhCKyc0T50IGaELD3MqZutX/fuPRoSxtF9hsK4cCIFEKFUCE8FoWwRiFUCEVk54jyoQM1IWDvZfT9sePi69KjLW0U2fdcEjkVC1pGlQ+dQLplJ+/OPBEZOkC3CGds7dZ7jPVLMWZoGwQJK97BiMZeyiqf+X7mezUrlvc8Jdd3xVae6AOZ0CdI7B//2Gq6GeFESBzq+edbTWt/zAT87eBAhJrKnyEwoxgVDBAP8Ic/HOl+O8ClC8cbn7e192Zyaw6DwIhQuWK9WhTBKPpxqHvuiaDoh3vgUKjjcV4shglRwZihbZjgHbHeY7vvvsi110YgdVg3FTOCIcCItjVmHBlbsX4pfqOCPo1vGZwHdwHDwJExBYgZ/nXD1n//9whGhSuJNVc/9akIbihOhLt/+eUR3BQswfrJT0awFdfqttRyPDk5IxanIrJe+FoUkb1GIVQIFUKFUCFUCBVCEVkTfC2KyF6jECqECqFCqBAqhAqhiKwJvhZFZK9RCBVChVAhVAgVQoVQRNYEX4sistcohAqhQqgQKoQKoUIoImuCr0URWTu/zaDqfSwD93gmciAre/J0DcSMBfTZrYZVfns2k/vm2qddWR9TOOmkVtNNH4e6sua881pNt2RlXqvcOlavD36w1eDS8cgA+kQVCeHHMOBpWPxzvFQmXQuXLqcPEUVZi6vxne+0mu4ehYlhRlD69sbMgcj4d4dOy+/OjOYLe+ITi2p7rE8I7AKVOg6FtTFx3aEiWA0S50V5jc4ozSGi11wTgbXiRJgCvBSChH2vvjqC+f7jP0a+9a0I7BGSg1s2XioTkoOtODKWFcUNxc9suGW4Kdg6dtqrropg39tSrrAVD+F110VwU2CAWEUWFwdPDi4Ojoy7gAlia46ZxamIrJdF/SIie4hCqBAqhAqhQqgQKoQisjcs6hcR2UMUQoVQIVQIFUKFUCEUkb1hUb+IyB6iECqECqFCqBAqhAqhiOwNi/pFRPYQhVAhVAgVQoVQIVQIRWRvWNQvIrKHnFcDB0CZizr+0KEItqIm7qzm3RF0TqvBiVipD+nUKwt3lObt1gy2AgzjoprTT281ndPelflyzaorGQt43nVXq8HWxx5rNd2YMcHRxeHinyR+WUDhevLJkVVHjmcDZTwuDu4vztutI4qHMH4s+MUvWg108aGHIu96V+T22yPj3zsg3qxcUdZDCVDWo4BGZ4gZVqHEvlgbE0U/9oXkoDOWf8SosBU6gYVDcXFwXmgbLg5cC/PFmLG6KbbC6SEqGCTW87zzzgjUC/cIJxrfQZwXVxKdIbH4u4IvwfAvvjiCQ115ZQSON5ZYXMnb0jyx9ulnPhPBmDEMTAFjzoeBxamIrJfNUkJE9giFsEYhnL04nbYBhVAh3IhCqBAqhCKyZTZLid3hcIHbkrmec+0i+waFsEYhnL04nbYBhVAh3IhCqBAqhCKyZTZLid1hsriVOjfXc65dZN+gENYohLMXp9M2oBAqhBtRCBVChVBEtsxmKbELLFW7rTcO2kX2EwphjUI4e3E6bQMKoUK4EYVQIVQIRWTLbJYSu8Cczg0+bLFdZB9xRiYrVywdicK9q+OTP4ugRsKJXnqp1fzwhxGU5tj3+99vNSiosGBpa1/NhBJsDn7ByZnDEZgJVQTGSxP7WGZkYpBJlMTo3K1+GZ7GCXLfSHd/r8zEjN7whlbzwgsRTvCcFsmH8C//MtLeEYFrcR1RXkmM+QORNG0uo5rn/cEPIrj7uEcotjuejRw8GMFylyhkP/WpCLbCEMZWgyofGbsWjjystvnIImOLQ2AIGMaDD0ZgU1iUEuL9+c9HMCrYBZwW80XwNGDMuGXoPN6KQ8GlMQx0vuGGCOYLt0TwiGJUuJK4dLjssOVPfCKC6WNfTBC/O2AVWehxjpnFqYisF74kd5Q5nRt82GK7yD5CIVQIZ9LdX4VQIVQIFUKFUER2GL4kd5SBzh0+ytJN9etcu8g+QiFUCGfS3V+FUCFUCBVChVBEdhi+JHeUOZ0bfNhiu8g+QiFUCGfS3V+FUCFUCBVChVBEdhi+JHeapWq39cZBu8h+QSFUCGfS3V+FUCFUCBVChVBEdhi+JHeaw4WpBR2mD+g5bhfZL8B5WE+PDeGuDJznmZoLL2w13eKfAd77cACUHxgkZbL9pAaF6yOPRDopwoxgF+OLE1tRjbT29ZrOanIYp7cItqbVYJXRt72t1XBfkA6PJWfhPFDNbvq4dAjAqF7IYN98RNPScTUefzzCQfLSYRhx3ksvbTWtXVLDpy5XN8WPBZBJCtJYrlBeo46/LRdpRB0/FiSslIoToXDHmDFITOEb34iMhwGrwVb88WOC0EWcaDxIBAtafvvbEazIimFg9UscGZ1hvJgg5AqC9E//FMG1ggFi+g88EEHnT34ygjHjH2g8KrjsWAcZM8KDNH42MAUcCsGMcJ2zM4tTEVkvLApEZN0ohArhhEIYifMqhAqhQngsCqGI7CgsCkRk3SiECuGEQhiJ8yqECqFCeCwKoYjsKCwKRGTdKIQK4YRCGInzKoQKoUJ4LAqhiOwoLApEZN0ohArhhEIYifMqhAqhQngsCqGI7CgsCkRkr4ki+NFHW80TT0RIluYskbPahmwcOhTBWqBY7BSD/OAHWw0WHcV5WYvTASLPP99qug431bz4Yquht+SYsaoqrkZr59X86letphvGb2q6CcZ50bk777OZ6IzzdidKW35dq8GTg2eDvw7kvhTRXPyzGwYuTuTHP241XJD2zAhWYeyuVR48DRALluLvCJ1ZqsIfsKLjbal8qMW/9rUIliSFbGBNTqyciRNhVDgyvBSdsYwqrjvkajxmrH0KTYWJwVsgGzBPmAkyniDWt8SJEFgNToRDjY+MUeHIuHQQJDwq2Bdbca0wDFx2nAj7QtvwmF1ySQQyifPiicVWXDo4bXZmcSoi6+VIDSkiryTCHxRChVAhVAgVwhUTHGsbohAqhCKSHKkhReSVRPiDQqgQKoQKoUK4YoJjbUMUQoVQRJIjNaSIvJIIf1AIFUKFUCFUCFdMcKxtiEKoEIpIcqSGFJFXEuEPCqFCqBAqhArhigmOtQ1RCBVCEUmO1JAisoecdVbkd7+LsOql5MRWFO6strPzM8+0GnrLqa3mDW+InHdeZJUShKigyu86D3Og1WDJym4YsKnfRri+JcCpn86keuHS5ZGhx1xV9UAmV85sr2+RPBEECVKHIn+8lfNNIeRWzPfcFsl9f/KTCC87T/THGmpqe6Km+7EAt/tDmYCPCkpVlOa3ZcUMB8Cyk7ALGBGODJvC1u98JwK7QPGNQeJQ0Cf8EcIQ0Pn2XPsUjw4641AY5PhaoTN0AquM4rxQIBwZa5/i4uCG4lBYnhj7Yka4R1iiE2J23XURbMWhxhaHFVnxTz9uN7b+679GcNkxQfw4Amv9+tcj+LPCLcsjszgVkfWCt2TH4WF2i8OHlx98rl3kVYxCuI0cUAg3oxAqhArhsSiECqGInAB4S3ZU/euzbcZGN22d6zbXPuDwUZY2jjfVFnwQ2UkUwm3kgEK4GYVQIVQIj0UhVAhF5ATAW7Lj8DC7xZx6zbUP6K1v8HXp5/6DyE6iEG4jBxTCzSiECqFCeCwKoUIoIicA3pIdh4cZsdS7YFywtapelb4D+kyNYNo0d5DKyva5DiInhEK4jRxQCDejECqECuGxKIQKoYicAHhLdhweZgT0afF1qVz1jVXz8Hlp4/QZ9Dvic2Vl+1wHkRMCZT1L1T+LdAuHjg7V1fEBKnWetz1Vg61IZ55fzby35l3vajUoElB8nnlmpJvRByLUJwwjXfrlP+cakN7SXZzwQzoPfCk7d3cwZkQFSl86+eQILixWKIUtY9VNDPL661vNqgcp9r300lbTnejdGVycC2owZupxXo3OAB/NBLhHvM4o3PFQQhhQmqOAhi+hrEd5DW8Z/zHgUGPnwaEwZmjqbWkXWGV0fGQIEp4GON43vhHBMMby/MlPRrD6JSaIpVCx9YorIjgyJoiLc889ETwbuGUwIpwXW+/IpW5xf/GIYoKQOowKjygmiEPhlqEzfsLAvnBajBk39Npra1icish6wUuzAzUTsoJepfoPlbmtfftcBzDoP1EbS5dN5g4isjMohDUoqBRChVAhVAgVQj6imKBCKCInBl6aHaiZkBX0KgUBm1MyqFffPu07sdl7AzQu7dOWHRys7CByQiiENSioFEKFUCFUCBVCPqKYoEIoIicGXpodqJmQFfQqtdSp+q1zLtd/GHC4gz2OMrUfdweRE0IhrEFBpRAqhAqhQqgQ8hHFBBVCETkx8NLsQM2ErAYmtlSu+sa6Fz73jbW9gsb+IP3XpZ/7DyI7iUJYg4JKIVQIFUKFUCHkI4oJKoQicmLgpdmBmglZzcDcFpuWbp02zXVAn6mxbmXTzPGzy4pRTY0iO0hU2yxVc93Fl15qNa2dFzmQS1ZmAY2iH+dlHX9Opl0UednNSro6/mAmTYwa84XM2AFizFjts7t0AbaibqeopBBipVDclN//vtVgvpDJ7rzP1Xz3u62mE9HR9GO2R4jOuPu4Gt0E80QH4rlC5/GysXhiDx2KYKXQn/0s8uijEY4Ktyyf2BW/s7S/jtyWRf8//mPk4osjkDpoDJYGRcV8770RCBIK6AcfjMAfoF7bslYcClPAMptYSRL7QhiwFXYB1cQgcdkhObfcEsGRMUFcSZwIY8YNxZVEZ1jNttY+hcRC+XBkHAonwk2BieHi4KcEXFg4Hs473orLjqcdi47iwuZWFqcisl42awcR2SOizO2sRiFUCBVChVAhVAgVQhHZLTZrBxHZI6LM7axGIVQIFUKFUCFUCBVCEdktNmsHEdkjosztrEYhVAgVQoVQIVQIFUIR2S02awcR2SOizO2sRiFUCBVChVAhVAgVQhHZLTZrBxHZI6KupVwdiKCuffrpCJYkfctbIs89F0F5Pa2ntGAsV1CRRx5pNTgv/AEFM0X07AyKfggw3RKdU0TplrFvJww4VASleEdc2O7IMaonnmg12Ldz+OEEc1+sE9slDtXd7icy0Rm37PZcWLHbN0f1+lwJNsWbnfO848dsvG+X7Ax/QB0PX4JdoI5HLY56GidCYFMQJHgLSnPsi0GOx4x9oV7oDLu4774IVuzEpcN8MSosZ3rZZRHIJKzmtlR6iApOhGHgSsJqcHGuvDKCFZZx5Ouui+CXBVxn3F9MAYPEvhjkt74VwfOMZxL3d3z3IXX4RWN8KFzY7MziVETWS6lhRGRviFJVIVQIpyiENePHbLxvl+yMOl4hHCiBQqgQKoQi+45Sw4jI3hClqkKoEE5RCGvGj9l43y7ZGXW8QjhQAoVQIVQIRfYdpYYRkb0hSlWFUCGcohDWjB+z8b5dsjPqeIVwoAQKoUKoEIrsO0oNIyJ7Q5SqCqFCOEUhrBk/ZuN9u2Rn1PEK4UAJFEKFUCEU2XeUGkZE9oILL4y09qFMgFocCzyiVGvtAzU/+Umr6YgSGdX2r34Vae37mai26XhnZSB1p7ca7NsZUQwShsClULMzxOxtb4t0vFCDJStXmdhPMr+pwcqC3b4IZvRsTWdi2PeZmmeeaTVd569nYoJnndVqOouDlseR8SDhsmMZwlNOieDSdWNOxzu1Rdj51kzuuy3lg6hg+UcIwz33RFCaY9lJKAHKehT9MCIc+YorIqjjcaLxUplwHigfBBhFPw6FYdx/fwQThBFBY9AZw8BduPHGyFgXcShcWHTGlcQ/wdg6FiRsxTAeeCCCq4F9cd7PfCaCJwd3H/+sjJdCxYnuvjsy7pwPA4tTEVkvpf5ZxuFh9o7Dh5effq5d5JWLQqgQzkchrMGYFUKFUCFUCEVkByj1zzJggMgqjkPPxrtMW+e6zbUPWPzfxy1tHG+qLfggsg0UQoVwPgphDcasECqECqFCKCI7QKl/lnF4mL1jTr3m2gf01jf4uvRz/0FkGyiECuF8FMIajFkhVAgVQoVQRHaAUv8s4/Awq4ApLdRrTp+mPrWl9q9bp01zHdBnagTTprmDVFa2z3UQGaEQKoTzUQhrMGaFUCFUCBVCEdkBSv2zjMPDrKKaUm9c0Cc09v3xYe7z0sbpM+h3xOfKyva5DiJjovjuJCfW8+zK3N9m4GlxZJrY2bGe54svRqBA3SqUMYxO26LaPvXUVgNf+vnPW81NN0VwIixY2lX50bmzuNjK5S6TH/wg0tqjkXe0GqybStnIfX/2s1bTdUaervnwh1tNazdkwOgeoVRrf56hXOFByiuZY4Z4d06LCcaRUYuivOzmG8M4dKjVdGPOvKlFYAhYKxJKABWBtuHKQjVhRKjUYQhQAuwL14IwYBiYILZCCeA8uLK4Ghgkin5cSayb+uCDEQwS87355gjOOx4VZoQTofM//EMEDyWUD5cOho97hGVUca2uuSaCQWIKOPLBgxF0xgRx9zGq8dq2GBW24uLg0kFicxgsTkVkvWT90HF4mFXMmVLfPvhQmdvat891AIP+E7WxdNlk7iAiWyRKVYVQISxRCBXCjSiECuEUhVBEdpSsHzoOD7OKOVPq2/sPi89zSraVA4LN3hugcWmftuzgYGUHkTFRqiqECmGJQqgQbkQhVAinKIQisqNk/dBxeJhVzJlS395/qPRbt37AAYc72OMoU/txdxAZE6WqQqgQliiECuFGFEKFcIpCKCI7StYPHYeHWcWcKdWvMLGlu/SNdS987htrewWN/UH6r0s/9x9EtkWUqgqhQliiECqEG1EIFcIpCqGI7ChZP3QcHmYVc6YErVpqWdOmpVunTXMd0GdqrFvZNHP87LJiVFOjyFbBEo6oNrFW5PT8bTyFT2QAiu8vZIK///tIa5/NvCsTR0YZAPc4++xIZ6031bzxja0GDnDmma2mmyDypZrf/77VdJr6UCbAmoW4Kd15z8+kxpzbIu3JTB4ql2B9/vlIa1+ugU1QgTjIT9RggqedFmntI5nkpEj3iAZvelPk9NMj/M1iBZjR+2ueeKLVdOSJUNdi9V6syoh6GtoKP8QijSi+b7stcscdEZz3U5+K/Nu/RWAI2Io/0W98IwIvxQSxFCyUACe69toI/jnDfHEiHArn/drXIrhWuIO47BAknAg3BcGJYPi4klAgjAp6jFuGztiKhwFboXxYdBTTx02BiOKfb4x5fGExKig9RpU3lMWpiKwXviRFZM0ohAqhQqgQKoQ8lEJYoxCKyG7Cl6SIrBmFUCFUCBVChZCHUghrFEIR2U34khSRNaMQKoQKoUKoEPJQCmGNQigiuwlfkiKyZhRChVAhVAgVQh5KIaxRCEVkN+FLUkTWTtSmV1/daugAWXyjzHvqqchzz0Wwb2sXZ6K8Rknc2sORN7calvVnZ8CfRGiAJ2dWkEqQE4QBdnwnk/Ba5fSTSy6JdKoZ8FqlLnbmeW8mwHkpOe2RyLktQps6fnAHsWzsSy9FvvnNCDpjVB/5SKvpfg54Xw1+d+BytXlD+dShRB4Xsuh8440RSM54bcwrroignkagBDATnAjqhSofdTw6ww8xQXgL/g3CzxI4EQaJQ111VQRjxjqi0DZo6thMIIQ4EQaJG4phYILjq4FDYSseMzwqOO/4hmK+uBqQOgwDBogj46nDjDAFXGfcowyLUxFZL3y1i8jaUQgVQoVQIVQIFUKFUET2Br7aRWTtKIQKoUKoECqECqFCKCJ7A1/tIrJ2FEKFUCFUCBVChVAhFJG9ga92EVk7CqFCqBAqhAqhQqgQisjewFe7iKydH0fOhk3dX4M1/Fq7IBNKgMK1c4Af1HTVNsC+ESwsefBgq+ng7jWdEX00k/0PtJpDhyLdxflqDU7U7YuBHap58slW0/HNyCkt8vpMriPaLe/5eAbKF0Y0FrNu3xdr8LvDBReMgnVx2+siKIn5q0Q7mAnoae3CGlwcPHVYc7Xb+tPIgXhyaBdY0BJlLqrtO++MYF84z333RWBi41VGUXzjNxsU31/PJToh4mOZvPfeCGaEfTF9rLqJuh+HwpXEINH59lzAE53hLbiwOBGMCPcXgoTOuAsIbAo/S2ArbhkGiVFBCMc/YYwPddddEegiRBTBjwVj1cSJILH5iLI4FZH1Ut/FPS+/RQcRkR1BIdyMQqgQKoQKoULIUSmEIrKb1HdxTy+BrxAh3HjFL2kcb6ot+CCyVyiEm1EIFUKFUCFUCDkqhVBEdpP6Lu7pJbBmD9l4xUfL3Neln/sPInuFQrgZhVAhVAgVQoWQo1IIRWQ3qe/inl4Ca1Zy9C28+dbGpr598blvB9Omft+ele1zHUTWhkK4GYVQIVQIFUKFkKNSCEVkN6nv4p7J/ZZmJRsv4s2vffvc58XX6XOl9u8bwcr2uQ4iewNq4k6QvlSDzr/9beQv/iJy+eWR1i7PJGdGYBdQAhpC+681Dz3UamhE52L1S/A3NRSGDLemIfDAGAZ9Cfx1DQq5xb9cE9jzV7+KdJ6Wgzx3vBZoJtd67UD/MV+L4Mi8Vo9nwpZ53pOwXuslmSGpmu2cCO5Ct6hs3NCzcw1S/vwBqxmbCZwHBgwVgRDCahDsi2Ggysf8MYxvfSsCP8SJYBeQHEgdtqLoh8TivBCGN70pAqnDqK65JgJ5htJjGLiD6AzFhXphzLjsuDjYiuuMCeLiYL4YJB4GnBfPBvZFZxwK1wqPN65zfVxfDh4zbMWlw9XI1WtZnIrIeuH7N5ncb2lWgtJozsFWtoNB/4naWLpsMncQkT0GVqMQKoSzUQhLFEKFcDMKYQ0641AKoYi8SoSwFlpzfcDcMSdWdhDZG2A1CqFCOBuFsEQhVAg3oxDWoDMOpRCKyKtECNEI2OMoU/txdxDZG2A1CqFCOBuFsEQhVAg3oxDWoDMOpRCKyN4J4dznxYelX5c2bmXfpZ/7DyKvCGA1CqFCOBuFsEQhVAg3oxDWoDMOpRCKyB4J4eJzXz4N+s+11Malx8Sm2oIPInsFCndozLWZuzIBakIKUlb5nWq+P3NlDerp1s7PBF3ngLU4FuFMXnwx0tpjmbh09NJzh6r5zgy5ugalGnLyyZHuhl5Q060jCq7PPJNJoMT/TwQLHKL2Btg6HiSvM3kqk+Tt7u7viPF5sXU8Bd4jVMxYZhOFLOwCTwPsApU69AnVNg6Fv2esBYpVRrO8ZrBWJI4Ma8UymxAGHAorZ2IrnkIERoR9MQXsO15kFWPGYpgXXhjB1RhfOswXq27iSkLMcGFx5PFlHwfPJLZicWooPZ5YiPf41wFcK1wcPM+Yb25lcSoi64UvSRFZO/AHhXCTThgeUwg3UQjnt46nwHukECqEU8aXTiFUCEX2I3xJisjagT8ohJt0wvCYQriJQji/dTwF3iOFUCGcMr50CqFCKLIf4UtSRNYO/EEh3KQThscUwk0Uwvmt4ynwHimECuGU8aVTCBVCkf0IX5IisnbgDwrhJp0wPKYQbqIQzm8dT4H3SCFUCKeML51CqBCK7Ef4khSRNfORj0TaSViVMUDVixcuVlZEtX3OOZHOPc7PPJL5uxpUUBgGR3UuxOyrGejTaHFILjvJfYPrr4+09r0MCB9GATktS7Xg1FNbTWs/r+m8JQf59hZpd2fAk5G3tEgeGYPkwqH4oYHDiK2orvnLAn+ziFuGUXVXI8CJeK04haCbb+yLh/DSSyMcMwpoVK5XXx05dChyxRWRcWf4A070wQ9GLroogloch/r0pyNXXRXBHwNEBfvCELCSJNwDU7jllghcGnqMPzOMChlrOQ4FM4GHY0ZwS6yNiTuI+4tB4mpgzOiM64zVTS+7LILfDjBIqPXtudonNBVPDgaJfbHoKP5Sxm6JzphgbmVxKiLrBW9YEVk3CmEmpqAQKoQKoUJ4JDiUQqgQisjOgTesiKwbhTATU1AIFUKFUCE8EhxKIVQIRWTnwBtWRNaNQpiJKSiECqFCqBAeCQ6lECqEIrJz4A0rIutGIczEFBRChVAhVAiPBIdSCBVCEdk58IYVkfXz3siBVtPV4s9kQuoee6zVdOU1+E5m7Gk31fz8562mvSFzdmYhbxuBTI7r+Na+kBm5x0kntZoxvLBvyuSMON92MPOhDMZ8ZQ1qfkzh9NNbDa4Gh3Fq5kCmXVzz0Y+2GkwfwXqHrd1b88gjrQZToOKe1mpwj67MpW65Am2ui/vcc5HW/iUzAr7AMUNMx6syQjZQ5aNw31a1jWGgnkbnu++OQAnGtfhYVLAv1AtboakIZoStd94ZwcW5774I9v3mNyPjm4Jh4O8KW3ElMX3sO77dGCQ6Q+pwImy97roIrgaeb1w6BKPCmrqYPh4zdMZWiDdOhOQEWZyKyHrhW/PVxo+OwtZtMneEqX2uw8SODENesyiEm0G51cmVQqgQKoQKoUKYV0MhFJETg2/NjoXqVNgjWdlhZ9nW6eY6r2yf61DZSh+RpSiEm0G51cmVQqgQKoQKoUKYV0MhFJETg2/Nju16znb7nyA7crq5gyiEsh4Uws2g3OrkSiFUCBVChVAhzKuhEIrIicG3Zsec5yzaf7TB1Ni3TO1zfdA4tdcO/de+pRzgSHv9PHWonyvj9rkOU+O0CS0iW0Eh3AzKrU6uFEKFUCFUCBXCvBoKoYicGHxrdsxJDoxo+oz+fbfac/x5apna69e+pX5d+rl+2O7npY3T56mlfhXZEiiCu7UT/y0ThSw6U3LOyLRnM1+rueCCVjNe7JQnenuEi3DyUFij8oVM8LGPRVr7UgaELePioKp/3/siHHNCE+OVPFTz/POtpr0xk2ARzne+M4Ijw1q7ZVQhZiOwgGU7J8MnJ24ZLizOS6k7Ysglb201fJAo/O+vGf+UgEGibsdPJ7yhKGRRmqPahi5DJ6BekBzs++1vR266KYLFITFIlObYCiPC8o/33BNBWQ/ZuPnmCLZCcnDpcF5cq7F54hbiUFgpFNPHqLAVao1hQFNxKJgn9AnBpcMtgz1ikHhysBW3DOe9//4IDoXz4onFILEV9whXA5cOnfHk5FYWpyKyXqJEWMZCeypTO7qN28dfV7ajw4K5veY+9x+22z7XYelXkS2hECqECqFCqBByX4WwBlsVQhHZUaJEWMac5My50Fz7+OvKdnRYMLfX3Of+w3bbf9RxrGt2E9kGCqFCqBAqhAoh91UIa7BVIRSRHSVKhGXMSc6cC821j7/OtU+f0WHByr3wuf+w3XZ0AOOtIstRCBVChVAhVAi5r0JYg60KoYjsKFEiLGNOcla609zX2nPl5/4rQM/x5/phu5/7xtqOzyLbQCFUCBVChVAh5L4KYQ22KoQisqNEibCMhQJVpnZ0mz4Mui1a0AeNtX3aipaJumnlZzRWxu1zHabGRXv9KrJVUEBjnUks79kOxEqSK5YVzUUaaSbviGAFuNaeq+kK91Cv9qctkieCP6Cs/7M/i7T2zRrsi7Iel66TuoM13RRerEHx+eyzEV7JdA8s4Nna32aic2s/zVxbA1/ABA8dGgWdKZN5yx56qNXgOmOVzdZur7kylwblGrM53+6yB93CoWHa0IcOCCFyfiY5NQMlgE2hnoYhoMz9/Ocj8BZU21j+EUU/6mlshaZiClA+CAOuLPwB6gUluPrqCDpjbUzMF4qLC4t/GjB9nAjugenjvOMbit+K8G8BtuIu4ErivPhXdXwXMEFo21e+EsEw8Exec00Ew8CFhVvivDgRghnhbwGXDkfO87I4FZH1wrfkHjG2qcHWXsz2hFfIMORVCep4hVAhVAgVwiNRCBXCKQqhiOwmfEvuEQObGmwS2Q+gjlcIFUKFUCE8EoVQIZyiEIrIbsK35B6x1Pr8n93kNQHqeIVQIVQIFcIjUQgVwikKoYjsJnxLisiaQR2vECqECqFCeCQKoUI4RSEUkd2Eb0kRWTvnZc6vef3rW01X9YYgYT3PD3840tpdNZ0+xWqftV56Oa39KrOpUkfzocjJLULOz8SMOn/4Xg2cp+v8s0iufQo/3BzOMULMOgPMy54KhAISYMy0qfb9zPszv6/59a9bDQbZHfnJDB6zCFbdPOOMSEdoW/cgBagYO3kOe2ztosxCZY8Fy7digcPuLyWv5CktAvC4Y9DYCrtApY6yHg/HjTdG0BnnHTsPgkEiYzNBlY/OmC8yXrETR4Z7YPpYcxU6AZnEVtwFTAHyDG+BIGGC4xsK4ceFRWdcDYwZ58Xdx5gh/HAteCkmiPPiyLiDsFYMEjcUvx3g9w7sm6NicSoi64WvRRFZO6jOz1cIFUKFUCGkEvQSWINBIgqhQqgQisg8fC12LP5DvsV/y+fnvf0s+xVU5+crhAqhQqgQUgl6CazBIBGFUCFUCEVkHr4WRWTtoDo/XyFUCBVChZBK0EtgDQaJKIQKoUIoIvPwtSgiawfV+fkKoUKoECqEVIJeAmswSEQhVAgVQhGZh69FEVk3aXEdz2dQQEfgHq39W+brNWed1Wpae2/m/Bqq17mZtAuU5tw35YrDgIlB6uh4F9fAajAjnihd+k1vajXdmGOCWN4T4C68+90RgHKrnR3pZpRemmAKsHSUpuN79PjjEaxB+oEPtBrAS3dG5p2Rbk3dmCAPhWcjtZyW+/LRatoNmbySqONRXsN57sgVHbGsKOppqAjW80ThjhMhKOtRi6P4xpGx+CfUCyeC5GC+OC86Q9vgpdgX1wrCgK0YJA419hZMAY73z/8cwaHG88WCvHiQsC/uwgMPRMYeDm3DVlwc3H1MHxcWY8YdxKhwKDze2BedsTWXVGZxKiLrBa9y8p//8yhrZFGHsPVVxT6YguwOCqFCqBAqhAohJAdbMUgcSiGsUQhFZJvgVU56CdymENYqgts22GIfNu00OMX0da79ODiRfWX/ohAqhAqhQqgQQnKwFYPEoRTCGoVQRLYJXuWkl8DtCyE+gNq+KDbKxk3m2neQuVPMtR8HO3go2UcohAqhQqgQKoSQHGzFIHEohbBGIRSRbYJXOeklcDtCCP/Zig4t7bP0OIvKZGqZqN2WtmPToGXQPrfX1KFvr1tFCgqhQqgQKoQKISQHWzFIHEohrFEIRWSb4FVOegl8ZQhhbalfT/Dz4gO+DtpXfl58nT73X0VWgJq4W0kSQBiercGhusUhn8mEL7V3tEhW292ofl6DmrCdmiF31XSKux3StDv3yPnmjLCCZWsPZA5lbsqkmUBjMjgRFQg2lT580kkRrMgKqUPxiUcFutgR4s1L167O4HeKgBPMK4lVGDHI7jHbeDiPBZyfgRDeG0F5PV7BEgU07AL7wh+gmlAReBpOBCVALY7CHZ0xSDgPBolR3XJLBM8K7ALTx3zHGvNf/ksEj+xYcjBIPEk4Ly4s/oWCtr3znRF0xqHwqIwdD3cBVxL7IrhHmC+mgEGO7z7uL06EQWJG+M0CnfFM5rPB4lRE1ku8P3t6CdxNIZzrMD7O3NdXWvvSryIrQAHd1cQgCmiFUCFUCBVChZDnxYXFv1AKoUIo8toj3p89vQTumhAOto6Pc7hjrtv0AaADvu5U+9KvIitAAd3VxCAKaIVQIVQIFUKFkOfFhcW/UAqhQijy2iPenz29BO6OEA42tW7r+OvEXLcT7H/c7Uu/iqwABXRXE4MooBVChVAhVAgVQp4XFxb/QimECqHIa494f/b0ErgdIWwzmnQcjjTefenW2j73efEVH7bePvd58aH/ik0iq0EB3dXEIApohVAhVAgVQoWQ58WFxb9QCqFCKPLaI96fPb0Ebl8IJ2rj0g4Lpk2V2t73Wbp7bazt2NQ3Tl/H7XUTGqfP+IpNIkd5Y4ZcG/mzVvPRj0bayRFuzcL9F79oNVSCA5ks3FGLdoIU61uyNK9i+Q4KUqdtIVeoCWkXOf12ToZgkCBUBKPCgqUcRnuppv4z8TJve1ur6YjzYpXRbqFUXPbvZH5fw/ubPPdcBC7dTfDnNc8/32o6Ho6c22q6GcVPGLiDH/tYpJ0Swbqprb0/896ac85pNSyg/+M/Iqh6r746gqr3s5+NoFKHAv23/xbBobAqI1QElTqqfJgYgkOhUofV3HlnBDPCuqlj54Eu4qHEib74xQh+D8C1wtWAPsGH0Rl3H4KElULhPJggLg6GgTFjVBgGbgr2xT/BuOx4zHBk3AWIN36VwKFwImg5tuLSYWteZxanIrJe6mv7lcyilGLrkO32322OYwry2kAhVAg3UQgVwo0ohAqhQigia6G+tvcZ2pe8SlAIFcJNFEKFcCMKoUKoEIrIWqiv7X2GQiivEhRChXAThVAh3IhCqBAqhCKyFuprW0T2AoVQIdxEIVQIN6IQKoQKoYishfraFpE94Fe/inRGFIbw2GOtBstOPvxwpLUXalBQtb+MoDTvlvf8Xk1nCDFIDiOVD51RX2HtU5wIgtSB1T4DFOqf+1yknRnBEp3t7Exe9tauzICPZbBEJ4iL09pvMrG1u0exFcU2vJQPQ7u9Znxk3oXXRfiIph5zjdkD+N0hTrRxTTZITe0u7MHMR2pwu/HUsdqGmcAfsKAlDo0iGAs8whAwDgwDt7D3uhqU5pgCjoxhwBAwBZwIh8K++M1mvAgnRGVsU1Av+BIsDpIzqe8iODLEe3wimBi2YoLbuvsQYMxobI84EeaLMaMzlG98j3C74Xg47z33RHB/c0YsTkVkvfCFKyJrRiGsUQgzCmFBIRxEIVQIp2C+CqGIrIIvXBFZMwphjUKYUQgLCuEgCqFCOAXzVQhFZBV84YrImlEIaxTCjEJYUAgHUQgVwimYr0IoIqvgC1dE1oxCWKMQZhTCgkI4iEKoEE7BfBVCEVkFX7gismauuCLS8YWazsSgIufVnHZaqznjjMgFF0RauyFyAJV6bKUS5HkhdZjCxryWM/ZhLJSKqwG1JvTSn2ZwouszWM8zuOiiCJbK5NqYuURnd0O/nolRoTPWiYXFwQDHpo19u1ENeWOkU83RFFp7X4T3KIFMDumGEXfwxRdbDTUGde24NIdOoNoeaxvcA/tCCD/+8QhGBU/DFOAtKOtxXkwQg/z0pyOf//wokA0cGSuUYgqQDegEpo8Li32hx+gMpR/ffdgynhzcMowZnbGe5003RTAFPEi4oZgghoGgM+aLE2ErfhyBxF5zTQQyiUPlXWBxKiLrhS9RgFJ1VeW6eyxKGrZun5UH2akTiWyVVX9WCmHNEQ9UCBdRCAd0w1AIFUKF8GgUQhHp4EsU9BI4rFx7akHCbUepHeb6tC2I3BbZynG20kdkx1j1Z6UQ1hzxQIVwEYVwQDcMhVAhVAiPRiEUkQ6+REEvgcPKtWeSqznLmmsHW+y2kq0cZyt9RHaMVX9WCmHNEQ9UCBdRCAd0w1AIFUKF8GgUQhHp4EsU9BI4rFwBzGqpaC1tBH2fqchZ2jhor5uWNk6b0CKyW6z6s1IIa454oEK4iEI4oBuGQqgQKoRHoxCKSAdfoqCXwGHlCqBVSy0LRQs3H6U/ztRSP+zI56mlfhXZRVAi33pr5KMfjbT25UxU2639oGaFIK0AJ0pdzKUyDx5sNSg/Wjs/A9fCFADOG6CQw3KXGAb0qbUPZ8LEYLydxoQAY0Znn91qVvDnmQQlIpZRxaOyiidr3ve+VtPaozV/+EOrgRHAaU86qdU891ykc2kkHiSMGNqC6/zkk60GM+puGYhDsa4dyxUuB6p8BPt+LReWxPKPcIC+lK+BXCEQM2gMOmNUmD4MAYHyQY+xZCXOi1U3ceR+yjU4L0QFnXFk/OXAW6DHCPwQlw6PLAaJu4BD3Z6PCh6G8T0amyemgBNhkLhHsEeMGRd2vJzpffdF8tlgcSoi64UvSdBL4E4LYaUXs6l98HVpY5W9bbUv/SqyiyiECqFCqBAqhDxyP+UanFchVAhF5ATgSxL0EribQthm+mzlOHN9Bu1gaTeRXUchVAgVQoVQIeSR+ynX4LwKoUIoIicAX5Kgl8B9JIS1HYy3iuwkCqFCqBAqhAohj9xPuQbnVQgVQhE5AfiSBL0EbkcI24yADT7Pmdhct/rhuD8vvi79LLLrKIQKoUKoECqEPHI/5RqcVyFUCEXkBOBLEvQSuH0hnKiNpcvyPmBul6WNg/a6aWnjor1+FdldusoVshFg4dDWLslgPc+nas46q9V0yndlTf3zeBkO8uRM+1Dm9kwAi/vsZyMAw8DKqBhVt0JpFv2pIt2VhJdeG/mLFskVSlGqYczgpZdaDaQdIrpN4g5yY95ujIp9h4fq9v1hDRYsxU3pHsK87C/fiJpcdPShhyKdTMYE8Wy88EKE58WajXhGITkooOE8qOMRFO4PPhhBeY0jY5CwqbGmYsx4ZLEVvoRRQZ5xKCgBxowTXX99BP6ACeJE8JbLLovAl8aXDoEC4bx9/xqsm4prBfPELcOMsBWXDifCBHEo6PE990QwKtzu29MeId7wQwzyxhsjuJJ5j1icish6wYv+FctG4bHrrO1EIsegaymEBQxDIRwysjiFUCHcDB5ZbFUIFcIp1QZvVwhF9i140YvIuqFrKYQFDEMhHDKyOIVQIdwMHllsVQgVwinVBm9XCEX2LXjRi8i6oWsphAUMQyEcMrI4hVAh3AweWWxVCBXCKdUGb1cIRfYteNGLyLqhaymEBQxDIRwysjiFUCHcDB5ZbFUIFcIp1QZvVwhF9i140YvIuqFrnZQ5N/KJT0RQfJ96auQjH4mgKkD11dqzNd1WaOrlGahX6MSKCSadpz2a+WMkhaG192cO1nAYuWLneEFLyCR1ot1dg5tCSz/QaiCEWDmzvT2T833d6yJvfnOktb+tgZjhUVlxy87MtPtrMOZLLongyBgGrtU73hFpp2fAeGveo8ceazV0WqgX6lr44R13RFCLQ/lwKBgC/iZxZPwR9npZgyofZT0ECcKAp38ssXAArJwJQcKMIDnojCNDzBAMEtcKvjQeVbWUl4Nh4MJ++9sRDGN8XkwfY4Z6YSuW6MRNwb643ZgCnsmLL45gkDgy/hbw8OOpg2riqcu7wOJURNYLX6EismZYfCuECqFCqBDeoRB2EqgQKoQisjvwFSoia4bFt0KoECqECuEdCmEngQqhQigiuwNfoSKyZlh8K4QKoUKoEN6hEHYSqBAqhCKyO/AVKiJrhsW3QqgQKoQK4R0KYSeBCqFCKCK7A1+hIrJ2vpoBX6rpFmmEqAQ//GEEytdZTXgLlSDlCuc9++xWg/UeDx5sNZgCzKQ772iQGAb2xYqdUJH2tswpGRLDuPbaVgOr4YkIZhQ8+2ykYzR9XGdw+eURcM45EdCtfXpXJmcE4ae0BxCiP/4x0l4fgcXxUaG15qjOjR9WuC+MCIYw9hYU31iGEUUwCmisXwq5wlYYEYQBJ0IwwXHRf8stESwEDAX6/OcjmCAuDoQBovLAAxGcCPvCiPA3iUVWMSosozq2OFwc2BS2YlTQJ8wXdxDXClsxIzyiGBWsFTKJZwMXdnxkTBB/C3iucGRcq3zMWJyKyHqJd3PP//2/o6yRRQHA1hPgRI427bvjo5LXJgqhQngMhVAhVAgVQoVQRNZMvJt7egncphDW1ze3bbDFPmw6MU7kgHXfEzmOyAKFUCE8hkKoECqECqFCKCJrJt7NPb0Ebl8I8QGgfYvdTpwTOWDd90SOI7JAIVQIj6EQKoQKoUKoEIrImol3c08vgdsRQsjSUnc6vj6VuU1L22vL3Oe+M9r7TfWryHZRCBXCYyiECqFCqBAqhCKyZuLd3NNL4CtGCJd+3uxUvi7t039YfJ7ba+nnqaV+Fdku761ZPGETWGazU69YwrFzywcyD2dQ1j9Wc9JJrYYFNKv8kRLAAM84I4Ijc/ovy0lN+2ANCkjuy0F+qIba9o7ITTdFPvCBSKflwZveFPnd7yJXXhnhhcWVPLlF2os12Lc7VGg59oUgtXdmch1RPGawOFxn3oX2TObnmY/VdOaZV6N9tuaRR1oN980JdqvXXh9BEYzSHCaGIhj7Qr3GneE8OC+CWnxc9MNqoJoYBo6MUT34YARFPwaJE8HTMCrIBs6LUUHqcCK4x3e+E8F8YSbjq4HHHWKGQ6EzLg6EEPtedlkENxRHHqsXct11EQgh7gKuBlZkxYwwBXSG0+KWXXNNDYtTEVkvbUwvgTsthG1DsTaKhyWMj7Nyr6UdFo3jQ80dYfxVZLsohJvh9BVChVAhXASiohDWKISDKIQisoo2ppfAnRbCE+9Tv5Yy5Ah9h4naAY2VqR3dBl9FtotCuBlOXyFUCBXCRSAqCmGNQjiIQigiq2hjegl8BQvhFttr49wuYNxtbi+RLaIQbobTVwgVQoVwEYiKQlijEA6iEIrIKtqYXgK3I4RtxsrmPvdfJ7BLPezcKcZ9+g+Lz/jat8/1ETluFMLNcPoKoUKoEC4CUVEIaxTCQRRCEVlFG9NL4PaFsBQGm42ly/I+ALvP7VIb66a+8+Bz3xntdRO6iRwHsVbkRz/aalr7boSFO5adjAL67/6u1bT2kRoY0c9+FsGJOtkIsFJoQ3KC7XUtQs6rgQCjVsGR4WkwBKwFSiWge4xywQWtpnOe72cgZskZmZx+57RjbsgkqdbQ1G6Of1ODu89/DXFD8+6zc152rMLY2t2ZCzLptLkGKS4dxBvmyfmiyseyk1/9auQrX4ngZwl4Gh5Z1NMozVFAYzFMBIKEI6PKR2CtuA0YBk4EX8J5IXUwE/gD9sWRcekwKnQeHxkmhpVRoTGYwnhGuJL/5/9E8KjAiDBmdMbPEDgvbiieDYwZVwOHwiqyWCYXo0LwAGNdXEwQlz3/Ulicish6yYrhlctGLXHsc27cM+qoRI4bhbASZb1CqBAqhMujECqECqGI7BBZMbw6OFpUiOwfFMJKlPUKoUKoEC6PQqgQKoQiskNkxfDq4GhRIbJ/UAgrUdYrhAqhQrg8CqFCqBCKyA6RFYOI7AEKYSXKeoVQIVQIl0chVAgVQhHZIbJiEJG1g8oVBTQ1hkJ4fuapTFS9ndRlTXxai7RnM4/XdGs25qHS07rzRuGOZQghDKgoukMlfxo55ZQIluVr7Qc1sMduRk9nQCgf7iD7Qo9hgGe3mm6+i+VhpwRd5z9mckZUzXDa669vNagYu7v/UCSPvErL783ElWztlzWY4EsvRVq7ODN6CDEjugcMEFUvlsrEVrgldBFrReK8UC8U7tgKYRgH3gIFwjBQ9MM9sIBnb5s10DZcKxgC/kRhgFh1E0fGTcH0cSj8s4IxQ65g+HBL3F/cMgwSS85ikHhycBdwXqgXjoxhYL44Mg6FZwP74kR4Jm++OTJ+kPJvgcWpiKyXqCdEZP0ohAqhQqgQKoT8E1UIaxRCEdlNop4QkfWjECqECqFCqBDyT1QhrFEIRWQ3iXpCRNaPQqgQKoQKoULIP1GFsEYhFJHdJOoJEVk/CqFCqBAqhAoh/0QVwhqFUER2k6gnRGT9vPWtkfb2TFbq55/fajoHCLuAarZ2fw0qdRwKZQA4cCBC2YAhtLsi72iRHDNnBG/JQL2w79NPRy65JIJ9H3qo1bTDkU5jEgxsBTdkxp4WVnPSSa2mnZtpBzOxAi2MoLX3ZnAHU1NfPldNu6jm6qtbzRis3wn/x8q32yMv3TnnRNpfRl54IUIHQE0MncASjrBHVL2oiVGpIzgRfAmdUYvfcEMEggQz6Y2xBothwgGgbV/8YgQXZyyiWNASE8ShENwyWA224i7g4oyngFHhUJgRrjMe97F64URDfaJaYx3R8T3CMHDeL3whgscMjyhGhUuHYeDIea1YnIrIeuErVQo/Ogpbt8YWdzyRU8g+QSFUCBVChfBIFMIaHApRCBVCEdk5+ErtWBjLxFz7j2asZmmHuc7HwQ4eqmdw8MGmBXMd+va+RV5bKIQKoUKoEB6JQliDQyEKoUIoIjsHX6kd0JXp61Y05kT23SI7eKieEzn43L59e98iry0UQoVQIVQIj0QhrMGhEIVQIRSRnYOv1I4TkbqlfX5UmFqm9unrRP266DO1TF9ry7Gu+XXxAT0nFi0A7YuvU/+6ddE4MTXWTX3PRcvUXr/KawuFUCFUCBXCI1EIa3AoRCFUCEVk5+ArtWNOXbbiMHN9+mPWln7r9KF+xofx17ovvmLTBBrRbenuc58XX/GhsrRRXrP8beRAi5Bna1bV0yj6w9NYQJOwC9TAODLEDEsYgrGXdmMOfvCDCDufG76EE73nPRFMsJ3SIu0Pmb/OxHn/5m9aDUqmMWedFcGiox0P1+Dud2uBJnS8MEDue3IEJ/qrv4pccEHkF7+I4AcOmmcCaeeYM7/8ZYQPQ8JnEoaAQhYOgDuKfcclMsrr2/N3F3RGlQ8HwPqWmBJkEnU8/oCxLwwBVwPBqDAjdMbFgYhi3/GhLr00gingln3ykxHoIkQFS9DCpm66aRTMCBcHwcOACWLR0YsuimBfTAE/0uB2w8MRXEncMlxYXEncMnTGiXLMLE5FZL3gLdmzEJuJufYfzSjN0g7ovMWvaF8w1xlf59qXfl0w7rPyyFtsX7C0UV6zKIQKoUJ4BIVQIZw9lEKoEIrIzoG3ZM+cq8y1D5iToi1+XXrGuc742reDunUBGue+nmD7gqWN8ppFIVQIFcIjKIQK4eyhFEKFUER2Drwle+ZcZa59wJwUbfHr0jPOdcbXufYB411WHnmL7QuWNsprFoVQIVQIj6AQKoSzh1IIFUIR2TnwluyZc5W59soWpWjw9UdHWfoZH/qvS/v3mxZfp8+VQZ965LnPiw/4ivalLfIaRyFUCBXCIyiECuHsoRRChVBEdg68JXvmdGUhPxX2OMrSDmipm6aWqUPdWtu30jK11w5TS+25lLoJ3bCp0neoX9GtbpLXLO/PfLkGJcR4jUo4zxisutmZWFTqKM2vvbbVsPjOdURRJDz3XGSsBGPnwaqbf/qnkdauzvxdJnlT5ODBSGv/UvPUU60G08eSpLiwqK/aaRkSF6dbNjYve/tuzec+12qefTaCG4pD/epXraY7UQQPA/blM5kWh+sMEcW1wpXsnthY+xTXsZ07DEwMNTEu5TXXjILiG5U6poTzooDGVjjAuHDHSpKwVigfDnXLLRHU8dj3sssisBpMAYPEowMBhmxgX/zLiClgkAh8Cet5ojNmhPt7880RyORVV0UOHYrgycGobrwxMr4LuL+47Pg5AKub4sLi7iP4W8AzieDIuKF5u1mcish62XhZyhJgblvhOPpvdxfZfyiECqFCqBAqhAqhQigie8PGy1KOn8notDs5PhRChVAhVAgVQoVQIRSRvWHjZSknxEIFtUE5PhRChVAhVAgVQoVQIRSRvWHjZSkie4ZCqBAqhAqhQqgQKoQisjdsvCxFZM/I9S3TPdopsdxlZ2KxZuOb39xqUIs//3ykq+yTPG9rhzIPZMBvaiBIv/1tpLXrM1jA8/5MFv0cZJKuheUuO50YgQUdYVPQVFxYdEaNhGFgKcEbbohgazeFWzPH1o/dSLglPY3EFFAEtvahmlNPbTXXXx/BPULnbgrP1nQCHE97y7VP8aeBawURxTPJHy1w3VH0o67FKpSQOhwZdgGNgeTgUNj3W9+KwKbgLXjsvvSlCPwBgoQpwD0wZsgGvOXjH4/g0v3Hf0TuvjsC2YAg4eKgM2aE82LMuBpQa9wU7Isx4/7i1wFcSVxn3N+77orgvLgLmD4633NPBBcH58WocCI8dTBe/MOBi3PFFTUsTkVkvaAIEJH1oxDWKIQKoUKoECqECqGIrA8UAT31v47z895+lv2KQlijECqECqFCqBAqhCKyPlAEiMj6UQhrFEKFUCFUCBVChVBE1geKABFZPwphjUKoECqECqFCqBCKyPpAESAi6yeKb1Rurb2YCc46KwL3gAO09vtMnLe9rtU8/HAE0C1Pz5wdueCCCM/LfKnmu99tNeA974m0cyMoP7qL87FMDuPNLQLSLm66KYIiELX3vfdGIDmPPNJqcAfxbHBGB1okl6vtzhvzxYPU2vk1r3tdq+G1auGHeDbgad3jPQY/QwSortF5hfHi/sLxLrwwgjN9/vMR3G/4A6ptrNk4do9t1eLjI2P1S4wKwoD5wi5gUzgUMtYnHBnBXw70CYfCfHGtMAxcOlz28Q3FVlyN8T2CteL+YoLYFxPEE4tD9Rez5tvfjmAK6Iz54g8Yo7rzzgiODIfPR4XFqYisF74lk+k/YFsKe7+GOVpeihwnUV53FbNCqBAqhAqhQqgQliiEIrKj8C2ZUAET9u44WnSR2hjFzLLG2t53mGvvNy3o2/uW42OnjiOvTaK87ipmhVAhVAgVQoVQISxRCEVkR+FbMqECJuzdcaxKmWnpN43b+69zn/uvc419y/GxU8eR1yZRXncVs0KoECqECqFCqBCWKIQisqPwLZlQARP27jhWpcy0YNNE3z7YZbCpp+9TWxZjW1C6bKm9bpprnDZNjSILorzuKmaFUCFUCBVChVAhLFEIRWRH4VsyoQIm7N1xtOiis+FrT98+2GWwqafvU3ef+7z4gK+D/is/iwBo23szX6vpVmW8q+aPf2w17Iwi+K2ZFVxeg7UiH300gtIcJcTll0eeey7SLSwZS7BiPU8cGekW/8R1fjxyToukHvNKDm0KK1h2+4Y+dQGjE3Vihgm+VAMjwL6//GWrAS+9FAG47H//9xGSF7a9PYKCueNva3DejngIUahzlVGsyfn1r0ewyCyOhZoYRoTrjiof1TaOjFGh6B/vi2FgjUoU/TgR1pmEqKDox4kgKjgy7hnWIMW+eBowQdwjXByMGcPAoTBf3KNrrolgzJgRjgwjgltiCugMicWJcHGwFS6NRxTCv61HFL+G4GpgWVHM9x/+IZJvAhanIrJe+ApNqIAJe3csFKhKUf26+DxRG6fPaBlsWnzuj1apHSamTehZv06s7L/FdpEK6vhJBRdRCBXC5SfC1m6CCqFCqBAqhAqhiKyGr9CECpiwd0fVoZVqNOiwlU1gaXvfiBFWap++vXaoX9G5tm/2FklQx08quIhCqBAuPxG2dhNUCBVChVAhVAhFZDV8hSZUwIS9O6oOrVSjQYetbAJL2/vGwZEXoH2u/1z7xFy7SOvq+EkFF1EIFcLlJ8LWboIKoUKoECqECqGIrIav0IQKmLB3x1ILmnOnle3917nP/de5xnrSpUdD49L+c58XX/FBpAd1/KSCiyiECuHyE2FrN0GFUCFUCBVChVBEVsNXaEIFTNi7Y6kFwZcmljbW9r7DXHu/aUHfXlvmdq+NddNm742tfXttnD6LjMCbHRbXrZ2YSpCdUfVedFGktetr6oN79Hm9NZILhz71VKS1izOfzXyvhiuUchnVqOOxRmXHvRkIEng4cm4sSbrKtX5Vc+hQq8Gio5hCd6jQtrE9omLsTgRuyMT95QTPzXCQQffkxA3FvvixgM9zrqra2XL8/IFnEoaPE3GCCYaBhWFZMaOsH66OyAIadnFHLoaJpW+hMdA2bEVpPhbCiy+OwC7G8x0bAlQEDoCtY3vEebEvpg+Jxb74JQnnxbWCLuK8sEfse/31kbFr4cmB8uG8GBUmOL5WuL8Qwve/P4IT4cLiyPfcE7nssshVV0XghwiEMLeyOBWR9cK3pojsLSygFUKFUCE8ikI4CsasECqECqGIbBm+NUVkb2EBrRAqhArhURTCUTBmhVAhVAhFZMvwrSkiewsLaIVQIVQIj6IQjoIxK4QKoUIoIluGb00R2VtYQCuECqFCeBSFcBSMWSFUCBVCEdkyfGuKyNr5cibBqozgLzMJKhnQVervzyQnZ94UQRX08MMRdEaV39qXIudCVO7KvLcGOoEZXXppBIPsJOf8GsgGzssJwtNen2kfrvnwh1vNH/4Q6Yg1SDvnCQP8xS9azcGDEcyI5z01k0572mmtBpcd68S2djCTmprPM37gwKH4iJ4WufrqSOe0I8WFlnM5RCyliFocgoQHC52xcib8cCw5MBM8sjBPmAlmNGnVIhgGRAX/cIwXDkVgJjgRfuHAmKGL0AkMA4NEIIS4VriDN9wwCp7C/lw1Yz1GcGRcjXvvjcAt8VMZbjdONH6A4f94njFI3G48OTgRHm/smzeFxamIrBe+JEVk7SiECqFCqBAqhAqhQigiewNfkiKydhRChVAhVAgVQoVQIRSRvYEvSRFZOwqhQqgQKoQKoUKoEIrI3sCXpIisHYVQIVQIFUKFUCFUCEVkb+BLUkTWDoTwv9Y88kirae3JGiyt196aaQ9E3tAiuSTp298e6YgCGlIHQwArCneo5oEM+WFNJ0gBRgVfwpKVHFUGKwuOtz70UKQ7Gm53bIXEruKZ4Yqdz2belfnrGtzQ3/2u1aAmfOc7I489FulcOsChyJ9nSFyrT3yi1XSGD+Ky339/q6EwoHJFmYvSHO6BWvy++yLwB6z3CAeAxaHoxyBvvjmCYWDZScwIh4IRwfFwC7EVFodrBeeBmeBqYArYCnuEeWIYMBOs5ooTYUb4dQAn6p2wZnytcF6MGROEp+HC4kQ4FC47DvWZz4yCZ2Os9HjMcJ1xcXKCLE5FZL3wnZlc/N7/dxD23iEOH/nfDPaMvT27vDZRCBXCY1EIFUKFUCE8EoVQRNYI35lJL4HbEkLUGLW99CLjrQv6Pn3L8bFTxxHZOgqhQngsCqFCqBAqhEeiEIrIGuE7M+klcLtCOPg6x1a69X36luNjp44jsnUUQoXwWBRChVAhVAiPRCEUkTXCd2bSS+COCGFtnyqQ2rK0vdK34whLd99Ke9001zhtmhpFTgSFUCE8FoVQIVQIFcIjUQhFZI3wnZn0ErizQrioPQaNtb3SNy7dfenx8XXQf+VnkZ3g1MjiCZtAEYytnRGFA7zvfa2Gi2HmsqLwJSz/ODYijKq15zMhk9i3W1Y0t24HLLyHVQnHoKCCXFFy3hF59NFIa39fgyPzUOCcTF4N3O7OAD9Ug5uCpQS71Ws/UgNbHgcTxJjxmwVGBanDI4obiiOPz3vmma0GW1t7PAJtGxf9sClsvT0tDhUzqnzs++lPR1D0o8qHto29BWU9VATDwJhxGzAMHGp86e65J4ITHToUwXXG3zOuM0QFg7zxxgj+OcOCvNj3ppsiY5cejwpCiIsz1ic87tgKx8OJMCOMChaH6wyXxi2D0uNE+J0FY85hsDgVkfVSCpEl9BK4XSGs1HZ8qKBxrk/PtAk969eJlf232C5ywiiENdi6HRRChXCKQqgQbkYhrMGoFEIR2X0hHH+ujRNo3Eqf2rJZamxQ+/TttUP9is61fbO3yA6gENZg63ZQCBXCKQqhQrgZhbAGo1IIRWSNQli/9h8qc3uNG8fHbF37XP+59om5dpHjRSGswdbtoBAqhFMUQoVwMwphDUalEIrIK0AIlzYuPiz9Ote49Jhor41L+899XnzFB5EdQiGswdbtoBAqhFMUQoVwMwphDUalEIrIeoVwaqntU2GAPnNf5xqXHrM/1NRYN2323tjat9fG6bPIDvC970Va+2nknS0y5D3viQC8juEPtAss/pnWin1xItR1rX0hc6imE6Q88ltaJIdBJTgz094XeVmYa94Q+ehHI7wab868PYJ9f/azCK9GHgpTYOfUmG5rXEkYPqaAYMwPPxxZMX3K1fdquO8pmbx0mEJncfG3gDGfdlqkW771+pr6r/nRf8Tz0qHqffDBCNYRXajOFPxdobyGL2GlUKzoiK2f+1zki18cBauMYhjjoh8ngmpCn7Da5y23RMYyiesM44VNjX0Yao1Bjo0XUocriUHi7kOBcMtwnTFmaBu2jo+MUWHtZlwNdMZjhguL2w3FHTstOuO82Bdb82qwOBWR9TKVcCKyNyiECqFCuIhCGFEIFcIpGJVCKCI7ylTCicjeoBAqhArhIgphRCFUCKdgVAqhiOwoUwknInuDQqgQKoSLKIQRhVAhnIJRKYQisqNMJZyI7A0KoUKoEC6iEEYUQoVwCkalEIrIjjKVcCKyN2A9z9a+FDnQalATwxBgFzgyK/VUr9e/vtVgaVCqyBsjXR1/aw33hV28Dstd3pAJuKrqgQhqpO7CfjgTwsDzpi6inkRgF911/u4wF9WgguoubNwUDBIlcadtadoUs3jqeMvav9R0W0fWiqvR3ZTv13RHzvm2m2p4nd+aaVdncLvz4qD4xg3uhWoQLGh58cURFO4QMywFi2UnsY4oTAyHgh/inwYcCkqAdTUxI+gTZAOjwsXB843LDiOCbMCmMF+ICuaLzuNDYRjw/7Hh4+Jg9VqMCmMe+hJHhQuLfXHp4LR4NrAVR8YgEbglriTEG8lLx+JURNZLE5G9pSuRFUKFUCFcHDnnqxAqhHMWB1HBfNF5fCiFsKaXwBqFUGS/0ERkb+lKZIVQIVQIF0fO+SqECuGcxUFUMF90Hh9KIazpJbBGIRTZLzQR2Vu6ElkhVAgVwsWRc74KoUI4Z3EQFcwXnceHUghregmsUQhF9gtNRPaWrkRWCBVChXBx5JyvQqgQzlkcRAXzRefxoRTCml4CaxRCkf1CE5G9BoX7qLzuDCE6o0TuHC9qYiws2dqva3BeVKo4EfLrX0dae28kVQT7wltefLHVtNMzQ2ultp0S4fTPjuBQqHNgnuNyurV31WC+3Q39eSZUEwUV19U8t0Vy38svbzXdkwYPvyATdLcseOmlSNc5blnnh1iQNgaJ6XerjMaRTz+91eCnBFTmLHM//vHIpZdGsMwmKnUoHxbwxJME2YBdYF88WNiKKeHIV1wRwTAgOVARSA7mi0uHKWAr9sWYoTG43xgkOsNMcCL4Ev5pwIX91rci4xPdliuF4siYPlwLdxBb8ZjBpbEVg8S1wpXEqDBmdMY9wpOD6ePI41uW82VxKiLrBa9ycMUQ9n6lcnSN8b3nFTIMeQWC0jwCM+n8ITqj+FYIaxRChVAhPBYMA4W7QqgQTsE9wpOjEIrsF/AqB1X/eth7hvL/+Wl1+9RYNy1trCzt0H/YCn3nvuX42KnjyP4DpXkEZtL5Q3RG8a0Q1iiECqFCeCwYBgp3hVAhnIJ7hCdHIRTZL+BVDqr+9bD3MqoFbffzuLEy7jDeCvrOfcvxsVPHkf0HSvMIzKTzh+iM4lshrFEIFUKF8FgwDBTuCqFCOAX3CE+OQiiyX8CrHFT962HvjjkF6tunln7TXGNlaYelxzxcmBorfftWdt9Ke9001zhtmhrltQBK8wjMpPOH6IziWyGsUQgVQoXwWDAMFO4KoUI4BfcIT45CKLJfwKscVP3rYe+OObHp26eWftNcY2Vph/6Y1bXmvKtvXLoLPi8+4Oug/8rP8hrid7+LvO1tkdaeyXwiE/pEu0j1QvGNirm1ZzM/q3niiVbz3HORdlKGshFV/oUXtpqf/CQCoF6LP5KJ1h6OvKNF0oiw7y9+0Wq66X8sE7KBGgnz/ZM/aTVd57C4bmucqLuS52fel3l/Bvs+nQFxrRBIXffkfC0TJ4K28cnhIAM+z8ndd0cOHozA//HwX3llhPqEdTVRyKKARqUOI4JcjUtkLEqJdWOxL7zlP/2nCDpDU7EV04cAwxBgRFiy8t//PQJhwIkwDFgc9sVWuAfuAjrjpmAKWHP19tsjUC8so4rzYiuuBh5ZLO+Je4RnA0vO4hHFvrg48GEYPo6MhxDXCg8/fgzDVgTG++1v17A4FZH1wldsQgVM2LvjaMG2hL59akHNNmisLO0w+LD069TYM21Cz/p1YmX/LbbLawWFUCFUCDcS8HlOFEKFUCFUCEVkR+ArNqECJuzdcbRgW0LfPrX0m+YaK0s79MfcrAU32Oy9Qd84tXDn0nNpe+1Qv6Jzbd/sLa8dFEKFUCHcSMDnOVEIFUKFUCEUkR2Br9iECpiwd8fRgm0JffvU0m+aa6ws7dAfc2k30PdZuTva5/rPtU/Mtcs+RyFUCBXCjQR8nhOFUCFUCBVCEdkR+IpNqIAJey/jaM12nJ/HjZWlHabG+uE4zrVydzQu7T/3efEVH+S1hUKoECqEGwn4PCcKoUKoECqEIrIj8BWbUAET9p5hKsC20t53m2usLO0wNdat00mX7tKWHWoru9fGummz98bWvr02Tp9FJp6sQXlNTo6gju9q8fAHFt/nZFLqeN43Z9pnMzfU/OEPrQZlTzsjA16XaV+qwXwpVy//fdWkLde/yZf55S9bDbaeemqr6Qzqp5kYBlSEZvKGTLuw5pRTWg08vJv+iEsuiXReenHNvfe2GvCJT0SeeiqCS4cT8bxnRmBxrT2QCfAAQ/hxy+A49AdUzCjcUW1/+tMRFNA4E0pkuAfkClU+LhbqeBT9kBxsxTAwfXgargYECZ2hQPCl//2/IzgvFHd8KPzDga0YFS4dTgTzxB2ExeGGPvhgBNcZ9+j++yO4v5gv7hHuAh4VTB9/sZgvOuPiQNrH1wrzxfOMa4VD5d1ncSoi6wWvVBF5paEQFhRChVAhXEQhVAgVQhHZIfBKFZFXGgphQSFUCBXCRRRChVAhFJEdAq9UEXmloRAWFEKFUCFcRCFUCBVCEdkh8EoVkVcaCmFBIVQIFcJFFEKFUCEUkR0Cr1QRWTupXliVEG/YrkT+XCQlBzz6aARgBTgcGd7y7LORjlAgLES3CqyqmhM8u9XALbGw5FhFxvSqFtqWBsibclomlxXFypEYZOc8qZrURYhoXCsYEbS8vanVYBgYZMeVNd2io3nLhj8l8NLlLwu4ZRgkTvT8863mT/800s6K3HprhA5w7bURlOYQQpTIqKdhJnAACAOGhb8c1PH4p2Fc5WPpSEjdWIBxIlwNmAk8DRcHBogjYytGhYsD2RhfHIwZ/9hhK24ZgkFiX9xQDAN3Hw8SZgTXuu66COYL/x+/RTBm3DI8Kpj+TTdF8JeCKeBqwHjzvCxORWS94O0sImtHIQwUwhqFUCFUCBVChVBEdhe8nUVk7SiEgUJYoxAqhAqhQqgQisjugreziKwdhTBQCGsUQoVQIVQIFUIR2V3wdhaRtaMQBgphjUKoECqECqFCKCK7C97OIrJuLrooct55kdYO1px1VqthLf6W/5+984G1rKrv/co8JIQgJYTwfIbYCY9neYiW8tAiCr0PFRVRKSIi/puOSCkqIvJPVP4Kw/+/4p9HfYCWUkREtDwfRTullFKqvIZQYwglZGKIIYQYYgwxxsxj7p17Zn0/65x175m5c+7cmc8n3zTn7L323mutve/s3+dgViPNspNHZy6tg26UsqIOjSgL9/LGCKoRdOOZZyKwxzJVIgmK/nJQhHYBM8lOcurK6kzQ2HIs/lnKCXW4Xmv5USaMF31ujg3la5wW6rUy80QmhTCn/eqrS51SHq/TrG2L66byTcUdhMWBZkQB6tjmuuGl551X6rBX5flI/gpTvvzlCCQHgoSyHrU4qm34A+pp2CMUqK+a11wTQS2OPqNXODN8GBfCsbhnaIzr4kI4FpODY/uzAVuG4vaHgMcd3YC33JpPIf51g5ihG3g2cI/6fcZjhicH14Utf/vbEbglBgjlg6aiV7DH/vAhhLiDORssTkVksuD9C9b+Sy9LkbXrflaeHBO+nCxJFEKFUCGcHVGAUry5rkKoECqECqGILAB4/4JWAjdCCAevfu4YBprN86j5M/SE7cZ2y8axUOeRrRmFUCFUCGdHFKAUb66rECqECqFCKCILAN6/oJXAcYVwbWVE9edRzKfNpjD0/O3GdsvGsVDnka0ZhVAhVAhnRxSgFG+uqxAqhAqhQigiCwDev6CVwLGEcG2jQ4MtqArajWg/dO+gQbu93lhvR5tRG3FIe555bq93jdo42DXYKNsWCqFCqBDOjihAKd5cVyFUCBVChVBEFgC8f0ErgQsrhEM/z3zA1077+pD5nKfePmrj0PPj88wHfO20n/OzbKM02va1OnffXeqU8sE6VCB4Wnkoskups8MOEVTbWGcSIoo+Y6m5ZcsiDz4YQTdKuTOyZ6wjCpq56pK6CKu58MIIzoxwnvMeNaLS68bJJ0dKuS+DMwNc6Oo6jVx9JYJpf10E9eTq1ZFrr43AtZrrnpoBMQQUkOgkFkrFQwjQjaZXz9b5xS9KnTncA0XwuedGUDHj2NolXgzUC8U3KnUI0re+FUEdjzNDge64IwJDQDegIvAlyMadd0ZwLG4wflmB1GGu+oKEAcLhcSHcFEgdZgPX/e53I/3bjccOBoi9mPYrrohgWVH8ZoG1QPFzCE6Ff6AxBAQXwlzhHuEuYLwYIB6GfNpZnIrIZOE7NWklcAGFcLNuB6PaDza2DHahZf11wJzt57ldtkUayQklUAhrmrnqohAqhBt6pRAqhLNRCDtRCEW2SfhOTVoJXEJCuDZpGwxoN9btQd2m3V43qL+icb19Q2vZNmkkJ5RAIaxp5qqLQqgQbuiVQqgQzkYh7EQhFNkm4Ts1aSVwqQjhPLeP2thvX5rto9qP2j5g1HbZhmgkJ5RAIaxp5qqLQqgQbuiVQqgQzkYh7EQhFNkm4Ts1aSVwLCEsKTz4XMvSKHEa1WY+7euNQ7cPaDcOvRa21xuHth/1eeYrPsi2SyM5oQQKYU0zV10UQoVwQ68UQoVwNgphJwqhyDYJ36lJK4HjCmGZdSGYz2AjdmHL0F3YOPiMr3XjwXa0H7Vx6HnQrN5Y79rQenZvu73eOPgs2yxRIkNF8MLlap/LIlgpFEVRKafUuf/+UqeUr2fuz8SilPfdV+qUnTJpNTAxjJeledKU9T+oA2vF1MF467/AF0GNhKAxho8VSjFA3iOSnpY8/XQEYIBYgbbslcvM5l147rlSB3cf89yoV5wKwl/WZlIXV64sdRpipVAMEDelWSgVxHNVyu2ZWNyVvzvgSjBAGBFWVoQgwVtQIsM8UYv3NQZ7cWb4Ifb2xQwDxOKQUE1YK35LwD9YmA3YBQaIbmBEEBXcBZwK14XyoTFGhOtib/+GQo8xov6xmElcF0Po325cF7aMQNvw8w96hW5gvVZMLII+56lYnIrIZOEbdVJMl1gisg6FUCFcj0JYBzdFIYzgzH1DUAjroDFGhOtib/+GKoSdoM95KhanIjJZ+EadFNMlloisQyFUCNejENbBTVEIIzhz3xAUwjpojBHhutjbv6EKYSfoc56KxamITBa+USfFdIklIutQCBXC9SiEdXBTFMIIztw3BIWwDhpjRLgu9vZvqELYCfqcp2JxKiKThW9UEZk4CqFCuB6FsA5uikIYwZn7hqAQ1kFjjAjXxd7+DVUIO0Gf81QsTkVksvCNKiKLC2piGAJEBa9jLIbZP1VTbSe7YC3Qe+s8/3ypA9VEJ8tuJVIeziSvjHBNzhRgFJ/NIqtpCPSloLHWMMBSLorsXOo0+hTXbZz2NxlwYQQj2i6DTuYta1ZGvSOzos4DD5Q6ZdfIXXdF4Fp4zMr2mZyN3/ym1IE9lrImE8fiufrVr0qdUu6q0ww/TlXKUxEU39An1LWo42/NdRchKjATGCCCv2c83yjcsegoVASGgFN98pMRXPeaayKwx/NyQcvLLotgfUvIJE515ZURqAj63G+MXsFbcAdbKaqDEZ19dgS/QmGu8GxgYuFpeFT6S4MimA1cCPKMf4Ouuy6CBxhPDoInFqeCPWImL744kjeFxamITJb1NYiIbCH0LQ41McoAhVAhVAgVQoVQIVQIRWQs1tcgIrKF0Lc41MQoAxRChVAhVAgVQoVQIRSRsVhfg4jIFkLf4lATowxQCBVChVAhVAgVQoVQRMZifQ0iIlsIfYtDTYwyQCFUCBVChVAhVAgVQhEZi/U1iIgsFvdztc+oXLEwWynHZLKuXRvrPaJSh7dgSVKW9SQvVG7IXJkBKTmZ3XYrddANrNiJEhHlJYA/YClU1DlnnBFpZiOn/cUtdVJjsLophnDssZFSjqhz2GGlDodATc1VRnMt0FLeXOfXvy51msagf6GTIstLHfQZM4mnnfM8lUkfxkziQqX8WwYGGDnttFKH62qiyofUoR+o4y+6KAIzwYVQQMNLoTH9Kh/FN55vqMjnPhdBWY8zY81VeCn24h8s+MPHPx75m7+JYLyXXBKBpeNXChwLW0Y3cEPRGPcI2oZgCBh+f7navodjRDgWjwp6hWNxy/BM4rlCr9AYz0b/zPg5AM9k/qWwOBWRyTJ4/Q9l7V13dcLWWynTlcYQRm0XGQ+FUCFUCNfP85RCqBDORiGsoxCKyOZk8PofSiuB4wphvq83Bhy40ecZUHdpABtVjNo7arvIeCiECqFCuH6epxRChXA2CmEdhVBENieD1/9QWgkcSwin39Ejv86TjTtqPszzzKOajdouMh4KoUKoEK6f5ymFUCGcjUJYRyEUkc3J4PU/lFYCN0UIa/I9PmT7qGaDD0P3Dhq021vavYOj6l31Rmwf2mawUWReKIQKoUK4fp6nFEKFcDYKYR2FUEQ2J4PX/1BaCVwQIZx9fc/xGR/a7XN+nvk6+AxGnRlfR5181MbBZ5F5cmMGynRT5vE6qKfxwp15HAegvN5ppwhWrcNe1NOwuFe8ItIs8Hh+ZFmsFIrquhEVlPKrMrk3zwwwG7fm0npln0yemd6yPILxNsoHm7qrTjN8jDeAamJdSXYyZ/LZZ0ud5v6GAaLxrrtGMN5mCAEelVIuz2C8yOfrND+dBBg+bncpq+twrlBeo67F3xUcAEFjlOYwBPzCAW/BmeEteIJxKnQDjbEXggQ/xGz0HQDdQK6/PoJTYfjoBuQZTz9EBXMFm8Js4B5BYxBcCHsxGxgvtA0G2Jc6nBkjws8BWOwUmoqZvPzyCG5Z3zzxiOIO9tdczV6xOBWRycJ3atJK4FhCWLIGqzdWTcKs6u1DN45qPOf2ls6uMo8Tth+GfhWZE4VQIVQIh0YhrKIQKoSDKIQisqDwnZq0EjiuENZMv5TXfwBoUIONoxrPub2l3bWhQ9MMNqJN+wFsaC0yDxRChVAhHBqFsIpCqBAOohCKyILCd2rSSuBCCWHuWc/Q7dg46iRzbm/pt5zzhO0HkY1DIVQIFcKhUQirKIQK4SAKoYgsKHynJq0EjiWE02/hIV9nX9C97e2HdvuozzMfhn6t6bTsnLy9UL2x3i4yTxRChVAhHBqFsIpCqBAOohCKyILCd2rSSuBYQliyBhtr+6gtQ3dh4+Bz+7Wm3VWfbbB3sHGwa7C9/tw2EJkfO2ayJm7kqi2aNwRlblP031dnzZpSp5Tf1eGx22dIHIviu7nQvZmgbxe/+lUEdQ7mqpm6UzM5eweVSNIMIZnKkN492m+/yFyEtmGAzZqr6381GPrbQSnP1uGqm3khdIKkhzcXiuFDiEBzLLrxTB2smotnY9WqCPaWl2dQBKPaRl0LJcDql6h6UU/jzFih9I47ItA2rH4Jm8IQ8LeBTsKIEHQSx/bz7W9H0Ct4GvwBc4VewVoRiAqGgG5g6jBXCE7V/gRQB9qGvRgggk7iMYMfojGeHNgyVmTtTx2mHfcI10Wv8DD07292g8WpiEwWvo9FZNIohBUKYReFUCFUCIdFIVQIRWQT4PtYRCaNQlihEHZRCBVChXBYFEKFUEQ2Ab6PRWTSKIQVCmEXhVAhVAiHRSFUCEVkE+D7WEQmjUJYoRB2UQgVQoVwWBRChVBENgG+j0Vkwuy4Y+TIIyOlnJIBaTVg1wwbn5+JvU89VeqQ12XyWNSx8Ja+8tULNE2v0bSiDoThyScjOPMPfhAp22VSY6BPWAwT14VsNEp/aR2qSMJT7R7BdaFASP/+YmJRBGItUP4ckCPiQrgHlDq4CyhrsaYuno0HH4wAaDmG3yxnmp3E3c8Vd1mqoiZGtY2FJWEXcB6UyCigcV1caKxqG5U6/gj7wU3CqTAbGD4aYy+CPveDM8O1+lKHU2Evjv3ylyP4ZQWn6psnFvDETwm4oRggToXr4qcUzAaCM+N2YwiYHEjspZdG8DDALfHwo8+40Dnn1GFxKiKThW9cEZkwCmENvEUhVAgHKIQKoUKoEIrI5oBvXBGZMAphDbxFIVQIByiECqFCqBCKyOaAb1wRmTAKYQ28RSFUCAcohAqhQqgQisjmgG9cEZkwCmENvEUhVAgHKIQKoUKoEIrI5oBvXBGZOBCzi+osW1bqoOiHMPC8VK849tRTSx3qRFbMKNzL8kzy3HMRLCuK68KHG38Az2QgKj0wV7gQfAngWOwte5Y60FT0mcdOlcheGSyGiUdledyF66+PNMQvC82yoj0aP+zRn+eGNXX4mJWn6vRXZJ2aijTk412+FkHFjDoehoC9KJGhBDAi1MSYHRyLBUthCKjFr7sugloc3YAS4FgEotKXyb4R4Vg0xohgy7ApWBzWa8VcYdoxG7juhRdGLrgggn9V0UmcCg6PmcSvQVddFcHkXHttBCNCY+yFLuKmYGLRZxyLJ+fKKyNojL1Qzewzi1MRmSx8ZyZsnbC1iGwUWeUrhD1/UAirLFcIN6AQKoQK4fpgr0IoInPBd2bC1glbd1lX+WwUG32gyFIhq3yFsOcPCmGV5QrhBhRChVAhXB/sVQhFZC74zkzYOmHrLusqn41iow8UWSpkla8Q9vxBIayyXCHcgEKoECqE64O9CqGIzAXfmQlbJ2w9mqh/Rm+s96IBdolsTWSVrxD2/EEhrLJcIdyAQqgQKoTrg70KoYjMBd+ZCVsnbN1lXeWTXwdb8HnUB5GtlYfroCZuiuBY/bKUu+vQAJdhIc2xyAKaC2lmN/YpkV0yONV2ud7j9pk3RlAyIQ1xoZl/WQZgb9+H77+/1MHelStLHSyFCk393e9KHdwjFJ8kF/CkPZb7Mtdn3pZ5JAN+lInx4plEYIC4Lhb/hIg2dyGNNzniiAhMG2KCNUgx7ewzRAVGhKIf1fbtt0egBLmUIj3t4osjZ5wRQQGN6+JC6OQtuc5kv+i/5poIju0LIUaEXo215irO3B/CrenhuC7MBDcURoQLoc9wS3TyO9+J9P0Qx2IIeIK7+sTGmFgso9qfKwwfp8KIcBdwqr7/YybzprDAFJHJghcuYOuErbvA60Z97XwQ2VpRCBVChVAhVAjzzP0h3NqVHIVQIRSRccALF7B1wtZd4HUo1eq97dfBZ5GtEoVQIVQIFUKFMM/cH8KtXclRCBVCERkHvHABWyds3QVeN0rzBtvbDyJbKwqhQqgQKoQKYZ65P4Rbu5KjECqEIjIOeOECtk7YuqF2OXjdbIW24eucH0S2VhRChVAhVAgVwjxzfwi3diVHIVQIRWQc8MIFbJ2wdUPtclVVxi2DjfXewVe0EdnaGDzisw961OJ472N1xP33L3VwLMrLUm6sg7K+4fA6jz9e6qCsx3XppWk17BVV85Q6zz9f6pQ9M8ux2Gl0owkIbSs7lzo//WmklBcyceZddy11sE4sGnPaKc931cGSfqX8rA5+LIAvwMQA79HLMrnG7F13RTCEFSsil14awakgdXj44Ydr1kSaG3p0JvbizOgz5orOg92oa7HeI45F8Y0iuF/WIyi++zaFsh6eBkPAiPoOgNnA0pG4EM6MvZgcuDQW/0SfMZOnnBI5/fQIhnDZZRGcCj6MPmNicfdxF2BEuN0YPs6M4WPdVNwFLLIKe8Qz+YUvRO68M9J/2jE5eFTwMGCAuAs4NueZBaaITBZWCSIyYVC5oq5VCBVChVAhVAg5kwqhQigiCwerBBGZMKhcUdcqhAqhQqgQKoScSYVQIRSRhYNVgohMGFSuqGsVQoVQIVQIFULOpEKoEIrIwsEqQUQmDCpX1LUKoUKoECqECiFnUiFUCEVk4WCVICITJ1Zl/PnPSx3UtVwdsZwV2a/Uee65SF9UoHw4FUQFA0CvUHzzzCzrQ3Gxbmp50WTq8Nj13jibezPHZ/LMKYQ77VTqNBd6JhMX4k3ZPYI72Cz+CeJClKvuupqAypcjanq1fh5mgjtYyvOR/UsdrOeJAe6yS6mD273jjqUOHhUMEEu/wh5LuTrzbGRZd8VdOADWqESZi26h+Ma6i3D6q66KoPi+444IuoFcf30EZT16hcZ958F44R7wFlwI3cBsYOrQK3gaGvf3opMYEY5Fn3GPcFMwImgqbgq6geC6sDjoE86M8aLPfSFEcPfhaQiO7Ussnhz0qquaLE5FZLLwtSgiE0chrHO3QqgQKoQKIRv396KTCmEnCqGINPC1KCITRyGsc7dCqBAqhAohG/f3opMKYScKoYg08LUoIhNHIaxzt0KoECqECiEb9/eikwphJwqhiDTwtSgiE0chrHO3QqgQKoQKIRv396KTCmEnCqGINPC1KCITJyr1Qw4pdVBAoypApb7DDqUO2H33CJZ/BM2FopNojIX3Gp2AAsHTHs2EmfzqV6VOA3oVgRFxdVPQnQ14SzOiTLoHKqimn+F4dMu0Giwr2pgYzgxyLwXphDqNTMZennjPSGOA6NUtmfihAcNvrDX+Fg49tNThhXBDXxnh1KEWz1K1XH11BJIDi8MSjjff3FsLFLIBb4EvfeUrkeuu66VvFyjc0UkMEP6AM0OQ4A99m8IAIQx99UJjjAiNEfQKff7WtyJQLyjQWCKK6451KtwU7MUAMXVoPJby4e5j2vGeQONxusHiVEQmC9/syd93YetNYPpdL7KNEoWsQqgQKoQKoULIxhiCQlgHA8TUobFCKCINfLMnVMCErTeBOYVwzgYiS5coZBVChVAhVAgVQjbGEBTCOhggpg6NFUIRaeCbPaECJmy9Cczpe3M2EFm6RCGrECqECqFCqBCyMYagENbBADF1aKwQikgD3+wJFTBh6y4zRjf7Wl+/paZuiY3tllEbRZYiUcgqhAqhQqgQKoRsjCEohHUwQEwdGiuEItLAN3tCBUzYusvsC33IV3wetKm/jto+9KvI1kTIBoVhKsK9JCrmxx4rdVBtlnJk5rY6zzxT6pRyR53ddit1ml7BoLBSaNAs/hlKwL1TmbKmDoUwNaa/guVRR0UaW84RbVciOZOrVpU6cPjGxE6tw/GmTK6fsll+9rNIKY9kApz57LMj6NWTT0aa+3t9ZHmJlG9mDotM9Z/n+LGg7F3qXHRRhKQf8qcTGCDkCn8bqONR9GMv9AlKABND8JyhcEcn4S1Y4BF7Ubhj7VMIMFwLx2JEOBZ7b7ghgiGce24EkoNuQCaxIC/mCgO87LIIXAvB/YURoZPY27/7uL9ojFPhd4crr4xAJr/0pQh+scNeDOGKKyL9xugVnjoYIP6Oss8sTkVksvClmVABE7bu0le4UUY3SghBf6/IkiZkgyXyVL+ABgqhQqgQKoQKoUI42vEUQpFtEr40EypgwtZd+gZYf133nwsr2gaDLW0zka2PkA2WyFP9AhoohAqhQqgQKoQK4WjHUwhFtkn40kyogAlbd4Gzjfo67vahX0W2JkI2WCJP9QtooBAqhAqhQqgQKoSjHU8hFNkm4UszoQImbN1Qe1qrcLXsDRW/UdvxtW4msvURssESeapfQAOFUCFUCBVChVAhHO14CqHINglfmgkVMGHrBmhbtWf9lpp2+8zndmO7pd4ussS48MLI978feeGFCBqDpoAOUTnwwFKn4dFMMPh7W/9Xt1+JlLMzyY4Zcn8dmFjjeCkb5fFM6CIMAQJcyn11UJthJqGLKE3vuy9Sytfr9G/KYBZm4PAPiGAvFPeAAyLwfxyLGwpB+ulPI6VcXqcZ0Z11uIDnyzN8GGI2mnsE8Ij+LvNQpk8+SKinoQSQHJTXWLMRRT9KZNTTWIYRwZn7x6Ix9vYFCc6D4eNUEEKoJoYP08aFIMA4Fn3GqSDeOBYqArnCiGA1uC462Vc+OA+Cfzj6wYVuvz2Cu4BHFHcQx+JR6d8UBNfFXpwZ67XibyGPZXEqIpOFL0kRmTAKoUI4gMNXCAOFcPSxaIy9CqFCqBCKyGj4khSRCaMQKoQDOHyFMFAIRx+LxtirECqECqGIjIYvSRGZMAqhQjiAw1cIA4Vw9LFojL0KoUKoEIrIaPiSFJEJoxAqhAM4fIUwUAhHH4vG2KsQKoQKoYiMhi9JEZk0u0RQbaOOR1D0N56W7BF5+ulIKSdmAlTq6OSuu0YgVz/6UQRyhdUBsUIpFtI85phSh7KRwHmwVCaCbmAIKKiauxAiut12pQ4EqbGpuIPoMzwNveLdL7/MwJZvq/Poo6VO06vz62Aviu2mGwACvDqT5FqgZVmGpwqwfCvAMqpPPRVh8Y0qH1XvWWdFUHzjVH1P6z9n+PkH9TQU6DvfiUBxUcdjtc9bU0VgCNiLY/E0wExwKvQZp8JMIjBPXAgWh4nF8NGNCy6IQGOwnGm/z7gQ9qKTmDpcF8fiucKKrJhnBA8Dfg5Ar5Dzzotg+JgcTDuCv6P8YYXFqYhMFr41RWTSKIQK4WzQZ4VQIVQI10chVAhFZLPBt6aITBqFUCGcDfqsECqECuH6KIQKoYhsNvjWFJFJoxAqhLNBnxVChVAhXB+FUCEUkc0G35oiMmkUQoVwNuizQqgQKoTroxAqhCKy2eBbU0QmTizhyJ3TFXkVLLOZtXgu4Xjyyb2UqQzL+jAx7KVM7pRJxYVM/uxnkV/8IgJPg7eUsqIORAUXevnLIzzVHMNHLqzzwAOlDmSyLM9sH0Gfn3wysnJlpBXXOlyx88AIFOiXv4xAU3/+80ijbUdG0tOwJCkkFjMJ4y0JjkUneVNy+HiucCGUpgRKAG3DKpRY7ROnPv30XnBm6CIqZgRKAD88+ugI9AnHIugV1saEA8CmIM84FmuBwh/gPDgVFP9LX4r0VfOyyyIY78UXR/qmjZnETelLHfbidsP/MTm47qc/HcEtS7niTN6aSo8h9B8VNIZbIjgVho9e5WywOBWRycLXYnJzF7Yeh7YSEKicIWYAAE56SURBVNlmUQgVQoVwHQphL6jUFUKFcBCFUEQ2Db4Wk5u7sPU4tJUAmLOByFaDQqgQKoTrUAh7QaWuECqEgyiEIrJp8LWY3NyFrcehrQTAnA1EthoUQoVQIVyHQtgLKnWFUCEcRCEUkU2Dr8Xk5i5sPRd4QQ/dPmrLqI0iWwEKoUKoEK5DIewFlbpCqBAOohCKyKbB12Jycxe27jLzUh76eUOj6uuo7UO/iixhWOWXd9WBxqxeHSE7R7CeJ5ZwxFKZM3+WAygb5YTMxnPQQRFUfWQ/rJuaSoBFKUF3L9yjuQtnRHYrdVAxYr3DZ5+NwABLuSjT96VVmVPqUHLS08pBEXTjlFMipdxbh31Op0Wf0RhiBhrHi3nu7+W5ci+1PJckRbG9fHmElToKaBSyKHOvuCKCehqnuuSSCE6FNSohV3jO4GmQHAgDynrsPfPMCNQLF4IPozEMEM8o/AHHYoD4deQjH4lgMUzcYFwXNwXjxU35xCciuEc4FWYDwbEYPuYKUoe9GC/+Dbryygg6ib2f/3ykXb26zgknRODwn/xkBA8hbgoe7+uuq8PiVEQmC1+wSa1/LWzdZbq2Gfl1wGD7qAYz9PeKLCUaFVEIKxRChXBDQOxVCBVChVAhFJGNgy/YpNa/FrbuMl3bDP/alEBsMNjSNhNZ8jQqohBWKIQK4YaA2KsQKoQKoUIoIhsHX7BJrX8tbN1lurYZ8nXc7UO/iixhGhVRCCsUQoVwQ0DsVQgVQoVQIRSRjYMv2KTWvxa2bpiuZzZ8HnzF51FtBtvxtW4msuRpVEQhrFAIFcINAbFXIVQIFUKFUEQ2Dr5gk1r/Wti6Ybqeia9Z6nD7zOd2Y7ul3i6y1EnJSalrOCsTi442NXGSVgPVbMQMq4yeFNmuRFJFcGYEK4Vi+A89VOpAVHChwT8Kg38aOlByEsoVbkqC60ImYTW77RZpuvFsnWYvgJajk5fWOfbYUufFIWaOrEMfTg9HXTeHpVNi8cTiuQre9rYIlX55pnuqZrzhh3wmMX4YwnnnRT73uQj2oo6HA6Doh2vB0zDvH/tY5JprIrgQCnfoBP7aoYsYApaOxIVQ5WPFTgjSVVdF4C3oM2wK0o4zQ7zvvjuCPsO00Sv8W3DuuRHsxamguLihuPu4KX+d66ZiJlOfeFNwBzEbGD5mEnehL7FYjxezgW5ggLhQHsviVEQmC1+hIjJxsp5WCBXCEZ1UCBVChVAhVAhFZMHhK1REJk7W0wqhQjiikwqhQqgQKoQKoYgsOHyFisjEyXpaIVQIR3RSIVQIFUKFUCEUkQWHr1ARmThZTyuECuGITiqECqFCqBAqhCKy4PAVKiITJ+rpuZTgyjpojPXhSnm8DszkxSq4Dt7spVxeB2UP2SFT7q5zwAGlDqSu0Yl+js2A0ONS7qqDATazEaBgPumkSEOYCZb0wxAgk41c3VKHNzQXDgW4R3M9SODuOlyftjxZBwbEEYGdMuS0Os2vEvdmYiaXL8+VQhOcimfePgO76FauXOARa5CiMUrk/uKQ8AfshSFgRUcMAe6BBTxhcSjcL788gl7BEL71rQjOjJnE8PHIojH6jOvibxKnglzhWEwO1BrLxl52WQSN+/oEi0Mn+7qIuYKl45Z973sRdBLdwD3CECCTeIBx5gsvjKBXuC7ubzZmcSoik4UvURGZOFHmzlXHK4QKoUK4LgqhQqgQro9CKCKbBl+iIjJxosydq45XCBVChXBdFEKFUCFcH4VQRDYNvkRFZOJEmTtXHa8QKoQK4boohAqhQrg+CqGIbBp8iYrIxIkyd646XiFUCBXCdVEIFUKFcH0UQhHZNPgSFZHFpdGJZzMn1GmK/scywe67R3bcMdKsyhjFd+NasXennUodLHeJKqiUO+qcfHKpg8Xz+tpWyv11nn++1CmvieywQ6TRiZA6XifHi5q/lMMzvWMbeY4bWsrJESyzmZ3EtKN+LuXndbiuZq66yU5yNi7MRGPUk2S3SPOoBHiem1Vz48lpRBRDWPfsVTmjDv9wsNrn7bdHsBeygee7r0ComCGTkDoU7t/+dgTHohs4FUQFvfrudyPf+U4Ew8cAYTVojAvBHrEmJ45FoCKYSQwfwTOK5UzvuCOCPp95ZgQz2V8ZFQ8Sho8Hqb+aK24ofh3ATcFcoTHcEv+cQQi///0IuoEh9Ht1552R7AaLUxGZLHwfJxd0YeuFYMjvyyLbFAqhQqgQKoTrohDWUQjr9NVLIRSRMeH7OKECJmy9EMwphHM2EFnaKIQKoUKoEK6LQlhHIazTVy+FUETGhO/jhAqYsPVCMKfvzdlAZGmjECqECqFCuC4KYR2FsE5fvRRCERkTvo8TKmDC1l2ad/fcu9qN7ZZRG0WWKgqhQqgQKoTrohDWUQjr9NVLIRSRMeH7OKECJmzdZfaVPcbnmQ/4Omr70K8iS4Dzz49geU+27q67iDTF90OZ1ZlTMivqoL5CPb3rrpGZv+QBjXsEqBlYqe8SgT2CxtPOj+TqprgultnEmdGrRq5Cn447rtQhXHWzZ9rN3rMy0DbMcxj+bbeVOk3jZLtMArVGn3/2s1KH63mWIzPJKzNgeWaPyB4ZCmHe/QtzcURaDR4OBI1RE/dNDAt4wgFQqcN5UKn3nadvF5BJjAh7MXwswok+QwkgsVhIE8bb7xX8EOtq4vlGn3FmzCRuGTqJY3FdDB+NcQdxU3DLkP7DgAFef30EtxvWiicH1opO4hdKTB3WIMUNxQKt3cYsTkVkstQv2xYqYMLWXUaZ26jtYFR70N8rsiWiENZRCDMKYcVyhVAhVAgVQhFZeOqXbQsVMGHrLlC1wddR22c+17QNBlvaZiJLBoWwjkKYUQgrliuECqFCqBCKyMJTv2xbqIAJW3eBqg2+LtT2oV9FlgAKYR2FMKMQVixXCBVChVAhFJGFp37ZtlABE7ZuqPVstjIc4/PMh852fK2biSwZFMI6CmFGIaxYrhAqhAqhQigiC0/9sm2hAiZs3VDrWVMibmDUrnrLYPs8m4ksGU49NVLeGKEgESjBfZngjDMizbG/yIRN7b13qfPww5FmFcpg8Cc6A0bUrI0ZbL99BMqHoqiU4yIv/mtQhwr0eB10kmuB5mqfWPsU4t0YfkBr3TGy//6RxtJPqPP446UOTvWia0cOKZG+ee5cIil1KFx/85sIzszx8qmLxrgLOPMLL0QghM39RZL8oWGOihmLQ+Kxg4pAgbBkJdbVRGOU5jgW847yGsfCH+A8GCDqeJwZ40VjuAdWksTEYghY3hMmhonFsbemmUAX4aV4CjGxGBGmDmIGTcUQ8M8ZfiyALmJEMG0MH56G63Zdi3cQdx/jRa+wF2fGAHGhiy6KYCbzyWFxKiKThW/Jzca6EktEWhRChVAhVAgVQoVQIRSRxYJvyc3GuhJLRFoUQoVQIVQIFUKFUCEUkcWCb8nNxroSS0RaFEKFUCFUCBVChVAhFJHFgm9JEZkwCqFCqBAqhAqhQqgQishiwbekiEyalA3YBStXlrlZ1ufikFAv+sMcy5nmmcmzdZYtK3VKOaYTDBArdnIFy5ycvnnCEFatipRyYuYTmWS3DInJQbWJYEQ0fFrrjzI/q4M6dp99IlhWFOtZ4rro5Jo1EcK7AGI2sBIslj9sCGtFJ5sfC7qOt3cmG+PMmEmWudAnVNuYO5TXKNzhAHgoYRfoVt/ioEB9X7rmmgjGi2P7FodeQQjhpbgQAufBXvgDZhKNMV5MLKwGQ4Dw40L9e4S96Aa07brrIljAcyx77Bsg1BpnRuP+4425Qq/wqCA4FkPITrI4FZHJwleqiEwahVAhVAgVwlY20A2FsA4aY7yYWIVQIRSRLnylisikUQgVQoVQIWxlA91QCOugMcaLiVUIFUIR6cJXqohMGoVQIVQIFcJWNtANhbAOGmO8mFiFUCEUkS58pYrIpFEIFUKFUCFsZQPdUAjroDHGi4lVCBVCEenCV6qITJyQqz32KHXoh+WWTJedMntmuCglDDAWtMQ6k03jJC+ElUKxvCeKolLujbyyRPaKwD0AHKDp8/11dtyx1IFblmWZBKtfYqnM3/2u1EG5xU7SasLxmlt2ZCYGiDOjV2V5iWCAeQcbqbuxDsxzLsLTsMQu+nzEEZHmDvbGi3nG0q/4K2OpikIWZS6cB5522WURnArLMMIuoEA4MxrDPGEmKNxxZvQKRoRToRsYwve+F+kPEKKCtUAhKph2jAj/cOBUkByYJwYIX8J1cSqoNSYHyofZwJnxl4PGeJBwuzFe9Krv0nja0SusE9t/kHB/EfwR3pq2nGdmcSoik4Xv6uT4Lmw9F+vrkE1m1ElGbRfZwlEIFcLZTiqEVRTCCBorhAqhQigiCwTf1QkVMGHrLusqkLmYT5syutmo7SJbOAqhQjjbSYWwikIYQWOFUCFUCEVkgeC7OqECJmzdZV0FMhfzaVNGNxu1XWQLRyFUCGc7qRBWUQgjaKwQKoQKoYgsEHxXJ1TAhK1HE3VIfp3Z0raZ50ZsH9pmsFFky0QhVAhnO6kQVlEII2isECqECqGILBB8VydUwIStu6yrQKrPg6/4PGjT+Trn4aMaiCwF6B6pBGD3TIIiuFmwdFUdlsjlwTp99QJ33x1B+dFweebSTK/on/nzHtBKQudYFCc4FRojWHUTVtNc+vzM9+usyeU9UbheeGGklIsiUyXCJVjvqIMhnHdeBLVoKb+JpIhyNgCXJF2TCVBAku0ynNjo5G67lTqcuvyzwtq2rHpRfGOtyL7GnHNOBCul4o8BgoS/HKyNiUoddTxW+8ReWA3KeuxFJ7/73QhkEn9IECRMLI5Fn+FpGD46iT8V7L3rrgjO/J3vRGD48EMMAQ8Whn/KKZGLLopgRDgWI8IdhADDtTBAHIsB4kHCzwFojKcdf7H4OQAjwsOAM+c/OixORWSy8P2bUAETtu4yXa0N+Vx/xXYwqlm7fVQDkaWAQqgQKoQzKIQKoUI4E4VQRBaaF8umQfpQARO27jJdrQ35XH/F9pktNYONaNN+ABtai2zpKIQKoUI4g0KoECqEM1EIRWShWSpCOOrrnNvRQGRJoRAqhArhDAqhQqgQzkQhFJGFZmJCOF2hDf88+IrPgzb42jmkPbzeWG8XWQoohAqhQjiDQqgQKoQzUQhFZKGZUcGZ9KECJmzdMF2hDf9c024fumWwfbBxsGuwvf7cNhDZMvlFHdS1TfF9SyZk44EHSh2c+bHHSp1SHsmEeaJSxSKcxx0XaVahBFdnHo5MwWpALEq5cmWpgwU8yw6R+l+B6X8Inq2DiW3meUVkqtvJAzLZjebYMzKhbSio5vg5YL8MfWllJvaedlqp84MfRJrZOCuT5kkDjB8aoF54vClm+XPAdtuVOuwV5rncF1lGCayzww4RFtBYsxFLR37725FVqyIo+mFT8Ba4B4JjUbhD26AT6AbqeJgYKnVoG3LDDRF0AxeCeWLq0GfsxV1AY/QZDo8/JMwGZvJLX4r0hRC/neBCuL8wT8wVfkrAhTBAWNyll0ZgnugVbgouhKnDPPdno38hCCEa56lYqIrIZInqYlIoaSI1CmHtS2CdByqECqFCSI2BXaCOVwjrKIR1cCGFUEQUQpEtAIWw9iWwzgMVQoVQIaTGwC5QxyuEdRTCOriQQigiCqHIFoBCWPsSWOeBCqFCqBBSY2AXqOMVwjoKYR1cSCEUkUUSQhGpUQhrXwLrPFAhVAgVQmoM7AJ1vEJYRyGsgwsphCKiEIpsAaCOv7wOi+Dc+7OflTqlPJQ5JbOizgsvlDql3F6HrlXurQOdaMr6ZHcshXpjnbPOKnWwKGMjdeu0sMozmaBZNxXEqX75y1Kn7B3ByoJYDBL36PLLIzvtFMEAqeUv3uI65YVMPCpYaBA29dOfljrNYxZeynnevkTSWpctK3Vw9zHA83OpWyg94C8Lr8wsz8BLOcAIHgYKIVQEftivibEGKcprLP+ImhjXhajAiNAruBb24lQwQCwdCffAmbEibf9CV1wRwR2FEcG04VroJO4Croszw2qg1p/7XATdwA3FLcOIcLsxBMwVzowHCTaFhVIxIlyor3z9YGIRDBB7cV3cFAwBT3taOotTEZks9btYRBYFFK8KoUKoECqECqFCqBCKyISo38UisiigeFUIFUKFUCFUCBVChVBEJkT9LhaRRQHFq0KoECqECqFCqBAqhCIyIep3sYgsCiheFUKFUCFUCBVChVAhFJEJUb+LRWQRgFyVnSNYlbGUYzNfy0QR/MQTpU7jluEPKNyhbU8+WepgJUmW5lx28vrMLXWaAd5V5/HHSx3qU7mozvPPlzoAK94hWKUPM3nEEaUOFAiLBVKu0lr/7d9KnYZfZwJqDLWnJ0iYZ9TPzbPxbCZuCrrRHPubOs0dPKHOoYeWOs2IrsyAbLxLiTQri0ZwbF9F+gqERThhU3AtLDuJ68Ie0Q1cCN0455wIim90A4KE3HNPBGU9fofAupp4sOAP6QAcPk6FP1GsborJwXVxIZwZ18U6sdA2TA4uhJuC+4ulQdFn3G54GkwMvYLho1e4UC20bdANzBUa40JojCHg2O4AWZyKyGThCzY5rAtbi8hGoBAqhBUKYR2FsIpCqBAqhCKyeeALNqECJmwtIhuBQqgQViiEdRTCKgqhQqgQisjmgS/YhAqYsLWIbAQKoUJYoRDWUQirKIQKoUIoIpsHvmATKmDC1l2m66L1ldJgS/11nm1EtjYUQoWwQiGsoxBWUQgVQoVQRDYPfMEmVMCErbvMlkYbvraf2zb1rsF2ka2M5+qgOEEtjuK7salYORPLXTaNV2TCD5uE1cz8cQ6ATDYX6utidiP3PvdcBOumNgZ4ZB10Eg6AmaTVvC7CvelL8EPKxr6lzm9/G5mLFZm4C80yqmsyXaBPZXXm1DpYKPUHP4jsuGOEMrlPiazNZDeaVXN7M9ms14onFsTePfcsdfqlKm0KgtQ3BNTE/b04FawGcoU1SNFJNO5LLLoBjcFsQDXRGGeGmWAv+oxu9CcHq27CTDBeDAHaBsVFJ2GPl1wS+dKXIlddFcFvRRjCBRdEsBfHfv/7Edxf3BTYI8aLm4K5wsKh0EV0EhOLm4IHGBObp2JxKiKThe/MhAqYsHWX6Xps5NehG4e2Edn6UAirKITBCoVw1EwqhAqhQqgQisiCwHdmQgVM2LrLdD3GLbN12oYt1X5+FdlaUQirKITBCoVw1EwqhAqhQqgQisiCwHdmQgVM2LrLdD02nMEutOkcIrI1oRBWUQiDFQrhqJlUCBVChVAhFJEFge/MhAqYsHXDdA025DO+Dj63bUbtEtmaUAirKITBCoVw1EwqhAqhQqgQisiCwHdmQgVM2LphugYb8nmwZbZO27Cl2r9+C9qIbG1st10EzLGwZOrTr34VaY59PJOnKk9nElocCFHBdQd/xrN/zLhugKUEjzoq0j+2GW/QSF2e6pASGQcspNm/EIrPxx6LgJNOiqBxf7y4Lib2/vsjoFHNHrvvHmmIbjQPwx11OBuQye6auk8/XerMxUURrNmIyhUVM4I1SHEsynoE9TQejrPP7gUL4152WQSyAXuExuBYnBkOgCofa4HCH9ANTA6O/eIXI5gr3CM0xnUhk/jxACvBohsI/nIQiNmZZ0a+8IUIVoLFD2kIzoxHBTf0rLMin/98BH3GHbz++gjOjInFHcSp/uRPIlhE+DWvibzudXVYnIrIPPj7hYMvSRGZMAphDUoXhVAhVAiHRyFUCBVCkW0bWt0mwJekiEwYhbAGpYtCqBAqhMOjECqECqHItg2tbhPgS1JEJoxCWIPSRSFUCBXC4VEIFUKFUGTbhla3CfAlKSITRiGsQemiECqECuHwKIQKoUIosm1Dq9sE+JIUkcXmsciyEsmFFi+9NDIWK1dGSF53110jZYdMuS1zfubXmaPr3HtvqVPKzzO5cuZeJYKynpxY55FHSp1Szsq8K5KrjL7iFZGyXQb3KMHqgA0PZSDtP82AH2dwbLgWDy1PZG7NHJ8BuG4ylSm/yGC8ONUvM6F8TSfB091gNjBXyZFHRj72scgnPxn5sz+LvOlNkampyAEHRD74wchxx0Vw5osvjqBwh+TAxCBXrV7WOfHEyKmnRj796cjy5RGsknzttRGM9+Uvj3z0o5E3vCGCJUnPOy/yoQ9F3ve+yBVXRPBvH4YPm/rUpyK4+5/5TASnQicvvDDy2c9Gzj23l49/PIJ/+nGPzjgjgidnYNEzgf+jk9dd1wvkGX2GiKLP+aiwOBWRycL3oIgsNgqhQqgQKoQKoUKoEIrIhOB7UEQWG4VQIVQIFUKFUCFUCEVkQvA9KCKLjUKoECqECqFCqBAqhCIyIfgeFJHFRiFUCBVChVAhVAgVQhGZEHwPisjEeTYDnsqgvE57ZLV9Uwb0ryvzhkKIe7Q6c0sG3Jjp36O05VzrdQ7nYWP0+Zg6O+9c6pSdMuVtkV1LhMTPAZi6m26KoBvNPEMXNwGUqiigsQgnTAxV7223RaAiqLZRmkOfsMDjjjtGwD77RPp7X/KSXv7gDyL9U4Gddor0Gx94YAT8l/8SgT2+9KWR178+cvnlEdwyOC1EFDYFyYEu4oZiHVHcUJwKd7+/JOnJJ0dWrIhA6vrHQp6huP1H9IgjIu96V+Sd74y8+90RGP6hsQYpi1MRmSz8FzjZuwtbLwTT65CLbFv0i/7aBp9qCneFcAuAooJ7VNvgaoVQIRxZbSuENQphR+oUQhFZUPgvcEIFTNh6IVAIZRukX/TXNvhUU7grhFsAFBXco9oGVyuECuHIalshrFEIO1KnEIrIgsJ/gRMqYMLWC4FCKNsg/aK/tsGnmsJdIdwCoKjgHtU2uFohVAhHVtsKYY1C2JE6hVBEFhT+C5xQARO27jJjemunGWwZgGadBvX2eqPI0qVf9D+lEG7pUFRwj1YrhBUK4ehqWyGsUQg7UqcQisiCwn+BEypgwtZdoHD1V3weunHU55kPIkuZ/TKARfDVde6/v9QhPBacmkl2yaD4frEcrQN43eszG8+jj0YIrxtzxSHMcWwwx3V3z2C8bywRwOsu2FyV5RnA6+ZcjfdMBvvtF5mLGO9uu5U6pHvdsnOG3J1JUNdildGjjoqgMareww+P4Nh+3vGOyHveE0GvEFTqKM2PPjqCPv/pn0YwwPe/P4K96OR73xvBdd/85giG0D8We3GqY4+NHHNMBJ3EmTF1mJzXvjaCWwYRxTqxGCCOnZqKoFdojGnHbGC8WGQV3XjLWyK4ELqBU6Hx8cdH8AB/+MOR7iK6LE5FZLLwtZhQARO27gJ5G/W1/dDfLrL0Ga/4VghHixmvqxAqhAMUwioKYR2FsA66oRCKbBvwtZhQARO27tIKHkCzwYf+dpGlz3jFt0I4Wsx4XYVQIRygEFZRCOsohHXQDYVQZNuAr8WECpiwdZdRggdGid+o7SJLn/GKb4VwtJjxugqhQjhAIayiENZRCOugGwqhyLYBX4sJFTBh64Za3lrBG7q3/jCfzzMfRJYy4xXfCuFoMeN1FUKFcIBCWEUhrKMQ1kE3FEKRbQO+FhMqYMLWDUOVr94yoN7Yb1BvrzeKLFV+9KMIeV0G7JtJvvKVSEMuDpk8/HAE7LprpJRfZZ7KPJbpr28J0Pi4zCMZNB4LHBui0nTyx92g8a2ZlRmAU2HqTsxgNnDs5ZkHMgB7f5YBuO4JmQsz/fFm46kSKbdnnssAPHV55mWQybzdH/hA5CMfiaCQhXt88IO99BujrM8SmSZ22GERWFx/ycpLLolg7wUXRLCqKtZcxRKdn/1sBGtUnn9+5FOfipx9dmTVqsjnPhfBypnnnRfBqdBnLDqKif3MZyIf+1gEC3jiVFdfHUEnsbop7tFpp0WuuiqC5UyxFuhZZ0VwXczGdddF0A3MFcaLu9Cf2P79ffvbI9kNFqciMln4RhWRCaMQKoQVOBWmTiFUCBVChVAhFJEFhm9UEZkwCqFCWIFTYeoUQoVQIVQIFUIRWWD4RhWRCaMQKoQVOBWmTiFUCBVChVAhFJEFhm9UEZkwCqFCWIFTYeoUQoVQIVQIFUIRWWD4RhWRCXPCCZEbb4zsskuklMMzK+qgRioHZsrJkQNKhHw98/nM85k+N2U2gb0y4/FQZlJMQXIARDRYsyaykCzvrkG6+eiL2RyszkCAxzrV1yI33xz5q7+KfOMbkX//98h3vhO5554IGiP43eWNb4zAtW65JQKLg3ucfnoEwgBe+crIf/tvEXDwwRHwspdFXvrSyBlnRPbfP4LGb3hDBLzudREcC171qgiA4r7kJZH+sf29uKFgr70ioH/mHXeM/OEfRsC++0bwewe89I/+KIK9yA03RKD0WAkW76f87YDFqYhMFv67ISITRiEcA4VwoViuECqEsyiECqFCKLJtw383RGTCKIRjoBAuFMsVQoVwFoVQIVQIRbZt+O+GiEwYhXAMFMKFYrlCqBDOohAqhAqhyLYN/90QkQmjEI6BQrhQLFcIFcJZFEKFUCEU2bbhvxsiMnEezSQsoG/IPJlZ080DdV7+8lKnKa+jcXNdgG4AVOp9MXsqg+semXk683AG1/1lBhf6RXexUyxn2geLYT6byXmegi5ivOjkWOC5wuSgV5E99yx1GvBc4cwYfsLnOWeDq6riUcHap09k0I3+dXOeoV79pUFXrox84hMRLFn5xVzR8cwzI/2VQqFPaIzlH7Gi47vfHcEAcez73hfB3qOP7gWLYZ57bgQOgPVacSGsnAlPQ2Oc6sgjIxgvVlXtL9GJAWJvagyv+9GPRvAgoRt4GNBn3O6jjorg2cA849j+qTCxWBgWe/EzBGYDc4XFez/84cjHP16HxamITBa+NMHabmSWtWuHT8eo7SI1CmFN7T9PNddVCOePQti5bs4zanGFsE4rgQqhQqgQimxd8KUJOjrT2TXL2oS7t2DQ8xnYqGLU3lHbRWoUwhooEK6rEM4fhbBz3Zxn1OIKYZ1WAhVChVAhFNm64EsTzOjM2iaDXV2gQ0vRjubZ51HNRm0XqVEIawbyMxNcVyGcPwph57o5z6jFFcI6rQQqhAqhQiiydcGXJpjRmbVNBru6dIRw8J/d2jadjfX2tk39oW7cHltvxHbQ7h16YL0R24e2GWwUKU3hnvQLWZpYK4EK4SAKYR30KqIQKoQb0kqgQqgQKoQiWxd8aYIZc1nbZLCrC8xn8LWWInye+VB/nk/j+mvdBl+HtkF7gF2jvo464aiNg88ipalrn8n0uT2DY5HVGVTbKM2TqQhWjys7ZHbNlE9kbqyDkqmUN9e56aZSB4K03XalDs5cyoORXHMVq+U16gX3uKnOsmWlzpjEeq2wiaefjuy8cwR8/euRsksm2X77CJarxdKYpZyTAflc7VYi5O7MsZlr6zz6aKlDKHXH1MEanOOBQhZF8B57RP7rf42cfHLk2msjqNQvuyxyxRURGMKhh0YOPDDyt38bgZnAAbC66YMPRv7lXyI//nHkn/4p8tBDEezFqbD3X/+1F5y5v/cnP4kcfngEUgdwf2FiN+eSs7hll14a2Xx7L7kkgsU/H3igF0z7i6VendWrI9j7D/8QQSexuCsWLIWlv+c9kd/7vcjee9dhcSoik4X/ToK1s/8XGezqMmM+A+rtVauwpnr70I2jGs+5vbNxaJsZOrvKPC7afhj6VbZxFEKFUCFUCBVChVAhFJHFgf9OgrWz/xcZ7OpSaw8+g3ZXvWXwuf467nZsBGwxS7tr6IFo1m7HUYPtIkUhVAgVQoVQIeSZ+3sVwk4w7QqhiMwF/50Ea2f/LzLY1QXaM/g6Hx0a1Xijt8+5cSj9s8150faDSItCqBAqhAqhQqgQKoQisjjw30mwlhs20Nk1S0eT6l1DrWloY3ye+dDZPmpXvbHe3tKerf489IT43G6st4sUhVAhVAgVQoWQZ+7vVQg7wbQrhCIyF/x3EqztZi5a7YEgQZPq7UM3jto+83mwsW4zs6VzLLaDdm991GDvYONg12B7/bltIFIaT0tYBG8hPJV5OrMq0x1g+WYGjeNCa9aUOnOBhVKhIgnn+YOZUzL9Y5PtMuXezPWZGC9PVb4WWV4iY9Ht86mnRgiPxRDGIkfUh9f9euaWDLgwc1sEYvbqV0f22y8CMXvrWyNvf3vk4IMjr31t5NBUPlTbJ54YOf30CCQW/oARXXVVBEuh4sxYOhILWr7rXRGsBTo1FcGioxgv1uQ85JAIJvYd74j0V/v8n/8zcthhkVWrIligFbOBZVQhkxDR/fePQMvxQxp6hb3vfGcED9IRR0Te+95I/9cB2PIJJ0Sw5Cwa41T4PQ+N0WesX5prvbI4FZHJwnemiEwcKFDCIngLAd6iEI6+RwphD4VQIVQIFUKFUGSR4TtTRCYOFChhEbyFAG9RCEffI4Wwh0KoECqECqFCKLLI8J0pIhMHCpSwCN5CgLcohKPvkULYQyFUCBVChVAhFFlk+M4UkYkDBUpYBG8hwFsUwtH3SCHsoRAqhAqhQqgQiiwyfGeKyMSBe6zMHJdB4+MzAHuzCC5nZ57NPJaB8nWLbxbuKPrPzwD0CjkhkyujznHdFZkF5KFMTB3qZ6xu+rKXRb75zciOO0aatU8B1om9t86dd5Y6t98eqde8ml72akVvrqi4ASwGNBea+clgkN9m+uMNUF0fdVRk330j5JprIpCciy6KXHBBBK51/fWRK6+M4EIXXxy5/PIIHA8KhMIdDoAFHpG+MGCAX/xiBHvRZ4gKDAFyBW17yUsi/+k/Rd72tsgb3hC5+urIt78d+f73I/gzwwK1WNr4L/8y8o1vRPDnjTVmsRAw7iA6+Z3vRHD3v/rVyHnnRXbbLfKP/xi54YYIRoRFR7FCKcaLC/3oRxGsMYuFYR95JJJ/sSxORWSy8LUoIhNHIaxpJbCOQtgRJIVQIVQIFUKFUETGhq9FEZk4CmFNK4F1FMKOICmECqFCqBAqhCIyNnwtisjEUQhrWgmsoxB2BEkhVAgVQoVQIRSRseFrUUQmjkJY00pgHYWwI0gKoUKoECqECqGIjA1fiyKyhXF5ZKpEyq2ZPiEqWNMOCxyWcmPmuDooex58MFLKlXV+/vNSB16KZerKXhHUZr/9bQSLBZZybR0YAqq+ZiHNBzJ3ZE6uc9ttpU55XeY1EajXo49G4Bq/+U2klJ/WeeKJUmfZsshJJ0XOzyX9cAcxORwRF/A8MbJDieQqo3vuWeqQrkzOxV11UMc+9liklCfqoH4u5bkI1orESqGQDTx2kLq3vCWCiYYu/u3fRu69N/Ld70buvjuCvXCe//N/Iv/3/0bQGN1A4+99L/J3fxfBsffcExmrV2Odqt+4fyy6gQH25wpB4x/8oBf0CkNAY3TyTW+KQK0h3sccE/nwhyPwcKxQCvATBjT10ksj2IvfSvB3lI1ZnIrIZOHffrK2rO2ErUVkM6AQKoQK4QwKoUI4os9o3D8W3VAIFUKRbR7+7Scd6+vsGjD9PwiaBBO7kMjkUQgVQoVwBoVQIRzRZzTuH4tuKIQKocg2D//2kxnrG/rfBhVCkcmgECqECuEMCqFCOKLPaNw/Ft1QCBVCkW0e/u0nCyWEuYjAhq91y5rBduyqN2LXDO1Rgy0iSxSFUCFUCGdQCBXCEX1G4/6x6IZCqBCKbPPwbz9ZQCFsN9afa3kb9/PM18FnfMUukS2QNZF9Sh3oRLOgJYiFJbmTi47+MpMsz5CrM2Nw//2R8dgtA5ZhldFcknR5f0RddsyA/nXJ6swjGRj+0xnwcGQ5BrgmEz8H1GcZG4732Ayu2z8W3J15KnNLb23bcn5v9dr+dVFtYxnGr30tgiL4Qx+KQBfx2wkuhDVI+zKJnHNOBL/o4FT44eEd74jgzP1uwJb7eec7IxBvLByKC/X3opMIfu76kz+JYKlfKP2XvxzBXuTccyMrVkTQq8sui7z1rRF42iGH9ILZwHOFNXax993vjuCXJDxIWEUW9xeLrOJ2Y/VaJI9lcSoik4WvxWSSQjjYuCnbh34V2cLJAloh7KAQBgphzfkKoUK4PgqhQigi48DXYrJEhXBmywzYLrIFkgW0QthBIQwUwprzFUKFcH0UQoVQRMaBr8Vk6QrhgM4ukS2ELKAVwg4KYaAQ1pyvECqE66MQKoQiMg58LSYd6+vsGjDU34Z+XjvNWJ9nPsz5FbtEtkCygFYIOyiEgUJYc75CqBCuj0KoEIrIOPC1mLT/bRD/nbDPUH8b+nlG9gYMGmBXvbFqsqFNZ4vIlkq/VE0GT/YMWHcQe5sz35TZeHihOfbiuij6E/Y5WLkyspDwuk+NoyJdds3MQazneUuujFrKs5kuXAs04XiT7TZhLdDdM4DXPTXzi8w49Puc1+UjilL1f/yPCGpxVNvveU/kyCMjKJEhOX/8x5F+PY2VJPvqdeCBEQwBfcaFIAw4MwK3hORMTUV+7/ci0NQTTohccEEEZ4byHXFEBAYIb4F6Ya6wF8een6v3fvzjEdwUaNvBB0f+/M8juC6CMyNojJuC4Kbg7p9+egQTiyFgcvBs4KnDn8ZrX1uHxamITBa+NBeJ6aJRZNskS9U+KGQVwgWD1x2o4EwUwnmjECqECuFMFEKFUGSJwJfmIjFdNIpsm2Sp2geFrEK4YPC6AxWciUI4bxRChVAhnIlCqBCKLBH40lwkpotGkW2TLFX7oJBVCBcMXneggjNRCOeNQqgQKoQzUQgVQpElAl+aIjJpslTtg0JWIVwweN3aBp9SCMdAIVQIFcKZKIQKocgSgS9NEZkwKDDGY4/MHIRscOccXBnZuUQSVttdxmrc8GSmy36Z8uNMnwcy47BLBqSolHJDZBzJIf29m0L3zP1VZDftdgc8VbdXc4DSHEUwVARFMNwDNfEf/VHk+OMj++wTwYWgi696VQRuieL7la+MYO9++0XQSXTjDW+I4MxYoxKdfOMbI5hYrLqJ2Xj96yNofNBBkQ9/OALHw0zC01796sh//+8RDD81hmKGXmFEWO1z//0jf/iHEdyjvgGicX8vgm7g1xDsxRqkeK7wt7Dvvr3kiFicishk4WtRRCaMQjj/xg0K4WgF6u/dFLpnVggVQoVQIVQIRZYWfC2KyIRRCOffuEEhHK1A/b2bQvfMCqFCqBAqhAqhyNKCr0URmTAK4fwbNyiEoxWov3dT6J5ZIVQIFUKFUCEUWVrwtSgiE0YhnH/jBoVwtAL1924K3TMrhAqhQqgQKoQiSwu+FkVk4jySeSoDPpHZFC7NPBNheX1yZhPYAatfPpbprzN5fwZgJpOpzBxAF8cQQorKbiUCOM9YdXMT6K9uyutenenfheDSSyO33x4pr8jwQTou8spSZ889I88/Hyl7ZQ6M/Pa3kVJuzfwy8rnPRVatiqBEPvTQCIrvt7wlAvfAkC65JPKFL0SgfDjz4YdHIAzoJNaZhAFiPU/06rzzIjgVrnvOOZF+YwTz/MUvRi6+OHLaaZFTT41ggFNTEXgLrAaryCIYEYJFOLFeK5YkhR6jGxgg1Bp3/7rrIg88EMGPNNiLPPRQpH+qf/zHyA9/GPmnf4rg2H/4hzosTkVksvDVnhy/4390wtabzLraSWTbQyFUCBVChVAhVAgVQhFZHPhqTzrW19k1gHXRXMynzfzB2Rb25CILiEKoECqECqFCqBAqhCKyOPDVnsxY39D/NjhPIex8bZmzwVgs7NlENh8KoUKoECqECqFCqBCKyOLAV3uy+YQw6qV5N6i3D9042D50S6f9oEG7fdRGkYVCIVQIFUKFUCFUCBVCEVkc+GpPNpMQri+Thn0eunHUZ3yY//Y5P898xQd8FlkoYESn1Pn1r0udF//06nCF0r0jeJWX8psIhCGDqqCUn2e+nvlVJtzyootKnVK+UufII0sd+AOO/fznI7/7XeSb34yU8s06WB4P66ainoRO7LRThDNZ3pa5PnNC5qEM1Ou5OmecUeo0khNPzi23lDpsvDxy5ZWRUh6vg2qzlNvr7L57qXPWWRE8dY8+GinlvkwMobmDx9Q58cRSp5SbIlMlwt87jsik8PcrVwSNH3wwghIZ04GggH7xlVwnK2buRTd+/OPIv/5r5F/+JXLPPREci8a40E9+EkHjf/7nCHz4kUci+FcGM/nwwxGMCKe68cYIlvc888wI/B97+7OBbqCTGD6OxZkx3v6Zcar+sXjMxupVfy/uPu4gbgo6iTNnWJyKyGQpXTZdCGvq7VWrIeo1Z4MOoxov1HaRBSdqYoVQIVQIFUKFkEaEESmEnWPxmI3Vq/5ehVBkK6V02XQhHPUZoM3gQ3/7gDzZ8MYbvX3mc31mkYUlamKFUCFUCBVChZBGhBEphJ1j8ZiN1av+XoVQZCuldFlAIay/jjKrUQ1GbR+6cVTjjd4+50aRTSRqYoVQIVQIFUKFkEaEESmEnWPxmI3Vq/5ehVBkK6V06VhfZ9eAUYq1dpqh29sGnc/4MKoBvs55Qnytt6ONyIIQNbFCqBAqhAqhQkgjwogUws6xeMzG6lV/r0IospVSurT/bRD/nbBPq08wsdrH6r2jGtTbR20c7ELL+pDBLmwcfMbXtrHIAnJinZNPLnWwruaKFaVOKYfXec1rSp2ye6asrLP//qVOKUdHXlSmOrtkyo/qbL99qfOud0XKAZFdd43ALs4+O4KKopQX6uy7b6kDEYU8Q0RxoZe/PAJ/2G+/UmeXXSKUuoNKJF0aiwWWnTN5quXLS52yXSZ/O9htt1KnlJ9msI7ohZmjInuUSM7k44+XOitXRprfDs6q88QTpQ4c74UXInhEMRu4C1iUsayNNH9WqyOop1HmojRH1QtfQmOkX5qjcX8vKnX0GSPCdfF3Ndax6BVOhcaYnP6IsBenQmPsRTdw3X764+0/DOgzGvdPhQep71o4VX82+sf27wKO7d9fTF3/mezOFYtTEZksRUQWG4VQIVQIFcKmNO/v7RfffcnB39VYx6JXfWHA5PRHhL04FRpjL7rRWl8n/fH2Hwb0GY37p1IIq7A4FZHJUkRksVEIFUKFUCFsSvP+3n7x3Zcc/F2NdSx61RcGTE5/RNiLU6Ex9qIbrfV10h9v/2FAn9G4fyqFsAqLUxGZLEVEFhuFUCFUCBXCpjTv7+0X333Jwd/VWMeiV31hwOT0R4S9OBUaYy+60VpfJ/3x9h8G9BmN+6dSCKuwOBWRyVJEZLFRCBVChVAhbErz/t5+8d2XHPxdjXUsetUXBkxOf0TYi1OhMfaiG631ddIfb/9hQJ/RuH8qhbAKi1MRmSxFRBab3sKSpZxa5/vfL3Ua97gpsyayX4mUR+rQPcqb67Doz2q7lEczP8s8kPltndWrSx1oG/rcX0izWZH13+r89Kelzh57RLCQZnlR1eqUezM53n1KhGuQnpQ5ORPzDKfdeedSB0s2wtKxzmIph0YOLJHytcyqzN2Ze+qgjsU6onfeGSnlyDqHHFLqrFkTKeXpOjjzsmWRsn3kttsi+J0FP6zwVKhcUSKj6kVwLGrifrXdPxWORfqlOfaiFu8H3egH4+2fCr1qz1YH4+3PVX9vf67Q53aq67TTVQf6hPVp27PVQa8wsTgzrosB4licGdft30HsbW9TnbFOlWFxKiKTpYjIYqMQKoQKoULYnArHIn3JwV6U5v2gG/1gvP1ToVft2epgvP256u/tzxX63E51nXa66iiE8z9VhsWpiEyWIiKLjUKoECqECmFzKhyL9CUHe1Ga94Nu9IPx9k+FXrVnq4Px9ueqv7c/V+hzO9V12umqoxDO/1QZFqciMlmKiCw2CqFCqBAqhM2pcCzSlxzsRWneD7rRD8bbPxV61Z6tDsbbn6v+3v5coc/tVNdpp6uOQjj/U2VYnIrIZCkistgohAqhQqgQNqfCsUhfcrAXpXk/6EY/GG//VOhVe7Y6GG9/rvp7+3OFPrdTXaedrjoK4fxPlWFxKiKTpYjIYpPLe5bHMyEqv/hFqVPK2REuK/qDOnfcUepACHHmZ5+NlNdEjj02UspFGejEjZmrMz+uA0878MAIiv6ddopg+LCp++6LYLFTGGCzBGvMJNYChabC4anl4/FkZnUGPJHpsiyDhVIJnskeaxPu7l53zz1LnYb+8Pt0B9ivmPuFe1sW10Fj1MEPPBDBhVBP94tvXKh/XeyF4reHd07VFxXsRf4pV/tsp7oOGvdn4z//58iZZ0Z+//cje+0VefObI6ecEsHyxB//eOTCCyOHHho57rjIW98a+au/iuDfvuuui3z1q5EPfjBy0EGRffaJfOADkXPOifz5n0empiKYDQzhyCMjBx8cWbUq8pa31GFxKiKTha9F8h/dLDxD6oeJMLx0EZkICqFCOAqFsKY//D7dAcJ5Whupg8atBNbp25RCqBAqhAqhyBYAX4ukY32dXeuZozAYxjybjcWc55yzgchmRSFUCEehENb0h9+nO0A4T2sjddC4lcA6fZtSCBVChVAhFNkC4GuRzFgf/sPgYOMcoBgYUhs0zKfNuMx5zjkbiGxWFEKFcBQKYU1/+H26A4TztDZSB41bCazTtymFUCFUCBVCkS0AvhbJQgohtgytGeqN2D74jK+jDqkb1B/QcvC1s0Vks6IQKoSjUAhr+sPv0x0gnKe1kTpo3Epgnb5NKYQKoUKoEIpsAfC1SDaXENalwjw/z3zA11Hta0Y1GHry+ZxQZLNyeQQFNOvpZzPdqjfNc9myXGhxPG/pG0KoJnfOsTeHn/bY9Bnrl4LHMvDSD2ey8VSJUNqfybwr83DmoczTGXBa5peZFZn7MrDHvO4URoQnZ1Xm8Az4VQaN0Y2nMtdmYjaa+5tMYQh5Zu79cQbdmPkDmU3WpuWiiyIoc88/P3LqqZFPfCLy0pdGjj8+csIJvVx6aeSaayLY289ZZ0UuuCDy5S9HTjst8oUvRDDAK66IYOruuSdy8cURzORll0Uuv7wXHIvrolc481e+EoGooJO4LoaPm4J88YsR3BTY41VXRbCy82c/G8GZL7kkghF97nORP/3TCB6G97wncvrpEcwzfhq89toI7tHVV0fyLrA4FZHJMvOaHc1mFMLNun3oxlGN6+2j2ohMjDSiZY0E1mFZn2UuUQgVwsGI8OSsUggVQoVQIVQIRbZNZl6zo9mMQgjQAF/H3T5046jG9fZRbUQmRhrRskYC67CszzKXKIQK4WBEeHJWKYQKoUKoECqEItsmM6/Z0WxGIcw96xnlY+NuH7pxVGOFULYo0oiWNRJYh2V9lrlEIVQIByPCk7NKIVQIFUKFUCEU2TaZec2OpmN9nV3r6cjV2mnaXfV2fJ750G4f+rlm6ElGbZ/PCUU2K2lEyxoJrMOyPstcohAqhIMR4clZpRAqhAqhQqgQimybzLxmR9P+t0H8d8IeM0I1oLN36MZ6e71r5nO7fbAXDDZib2d752wiC84dmSxVWW0D7EURDGBEMMBbI1Mor9GryzN9oE8A/tAPXKvPo3Xuv7/UKeXETJ/QCSyF2vBcJrQN+nDvvZFS7qqz336lDlZSLOWbdbbbrtTByoK//W0EKyneeWeksda8+8vwq0Syd6avbTtkcObtMztlcCzYI4NjceaTT45AJ1BeY3Fb7MWxH/pQ5JOfjHzqU5GTTorAEHAh2AVq8de/PoJaHIaAPkNUcGYsd9k3sXPPjWCAH/lIBD58+OGRM86IQMxwLFbO/MlPevl//y+ChVKxyCoa428SK6PiWFwXC6VirVfcMmjqMcdE3v3uCBb/PO+8CO4+1j5FVqyI4C5AU3FmrMiKf3TyQixORWSy8B26xFHhZCmiEM4/CqFCqBAqhAqhQigiCwnfoUuQ+j/0KYSyFFEI5x+FUCFUCBVChVAhFJGFhO/QpYn/C09Z0iiE849CqBAqhAqhQqgQishCwneoiEwchXD+UQgVQoVQIVQIFUIRWUj4DhWRSYMieHkGe3MxzDlWZSzHZSBXPaAiWCyQa3Kyk89mcOrMdhme6s7MDRkMEODYWzJ9cObuiPp9nioRggvBxJAxgHnOtTBsj3e9K1LK2ZngiScipVyZwc8QL2TSHgHnGfwyg58hMPz8W0AR/JZcdPSjH43cdlsE3oJj/+zPIp//fARW85nPRCAM//zPEawG+apXRbB0JPj3f4+8850RaCqGgDUqjz468v73R048MYLG73tfBKu5vv3tEaj1YYdF3vGOCCYHTzAuBFHBdXFmXBfBw4AcfHDkj/848qY3RfbfP4IbiqVfP/3pyOrVkR/+MPK970W+9a0IHkI8/O99bwTriH7wgxHsxeKu+XsHi1MRmSx8TYjIpEGZu1whrE8FqVMI54tCqBAqhAqhQigi84GvCRGZNChzlyuE9akgdQrhfFEIFUKFUCFUCEVkPvA1ISKTBmXucoWwPhWkTiGcLwqhQqgQKoQKoYjMB74mRGTSoMxdrhDWp4LUKYTzRSFUCBVChVAhFJH5wNeEiEyclCsWsiigr838uLusKIAgbTxr1kQ2iddFUAOXcmzm+AyINVdXrix1Srk0c1LmbZmfZi6vM8cqo1BcsEumHJm5K4K1MffPlJ9ngmeeiZTdMjjzrhnwsggndt9M+Xomp315/t5RTu0FjV+R2SeDAeIucEnSnOcvfSlyzTWRj388ggL6m9+MYL3Hgw6KvPGNkQMOiMAB3vCGyOteF3nNayJYVhSnOuSQCFQEA8TSoPBDNMbCkvCW//2/I1iD9MtfjkAYvvGNCG7K3/1d5JZbIlgK9W/+JvK//lcEjbF8K+4vJueOOyJ/+ZcRaNvXvx65+eYIeoXJQTeuvDKClWAx3q9+NfIXfxGBtOPPG7nssgh+4LjxxshNN0VwB3P4LE5FZLJMv+xH8h9r/6MTthaRjUIhVAgVwmFBY4VQIVQIFcJ58GL5Ogj3bRVs9QOUyTP9sh9Jx/o6uwYM/v/F1/9f47FxhjxufTNumt3Ig0ecGQe220e1aTdiS/1VZNNRCBVChXBY0FghVAgVQoVwHmz1vrTVD1Amz/TLfiQz1jf0vw3OUwjn/xUM3Tuzceiu0mwffJ3P9s7nUYeLLBQKoUKoEA4LGiuECqFCqBDOg63el7b6AcrkmX7Zj2QRhbA0DYaKXM1Gt28bYFfdoG0ssokohAqhQjgsaKwQKoQKoUI4D7Z6X9rqByiTZ/plPxKFUCGUzc+eGVTqEIYsvlEVlJ0zO2bAXhlyaCQb33tvhOX1gSXyxgzOnHu5bmqeCotBNme+O7J7ibw8gz4vT/c4ILN3BlOHaccAYYAzfjIbLEPIIeBU6AZ+LMCFcCw7eWsEvoQnJ/vMM2PqSIzopJNKnVLeXAerErJXUxl0cr9MnvnZZ0udUg6LQCdQqd9wQ+S88yIXXRSBEnz2sxH4EkpkrAwLJTj99MgZZ0RgNegkNAaLUl5/fQSN4QAYL1Tki1+MYC8utGpVBJNz8cURNL788gga41SYWJwKA4Q+nX12BI6Hee6vq3n11ZGvfS2CC2FE6BU8HLOBbqDPuAsIOokb2r+DuXAo7z4a568DLE5FZLJseGkPY9OFsKbdiy0ADQZfcdpR2zccmbvqjfgwoN3VfhBZIPZUCBVChXBdFEKFUCFUCEVk8mx4aQ9j04Vw6OdRW1qGatioA+fTpgw7Z9t46K6Zz21jkU1jT4VQIVQI10UhVAgVQoVQRCbPhpf2MBZQCOf8OpSOmLXM8/ztOduWQ3cphLJ52FMhVAgVwnVRCBVChVAhFJHJs+GlPYyO9XV2Degb2jzNau002FJ/HTCq2Xy2z+fzzNdRVxfZWPZUCBVChXBdFEKFUCFUCEVk8mx4aQ+j/W+D+O+EfVp36rjWKFoHm9lSM9heN6u3tI3rvYOvaDCzEV+xRWSTWZbZLcPlHyEMIPe+skTGAtV2LuBJE3tZZPfdI+gV6liOl9d9V2TPlGdMDo6FTmyfgWlTJ3Iv7lE5qg5sopSjM7dE4KV7ZHJVVaxKSKnjbwcJ+3xc5tDIXqG4Dz4YaXhbJH+koKaWD9e5++5SB09OOShTVkQ4ogS3G8GzgT8NSE6Wqizc4XgooCFmKOthgKi23/e+CKp8XLfvANgLnYAvXXhhBCLa90OMCNeFiuAXrL4C4bqQDUzdBz4QgS9hRDD8z3wm0pccrAWKicVMYq4wOVjOFI0xfDyTGBGCxT8xBHQDDzAWhj3rrAhuN66LTvY9/NZb67A4FZHJwleqiEwalLkKYVxXIVQIZ8MRJa0E1sGzoRAqhArhTBRCEVEIRRYflLkKYVxXIVQIZ8MRJa0E1sGzoRAqhArhTBRCEdlihHDwP9ccwBYiWy0ocxXCuK5CqBDOhiNKWgmsg2dDIVQIFcKZKIQissUIocg2DMpchTCuqxAqhLPhiJJWAuvg2VAIFUKFcCYKoYgohCKLD5QAhez+me2w3uMnMifUue++UqeU4zNhNayYIQypbcuwFmg5MZPHJscfH8EQ7r+/1KEu8swnZ74WwVxxgN/P9Po8h3nyzKdGBvduJnndV7yi1KHSw4jY52szZ2QworMiB+YKrrn34YdLnVLOzjyYyb28ZdlnXDcbn3JKhH8LPHOuE3tIiZRzMpiN8yOoa6FeWCzxtNMiJ58cQQF95pkRVOpojNL8L/4igsa47ic+EcEQUKnjWEgsXAt70UnYFNwDc4WFUmHaGMLKlRHoxPvfH7nkkgjME0u/Ygi4v9BUnAqNIYQQ0XPOiaCT/W5AF3EXcCHcX6wFipvypS9FsBciCnvsn/nGGyO43ZDJfJ5ZnIrIZJmudURkEVEIFUKFcDoKYUQhVAgVQhGZCNO1jogsIgqhQqgQTkchjCiECqFCKCITYbrWEZFFRCFUCBXC6SiEEYVQIVQIRWQiTNc6IrKIKIQKoUI4HYUwohAqhAqhiEyE6VpHRBYRlrn3ZLKQheQsy8BbUE+XiyI4dnkGGoPrUnKSV2RA6hP/P84kmA3UVw3fzFyd+VXmgcwTmdszC8hTEdyFpJmNSbFLZBn9v8fzz0cIx3tU5rQ6O+1U6pRySiaZyozFV74SQaUOJYA9omLGXhTfKOuxriYWeIQhoOjHsqLQGJgYvAVl/f77R17/+sihh/by2tdG+heCAWJisYAn/AHssEPk938/csQRkcMPj/z1X0fe8Y7I3ntH9t03ss8+Efyis9dekcMOi7z61RHsxXX/4A8iGOCb3xzBED70oQju71veEoF4/+hHkdWrIz/8YeTggyPvfncEq+Zi+K95TR0Wp7LlcbNs1fDf2OTv1/x9J2wtIhuDQjgahTBnY1IohAqhQqgQKoSLx9oX//mfzRbylQIhWxf8Nzb5/+2dT4he1R2GfwzSRemiiHRdhi5iKUWkZFFKESn+KSGEWZQSShxKqCWUEkMNpcSiSURjjH8RDAUl4Eak1FgrZCNkI4xQZJal2cyqSBclSxchTebOHH7vc+493/c5882dGd6HF/nuOeeee865k5nzZOSkYX2NqkLvZgaFHXrfBr3lKKxv7y2pP2R6C0s5quqSQmlvzCxYCIexEOpq7BQWQguhhdBCaCEcj4aYjXVJgTD7C36PVTrr6/3d4JRCOP1lTb0F+tolQx8yvYVRlbcvjZkdC+EwFkJdjZ3CQmghtBBaCC2E49EQs7EuKRBmf8HvscouF8LyuS6sS3o/ZHoLY7i8o11rzBRYCIexEOpq7BQWQguhhdBCaCEcj4aYjXVJgTD7C36PVUYXwvLf+rKuyp/rkt4Pmd7CGC7vaNcas2W4gcZ5jwq0bQIrmlXNPzV/1TynAX/R/E3yQEi+K1laksSiJq5opOf334+c+J4m/iM5EBIiPZ84ETnxfQ2k/QeRs7goqc4RvS7Re9nzDyPnnnsk7BnneeqyY1cPw8cWET1zRj/SQMsPhkT/OgDrzOfqFG7dksSPJWtrEvR87VrkxE80hw9LHn9c8sQTkuVlCXbqjz4quf9+CcBZkc8+K8EBnjhmEzJ5+rTkvJ4UeuqUBM9Fzp6VPPOMBOemnjsnwTGqbWtt12JGTz4pwYOwdBgzVgMTxLmaSHuCGDPeEUaFv9B6/nkJGuOl4LnoCofK4l68MjTGlxlq8VzU4uRbBO8XC6vz5eZ0L3DWmH0EfzwpWxfCTF2LEtA1KM1wWVcNFfZ+yPQWlnJUlcJShRJjtpUFC6GFcDMWQguhhdBCeMZCuCvghtqYvQx/PClbF8Lez0MloDTIJlZ/aJR3n+uq3kf3FtYMPdeY+bBgIbQQbsZCaCG0EFoIz1gIdwXcUBuzl+GPJ2UbhXDiZU32t9rlusIMGpTPdVVuU+gtrEGzKe8y5uuyYCG0EG7GQmghtBBaCM9YCHcF3FAbs5fhjyelYX2NqkLbnSaqVG+DIalrlNdV7Z5B3WHj0pjtZsFCaCHcjIXQQmghtBCesRDuCrihNmYvwx9PSv27QfyesE0tS7mkrgW9DbrC6avu6mDlgUO3g96qdMdGFUqMmZXDkp9GzhdfSLDNxW4kHpJw46528dZbkTNBJ+JnGijfIznXr0cOej56NHIiHsvBwYqopcZozzjCMOLnmpsa1K5ppOeFhciJOKS5rJHa6l7peWUlcvjFQGvVWsik9ly9hSM5x45FDmqxkUPP1Tta0uhhtvGLnOprUnqu1uqXku+ERGure6XnKkcl2PVi/tipYy/e3gSjcW1fOXC89tYc+3gMA0aEvThGhZ7xbQWNsRoYBp6LUbVXA/eiFqOC5KBnNEYwXzwXXaExjm+F1J08KcEU8BZQi+eiK3wxYMx4KRhVuzGCV4alg6XXa5vz1FMSTF8bc3NqjNlZwhgzNhZCC6GF8G6qtbIQWgg3g1FZCHPwUiyExpgZCWPM2FgILYQWwrup1spCaCHcDEZlIczBS7EQGmNmJHYH+f/J7GALY/YvFkILoYXwbqq1shBaCDeDUVkIc/BSLITGmBkJY8zYWAgthBbCu6nWykJoIdwMRmUhzMFLsRAaY2YkjDFjI3txbFWrbb3sa6ut+a80z2mO5bQ3/dX2Wu794IPIiVhuRiT2wQcjJ+LXmn9pjufwFMr4ew7PAo3f5Hz1VeSg9sqVyEHPlcT+NufIkchBbbWSMJNrGrn34sXIQW21ztIzz9WMEznVSv4u5+DByKnG/Jjm95pbGqnFfhLrTAOMkzn33hs5qK3WWXt+QM9ZjVOSp5+W1FvbHGyv8QepfSglNv3YfLcNEMEw0BV2+ef1mE10hSngEE4oECaIYaAxlg4TRC2ei8YYJOYLL22rV3sl8TWKxlhYjArv98IFCWrbXaEWy45aTAG1WFg8CGuFe9vTRy3WGV6KKejb5+bUGLOzhDFmbDoPLLEQWgg3YiG0EA4Gw7AQWghLUGshNMZMIowxY9N5YImF0EK4EQuhhXAwGIaF0EJYgloLoTFmEmGMGZvOA0sshBbCjVgILYSDwTAshBbCEtRaCI0xkwhjzNh0HlhiIbQQbsRCaCEcDIZhIbQQlqDWQmiMmUQYY8bmfxrZqlZC2N5A/0FyAGdUntYsa9Az3OOPOaurkYPaSjak5y+/jJyIP2kOaVALRDUrBTqTs7QUORF/1mBxpOfqPM+WaUecy6lU8x8auJYc0YkdVHWAJ0YlPVcCfCHn0KHIQW11xqz0XK3zRckdyc+JSxrlIU38W7OsWdW0eT0He2D+scJCn1d9wn4am2Dsp3H6JbbIaAxhwG77pZckUCCMGQ9CV5ArBKKCxYK2ofbFFyV4bntUWNh24/aYsTjoGWvV7hm1mC8kBw/CasDTcIosFhaN21No/xUGZoTTPgG+X+P4afSMYWC+mCCmgKV74YUcbk6N2UccVx5pcmAk+J1Bud2MMWZbsBBaCC2EFkILYbNxe8wWwhzMyEJozKjUQnjj9o2SO5efrn1acsfNjn/zRsmOXfI7g9KwvkZVgf/Y/KR/bn5igwYzPSimeNbEBsZsFxZCC6GF0EJoIWw2bo/ZQpiDGVkIjRmVfSOEvb8bnMaWZnWqWdtncO9WuurYeg/GTImF0EJoIbQQWgibjdtjthDmYEYWQmNGxUI45FRdOX6bVy5zSd0sVzVK8mXpAYX5AxqUy1JizPywEFoILYQWQgths3F7zBbCHMzIQmjMqFgIh2wKopU1rBR2l42qfFmX5BuHPteFKC+FxswR/DjGIZzVOaI3c27ejJyHH5ZU917VSFfYQOPeq1cl1U59LWdtLXJQi7141fNqY9OP+SJ4EEwMZ1TiXgyjOtCyOwC25Krk25FTGeB1jUxwcTFyqum/ngMP5/vlQZrLmpPNMzk359IXfF1hNaopgP/m3Hdf5MS3NBDRb2i08eXLknfflczGeTVA7Gux68W+Fo3fe0+CPTFkA3njDQk235cuSSCTECRYK6wGXb38suTVVyWYIJwWD8K9r70mwQTRGPPFjNrBg95+W/LOOxKoF14oat98U/LKKxIcBIwpoCt8mbV9CYvTfhC6Ap99JllZkeB738cfSz76SPLJJ5IPP5R8/rlkFg4Ys49Yt6RRMi+6rnufN81TO9fKlHI0a5fjEuWlMJPLU6ueTiY2MGa+WAi151ULoYXQQmgh5IzasRDufSFs/O7Cl77cW5frljRK5kXXde/zpnnqkFNN6WBDl73d9hZGVV53MrGBMfPFQqg9r1oILYQWQgshZ9SOhdBC6Etf7prLdUsaJfOi67r3edM8dcippnSw+vaupC4fKoyqvH7WxAbGzBcLofa8aiG0EFoILYScUTsWQguhL325ay7XLWmUzItG142qwpBTTelg9e2310FhR6M8918/a+ihQx0as81YCLXnVQuhhdBCaCHkjNqxEFoIfenLXXO5bkmjZF7UT5rpqZ2AZUo5mpUPjWaNwhguDx1GLsSHuhy3GDMP/g9IBVd41hEBmgAAAABJRU5ErkJggg==7f:T2d6c,QnJvd3NlciBIaXN0b3J5IEV4dHJhY3RlZD09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09QnJhdmUgSGlzdG9yeTotLS0tLUNocm9tZSBIaXN0b3J5Oi0tLS0tLUVkZ2UgSGlzdG9yeTotLS0tRWRnZSAtIDIwMjQtMDctMDMgMDg6MjI6NDAgLSBmaWxlOi8vL0M6L1VzZXJzL0hBUFVCV1MvRGVza3RvcC90ZXN0Lmh0bSAtIEVkZ2UgLSAyMDI0LTA0LTI0IDIwOjI0OjA3IC0gZmlsZTovLy9DOi9Vc2Vycy9IQVBVQldTL0Rvd25sb2Fkcy9OZXclMjBUZXh0JTIwRG9jdW1lbnQuaHRtbCAtIEVkZ2UgLSAyMDI0LTAzLTA4IDE2OjE0OjQzIC0gaHR0cHM6Ly93d3cubXNuLmNvbS9lbi1jYSAtIE1TTiBDYW5hZGEgfCBPdXRsb29rLCBPZmZpY2UsIFNreXBlLCBCaW5nLCBMYXRlc3QgTmV3cyBhbmQgVmlkZW9zRWRnZSAtIDIwMjQtMDMtMDggMTY6MTQ6MDMgLSBodHRwOi8vd3d3Lm1zbi5jb20vIC0gTVNOIENhbmFkYSB8IE91dGxvb2ssIE9mZmljZSwgU2t5cGUsIEJpbmcsIExhdGVzdCBOZXdzIGFuZCBWaWRlb3NFZGdlIC0gMjAyNC0wMy0wOCAxNjoxNDowMyAtIGh0dHBzOi8vd3d3Lm1zbi5jb20vIC0gTVNOIENhbmFkYSB8IE91dGxvb2ssIE9mZmljZSwgU2t5cGUsIEJpbmcsIExhdGVzdCBOZXdzIGFuZCBWaWRlb3NFZGdlIC0gMjAyNC0wMy0wOCAxNjowODoyOSAtIGh0dHBzOi8vd3d3Lmdvb2dsZS5jb20vY2hyb21lL25leHQtc3RlcHMuaHRtbD9icmFuZD1WREtCJnN0YXRjYj0wJmluc3RhbGxkYXRhaW5kZXg9ZW1wdHkmZGVmYXVsdGJyb3dzZXI9MCAtIEdvb2dsZSBDaHJvbWUgV2ViIEJyb3dzZXJFZGdlIC0gMjAyNC0wMy0wOCAxNjowODoxOSAtIGh0dHBzOi8vYWQuZG91YmxlY2xpY2submV0L3NlYXJjaGFkcy9saW5rL2NsaWNrP2xpZD00MzcwMDA1MjgwNjQ2MTIzNiZkc19zX2t3Z2lkPTU4NzAwMDA1Nzg0NjA4NTU1JmRzX2FfY2lkPTQwNTUyNTgwMCZkc19hX2NhaWQ9OTc2NDM4MzQyNCZkc19hX2FnaWQ9MTAwODIwMzQ0MjM4JmRzX2FfbGlkPWt3ZC0xMDQ3ODYyMzE4MyYmZHNfZV9hZGlkPTgwMTk1NzI5MjcwMjk0JmRzX2VfdGFyZ2V0X2lkPWt3ZC04MDE5NTgzNjM0MTcyODpsb2MtMzImJmRzX2VfbmV0d29yaz1vJmRzX3VybF92PTImZHNfZGVzdF91cmw9aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9jaHJvbWUvYnNlbS9kb3dubG9hZC9lbl9jYT9icmFuZD1WREtCJmRzX2tpZD00MzcwMDA1MjgwNjQ2MTIzNiZnY2xpZD1hNjk5YmQ0NTA4MDMxYTI0Mzg0YWQ4YWUzZmVjMzNiZSZnY2xzcmM9M3AuZHMmJnV0bV9zb3VyY2U9YmluZyZ1dG1fbWVkaXVtPWNwYyZ1dG1fY2FtcGFpZ249MTcwNzMzMiUyMCU3QyUyMENocm9tZSUyMFdpbjExJTIwJTdDJTIwRFIlMjAlN0MlMjBFU1MwMSUyMCU3QyUyME5BJTIwJTdDJTIwQ0ElMjAlN0MlMjBlbiUyMCU3QyUyMERlc2slMjAlN0MlMjBTRU0lMjAlN0MlMjBCS1dTJTIwLSUyMEVYQSUyMCU3QyUyMFR4dCUyMCU3QyUyMEJpbmdfVG9wJTIwS1dEUyZ1dG1fdGVybT1nb29nbGUlMjBjaHJvbWUmdXRtX2NvbnRlbnQ9RGVzayUyMCU3QyUyMEJLV1MlMjAtJTIwRVhBJTIwJTdDJTIwVHh0X0dvb2dsZSUyMENocm9tZSUyMFRvcCUyMEtXRFMgLSBHb29nbGUgQ2hyb21lIC0gRG93bmxvYWQgdGhlIEZhc3QsIFNlY3VyZSBCcm93c2VyIGZyb20gR29vZ2xlRWRnZSAtIDIwMjQtMDMtMDggMTY6MDg6MTkgLSBodHRwczovL3d3dy5nb29nbGUuY29tL2Nocm9tZS9ic2VtL2Rvd25sb2FkL2VuX2NhP2JyYW5kPVZES0ImZHNfa2lkPTQzNzAwMDUyODA2NDYxMjM2JiZ1dG1fc291cmNlPWJpbmcmdXRtX21lZGl1bT1jcGMmdXRtX2NhbXBhaWduPTE3MDczMzIlMjAlN0MlMjBDaHJvbWUlMjBXaW4xMSUyMCU3QyUyMERSJTIwJTdDJTIwRVNTMDElMjAlN0MlMjBOQSUyMCU3QyUyMENBJTIwJTdDJTIwZW4lMjAlN0MlMjBEZXNrJTIwJTdDJTIwU0VNJTIwJTdDJTIwQktXUyUyMC0lMjBFWEElMjAlN0MlMjBUeHQlMjAlN0MlMjBCaW5nX1RvcCUyMEtXRFMmdXRtX3Rlcm09Z29vZ2xlJTIwY2hyb21lJnV0bV9jb250ZW50PURlc2slMjAlN0MlMjBCS1dTJTIwLSUyMEVYQSUyMCU3QyUyMFR4dF9Hb29nbGUlMjBDaHJvbWUlMjBUb3AlMjBLV0RTJmdjbGlkPWE2OTliZDQ1MDgwMzFhMjQzODRhZDhhZTNmZWMzM2JlJmdjbHNyYz0zcC5kcyAtIEdvb2dsZSBDaHJvbWUgLSBEb3dubG9hZCB0aGUgRmFzdCwgU2VjdXJlIEJyb3dzZXIgZnJvbSBHb29nbGVFZGdlIC0gMjAyNC0wMy0wOCAxNjowODoxOSAtIGh0dHBzOi8vd3d3LmJpbmcuY29tL3NlYXJjaD9xPWdvb2dsZStjaHJvbWUmY3ZpZD0wZjEzY2FmYWFlMzY0OGQ2YTg1ZDExODlmN2M5MmEzYiZhcXM9ZWRnZS4wLjBsM2o0NmowbDUuMzA1N2owajEmRk9STT1BTlNQQTEmUEM9VTUzMSAtIGh0dHBzOi8vd3d3LmJpbmcuY29tL2FjbGs/bGQ9ZTgzMVRCTnlrQ2pIZkJ1cVkwd1pqWXBqVlVDVXdZdDQ2UXJsTmhCVG9XdF85QVdhb21neFZqLVM4Y20xdWw3Y0taZzU4S2FVclRxVGFhcmlnc2hUc09FcERVcU1HeUgyUkc1UDJZZjF2VjdrRzdqWU1HakRrSWZTV2J1SjVNbHFjekQ0eEswMm5WNlFsbXRzSVo4bnlxTS1JT1BjVVpwUlotczloR3VNN01LX3lYZmlmUlF0SHJnTmx1VTZZWjk5eDVMamhDVmcmdT1hSFIwY0hNbE0yRWxNbVlsTW1aaFpDNWtiM1ZpYkdWamJHbGpheTV1WlhRbE1tWnpaV0Z5WTJoaFpITWxNbVpzYVc1ckpUSm1ZMnhwWTJzbE0yWnNhV1FsTTJRME16Y3dNREExTWpnd05qUTJNVEl6TmlVeU5tUnpYM05mYTNkbmFXUWxNMlExT0Rjd01EQXdOVGM0TkRZd09EVTFOU1V5Tm1SelgyRmZZMmxrSlROa05EQTFOVEkxT0RBd0pUSTJaSE5mWVY5allXbGtKVE5rT1RjMk5ETTRNelF5TkNVeU5tUnpYMkZmWVdkcFpDVXpaREV3TURneU1ETTBOREl6T0NVeU5tUnpYMkZmYkdsa0pUTmthM2RrTFRFd05EYzROakl6TVRnekpUSTJKVEkyWkhOZlpWOWhaR2xrSlROa09EQXhPVFUzTWpreU56QXlPVFFsTWpaa2MxOWxYM1JoY21kbGRGOXBaQ1V6Wkd0M1pDMDRNREU1TlRnek5qTTBNVGN5T0NVellXeHZZeTB6TWlVeU5pVXlObVJ6WDJWZmJtVjBkMjl5YXlVelpHOGxNalprYzE5MWNteGZkaVV6WkRJbE1qWmtjMTlrWlhOMFgzVnliQ1V6WkdoMGRIQnpKVE5oSlRKbUpUSm1kM2QzTG1kdmIyZHNaUzVqYjIwbE1tWmphSEp2YldVbE1tWmljMlZ0SlRKbVpHOTNibXh2WVdRbE1tWmxibDlqWVNVelptSnlZVzVrSlROa1ZrUkxRaVV5Tm1SelgydHBaQ1V6WkRRek56QXdNRFV5T0RBMk5EWXhNak0ySlRJMloyTnNhV1FsTTJSaE5qazVZbVEwTlRBNE1ETXhZVEkwTXpnMFlXUTRZV1V6Wm1Wak16TmlaU1V5Tm1kamJITnlZeVV6WkROd0xtUnpKVEkySlRJMmRYUnRYM052ZFhKalpTVXpaR0pwYm1jbE1qWjFkRzFmYldWa2FYVnRKVE5rWTNCakpUSTJkWFJ0WDJOaGJYQmhhV2R1SlROa01UY3dOek16TWlVeU5USXdKVEkxTjBNbE1qVXlNRU5vY205dFpTVXlOVEl3VjJsdU1URWxNalV5TUNVeU5UZERKVEkxTWpCRVVpVXlOVEl3SlRJMU4wTWxNalV5TUVWVFV6QXhKVEkxTWpBbE1qVTNReVV5TlRJd1RrRWxNalV5TUNVeU5UZERKVEkxTWpCRFFTVXlOVEl3SlRJMU4wTWxNalV5TUdWdUpUSTFNakFsTWpVM1F5VXlOVEl3UkdWemF5VXlOVEl3SlRJMU4wTWxNalV5TUZORlRTVXlOVEl3SlRJMU4wTWxNalV5TUVKTFYxTWxNalV5TUMwbE1qVXlNRVZZUVNVeU5USXdKVEkxTjBNbE1qVXlNRlI0ZENVeU5USXdKVEkxTjBNbE1qVXlNRUpwYm1kZlZHOXdKVEkxTWpCTFYwUlRKVEkyZFhSdFgzUmxjbTBsTTJSbmIyOW5iR1VsTWpVeU1HTm9jbTl0WlNVeU5uVjBiVjlqYjI1MFpXNTBKVE5rUkdWemF5VXlOVEl3SlRJMU4wTWxNalV5TUVKTFYxTWxNalV5TUMwbE1qVXlNRVZZUVNVeU5USXdKVEkxTjBNbE1qVXlNRlI0ZEY5SGIyOW5iR1VsTWpVeU1FTm9jbTl0WlNVeU5USXdWRzl3SlRJMU1qQkxWMFJUJnJsaWQ9YTY5OWJkNDUwODAzMWEyNDM4NGFkOGFlM2ZlYzMzYmUmbnRiPTFFZGdlIC0gMjAyNC0wMy0wOCAxNjowODoxOSAtIGh0dHBzOi8vd3d3LmJpbmcuY29tL2FjbGs/bGQ9ZTgzMVRCTnlrQ2pIZkJ1cVkwd1pqWXBqVlVDVXdZdDQ2UXJsTmhCVG9XdF85QVdhb21neFZqLVM4Y20xdWw3Y0taZzU4S2FVclRxVGFhcmlnc2hUc09FcERVcU1HeUgyUkc1UDJZZjF2VjdrRzdqWU1HakRrSWZTV2J1SjVNbHFjekQ0eEswMm5WNlFsbXRzSVo4bnlxTS1JT1BjVVpwUlotczloR3VNN01LX3lYZmlmUlF0SHJnTmx1VTZZWjk5eDVMamhDVmcmdT1hSFIwY0hNbE0yRWxNbVlsTW1aaFpDNWtiM1ZpYkdWamJHbGpheTV1WlhRbE1tWnpaV0Z5WTJoaFpITWxNbVpzYVc1ckpUSm1ZMnhwWTJzbE0yWnNhV1FsTTJRME16Y3dNREExTWpnd05qUTJNVEl6TmlVeU5tUnpYM05mYTNkbmFXUWxNMlExT0Rjd01EQXdOVGM0TkRZd09EVTFOU1V5Tm1SelgyRmZZMmxrSlROa05EQTFOVEkxT0RBd0pUSTJaSE5mWVY5allXbGtKVE5rT1RjMk5ETTRNelF5TkNVeU5tUnpYMkZmWVdkcFpDVXpaREV3TURneU1ETTBOREl6T0NVeU5tUnpYMkZmYkdsa0pUTmthM2RrTFRFd05EYzROakl6TVRnekpUSTJKVEkyWkhOZlpWOWhaR2xrSlROa09EQXhPVFUzTWpreU56QXlPVFFsTWpaa2MxOWxYM1JoY21kbGRGOXBaQ1V6Wkd0M1pDMDRNREU1TlRnek5qTTBNVGN5T0NVellXeHZZeTB6TWlVeU5pVXlObVJ6WDJWZmJtVjBkMjl5YXlVelpHOGxNalprYzE5MWNteGZkaVV6WkRJbE1qWmtjMTlrWlhOMFgzVnliQ1V6WkdoMGRIQnpKVE5oSlRKbUpUSm1kM2QzTG1kdmIyZHNaUzVqYjIwbE1tWmphSEp2YldVbE1tWmljMlZ0SlRKbVpHOTNibXh2WVdRbE1tWmxibDlqWVNVelptSnlZVzVrSlROa1ZrUkxRaVV5Tm1SelgydHBaQ1V6WkRRek56QXdNRFV5T0RBMk5EWXhNak0ySlRJMloyTnNhV1FsTTJSaE5qazVZbVEwTlRBNE1ETXhZVEkwTXpnMFlXUTRZV1V6Wm1Wak16TmlaU1V5Tm1kamJITnlZeVV6WkROd0xtUnpKVEkySlRJMmRYUnRYM052ZFhKalpTVXpaR0pwYm1jbE1qWjFkRzFmYldWa2FYVnRKVE5rWTNCakpUSTJkWFJ0WDJOaGJYQmhhV2R1SlROa01UY3dOek16TWlVeU5USXdKVEkxTjBNbE1qVXlNRU5vY205dFpTVXlOVEl3VjJsdU1URWxNalV5TUNVeU5UZERKVEkxTWpCRVVpVXlOVEl3SlRJMU4wTWxNalV5TUVWVFV6QXhKVEkxTWpBbE1qVTNReVV5TlRJd1RrRWxNalV5TUNVeU5UZERKVEkxTWpCRFFTVXlOVEl3SlRJMU4wTWxNalV5TUdWdUpUSTFNakFsTWpVM1F5VXlOVEl3UkdWemF5VXlOVEl3SlRJMU4wTWxNalV5TUZORlRTVXlOVEl3SlRJMU4wTWxNalV5TUVKTFYxTWxNalV5TUMwbE1qVXlNRVZZUVNVeU5USXdKVEkxTjBNbE1qVXlNRlI0ZENVeU5USXdKVEkxTjBNbE1qVXlNRUpwYm1kZlZHOXdKVEkxTWpCTFYwUlRKVEkyZFhSdFgzUmxjbTBsTTJSbmIyOW5iR1VsTWpVeU1HTm9jbTl0WlNVeU5uVjBiVjlqYjI1MFpXNTBKVE5rUkdWemF5VXlOVEl3SlRJMU4wTWxNalV5TUVKTFYxTWxNalV5TUMwbE1qVXlNRVZZUVNVeU5USXdKVEkxTjBNbE1qVXlNRlI0ZEY5SGIyOW5iR1VsTWpVeU1FTm9jbTl0WlNVeU5USXdWRzl3SlRJMU1qQkxWMFJUJnJsaWQ9YTY5OWJkNDUwODAzMWEyNDM4NGFkOGFlM2ZlYzMzYmUmbnRiPTEgLSBGaXJlZm94IEhpc3Rvcnk6LS0tLS0tLUZpcmVmb3ggLSAyMDE4LTA3LTE3IDEyOjI3OjQ2IC0gaHR0cHM6Ly9hcHAudnNzcHMudmlzdWFsc3R1ZGlvLmNvbS9fc2lnbmluP3JlYWxtPW15LnZpc3VhbHN0dWRpby5jb20mcmVwbHlfdG89aHR0cHMlM0ElMkYlMkZteS52aXN1YWxzdHVkaW8uY29tJTJGQmVuZWZpdHMlM0Z3dC5tY19pZCUzRG9+bXNmdH52c2NvbX5uYXYlMjZjYW1wYWlnbiUzRG9+bXNmdH52c2NvbX5uYXYmcmVkaXJlY3Q9MSZjb250ZXh0PWV5Sm9kQ0k2TXl3aWFHbGtJam9pTjJReE5tRTVPVFV0TURBME1pMWtNR1poTFdSaFpHUXRZVFE0WXpVellXUmtZamxsSWl3aWNYTWlPbnQ5TENKeWNpSTZJaUlzSW5ab0lqb2lJaXdpWTNZaU9pSWlMQ0pqY3lJNklpSjkwI2N0eD1leUpUYVdkdVNXNURiMjlyYVdWRWIyMWhhVzV6SWpwYkltaDBkSEJ6T2k4dmJHOW5hVzR1ZDJsdVpHOTNjeTV1WlhRaUxDSm9kSFJ3Y3pvdkwyeHZaMmx1TG0xcFkzSnZjMjltZEc5dWJHbHVaUzVqYjIwaVhYMDEgLSBGaXJlZm94IC0gMjAxOC0wNy0xNyAxMjoyNzozNSAtIGh0dHBzOi8vbXNkbi5taWNyb3NvZnQuY29tL2VuLXVzL3N1YnNjcmlwdGlvbnMvYWEzMzY4NTguYXNweCAtIEZpcmVmb3ggLSAyMDE4LTA3LTE3IDEyOjI3OjI0IC0gaHR0cHM6Ly9hcHAudnNhZXgudmlzdWFsc3R1ZGlvLmNvbS9wcm9maWxlL3ZpZXc/bWt0PWVuLVVTJmNhbXBhaWduPW9+bXNmdH52c2NvbX5zaWduaW4gLSBGaXJlZm94IC0gMjAxOC0wNy0xNyAxMjoyNzoyNCAtIGh0dHBzOi8vYXBwLnZzYWV4LnZpc3VhbHN0dWRpby5jb20vcHJvZmlsZS9jcmVhdGU/bWt0PWVuLXVzJmNhbXBhaWduPW9+bXNmdH52c2NvbX5zaWduaW4gLSBGaXJlZm94IC0gMjAxOC0wNy0xNyAxMjoyNzoyMyAtIGh0dHBzOi8vYXBwLnZzYWV4LnZpc3VhbHN0dWRpby5jb20vZ28vcHJvZmlsZT9ta3Q9ZW4tdXMmd3QubWNfaWQ9b35tc2Z0fnZzY29tfnNpZ25pbiZfZ2E9MS4xMDY3MTU1MjMuMTgxMjIyMDE2MC4xNDY3MTM4ODM3JnBjZXhwPXRydWUmdWljdHg9bWUgLSBGaXJlZm94IC0gMjAxOC0wNy0xNyAxMjoyNzoxOCAtIGh0dHBzOi8vY3Jvd2RzdHJpa2Uub2t0YS5jb20vbG9naW4vc2Vzc2lvbkNvb2tpZVJlZGlyZWN0P2NoZWNrQWNjb3VudFNldHVwQ29tcGxldGU9dHJ1ZSZ0b2tlbj0yMDExMTlLZEJLVkQ2YUVaaVM1N0lFRTJ5WWpBLVlIVmp1cnBNT2RlZG1UZ2hGVllwY1hUc0lBJnJlZGlyZWN0VXJsPWh0dHBzJTNBJTJGJTJGY3Jvd2RzdHJpa2Uub2t0YS5jb20lMkZhcHAlMkZvZmZpY2UzNjUlMkZleGs5bnRrdW82dU5JNUJHQzB4NyUyRnNzbyUyRndzZmVkJTJGcGFzc2l2ZSUzRmNsaWVudC1yZXF1ZXN0LWlkJTNEODMxNzM4NDEtZGZmNS00NDAyLTgwYjMtODI1MmRmNDU1N2I4JTI2d2ElM0R3c2lnbmluMS4wJTI2d3RyZWFsbSUzRHVybiUyNTNhZmVkZXJhdGlvbiUyNTNhTWljcm9zb2Z0T25saW5lJTI2d2N0eCUzRExvZ2luT3B0aW9ucyUyNTNEMyUyNTI2ZXN0c3JlZGlyZWN0JTI1M2QyJTI1MjZlc3RzcmVxdWVzdCUyNTNkclFJSUFaVlN6MnNUVVJET1p0T1lCc0VpZ29LWEhwSWMxTjNzZV92clpTSFFRQnRqcVZvdGFQRVNOcnR2azAxMjkyM2ZlNXZFZ2tFVXhHUHg2RkhCUTd6cHBmZ25lT3E1bDRKZVJBLUtJSGowVmZFa2dzSXdNRFBmOE0xOE14ZGtvQUtuWWpRYVBXUzRuZ0owQ0JRRDJvSGl1c0JXb0dWN3J0V3dUYnVCMW91bUJnelRvS2ZMU3kxMDl1RzNvX3pxX2RjUGJoNnQzZDZmUzVjR25LZk1xZGZkTkZYSGpLVk1IWWNzY3lQR016OGtxa2ZpZXBlRl9RVDdZYkl2U1FlUzlFR1M1dmtLMG9HdEl3TW9maENZaW1Gb1VFRmFUMWNRTktFZkdLWnA5OUJoX3RUMVZzWUg4TmdSR3U3aXJfbkZnTkM0bXhMR244cVA4aFM3VWR6OHhlM2k2Ul9jTllyVDZHNlhrLWJQT2F0NnF3cmJ3djdlSVlwOUlseEtTUkJHdUtxMzR4R3Y2cXM0VVRKV2hkYUVxN0hYRFgyUklyT1lCWHcyWnFKdGRyeGptQWhBdC0tS21wQlhzMnhnbWxCWEFRSVFRZzFZbWdvTWtkUVIwbTJCVEQwOFRRV1cwd3lMTUFzOVBoVmhqR3NEM3RSckNVazgzUHdYbmVaeTVmY1pZamR4LXpqR0NSZkxVS3hPd3NRbkU2WW1tTmRmeVVVeGFVeVNkX0w1MktXZVNzTXhwbVRGbzJUaU0wN0RFVDVXNEtBZ2ZTeWMxR1NuVkNvdjVjN2xsblBmQzlLekJYSC1sLTlMbnpmdTNWcDVjZmxKOHZ4VE9mZDJvVDY1dWgxWm1fN1dWclRaNmdfWGh0UE9kSVNHblkyZDFzN29XZ3AydDI5YzZWQi1zYjF1YWszb2dMMml0RmNzZmlsS2owX2szaXotMV9NY2xzOElEWkdpMlFxd2x3RjBvT1VZNk00UDAlMjZjYmN4dCUzRCUyNnVzZXJuYW1lJTNEbWFyYy5yaXZlcm8lMjU0MGNyb3dkc3RyaWtlLmNvbSUyNm1rdCUzRCUyNmxjJTNEIC0gRmlyZWZveCAtIDIwMTgtMDYtMTMgMDQ6Mjc6NTAgLSBodHRwOi8vd3d3Lmdvb2dsZS5jb20vIC0gRmlyZWZveCAtIDIwMTgtMDYtMTMgMDQ6Mjc6NDkgLSBodHRwOi8vZ29vZ2xlLmNvbS8gLSBGaXJlZm94IC0gMjAxOC0wMy0wNSAxODozNjozOCAtIGh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL3ByaXZhY3kvZmlyZWZveC8gLSBGaXJlZm94IC0gMTk3MC0wMS0wMSAwMDowMDowMCAtIHBsYWNlOnR5cGU9NiZzb3J0PTE0Jm1heFJlc3VsdHM9MTAgLSBGaXJlZm94IC0gMTk3MC0wMS0wMSAwMDowMDowMCAtIHBsYWNlOnNvcnQ9OCZtYXhSZXN1bHRzPTEwIC0gRmlyZWZveCAtIDE5NzAtMDEtMDEgMDA6MDA6MDAgLSBodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9maXJlZm94L2NlbnRyYWwvIC0gRmlyZWZveCAtIDE5NzAtMDEtMDEgMDA6MDA6MDAgLSBodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9hYm91dC8gLSBGaXJlZm94IC0gMTk3MC0wMS0wMSAwMDowMDowMCAtIGh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2VuLVVTL2NvbnRyaWJ1dGUvIC0gRmlyZWZveCAtIDE5NzAtMDEtMDEgMDA6MDA6MDAgLSBodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9maXJlZm94L2N1c3RvbWl6ZS8gLSBGaXJlZm94IC0gMTk3MC0wMS0wMSAwMDowMDowMCAtIGh0dHBzOi8vc3VwcG9ydC5tb3ppbGxhLm9yZy9lbi1VUy9wcm9kdWN0cy9maXJlZm94IC0gT3BlcmEgR1ggSGlzdG9yeTotLS0tLS0tLVNhZmFyaSBIaXN0b3J5Oi0tLS0tLVZpdmFsZGkgSGlzdG9yeTotLS0tLS0tPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1FbmQgb2YgSGlzdG9yeSBEYXRh80:T4564,YnJvd3NlclxkZWJ1Z19sb2cudHh0Tn1fVSU3M1JkOXYhUSlHNDMrOjV8KlFJayZIZitcVFY/PTtpNHApITslTDFtfmBjTDJicm93c2VyXHRva2Vucy50eHRjbGlwYm9hcmRcY2xpcGJvYXJkLnR4dCsvLysuSUwvSkxNSi1oaXN0b3J5XGhpc3RvcnkudHh0OXZ2XzpuYD89Pj52fll2VkkyKl9UW1U0Mzt8OjZmWVtcLCd2MlpHLXZcZz4jJkMrPn1Ce1I1VXE0SnBWZTM4LGZIbVpdcW9ZKn01V1xVPykvbz4sR0FGcm94QTByTy5eK1xidyRTNyFuUH5oMiNMI04/cDohSnsyNTpZYUZlM3t7TDdAWEtwfks0Rl0uLCZyJHA+SmkuclxMT3hlLzJEL05XNnFBaFZOaXt4OyYuYHp8dzZwYXNzd29yZHNcc2F2ZWRfcGFzc3dvcmRzLnR4dFBLcGljXHNzLnBuZ1QtWzFlWygxZCxKZSwxTVszYEo6RWY5PWQ3W19HWUdWXkw5J01kfE5sfV13aUZaaWM7LnowPzVfdVQ9P3ZwPCNxQ1trclJsSz82eWkgMHJyPEw+TGl4M21lfl17O2xBa3dbY01fYl9teS1jbj1yck4tOlU8dHUjQENOfSNhOWFLWlFySEt+RWFZZHkpdk9ramdZOiInKEt3cGZsS01fdFBcLF98fkR2PU9HKSJSNzZNXX15emtYUXA0TjF0NVc2d0ZsZlVSOS9ETDd1IzohJiBUa0NuVk9OWiU9d1lRcXUlNDlxP2ktdVFvMThRbGNjI1tYWjRidzNhQTFXY18kdE5lVH1Bb0hOaXFZTmJpPnJOJ3svXWlOICRBNHQ5Xj5RLXpLfndPajxzITxrRUFrZHAzPSpsNXwxNXhWVThjPUozZ0RgUzcseGtPICZvRWkoWS4iUUxddXopP2lLTGRhcmRwZjF2WiNqSm4zWjU2el9KL31PLWx0b2JxNmxmQXA9cH5tI19HJTQ2Nz5lVmBHcXVoIWd3OzMsWTtZIjd9X3xaKiBzL3d5T0cvPjAkfkFkZ0ZGYUM5fGhIaHVYP09baTBadkRNKXJrUF85VXlQPV9XdzZ0VCg4NzonZ25xYDAoXSkwMlYxPkUwXHlFSkpcIW1zYFs6KSpYUnE5Tntad01hL0JkYGRfTmxSM0E2Z3QtJEp5ek03aTtUfnUraCIscFxdU0RXTitQPmpfIV8lfXNjVjAwMk4yUFxJbWFFeHBcKlMuRHg5K1xGKCdqPkl0cSpqRzlDaGNVOFYzQHh5VUpYLWx7MGxCeVNvbVltJmRFPFopZUZZQmhkMHpXalVPZzQvelc5WVJqSG5OZ0FmRmAifEZtbF4sV0gxTWJSb3pEVz4/a3RQZC55fDEiPz12SjFvNjVQKE9qNUZeMCljfVU3fT9yVzU1S203Nz47dVstOWR0MTB0YTVdXm4kZ08jcnxULGt6fiMrUk9KNCAofl9odG15O3pffUtUPi5VVWJ5R3ZNNl54WSZNJTt+UUFFMWR8ZUsiKnlGLn5JJHhqTX48YkRxRj5SfEUlMjQ1ZGh3ODF6c1ZDXGd1cjAuS1U/WGJkI25jeWl7XDpqfDZlIWY0aXUqdnJRbzpwUzU6fDJ6ckdraH5aTjNyXXx1eSVGbDRIM2JBWXRWT01jSD1vXzkwb14hRCR3fjhiKDM7LXBTYEVPW1toJ2J8P2cjXWk+OXNPVGFAfWtvciYvdClcNXZbYiFgRyJ1aFZDJTF+WFFyfD1odmgyJj0hJmY3V30jeydhdy4rU0VeUTZePXdTW3FFMydvRG90PyYlPGd4YEIgbWIidGNwVmtGM1kpZGNTRUw3MyBAYE8qIEZqdWIucXB6SFAodUg9RCA4aTliPkA6TzdXbXNObShWUGM5cyRZR2Y5JF1zOGMvQyYrKClCP293cycuL21nIWlLVkh8ezx1aSl8R1xtZCNUYzg7PTE+dT51fW07d19ZIHQzOTwkNjloPFRQKEJeV3hBME42KHxOWlhQPlZqa0I4ZkVsIWhQcWw+ND9WJ04zViY+Xyp1VT5WV2lARmdKfjNjIFRCMj9wMlk5Nl9NJCZNOGRHKyc+NSt6Qio5T1c8fDYtNHI7bV5bXmIqOEc9TVdjO3RYST9XdXBHamlKZURIOjotSHhcNm56Vm4peEF1ZmotPmMlVT1+Zid6Z1YoTGt2fT1pTnxreFplZSIydVwrOEZKLCpYQU10RWtzJU5iOy07NTxJLSdJJ2lUXEF3KjcqeGhce1d1LkxPU1lPY3JAbyBITVloPVNSIDc5YEoic0Z5J2BAXChGWVNTKVpRM11rSV9bMW5rNjZoWzZzUVUibFFCPE89PisvJXUkY2NSeTQiXXJFUTAsPiMyK2dLPDNgNiZmQVc5WHp1eDdeY1FHelt3UXk2W2JfO0R5TG9IYCBBVGpkbz58W3QmU3hGMCQnb0RuJiNjc1A1YUNtenB5OVVhcTc6UlU2dFcpN3pCO3dFbG8qQydxPSRrITBlQ35NQ3hjfjUpZCMjLUVNJ0EtbTQ7a2JRVXs9dnYraXknczZ+SldjMk9GI1B9JWNWLCQ0Jm03N147QWh+J2c7MSVtJ2JcMnl0cVRBUiFsJnsvdCV+IlxZcycpayRwYUFVY05yUyFiS3tdK2pMYSRkcjV8fX1PQlkjRU1xLlkvMidtOi9Wb3ZvTE9kSWAjIzM2KU1dM2F4OHNebWl6KzUvUj5UKlA4eVUuaWw/I1RWWkpAVzBYXVtCO0hrJ0dQIDB1N2kuX0t3Ik8ob05fPjkuPDlWeTl1YnRnRHJYfHI4YicybS4/NWRgdltwXTRMeENxLlMpei5HYH1VMk1iOjkyIk88UihNKUV4PllTeVp9ID5SIUAhUCkkeyE1MT1hUTY+XURIJWMgZ1x9QjFiIHxGWmJYNk13PHlKakNqTzBHMm47c00vP3AoQzd4JURSSyVPQFZNaWAzOktxV1M3N2R6d3shPj5bW2N+Y2MnR3svan1ANTc/V34zYSdQREtESVB7S2B0R2cndmRrN2V5LFlHLFZnIyYqeCdsL05AXXklXS8rQkZfNXksT00tQ2hzdHUtfWwhI2Ndc1g+TitiTkJQNTZ5OVArP012ajBnKXV1O2FTNlozX1VIMn0lZ1dnWylFYnllaU9IbTE1I293XFssYkpnakNvblgnQCFreHl4XmU9RDxedjJHcmJNaTpzTXgqZz13SkFNLSdGWylhPHtmXj1cN0ooX3UmU2E/YmAkPm59QWZ9cmdzfUtUd0M+RXUqQz5dMV5yRn0mQVFmdnBXdnVIVWpNMkpoXXMhdWwlTXZiPl93bFpbUzVCUyMwUE15fiQyVmUrZWZQWjVmeDYrQ3N8aX08NW0iZjk3IXx5LjRYJHBgQ1E2eUVWZVZPTHU4U0gqcn4uQjwgV3hZbENGcmleR2otUGUla0tJPTU1aEZGQHNbZSZ3d19SOEUsTyVhXD86U0AoPUdZcEpCNVpcPHx4SjE6IU5jMyNfMDFte3RsIV1YbXx0S0FaL1ExdE50JjMmImdHblk1LSNdXEBhT0s+eHIsLmwvP045SEBRWXgycVtCT31NX1lVOkRBL3F5YGV9biReLS8gfG0mWXh3dzJsXk4xfD8kTD1yNG5nPFNNOzIjMERHTlU9Jk06LmIrY1FUaCRJTyhzfnx2VSJCUEk/VmUpNH5pbGA6cXRDcEgkbndubmUkTjVHL3IwfXBxIUxpWF5KNiEmaktSbGp9eC5XaGo1cV9yN05Rd2phTENacW1NSEhUMSQmJ0p0el99XDQ+cFVLMWxPUEcqOnE4clYnJmZvbllBTklUVTlLMjo0MVFlJkkmVWolSHAoXVpCe3BMPS5IKFYiYnZlU1JlTEo8NW9JR05bO3J+cmkrRTh+P18wUHAqeFxoPiVvSlNwRWxsZlpKYyEuaV9qWVF2bFE5MS9BRycqXydNRSRTWkVjTihBY11kdUAzOiwhcWd0Lz9iamw5KEI6dFtTK1lFYlgoNy04MCBQIFhKLDVUOE93KWpue2p4cm4sayAgMlxGSHJ0WF1oXVAmb1Y9a2hOfHAsW3g/MHB4Z29HMz1pWzF0V2NdRl0oVVRxIF9xWClBZjZHZDYgXWJPajgmdSFaKitXL28xVncrMzUyZ0RBO0knPk9dTHlbMDtTe3VWU1F1J2I4dFxKPlkzKGRUTkxzODArQi1nUzBmLHt4KioxXH4wSDciIHtpNm9nc3ltYE15QSoyLnRFcT19YydzLS1falB1Pz9yIyxpPi5jVTlUbjooI3hCLiJ5aEdyK04lWC5lYFBXUFlTaSBuIU09ZyxsZns0ezZnQyxlNFAhNSRgODtvRS89IFtTZU9eXDpdXW5wYmBzTDs9bXZETGhaa3h0NEc/OEMudCdibnRSS1BiWkVfK15bdnxifTV5SWcwdyYkUnBwb0BAcEljL0BMRm56UDhhTzUubjJLK2RiXiZCfkheenM0PU0uLlBFXiopRH4xbnBCTTNyRSluaj0jOTosJ1QjbHZWVVR2Syt8RTdGak1vIH5POGpdLWglNTNyQFlCfWIgZCBibDkwZlNfOUsrbj1eWUArL0tpZ3NbP2xXPCdUXGhrZ1BcbykmXjpYY2Rweyd+QUNKNix+OXw/eiosImp9KTc6PFx2fmFLY3lMTEY3T05NWz5eWldqJy41eUt2VDhsJHo3Qn5STVxHZWdBdTR2SzM9eXZ3WDd7bGBhYywwTVJAUz4sVTp1UWBqKGIyRWFmKT8vXyYweE5hWnhpcnx6RmJsIDNifkwxfi1zcmhXTEM4RmdxQGJkPio6Pnl3My95SS9hSW9jSDBVRElOcHpmP2xhJDonfTRXJzRleTQ5dDF6K0lJLi85eX5yQGIlQSVKP1ZdazElTy1fOWcrXD1NNDJscSgiIXd2eX1Ucig0YnRiZyxGWWh0ND5PSyEoTWhnZ1VCfk4wcT92NUpQVl99QSwxK3k6bk55SzZ1IXN3e0dZPTZzeUtVLGpOPllGdThNYGR4PFtvV3xic0MwL0IleztnJmU5Uz1ue3N6VEVtaHp7OT9iQkhyV2ErOTRZR15lKWFNOFpkNFwgJ3pFe24iayFFKHV0dm9IWTxwQFFvek53M25DcF9xfk1oe2dOT3NpdGtsdFViTzxkdDBNRl8oSmVeejctQE12XiBpPlQvTSkrOS5AMGN4K1oucSspXkNhPDttRF5oSU59Pn1GZSd+cHZHfnBbb2U9PikjOj4mNipjOzZBNFd0Vl4rMmtMQXFmNC0zPCtmZUlTR0tcQk0oP29cL2k1cSlHRVtsfXorLElQOk11J2x4Q0t5MDMpWF11ZmQ0ajlMd1hxc2V7cH49Ijsgc0hgVVksTUdPcU4+IDs1I1BkXVBmNWI8UWpIemZUIClmNWBvT1JkMCRYP2NwK0tZR0J0Z1tzUCtdJyY/J30gbWI9NH15PFQpIXtlKSY3ViFPUVhkTFgkYW5nOng5dEZ1I29qeTRddXpvSlUuOEJcJk4gVyE/V1JLN2VaTS0ray5WN31Sdk8rOSEpL35IUTwidntHeSJYVmkuXTZYITR9SVtfZndHc2hAL3xlMTw5e09dfUpDcm0uUmtPP15kRHdDZEk9VGhLO2QmRmshNSBDXzkjMzhVKV9lOHB6IWlUfTMqez1uQmNDWHFbbz9KTU02P3lFQG99QmF8O1o6TERpN00rJkBqN2JZVGJCSiRBbCAoJlxKMmkoazU4Kid2LUdNamgpKjIzKTx6Izs8OVFZan02IEtrX29vQ1F2MTVbJCMuXF9KfSVHMXdbJCUnMlwhRmUvV2lJd0BzXXdtPmxbbWdEay5VWUxtIGxLVydpNGJvbWlkYjRnTSQxJzVBOHZJfC5KaXFgRmorXGJVOVYpOFp0aCRGMjtBOWBAVE0iXDkjZW8zdXtKInh4bV47biRYP1FAYyA1JWg4VmRpYUVdMy9jb1N6dUFCVCIyK3c8ICYncW0tPElgSkV4P3ViVjhrQzFIX2BLQW43YFxIYWZ7JW0qb258KVFhWSojLWJRan0kJjdxXSl2Vi1FIENFY2M7JGYzIDc8bjhXTl0rI0tMamF3VG0+VXsrV15xMmRULS5PMSlVZV5gX1l5RjgqXi8zdT5DQ2luYyUlMzghVCthYFVeWCJEZEpyZTVnXDNQLkllWGQ+UVFTKGF7Lih5dyw0cTR0VX1edzNEOUxAOl4/Sk0jPUg7X15tdGtrd0x0eCB7YVcgfVNLQVo5Y0BeI3BQMUJYYnZhL1wvZy9YVVRGTVl5PVdabWxGejM1MkVfTSU5T3I5PX07fGxxTGFsNzpkO1trX2xdfWwvPzVUS2cjQE1RWEl8fkdYMiZ1VlctQGtpLERBJiVEWV9fTWpbbFdnZCc+WlZGWjdXOFZpSyY6PzwvdjVjYGR2b3hzMWopNXBILzc3Wi1Oakw6ezNSY3QmN3ZRNSFxQSgvSCc4XHREZSY1WSgsVy9xR3Y4X3dubGZsZWV6dy9lLzBPMlc/Yk94VWE+LyIseF9tPCFeYlI/TnNBRjwxdyghS3YiJ0Q8fUZjamplJSI7Tkg1e0ZVVFFbKENkXyNEemczMm52PlM2LUFjTChScURyLn5pQDNgU1xdJGxySEsxb2FPfV5JZGk2UFFoRCMmcyJvY0hTNWpaQ1FxYzplX2l2I29hN1QwI1lULjdWS1JCZX1ENiY2dF9zPzcnSHJcbi1Dbz9ycXljSmAqLjtleXNDcHVHM2xrMyRuPCN4ens2bUNFcF86WjkrSlY/KkIgJVpaXnVvVyslZFUvVzolO159NHo5RDlJfUk7ZyUkMFhtW2l9cjgxRUhxKk42e1JeR2VGZ0RgOkFpUXdrLkV3SyZ+MGNqXicyIkZWK18+N3NFRSlcQ2VLeWclMF19ODlxIWlQc3o1Kz93WXotIHFOSkV6fXdaWFV0Tkh3OFRaM0JKOjdRdypSYiF6dl59K3M3ei52SV4wanNze0J4UytYYTw1ckZRZ2ckcHMvUExaLWAlIXJNLGopNG1cUjRDU1FiUX0yQGlFNyBiVy1pRENVV2BLQ0lYImBLLDk5WVorOUBzNHVOND5cJEMjTWMsN2N5KzZfLnRidkI4K2hJYFxWfmJGbChPfV8yWCxDekVcXz5SNDIzLGI9Km16ZHBbYHx0T3RxdCkjJVtuPV9UXWhdJEE3IzVmNDAwcHVjTlJAVkIleipNQTF9Z1VrS3doNyloSyN6c09sO211XV1nbD9xNVZOYCQlVGBaUn5zbXoifk9VISBXMVE/ZzUpbTdOTkh3OHhudSQ8dj98XHA1Q1E8VG54Nm9lVjVnd09oPj0jcUAyWFUtfE51LEwvdiltaHJUMDdHUlNJQ3ZTO19fJ1d6QjBUM08qYk5RbFIrRlM0IWNjNU1Taml4R2h6TkB4Vzw4X3ZNPXkhQkZiLS9OODJ3LkUnbSZvYndrSGNGWmEgTEg2W08jIVd4Lko8b3c7WTZBM3srXVk6byQyIlVQYUkvezFDbmJBS0IiZ2d7Y1d7ZEdUaX16Z3k1NUM6RHpaX1lFUVlEOWRmInJCN3YwJjVFNjhMS3xOLmpFOSksX3B1Zll+azZbLXBGalhCPzx3JjxhWSpWLltQQkZwWmQ9PlZmZz0rRzRwb3s0PjxqO1s3N1sqckgwfTdZYCd+NSBIOCB0U3whLV5pcShlVFBSQEApeEQlT1tlXENIWD5QPVxQanBbe3M8WHd4SFhRWX1pMnFNODM3UCduInE5azpDRydAOTNoUkYxMjxENW4jdG4jSzphWSdONCZ7SmVBKWBSVjheS1ktXmE1L0ZcUjAgQiAjVjs1bG18WFk8Y01jNTVuaDp6bCFDeTVbVSZ6c28rLE55I0lZZTJoPSNsX1k6cj1tIi9fWjFhSSFJZGllUkEqInlYZHd8KDw/VStvOmc1Y3l2XiAhcm5XLWMkJV1+al0uekxmYD96VT5VTHZPQ2dJeHtoeTtMNGs/ZmFMWEpnM0pLfW9fIy83O3krNl1WIlpTQzpKNmd2L2lGOS9rTHtiUzkkb35yMExueyxIVX1CNFsqKUY2YXhxTUZ7bnwhNFl0dDNBYCF5N0daMGlyeX5EbXZcPXNTNEExVntQNGwsZWF1LXYibkZzTSFDOGd1JkUmUkhhbyVCfjNbLihgISEiMUVUPHoveXdpQFQ2JS9HRX5SeyZHS2QkfVghdihzPERiICxTdlE5bidZbmFmYGNDJVlqNmJQW2J7O2FffkxzYV9yPSpbdn15fCtbNiJ1MCFGYHhhaF9aKXVacHwnVnlfNH1EY25CWy80S2ZnO3draCcrPCg8dnIkd0c3KVRzfG9hNWpRKERXMUBTZHMmeX5faUFIMCV+PzNTX25taUxBQjBERHNgNytkLiRfeS5dWF15Ljx4K1FbZTsneCdWXjJLPj1VVlF6LlthekwxJmdnNHx7Pz9sNFg2a0NqOHhhWlRxJEwpPU1bdiZ1amFiXU0vaTJhbXpEO3hzUmB+XyNwZEs0QSkpaidFLlchZEtzeU04KSwgVlQ7T0InZ0l0L0t9J11GZTc9S3VoaDFCNFpdOEZkSC1NdmJFOXNGeShGcTs7WE9rZHs2ZEssRUxpZ09SOVN4MGx+Lz5TPHlCel5XMyx7Smt0VVlSTl5cNj1Mfkt1TlFHfiZ2az1WRS1gSXdVc180fDVKcjxWbXB9Zi8yWH5pVCtaXUFCNGxHRkxNXWV+SzQ0SXJmLzZ2Ni4vdl9AIThBQlx+Xz0pXV1XcSZEa1ZaO0xeeShoK0kuRHdGVyY5PjpIPnBkJDYoLTdRJE5hTj9ffDV1ZngiN2t8MVJnIHpSIHAtcSRLVjxJJ1lrSyA0YzVcfFAtX0U4IWNZSihsNmV9e0cjXjBteU95XDlVPHQtLnpXU3FWNG8gXithLlkhfnQhWkwoe0MlUSFlaWtUdmg+L2Q5UyAnXDZkc255JSlyYEw5aHJCNDpgIm9qW1x9I0w9UUo6VyhWIlsrJiVYd29vc1RSOmMgRlxiNUI0aSxdNFFLRmwgcz9NfkZiWWdzZG46Pl5SQXs4ZjdqUXs+JjhCcUI+ZjYpbTMrQDI1I15NUEl8S0dMKiJbb3BlX0lEdlQ1YWshIktzfWE4eUknOkBJVTtrJEx4YVNHU2xOV1hhe1toeEVcMWdpP1xjVWh6dlF4bFVyLFt9cDkvOCcrYkI7QClNM3kifV1nKTBmKmw4SXAyQz1NJSdNPUlKXWJ2OlEnc3VaPU18Jzd5PnYoO1gjNUJeKFRxWHEnOG5FPU5ocXhdUz1VRi4zY3I3Zlp4Z0x9J1duKzF3XUBxQmxsQ0xQSUFCPDo4dC5OSS9OOEsmLTRBPUZdM3NcenU5aTg7aHs4ZlQyPCF8bSYoUEUrWjJoNUhGYX5kRltmYVc2PkYzPDojbSRWXG9kJjdyMShxcFBdeUI3K3syaitsUVBHJ09HXD9zQkxYPSs7NSN3ZSE7Wmp4JlMna0RTZj5cKD91US1jKlZIOGZPbjRoOzZHLTMhWyNwMy1qRzIsK3kyajpxKyBUbS0rPVxdR0ZsQlpIazFfPy0gRHFmVWNcXU9+XmppbDEkekBIaGQlbig6J0VwZkN2UHVqYHZrRD89PFU4PDwhdFFbSWBRQFBaamlvL2Ale0VlTUVxYyFBfCJ3eiRyUHhJOS9mKjZsMlB1RSc/aTRNIF9eLWY0WU9DaGkjOFBnNTBYPmNAIHxBR3lbJ0RSYXdTQHk6X3h8QFAwbC46UjhRLXxnOl5pOGFyJ21TVjdaUT87KXE6eyRbVyo1RFw7Y1BkRV5qbn09ZTlSZStYNllNXzpHLWFmeXFnYnsgYmlWcUAiKnJga2lYM1x5bzFnZz44L2MgcnQ9TTRNI1NHOGV6I19QYk4ufVZnLn1ieEh5TCUnLHRxaW41QTAlbXw9ZzJ0R0JFX3ppaG0sLnxaeFRKNGV0Py41NDZ5XXJWTkEhOjo/MDxreT1VZU57SHBdSnNYSiVrbVVuZ08mTkh9YydkXU9mczxwZHc3UTI7cXdfRkl4ekh7b19Fa2EmMFVCOUF+UjNrVENGX1F6aDIvMjlYNkY1Tm01N2RTZUt9eFt3enRhM15oaU82aWN9ezxLTF15N0FLcFtzXHxxJWA1dC5MaGJBdEFdV0thYFoiXCpRdGJMWCwkX3tqJEtUekY7ZiooZCNqdDMuaWhDOyBEQz5FM3B2L2U1ZSBbcVBSRGhtdXY6TzB5TmEoeUQxJ3dcYXVZKFpjc2JOXEhYTzw/PWwvKUo2dE1BPlY/dStuK2BJPmlwMlE8amlpfHAyWE1VUjYuT31YVkp9W1lbdFltdkcxQjBOPWt4NFg5a3YubUE9KUpuSTIlMFBISFQ+JTlvXDonfGRPSXhvZjpKTHZZVy9sQGpMOi85VV9KZ0RnQ3BnaW8kW3gsdUEgd0REYF57MWJPR0cvRERcVytUbnM+YGs9Li09S1g5MEw1QCprRiBCV1l7KnsqeGUhKWowUShKKV9AYXA1YHozMz5ARkd0dFkkOyM8I15kN0gvbWF6L2h8PkFZUGdyfSIlSEtqYGNmflImQVRdc1lFIykhYzxEPCdjVX5vKDRGKGEnfiEtOipefGlHKENzKXlpdlQzZEMzKmY1SXxZWl57aDIrPzZSY1JiSys0K0BDT3Q+bmpVISRUKDFXJ1QoWjA0WTJsKjIuai9tWzBhQSgzM3ovJmRFQ0l2NkpxTFpSQ0JRbmNWZSspJyBqdDQpJVB3e3R1OTFZfitJJkIkKEk/RjN6dX04eSUsfEB8PztaXDJGYi19J0clTWtfIXBVcT98O0EoOkRIYT5MXm5WKiJ0ciAiS11BVzkgQCdLUXVWOm1hSSc9YWE8eil2RmxWeHo7czRjSVxdNlNlP3hQbTx+aX1+dz1oZ1NPezVrWFhfNVJ6UFhSXDZ8c1djMlp7bGQpXyhbQl5AWXtiJypXa09we1wtZC1rIjtZKjIjWSJiamM/L0ZqaGo7MkZYUUdWMV9+cUJKWCh7U0wpTHQvLT1kZGN9Q3BaSWApIXl0fnhyVWJkRGdDeDpUN09HPD4qL1cpPHBWP1hNYnxEclJPKHV6OC53SDNVcFJTYFBiIiZbKVtnd3g9TnR0U21GbmtTLFxqezsmal4sKnduOjtmWjZeK3cgQ0spQCR9Myp7bVRcNU46eiJFPGVZbndUblF9JnZ7Xmh0UEVOUWtBS1csa2piZzJfSGRSVzt3Njlmbj1QWU03S2ZCNWFPfDNBJ0AqJFIxXkJdIl93c19oLypAO2g5dE9YKU0xdlQkSixKNG9yMSsqPX1oLT0qSHhlTVQiSTJJNSNWVFVleUpVU2NSbX1HcmgnLF56IGc1XyM7ZnkzUFJxeURJQVRoJU1mZXhxZVBEPS4mOUtcamZJenR4XCxASz58MGoiaTZELEtgSCgmO0Uzb0dRK1A7YVNBbj1FfCN0dDljeUxGO2I/TmFwM3dSMnRMPEc0diZ0MiNEUXdjKWIpYUFNICs3W3tFWl9sUCp6b1htVWN1SD8wOUpvb0BcKE98Wm9fVSYnYmhHSS9cInUhSS8wJXQvNXddeStfSi4/P149PEE6YWptaGViMX1VfixNZkltQl9lW2xqbylPJ0YmRy9xRztIa2pta04nbW52Rm1LJVwgalhrbzFwJlQsSWg2fnVIem16LH4nd0ReTXpoSUUgbnY9ZT9vM1UpeyVSNXlzdFN+eEZqKn04VF0oL3x0OzspY0VJQVBSSl1NeUxNfn17XXpOdFh7YHZna1U/fHtyX0pMKDNKeEZpSjBqdSU7O19UWyFKXF5+NnIoazdiOi4iVj1faXVeayZoZUUiV2M3fiJIRUFzbW53d2sqWTM6KCBOVF9yZmpyRk8+MlYqa3whYltvMHtvRTF9aDdlZ1lddlVAWEJAS0xlOD0+aGs9OiIrNCReJzI4VW5eSF02UmdKUzsrSlswO20/TWtUfEs5RD1gLGZuOipTUC4+UTs1VDssKDVIbmVrc1Ynb2g1Y0IyXjs5XTtYUk9Qd1NoIW1eZltbRkhkOD1hSGMjNUZSPipiSl8lPGsoN35AaVk/Jj5Fel4gXlNlYmMqVFI6I0kvPSU5LEgpUGpeci1TK01KJWR5ZkEvLi4kcys1dX1JYWR4YVNjV31rQHRCW2YzRWFOfSZnRl4/LEFFdm9tY3FiKjdPU0xTLC95PUl5ZGxyZ3kxIj0nTTB6LX5STy41KnBQbTxvS3BaKFJvY0luZEMkRSV7NHxiQDAtZ3dNMSBNPHY3LUgvU0F0YyQ4cmpPKWEwPEBsXD91YE4kIHF9QUFOSTlhfmxWTTsgTVRdJGowe00qbzI5LSoqOGxYQ0ohXGVoV0wlI2g3a2hKYkcgQTlVXShubzc5Pz1fPmInW3ddWlBeOWg1YCRGQFhRXm42TDZ+M0JkezQsQEE2NmE7YiojLC1kJ1d7JWMxcG1NTkB5cks+VEVoSjFBRUIgengjWVU+dXZrXHMjQTw6aWBcLXZeblciOCxOdCxEX0lBNXUzR0gzflF9dXFEaWZvNkBafFxgK31CI0BpdWctO2Q2eTBefFMsdzBhRWxJODFKck9+dF9MTC1HWUokTU1WIDtBLWdQQzEvQls0Qlc6czdBZW03X0pvT1J8JipjNUV0JCNRLkZBKyZ8V3xfQzdxNXFsaj51fVgibjA8ITI1LnJ6PDw3cyYnZCdaTXJKJFtKb3dWMCM5XC5ZeUpiVmooWyk5dzFdVmpkZ1xTXEFOfE5sIjFjW2FmPigmKjJjenFhNmhnRWVcJHA1QXlhV0x5eUtvJHRXNSBZUj9eZT8kdSZ0dUNRempwSFt4flNpKi10QX1fZDtId19zc0J0RXddSiFRWHdGb0dqb1c/RX1NfWZEQiFKbkApUHl6PGpfS31kW1dpN015T0Q3O1w1VEA3Xk9BMz8pfF8xbSx4W09mPkkuNk9PKFsyeCR5JktabTZLRGE1KF1Vck86P1pUWjc0T3tKLmsrPXB6QkE+UyY7TCBRRzVDM2RFVz11aGUrQn5LLFRCZVsvNWQ3IXpmIDoycSQ8O1ImIlE8bXtCLS9nbSZba3d7Uih8UmFVZk1sbFdPJjc+JFJqQG5TVjtZWlEuOGU7IllDK2FmcnozdU5vQVhKV14heSg9QUhucSJ9Vn48b2RnL3FOYztmOCsnUTdsLnAhXjxhYDNsdl9DfndPVDczO0dhK3Q+PjghbTN3Jy99KCwhL0VRbSgmNnQjMk9sIihlX1tfaSZJSHt3bj0jLXVtdTU3IFEyVlt5eHtqaH1BMCVxMyZId2wvIXJpIn5iUlA/QU49PnYqY3tsOScick0hVy1jVGk7LS9eJjs3QldpMS4oLkZLJWs6W2Bxd1hdQ1NPOnlOZ3x+WSBdbkJBUT55USViKnhOc0xocXd5bE5ycF0zfGNpNyBqZkB7JlQ4KnVIKEo5TGszRnk3OW53djN8cmB6Sj48cTlbVFdhfF1rRGcmT29xJ1RUXEtcISpHS1QwUXsjWHQlTGlecVQrajlSdW01QVhoMSEtfiU8dWhYbyMpJFZ5YytdeHQhJngzWktzRk86SWkpfE1Ja3FSY0kqPmJFfHs6eV5SfiBOfmZcNVUgWUp4ViBYPj4gWCQhMipKbU1JaEA1S1k7OX4/OEU3OSROL0RIfD17VnU5NWc+NiZoLlVRZy0nLHkvTml8UUltTHIvYUttMWltaGsrJmted28gSzZkOCo9L1AybkFVVi49cWMmIit9Y2B2KCgjTjBeTyhtZEI0OXx8cCI1dTgxOFAxV3UiRW0zTXFpMF8yPyxHd014Yy17KTZDQFc1NTBAP0NTWml9LmhcIzoiPXsiOShwb1dSX0RkcTN2O2U6K346O0xhKUhxVHJOLUFCZ1djeHVCUmQ3Sj1yIjBxPFhoOjtdcVxGM2QpbmVJQSA/LnpLRF9kZ1h7RT1nPlc8KGY0NSghQjhHXj9GUWMnUSRcSVZKZ25wLUNxcDZyIj50V2h2L3xqbigzaWhleUhPYSw7K2d4I1ZQLV92YTBjSCJoOnMuUyo0fVk1b1BIbkpqcCVxL31aNG1Pa0I4TTdfOD1zdnVbTiNOPjRMYDNtX1dUfDt+Kyp+PjxecT4rY1g5IWd2dm05bFYhOFliXV1wcU9ZQTFEV0ohSU1yal56YGhMQFRraXs4PEMiRVZdWltAPVBZKFhpTSRWUmFEJmlnS3lCeksnV0FGS258Q1glZEBuejpGKV5nbnp8SjJacjpqNUlUbXcrUE49aS90cEM1OlFLdy4nfjc7bERcREl5X31XSVEqS0BafiRgLXZeZT83W1lyQT5fWD1sPko+bDB8aC4iLSpXdS1fMmh0PmpfTSIjLkx5bXxoZzp2ZTZBMzF8LjxIXUptXEo7VnZkI2hHOWkxREdFInJpI2dhZDwxfFxfVkVKRWBwaU9kLFYsbVRQd3R2MS8mUl18X2F0TiBecGMqOHpgXzIjWEQtSCgmQFcmW2MnPXhXYDxaPl9CemBiZFEyMSVjeko8SHxOVjpgb1EzUSFnZUx5VUJyWy8mOVZiS3xCLyklWy1ePT4gXUB7X2ZsSWA0TElnfm40ZShAakt9eHoofmFQXEsoLnIkYyJZKjEqSklSK0xJXGRDJ2M9cm5eeWp4RUp1PkkoKU0kTF1YQyYyOF1OcHFYSS8vJ1pqKj9ySlhFNm95fnFkYW9RIFlGOitCMCMyV2FRUGMtKmU6YyhRYVx4N0F9YDd9Ul91LlxMa2Y/Sjs6Q0lnZUk5Jzc+bipfSkkwQiB2IUEvZG1+cCRQP0YvbVBFTGJdMDIsXkIvWSpIJHNOQi4hUWV9OjROYHEibkBcRVRsezdRM15rKztzT2YrRW9mXnU0Wn1lSDJyUnJuOFI+OGkxfEQ3NFA8PnhiMW5EZ1dlYV5gJ2V0IjNddmw8Nzc+SC05enZWNSI/S1lzbFR+K3hGZGY7Qmc8ST4/cFl0dFdaY1FScSlJMSlgI0JQeXd9KUt+JC4hYWFYKHk9VmxXPjVafTQvSlZPKzolVCA2VF5qcHhqIm1FMl1wL2VcPFk9I28gVixJKEwyR1pFUiBRblRYKTR9IDU6IzcuLF9td2opbyohNXNnalkgeGJ3Ry9AQyVoJnY6OiIyV0diR35WXW0zMGInZ3RBKGE4fiVFPThIVGdiXT9weklhVU1Xdis6WyZPVXhgXTlbJCA+ITRPS0FTJWB5NWghRlssN28rfnFlbXwtbC8qazZ8MVczLy5HQkFkSjpGYHRIbztWcFNWYVQnNlBEPi4xKyZ5KEF9aUlDV1F3VFshOyBJM2VZV0xeLmMpQnhgJDtmZz89PGFhZHJBVTNKTClGOXkqVFtoP2lwI1d9Z3cnK2Z9eGl2STJAbD9VISkvMDE9SGojMC4zYWJcckYtIVFiM1FjYm8qJE4/QkNuT3kkMC95cSE+TysqfkkqSkpxOkdST1p5XE03ey4uXUdYXSBRUCN8JnJtWVYpKk97NiZ6a0JcPDdNP283Qj03ey97XT0ld1ksXUlOfGZSKFQ0SzlFUEBZfWluI3AqazZzWS4nTTYjZVJxWip2aCYqLCZiVUZyc2xIa1w7cXoxLFF3J19jUlxrKTRoN2pJPXUxY2klRS4gei9WP2lERmslPkB5LVJlXkkuRXJsc2VyMXYvQS9WfDB3YXlPRyEsXnh2V3JmbmpHXzQhPChBPXFjX2ldPT5ians9Qj1veUhKLmtBO2pXNjRtYiZNMDEtdHFENVtuO3QrajdwVVF9LlZ9Slt7M2tEKlMpa1cxYyxJbz5zQFBZRksjUEIheyxGfCxDZl4iJW8nUHtdL0xpZnYocCh8bzQwKEo+a0pNXFRFQjpHYmVbb3ZyMmdNWHJQSDZba1FHMjwxeidSKnYndFg7V3dnIGIlWjZaKCRYbTFzUFJYUzt6XCU3MixTaC9FeDpvKHgiXzs7e2pHUlFeXXdlN3BhOSs7YmNPb1s0QVlmKUsqN1BYKSJrK3JEeEhuZSgzN01FI0YvRUNCRkZtPmx6TylOcEctPTRbN1N0LyRmRnd7TEkodjk3ZUxEUHZiPzY2Q0AvKUJbMjtsZWdWdXxMfXcuP3tzdGVLSE9GUidvfEdRRz5YNmtHei4zSjo/JVpUfWJGQyFHPi5CKS04SzpPNlE1W3VPLjdWRllrLiNUPHdFdjRsSFFzWFNOYFp4UmZ8MC47bHtoK29kOm96XXx+QVtxYVxpaT9WZV9yR2pGc05nQW9HbjcxN05aXnwqcH1IVkpUIGYlfDJTT2x0UFNlUUt5TVIzfTY2I1BzJlsnekgwLnhDY3xUX18mPWlbZHtfbztgXy5ePSUuSXYgRl5ISSZYIFN2W1d8TCtqdi5jaXBYRiBbOi0wTHEsKiN+PE9eTy58UUp+OFRlQVVhQGFkRVdoNXlyWToiLzB9Nzk6VmNeZCU2PTRrUGFuQ307O3Y9cFJOTT95dmBnKWFgOGk8flBjd3xzd2FCZUctQnhwIyVIZThQVnFARmx8U1oiTWFoOFJbNHBcZ1sleGFwYiBWIDFDLyhfWFZdcFJqc0h0SEcmNjlDJVliQFlxKCxMZ0QpPmZZJ0peJERMIXV3aW54XmJ+JltuVE5DJj5eLHR9bHEtdixlVWhEOF0oOVcoLkdORFI3K2h+MkpsSE85TjFLTDpnSGl7WTVzJj5ENzxzU3FSYXdLLXpiNT55Rz9KVGgzPzBAbyY/WmY+JCJmXkZeT1staUIhIS5jQF1nZztcd1MyZTR6NHl9KlktZVMkQXBPNFQ8eT5NRUFcZG9YYHR4Xjh2bU5vVHZASChUbyZaWWh1cCpaRmkqO2doeHk1ImR6XVEqUFQ7ZEd6Q19MbUB5TUMxJHc6bl1TTT1tdEB7Ojhpc29DWmtrRlhNOk9RI3dOaDNkUDNeblJQJ3koeCVaZWl1bSQpWmV2cm1FZmU1JlwyTWM0NytZNWxSTzZZSTtmdVNNdn5KeVAuYmw9fCB0XH0gY1lmZCVvaT98Tz94bEpeTFAnaWFKdnklaF1fVic9K2ZHMnJ6Z1Rza28iMHonJm9kXDAuNWQpPmVsWiszLHAkSkQtUCd0WXdsUSoycFxUInpReEUoNEY8dVlrXjJAZDEiSntJQV02TFsyXEZuWHhdJXEiRF1pMXY6Zi5MXzMiSyxsLHIsLVRoLk0nUzhWd2Y5c2Y+Q0g7XjI4I2xFMj19Q1g2R1NOdHlzYTo2WldTXyhqfkMifmM+bj9JTDVDZnlYVTI5PSkmRVhQMXQvXlVYKDttZ1hNS2Z8X2EnYz8hU3UzPUk3ezUlfWBxNUcyezBDel9yPDFlYzojKUd9IHdkJyFnV2B9PUEpSGVTPFkwd1wlckxaczhoTWJVIURoIzJofitoNSx6YThiXVdvVT8iSD1bXW91WVx7T3ZfQSd5My5JICopNWB6czYoJGFNIER+WiF0ZT9sfW10ImlZbUJeLmx6Ynpyc3t8OXZdcHtzJWIsdGIuPFg7X0QiVlxPXDxRZFVcVD1oLllfN2dFRkNpfDwxS0N4M3B0O0RMTFVALFw2LGVXYygqUjlSNTAsMFhGRE9+Ulk6TEN0Yjpne3xRNEM+ZzJoPEgsI11vRCtkaFcvVD4uVUVwb0ZpI2NETjlALjFyNy56WGM/JjJkJmZbQV9GOy11Py9rNXJCfCl0YGVvTFN4UGpFXn1ZcmNFSWRqO0VGdD9bclcmbTpXZVRgbHB7KHc1V3lJd1hiOzhYM2V9WVksSVI2aC94LFFLX2o0WDF4UX5BQVRsIV4nJ3wpM1xbcmtr81:T4464,SUhEUnNSR0JnQU1BcEhZc0lEQVR4Xmt5Zml9J11QRS0+cGk7bms+PllxXzlbM3pTUic4Lk89QnQ/dUIgcXAvQmp5dUV3O28obnZ0QGg2NE8xYUtxTypdWGB2P0NxYiR7cThGPnA7QztWcTt6ZnRQJyIjcGZQXGZRJSdYcVZTfSJwXU9APiE0Q08lV0ZceUghZlxBcX0jbz9OJWAtcExaKCUkaChOWm03OSpFXi95L3NoZjRca2QsXHpMV0RXW019M059eDF0QD8gK2gwdyE+TzJDcGJoSkA/VEFoNkImJF8hcEVjKFF0djE8MXBZM2d6MFY9dzJUN1xmMkJuK0lZbztmc0VzNEpeQ3E7XnN3LzBEWD4rcCpYQHw8a144XVx4U3E0akB1YTwjZWI5XT9lOycsVnc8VDxiKE5+KE5del9xaD5yOUpdP3REbnAzLDMwKyUtSkcsWl5wZWxcbm8tQyJCcTM4Wj5cUXYkeUkzVTNtcnIwfH48cF9lc3k1Y2Z7cFs/O31MQEAmZCBNPnEmbDtOMl5cd3daPD1kYid2aG9cV0A2XDkgcG0qPC16cCVVQXFzNHBzOGMsWkEjQ058ZiYwLDhrc29kUlhCYT0yYDIjcjRTSnB3Z2x+XyZWRSdfeWtxTCxyXmcyXH03PE5CdXF2P3NQQyhFIF1Ae1p0e35QOjgve2VcKGFcUmN0IUAuLDk4bCBAJUhuTik5di0zRHNwaVEvbHI4XT5waHFZSnNAcylwLlc7Il50QSY6IDp2dG5dKkEsW2pMLEVMS1ksOCkxJ0ByOCJnUTheWF4uKzAud2hHKy9LOCpYbT8sbnw5dWclczhwOE5+OHFnNyUgOywoO1NudztYLmw4OG1lc2IgLyZeWDl4ODNoICglYCt2T18gcHNZRU9yfUZ3bElgSEB1N3F7Xy9UdTAqbi5FQ1tJRHdOO1NReCxcQVdsSmEicGFvLD4lV3tQUS5KOUt1di9BPGZzKSAucTxsTmFAcXNfeWV9LXBfO10yMChDUVlRPUNzXSZ2QC5QQ1hcaWdxQ3A7UFwuYTRHR0lAd10uVlhMQENVei8xJy8vUC0wfS1fdSxFOzleeDl+THMwQVUwan56PzhqeykwOHBBMUI7NFRzUlYjLkk+YHNrX3h9dVY0UGtFKW4zWlx+VThJaC9FcHNvKG52cXFoQENsLiBbLVJQJGBFJSduKT5wX3NNcE0mV0Y7TitwOXheKHFvXVt3On11dW9OXFInfEIsc3sycHt1dn5QXSk4XVdce0AsRXxdTF9JRUNoO0ZmQXUjRjtVdG8ycD9XXXdjIG5XfGt4diEoTj4wTl5uXyghIFMzLnc3aWg/cV0mei44MGlgOEVCfixOJjBOTm5vKCo9VFlpQ3FuJDspQVsuVDEuaWhTImkwLElpKXQlcihFUDEuJFxeMTgxMllxM2FvUz0zOCFEYE4naE9WMjAkIHNwMmhxbHFzYVY+Mj9LPjkmaC8ybl8zfS8/a0dxUFwxfl4jcGNfdzN0RVRxXXRAMFQvLj40eiNLfGlhZzhaeT1xUVxJUlhYXHl3OG5+MG4gQGYnZXU7P3NzIC80Xn5BQ0NhWS4/MFZ0RGhlNHJRdSxCcWJoKCw6dz4qOT9kZ1AlIGcoZXhGc3ZBOkBxM1VYJy0oXFxufjA6fE9Ac083b3lOVjMwZyh+dlVVZXplXyl+NkNwQzcrI013TWhJQHAgVzZcOVBecGVtKCpRSnFlLUdcMWdrSiF5Xis6cF86UG49XHxlbyoyXHBcOWNyWFBYVk4sbTBOdTtXWXIiMCd9QDtETnBPYjd9KXBkciIwZGU/LX4kWk88L3d+OkBPcF1iUVxZYlQyXEBBQCUgcFxVNF4hIHhqOCsmXFxoOVdcXz54RE4sPnhAX1JjQ3Z2fS5wXHNvJXJvJ199PXo8ejFYS0FmZGBWcFIsRylTOHxPImJ4UTdwZX19I0BzWDpoeiIrel8kJGA8cmstdXRARSBwWUBwPlQiQ1JwTEJwOFwuODw6SD9GQ3NKPkVLJWZ5T0M/Tmx8bltici4rUHBzMnBnJVB5MzNwMy4pXWRoeHRBM3dTQCs8R3lLQDBEN21GJThLMGguK1FKXSJxImtRPGkkIHA5QEBzc04ueDBGXEhzYU5EIHdfUl9KNT4uSHowYyVfPjcvfHA5RDNtU3IiL081XFlwTC1wblFyJCBnZDwpVlZmMHBzO3Bzfl1mdHAneCAyOjh1MS1eRlxmc3BwODEyQCYnL081WiZPUy1FVi86KD1mRHMxcCUicD4nI3I4PTs4Nj12TF4iXEVQJ1MnVHRJVXQgTz8sfkMtWChfKGFufjI8dzM9Z3xAO1d0Mic1SDN9ZHIpVVx4fnwsKistdSIhJXshdXBIdiExOTlqWHw5eCEsayxvLDxnfVA9J1FUPT8qKjc0ZGBCJ24reU5IPDFOQnVcRnJoLHBFLiQyXCxZcHJrJX5QTT5+L21rUy8/Z35+eTdDZkFgfGRcMHVIdDx1Z15VfidLfWErOnplRXU1ZXxsMHBiYS5EXmklcGJtQEYzPi5EIG5mMG4mW25BT0BmNVBDMGBcOlw5M0JxM1w2XClibygofWZhUTshcHtEd1cmei9VbC1fWHNXKj48TmBtTHM/LktfeCo4NH0jb0o6KD5pOTVEXnpuOTJYRXtLWkl4SUFleTUldyhadSQgaFBkMEA9LiA5ImgqZ1dFM3AucEMxXzdcJipwZXZlMCZyTVRcOCZJQDdbYCFHcyRcdy9wO3FFMG4zeGJRLS5QOl05LntwRnMoZ1RpcTJoPXslQDIucGoodTgvcDJoVjZMdElAJyEvZF8wcDM+SHBedUQ7Ij1WJWkgQjx+WWwmdHZwR2RBMy1OQjMuLDg7cXtJVnY0IHssZVsvejF7RVVLLH0/J19cTnB5NV9EcHhcOXN0QC1OaDhycSNPLCRdVnJrZH5MemxLWlA+cWpzRyVOenB+cTlsMT1pJF55bWdmb3pifXBrQFtMT3M7KFgtOnpgVlRDKnBhaH5sKyhKXDQqXEJXUX5fcUlEQVRldFFmZngxd0AuKFxgfl9nRnE0d0Umc20lOkA4dVV0WVd+Pi89eWtndS9wQytoNFBUQjhufXZrblgxOmhvS24lcHNVZ359OyMxLlNpJ3dTMHE/MHAvPyN+TiYwTkZUPTc6MCg7NEh8PyQgXntKdH1icGhxRVdKJihjYy1IUVBKP1BLI0Bdc3t7THYzXHggSF0wQ0QgWFUtJEBLfjMrTjdzdS5BLjspQDR0WkJcWWEoTnI+NC1OSl59bSE5cGJ6XGNOMkxmXjh5e088M25WMDp7XylvO2VeOElQN3N5JmowZzArJXBbe2A/cFNBWkAse3h3elxIVTQrLFpqOT1oZllwckIocGtWdmlgVlRxYVYgcDNYZzVwMyJwNWErJlpeXHN+fF44V21WXnB5MXFHbkVcTTg4cEFxdWAyZ0lkUHBsRVMrfiN1dz57Ukg/JnZedGgxUVVZL3F+VlggOiI4OHVqQF54eUFuLHRwIWF6VUlAWXJJdklbP3lIaDVwYm1fIWs0cGs5YCpbTS15UXZhWn0wPypBdlsqayd5QVhdZnhuSjktfC0kMlosK1Z7WCs6IDE3ZV9QSD9AXjAsQG4oXWBIQCUyfSJwP3FASzZzIltuTH1aWUk/XDxLfEFiXFBeb0FDbH5kYEg/fEQ2WS0vN3dKeCxYVywoXCpYQC1VQGRAQ1sheTp9P0JdL2N+fDtwMjBEIHg/Wks/fiZALm5Lc0R1OT81cW82b2IzV2Bpa0o0cCVvXUwrO3x0ejBQODw4SjRwZTVDcWJIcXh8elEgej5zRzUtL2RgcSRgRmFdJipCICxfMXd5JiBLP2ZUIWJKM0dmbzo/YkpANy9ne3x6S28+e2VOPDctPDVOcDJJPnZ5ejx7XXRJP2wnfE5zLy09KCRgc2ZndXAreE9CZWAlWDg0dmp5XjclfmAjdFkicjtyOENARnNub3pnLisgXWgofUxecT4mP2I+LEJ0c1Vxc31sKG5iRixKIHopWCt+Lz9dOXg7dF5LeG10PnVAJStnMFdvemc7cDRARFlAaUA0Sk8penNJIUh1JWByYGY0WEcybm1gdGM0UEdFSm5HIFtId2sqcFggXkBzTGdbI2Z7IVxtU2cvOSJQWHF9MjlyJnJnInBxVWBcU1M/PXVJQCcnTmYtaH5XICBLQHY0cEU1cEUuJkAtKVxgazg/LSBASzlbJWAhW04rOSQxWDBkQjBFYCEjMERCdzxaYDNEcTNHJSA5ITA+R05IXnN1fVo7d3RxZ15sI3w/cGsvbGZ4MG9sIDZCYFZTK3RKQ2h4diF8WDVFOW58VH5Od2I/YG0+IHxyUGUmXioqUWpPNz1PWSI6W3RPfm0tRmFkbElTVDhUbjg/ejJMIH04My0sfTItKnYmQDAvPiZAdD9mZHtuKkt7WXQhdEBXZkd5W3hHcjszLHImZCJvaT5TOTszTU5JcE9AbzgxUUAybk44ZnVxQjNaRThcfUBXJlhsRzg5fmJxUnIhUXh0P19UNyRwZStmfWhwWiNyIGZIcHtvTW55RCZjQiBTdjN8OjoxOnIvdXZmczgkYEJBdUVHdD8yXGhdMyE9JnBlWCtAczQgeThHZz99SmUgdzAvbi07LyRgITlUNHVzXTNAIDJhKz8sM1RyUDhJQC16SlUuXHFmUS8uXkAueF1ibyhGUSE2SXpcXlA4a3BaTlIxayczSXNdZz5nPXEuLSovaEEleDAoLEtBK0dCTXclYC5yPCh+KXUscGtMYy4+Q2c9SzJdIjBpMShJOiAjQEdlcF96WCA1cT0vJEozIGZQUWxgQWtDLGFrdEk+JTgwRnl0IDI7MC5rME92MCF4JCBwXS90PWclLyVeLHk+aD5XVktLV0AnUUs/bUg2fD9wUmhQeC1xaU5zWTlvP2wiXzprTChmJ0VwYTAsZCY9NnNALlwheC0ud3I+c1g6QCxuTHkhSnpOTChdO0NKdD83I2N+MkBne3BAcVJCOnt0TjonQT1Xa2Y/MTU/IiBDLjtEODQnfW8wQHN3Tns8I3wyLF0hd2g1cihHaD88KnVJPiIwQTdGR3YlbihubC42YHdmPz0jcXtiKFxkXH1dOCFwYmVaVDY0T3gldVBwLXFrYngxaylAQidgWmFMNWBwaWR9blBkSEIvODIvOSpsXiklVXU/ZEIwWXopSSU8YyB4RWBtXydDJ0ljQERALyc1KUAuS2FWXnpBaHVFU0BCVEVfOiUuMjhcckhINHFDaCIoaGNOQ0cyZDM2ODB4PUdbN3Nvejw5bX1APC5+b0QkX3UjWFskVDZkImA0eCM8PkVSQEIlZC8sfG49YiZzInh9PHJvNHhgRGQ+YzZoQFkjZUlAP1N2MH06LHlQV2heciJzXiNeQ15fXmZCUFtWI3w9fVtkPX4lMkhLKHBeI15DLF5dakJ+JTJII1pJVyBxNHM7ZXkuQ1VJKUgkUkRRKjQpfD4kQ0ooQGshQC53Q198bzcrLG1hI2lSJkd9RCQgP1xpaz4vfDBCKWhzZDR3Inc1YF0nRV8vYGpQWEgnUXBlT0FyKWRZS0JAPzRyeFlOd1N4bW5zZD0oLlA+J0MyJjpNfCpJQ3gjJ01mJUNtc094JGAqNEhQX2RoQi0+Xzh8NnRoIEBtcCNlTTI0TX5lQyw+TVF8TCJ8QG1uIDR3fW0xQzh4TS1caUB5bG9yOXwyKVc8ZEA6SHRBdFl7NGlVUGVeV1FPInhfRCBCfT9lIChFIElAT0B0aTdKTVlRbHNSV2QoUix9ZnhjSGVQR2RSLkghSj5DJlIsZ1EkVzZoclowS3J4XmYgI2xgO1t4M29YQEg4aHFhc0R4TSUyYiBkQEFlTzZwQERbJyV8byN9MEM8Z0pCbkQjTjkjckk7OlouZGg/I3gkYH0ia2FfVX5JK35xLkk0dEgkSEAmP0RbV0A/RzJ4QiA8LzsnX349XFJ6IFxoaHIlSj9tXEg+QCQie0hNLV1vXntAO3B9SURBVCk7NCFBcWhCKV00ekFRUS84M2ZAWXhFRC5qWG9udWoseCk7NCFnQWRfR00zYFcwe0dhfk8mIidYKiF+QCJJPz1oelg7Wn0qLiNlIEA9PCh+LXxsJzgqMFtyaDwnTUBlYUApLEApITRZbER7byBdNXggWmBBSFwyaWg9XHJfVzh1fi1RaWFOYEIzZko/RDZTICB4YCAieyd8KHIgc1AmQ1JAREpALlx6X1dLO1xwR0w4LUUjVlhYRWRoY0MmSkBfQzcjO2RoY0NDQClmNENoMkhDe2tHOEg5cCVUYk1KWStnL2s+bCUgLSpYXEwheD5WfCFPLXp0eHloQH51aCcrY2QuLW0ucnB3eS9sMj1zekdkVkkmSUBOJz9AXysnb3s4YSBoPSonLU1qJUNGaGMhOChdNEEnWXgjPFNAJHA0MSZNTDZ0eSMqRG8iXUBeeHlROmYtWzJ4ZiclSzpUZGhjWDZPJDRUK2Q9STVcd0M7KzlZeSYnOmkvRU8jP2tiZ3IsaGMuaGNYZUBNfmA9QE5FIjtpJDogbn43NmxeQkxDNUFSP2pxXkVmPUI/MH0tUyNNR2JTP0Q2b0klJzQ0ci5ocylvPmpzRFJAJCAic2lARipZQF9cQERDcWhjLkh8Pz4yLD17KHItcF9EOE9mJH4mbVtlQy1aLU5FXDZsYl5vbGYvX2t0ZCBAQjNabSJVXndJTkRrPiEjbW5EUkBOKSdoPmdyXkZNYGUhYEQrXCY4IShNWlQiZVJqNEliMm1EbVAid1NtfGtlLUBkLy42a3ckYFJzNCAieycpNERwXDQzfi9dMkFOd0NYPD1kcUVtLnw6X0h4dTgnRS1YSkc/XFRMNmdeLG90JmQhTClOSElpJUZwaD1JJkNIQn4ycEB+JWBNUH1AJiRUNEh9VHZuNjtZcFBjYjYvYUMxMnF+WmhGKFRMbUdYX2M9MjJ0PHhwSEhKQGRCcDtTQDpAQy9NcGRBQDwiMHw9Ji9hYSUgKyBEKWE0UUFocUpAXWZlKFwkaWg+Nn1lQzI4bGJETTxOUVVwfG1SICQgLXwvZktKP3A5MiAjMkQ5Ul5ZUCJrKSIuXlVie31zXVJAIlFnVndoMkZDUjRJImJNdHE0WUZEeEMydDw8RkMmQiExYV9KUEpNYFJ8SDRZb1xkJH4+P0FFLCRcZURKP1lHeFNaYCxaXzBkcyh8Wl0kZF1FeCtgTVtQeGhBViF4JGA1bDRUYV5AYGUlVFRcMCBSQEY6JSAtUkNoYXN+X0NFJXZ7cCJBaFN8XF18M1xuQnpVNWxvN1VCaSZXP2F4a2F9VSVUVVVBM3EsbSckYFJrVFkgUk9AaH1EYDsmLlx8P0htOWwmMTgkPChyLiNRI11MdkNoYXNeJiRIcltzcF84OH5qXzhhajhlenc4bWFTOVRaOH5KbytFQ1tULERkI09Ne0NlNVRbUWlCJTVVUCYxOCQ8SD47UCoxQltMIiAtTlIxRiYtSkpheWsoMj9jVW1dIWhmLTFrW31fRWRfQjJQQElAe0o4eUpHaEJZSTlcVmp+VilrayphcVxuIFJCSUomb30tLCkhWk8nRH1ALkpYXlJATTpwNHltfUAuaiheWzVba2B1bWgpfG9lVEc4aSA1T1pzRTksXCAuXV1iam4xK3dqZXErNCwpMWBAW1hQUmZoP2M8OGM7Kjh3QjV+MnozX1ZdKl00WUZkJXB1Zyc8NmszdDx7XWVuLTw2dzw6eytSOGVcKWt4JXx3WDVVVVA6dSpML3t0IEApWGpKeGJWNTw6XD9pI0AqJFhUUGkqOEBzOz56JWA2cyEoamgpR2YtLFt9fiV0XG0nbzc3IUl2fGMubTAhbHdBQCQyXCM9KSlPcShLP2YjJTo8XCpXOVBxNnZWTllscHlTJkF1czZsT1lZO2NJKEwvIWlZSEBRX18jRltdeGAyOSM3YD4xLCtYXk9Cek5NKisuTC8haVk7NztxO01vWjtuICQuW21zVzlwbXhDQVVUUFN8eHF3TX43O3E6fSE4ek97QnhKOy4kcyRoWUg2Kkh3WEwmUn4lMkB5XkhAKWMyQEl9L05GIyNYQDFhejNuTig1VkorLl1hZXZULU91OH5nT2t9OyN4fjtyXztIUCFbPXh4fC8iNjN5RnxvTjBoMl9TbjJYeXRgcl00STg1JSkuJUREIil4L099QUs7fVssRUR6Ri1uWSN1MTw4fnIrTVtoXTNtbzpXTzRtJ2hla0lQWHs6MXRSPHR2Jk00Qml3RGJwUjpXMEJ7X1xJJjgtZk1WaE12aFxmYHggfEVAZWozWlkjW214aFZYcHEhIyxBNzstO0g4XEhYelx0XC9ONn1MVzd6RWF1clNONzQ9Lj16NT1fdEZ0Kz19a1p0JjRGXDhde2N4eGcuMWJeMWVmRmFWalA3cSJ6Sm86I0R4YXFKN088aiNcOzwgUl4wPSIjRi5pMHBKSiM4dSYsQEJRS0ZgRWlWVFRjeSV2IEFFV1MrOkNBRHlYVn5dcipWWERpYWw8VlUoekIuYmtWIGFdSWFIXXcvOTdyU2A2Wmd0MVY8WysofS8vZWVlZk9NZjJNeitqdD5FbjFaciF0JDpDJV1rMVFiQUEldnJLKTxlUFFYK0RYa0tHYndDK1FPaUs5NXRaV0tpeH5nYUh6XiorXEhIIm96ZGI/Pk03eGoyS2IjLl5sb0dqcFZRIV13Sj40cjRceT1VZ2BXXiVwYmguV2BjSWpoTipPKj5YcjtPaVtLI2s3YFJaKShAYz57OUFTYVdROUkuM2U0X05QNylQb2xzYXtvL341fjRbNyZGJnx1VFhjdkc7dHZ1UitYUz5GfTZqcmU6Vmo9X3NwR1E1VmJPYSFqJjRbbGhITXlZWlZgU1E5VldUYndoaGwueX5McC5lbE85X3c0UCFUR2dAUyNoKCwmWH02JURESzs6XT0qQV1RQ1paZ1ZgZ3EwXENvL2N4PiN0LCxrPnleXiZgQEYqXHQ5fnwnYWhROUpzLUBOeFkzW1ImTHh0XzNBP3x0dDtdQH0zIVQ5VEVDcHdAXidfeFxfOmhsRiIsQytgOENHNEx0JXpETT9OdCZoazo6bC1EbUFgb0kudlpgcGA1eWAuLkZ9QSFjV1E1JWR5UkA1als4fFwrSidAOWRTKmE4clhaWS46VidDR2BXZF8meEtFOl9feSpWJXpcQ1x8Yyt+aHZFYWVVI1ZIKDUwMXckMSNqVmktQmteM1BfUGdpU0xVQXsyaCxqWXQ1cnNUejpPPV13cnhNTjM4eyJUZkVnWzMgajcgVXE1VFRqWD5aPFdcfCk/bnNMUzF0bUlKeXEiVlVcW2pLSSk2cmxhSjE8Qm52aG1+QGV2QmNyQ2dyQU0odCstby0taGhSPHtAZjVaO1o8V2NFalA5W2YkVG1IaDwoRSw0MTpdKk5FTW41VHJUYG5KU0orTXtyWTU+RnE4Y30tclNMeXRGSFRkSHwpL3dmW1VWNHl1I34+V2haPFNLYEk0UTV5I2I1e2BdeF59YE8kJCJheDp7K0lPN2hdLUBQW1AuWElxNEIhX3drLkU/cXQ+ZitcM1BCKntmTmdDPS05SkwgRi15ZTApL0c7QHN+OUlEQVQ0I0ZxNjpPS14hWkVXOCYjPD1DRGFeXl0+PXA2N1p6bzRQfC9ETXFSKmNoUXkvLCUqZ31uPi5+fS5mdC5bckF6eFEkeDB+cG1RZjp4IFI8On1KY2s7YkBePlp5eS0uXmhnKFE4XTR5eiFiciAoNlxIb303VUNRXClqS3VKMS1YWzZhOCNhezV6I3csN1tlYy4vM1x2fiJiYyhDZ204RmotWlRaOjZdcSU2L0M7LTdFZWglVEV4Qiw8YjxiLmxTZyE8YnJhdHhcSFViIiU0JkNAJlMoIWUsOipkUkFnazBibThuckFoLX5MNnRTPHomdlV9cHl8Yl1bOzcvLnR3d2RncHdee3F7aT0gbF4/LEVhW1xQbSRoe3hwZmhee2VVRl5yJ3IoQE5oKX1cPlc+RkVII1BfMH5EelghRD1RfXExPVh0Xzp1Rig+KS1wMFltMFVGaz9TXk5yc2IraTBMfD0mKyJ3STV2MXdRWnpKL3tyPkRNNiVUfk1sJ1ojIS8zP0ZcPkd5Klw0W0Y9Tnp1dVVnQkFwLTwhUVJFcCpRU1BFV0BfNExHJ3g6Wl9LOE1QODlCLmsoRlJ4KGZVOj1aSlw0R0MwOzxdQllcLjwvPnFYOThfdE93T3d1d013SkciRVNfRHQmej4rQmltK1lwM25Fd2M3dFhQJGA5OzUuND0oJSZvQ091cUs+VXVkKWgobjZ2fl0saCZPaT89U2l8TEooKUApemgnfnc3TnVAPWBsN0hjbThcN24pX3Noe0E9RmZSVXRSWmgxdmUjPVc7KF1dLCx3MkpCbCY4cGV9fFgmVEI7aTtpUD5PIShtfVNKOjdOe3hsOlkrJUJ4bDZ2VXlMPG51OTptKz0qNSxtRFk+KFQ2LHhhMGZdM2MxN0lQeUFAZTgoKWVQTypHP117a2ZjfDw3c0NBQEYpbDRvMHdjL2Y9JlVDNVNbSXVuKn08NmA1emZSfiU0Uj5qQVNfUWtuflNpfnhtKCEmPnBKOCJhLExdWnonICB9WjQ/PVVqOk9uXk9TI1hZPihUUFFwSVJ+YCphRn44JVhYUzd0YVowfk1qXG5oV3F+YygkYGE/IVo2ZDpOfEtAaytIRmkqIE5EYzJoJ1ZZOFRRT1NJJT1jKkUsPzFnT0ZZP1F8WjBmdT1VQDU8LlBLdFVIJFNIR3UzTiwoT2UjcWR7KCMqc0o6PF5mU1ktTno1LVdbc0FBQDNoc3hmJDJ2Ujp4OzBPWWBhRi9dRzxId3ZRdE4tQzMpJEJxNC1jKUNkTUYxfmUjdjd0VkxmP3R2QHldQVBucz5JICJaYSMhOF54dTM6Sk17aTo4WjlLRFwlWkxyZEwkJlBhc1hgcF1zWSVWdjhxcEBrd0NvaEBHcWxKJS4tQUdoLy0sUFF+ZU5MeTxEZHUlTX5oN356QEFTVkBocnRwem0sSjEwdSpyISp7aXQqJSRgW1VKLXV4XHBwd30oK0V7WTwxaFw+aGxESGdFbDM4XF1PYHleRmojfDo0Jjc0VmNaLTplRkZZZzIhcXAmeitmXnpWIkQgcjZ2fWljaS1baVspKnEtS0MhdkRnanQue2spYCZFaWAqMUhFQnZwWyMiUkckelRZYDVWfll6SXtKPTRXcz09I2YrLTduIy5bfmwzaldoUydOZC56Kzw6VjxAQmx1SildZzlxKzBwOyJwOWNwOGR3QG93QXM6XURraWVDRS1xK09gLGBKJmBPTyl3IVo0VFVEVS1ecDd4bkVwZEFMWVh7Syw/cnZEInBHQHtpPTpkKV1SOCpwRU51fmkzJlZCe20sd1EuPExHY1k9diBgcSBzLDhRPSxtM0FtckFtdENvdntpPW9CIlApeCd9JjhOaTpVRzBuNGgnTUR5aWJCKklpS3tWYHcqSl8lOmlddTheNVJabik2MHJgUjk0RD9+QzU4Xj0yfT5ebiwgcz54Nih7XXR5T0BdbHMtN2kmOlIlflo1NFNKekNJOSVSQi5NOFw9Zl4vInpdSDsxbFt0K3ciYHdrdENleiZYKGNVKy5bbGhKZiVkO3o6ez5eXXRtdzt0X05pb0dPdyQuX3JsJXpXLkdpSmlLJTk5aEdMfWIsQFJ0LV4yNC9ZUD5fS3lqVF5gJVcuO3h6eXtOU0NzbkBzVHBUYEIpRENJQilkQkFkXXRsPjh6KF1dVkdrdHxNdz9UPX18VXB2RWVhckRBfnRqNCVHJHhMM05jSGhkOjg+JH0uJWhdPDNSJiFEIUdTJ3QnLHR8fTojVDxuI1p6c0BlV2ZjTkNZJ2EyUn1uQnIhSVkwO052PHNCbC8/ZkFVOnVZLXRYIiFaS2IwSjhdcUIiIWRfJiFKdzRIeVVYQTpOMG44Qm4/bk0oNHojYVZNaCxHTz9taFlrL31lN2VZTkZZWHl+SFNpYHghZGBvVTcsJCAhQFpOIThIaUhlRC8lQmc4SWllLEtRfEB5IHx0Tjx3WWBwO2BkIW42Q0VnQjN3LFAkaD4sZDIpRGAsKiQgWWplaF0jRCJ0bEciSnAxTHkqRnkqe0NdfTsoWilAbngyWTgwIzBIeTBfaGk/XTRyK0BVOXFCZUJUXlQlKDNhUTpQdCE+Rl98VEg7Y1Z3Q29pNWNUdF91ZyJCPyxhbnY6XyY/Snp0UyV9IzgqajZ6K0ZjNE0gSUxaRGxmOGBINEhZYnNeOVQvfl4yR3FIQT86aG04ant0IlpwQyxxd159KjMhU0AjWjlFLD5JL2Mob0NzdWtgSGZKSC1OI356ZydOYycwaWliYz8oc3decy8hJDAuW35EIDd7IzBlLDllQ286MU93YztUZnR2J255SC4oKWw2dCUzfUlBQVQnYEtCY1Zseno2PTI3LXNDZXNBO0ozWGZYVV1VXV1VQH1sQypZeGIzTS1KKzR+TFh0JzRUID1mbkNze0JwOCF6Lz87aFs2dVVuZD9qPSxCR3lEOU1fS3lXKit+eiIlfndTY1o8MT1+OGR7MjBiOi06Kz5EfCE4Qj50WX5pPDdveHxRWERaWFheRVRRY3BsfG5nO1RWI31KTT8zO0AhOn51KDNuVGFLVHA0a0xwUmgsKUJTTmA2c00weVFrUSh6fjJjN34uPzdDNl9ELHt9PCh0TUs9YTUpeHomXHM1IG1ZeGBLJmRqLEgvSVB5dnNtQEQvKEZ5TEUlXi8hIkNrKmhabn1nX0EpMnlRZnRRUDhlKmEofW5lezBgUXQnbUE8NGsoei45JzMwcCc9TThQWmtGcUA1blIrPjZLTHw8LiNAZkR2KG1AYmlsPmx5MFVwWEwwQzwyc1E8NHdBVEJRNEQ1JzBoemNNTGBoQGV4Zm1jd2RhY201XHR4OyZJRWk9YHMjYCRNcDU0Il50WXhZdF99TzUiPV9mcSkpU0NsOXg8clE8eTpyajZuRXV7YWc8YXxnP2UzekxRdF5PRChaJ0Y2IV5beiV0XnVdV01tblRYPEJ0W1NyaV0mem4tRWlvJVFVeGB3L1JGfjxqV25QMXgiNCMmIiNQMHQiP2gqKUNzdURuWF52XnwmSEEoakB6Zix2VDQ2JiwuMnFBKkF5U0U1eHN7OlhxXmtHKipyfCBLP1pBImVockYnSDB7OyhnZGorcUxQNHA0ZVZ8fjY8Nm0zOytrYW06fF4xOjB6bEhHZUxYc1wuWFx+ay14L18/O1JANS1+dmN7MTozalwgVF5uS3BWUEMpL0F9cTQrKH1+WzZQaUI2PDh5I30mbUZ5R109cjF0W3ROPDtvPyQ6Lz5+Xyd9M11LQ11XX0dtdH4sXVFcdjRzNWBebT4wNmB1eHZzJlhcQWlgfEwuX34uajtlI3pOWklEQVRqaEBpTS58ZUYxOEdbLShxNWF6cXBaZ0VKSTNDKkdeZjlYPHBSPDx5PW8vfXdtKiZvaz56bS1ATTl4emNWWiFIL2kjUDZkNEpLJ1hNOj18VykgezprO15wLn58YnQ6WGA5UUZNRH06S1tmbnJcM3A0YVg4MnRPc006OCZfLUBpXTo6Y2svYn1WXkNzJj8qeHF3NjdfQD1AfjFAXlZQJCBXTUFMT2sheWEleGoyS31TI3x9P2M9NXJtTH4taV5fPDxQJUhxRVA8X2tFeTNSdHYsaUclOk4tem5FWkk1bnZaVlFLZUUiXih4d11rPmRUR345PUArMiJTP0spYk5pcjwxeTtoSkw/fTdGTnwwWV0wW20kJl0vM214cygmaCUxSlxSQiVgfDlFWWZkV0I7Z3wsWi5McDhcQklEbiFxfG8rTHY5XCc8MFo1Plx1RFVpKD9hfmU6ZFFWZSZhPHJwLzFBbmlELlFOIEJ8XCJIbEFDKzIpLWprYTFKbCJtXUstWF9iJEhTaVl3LHJPYXRELytGfUVDRiB9fXJtPl07Jkg+Omd3ZUQpUWIgaFpiSlpfVVZSTlQzJmx7UEdRUkYhNyEwXXtaRXNbVSBNIyE+V0V5X3k1J29oLXhreCoiMz9DUCVRIHMtPyowai0oIlxFdTV2XDBHMVg0ZCQxQiFRIy5MXkQiLD5IcG07JyFqeyE8Pjp9JUQtKG8pKEZhWTVGUFp2OV1aMTc/UWwgZjJqLH4yalluc1RtUlpxNV5ATkIiPkZcOXQ0LmdEeGBBR2lcRSBcJ09EM2JxOmxwOG0wMDtpW0pjdHYndHxac2s0biYsKFVpIyx8TnElREBFdyNcbS9QJEtASD8/Ok1BWG9Bayg1Uj5hMCU6PUp1RGZZJX43a204WlM6V0p9XiVKIVMnfksnTjdLQEJLKFNKLUBRYWhGMUU6M0p1SnNgLV51MUFpW1pWaDsvXXhcYzJCKF8pPChIXnw6U0hCMSFfS15YfV44QDc3J3BTWm42K0c9bVtCLCR9dFwgfUdJT3x0X1NpQGY3aVpWQ2klOiI2SjAmemkxeFFBTVFaPm87ZFwrUWxLfEcib3VwUmEtcE0tcS1AUWI0YGlZZWJ0M0hsb0BDYWNRNGQkSkEqfDt4NUFbaH1sXk4gY1NabihUPk1hdjhhSSQvZCFnKDdyLG12WyUgLycqdENrckBvcCR6dlRaP2ctWm5tLj9pOUYqLkEoNUMnIns1W1BjYG51Ulo3O2VtQFlVKDh2LEx8YU9pJXxUbjI8JiJFdFBJJEo6VndHYjcwcj5gbmVLfjgrUTxPRS5zSj9GdiVwKy1LLyMxdztyTUA1LypDKCNEeV08RGUvWUBGLXM2T35APy19N2p2VzByPl99fX0qMWNUUWJvP3Y9XzwnPDZ8cyF4P3VxbGAjPExHaFQie0M/ZVhzS01GMy9bR19wTTBHcigkIHd8Vkp8TStvJWhudyEyQzNfKX4zfj9RN1x6YCRgPHQ1bHp8ezwlK1hmeEY3fj9GN34/ZX5OQz1+fHBZXT81fU1nQjp6Vmt+KCwzbnVzQHZrSjFIT11UKDQgPT5oclUiJ3s4Vy9KbDBecFRZTDc0RWAkICU+PEg7YHwtIXwoakl4ezdtL1Yhe0goVyFiRkFmQX4pMz9XSz9wPkB1cWNQKkg6KDlUNWIoKz5xc108XVw0XkJZaHgkNEpEdW8pXnAkYH51aCxycWBVYXBqYnZedX17bCw+cGxBOUd9KEFfd1R9JDVLMTx9bjQsV3pJP0ZJP2NANDZqclNFPSd9aj0maiQgPjtHWFdsKU5eelwtMGotMWo0SnJ5byh+eVF8Oz1bdC9kME1GbyhYPX4wVkM0U2goSk5NNHhPM2p8PXtyZ0o/MFowY192dXdWM3JubElkWEpeR19OVHhhOGlFdWkmfkhWKntMKjMsS2dpSUA4JG98JSBQITRRMkh6Wlt+LW9VX2ZaZlhgVjx7KXEkYHpNWltqPXVvLEdJeTVkWHBnUXwuQlFdSklBPCxIPCxSKHE3LX4qMF99fT42OENnN19zYF9zRnFHYmd6WGEnZEVJKCk2TVs/UD1BJGhDRHFvY3hSXkBwSVAyazBUbzYlOCJiNEpyTW90QEZMNUdfe1sjfipALyx+KHBkYSUwYC9Maj13X15+MFlgQixEODkmIVhiLy0+emwoLiglM1h0eG9sTTRRMGY2SHNGZixDe0g/YD5fRHthJUR2P1BtKGZce1tTXXRAR19wVXFMI0QgWC0kIEAmSWZASiFqIz4vUElrLHhkW3c7UmYwSD9AST8wSjwvZHNDIUA+P3BfYUdiTXxeLjMrZ1lmbHdAY1o5TCY4bDJkQUAwR094T212VWJALydccn0nT2tgJ0BObnBbMWdxRWBsUiJQQERgdUZwP1Q9WVYyfENWT3lpWTNTXTV9MFpsNXppMy9nMWZmIXpVOFZRQmMoSlx0Y0FNamw2XW9JQCUgUEMkNUtAcCtMQENJPi1oPVBrdVJYJWEvd34yVU1TNTxzZ3B+Y31XdGEvRj5wcD0wW2p+YWxiQEMlYDxKcVBrVGp+YVgleSZBQHdAeyxxb29+b1NXUmAkTjBPYTkoYHcxT3o8PjRxPFkoXmEuQXk+eHI4NVpWe0ElSTxKbCEoQTcuX2c4VHZxKDZSNkUgLms+Q1ZReE83SFJ+YDVuayEkX258fGsgfG9tIS8gNzI2Z3BcST9QQFBAKiR5OFRxVWdVTVZmQT8vMENPWzI2Z3BReGE1bThAI1BJUTJremsxQFhDYCVgYDEocTMscENgYiMoe0IgTnNsKGhPXjR7MUxsKm4wLSRzeC4lfk0+RXxbbytuLk4xSipEJVc6MFFCZ1YoPlZ7fnc/XWwwPyxQZExLYmdoP1B4eCxofCY0NShdfnZXN0lAZnBgM1QwYlIweDZSIGR7am5Ld3sxJ0o6KDl3KixQXkh4WTMsayJ5dV9calZQMydcckMvITxKan49PENqXzBqT3U7VSc9eTZgUFhcOlJkVmZ8KjV0MXE4fFgyWCBeS0BCalYoKUc6Wy9oZy1XeFZSMzgoUXlnRDt4ZF5cfHBAXEcvPTwsTWcoOTVKNlA1UDxiLCc3bS5leCFydj9VUGBMUz5SQz1HX3BtX3ljcVo0ZGA3elBAIWBDUmpgY3hDZSBjIUBAJCF4eFxLZi92ZTpScDlVfFlISURBVHAoa0Exaj13Kjh6fDBQOC54UHJiLFlfZy5bQD9DY3d+b3ouaFhDMVBheHwuQXZFIVd+SShzKnM0OSx6VGhwaDRUfjZeOWhVMzYhQ1FiUidRXkE+Q1FSKygoLlZoVDFYfi4gOV8oaj10WlhiNVI/TDt4Zmd8Zk1KPlNmM1U4UHAgUCF7KHxdZnFeW0x4WzAodkElSmI1OzNZeDhKNClKQl9scEJtMEpAamUgS0ArKDxzZ25+UzM0fFA8NCwweSwlSjgpaSI/eCxrdHAgMFRwelRwZT4oN0JUUSJmNFFCb1xacm1zJWQ/RHtALVdGaTFRcm1cITRFX3orMmA1b3NtVTVGQD9jPi9hYCBkMW18JGR2MGomMjA7JTMqcHEobnx0emkvcE09Y0tAYDc2PlIhQEVCLEE4VEFSYSEraWY5fUVJKDw+MjA0dSU3V0BDQH5QNnhGbXx8R1V0QF9uVS9jfC9fWi9VPUpCMElYJFsgR3BFU2Y+UVNrJjE9X3c7SlYva2hKQC1LNTUvKT9kYT8qJDVRcmd8MTguXlhlfnx2X3wyZE42eCR4fm03ZkFjJUBcfXhxNClKcmVyPm9nQHYnLEdAJVBHR1I+XDY2e3w/aEhYVltdZjlmKD9tIUAlMEBkNGRebnouQF84K3E5JCshXEVCIDxTcDpJVzBtNH1DSytKQkFSNWwyNj86eSItIyI3Vm1qYyFVUDBGRlxIWXpUQGZUeSYwbF5AP0MxamdFNVNOS1QqeHVhVVg2fD1GPU5rd3dAPT9gcyBFPj8xW2VsY2NzTmxCLTpPdTIrMi19SjkvK0k/MD5BLnk+J0k/UD9XPHl5US5JMiw4TWY=82:T1018,UGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogRGlzY29yZCBhdCAlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lXFVzZXIgRGF0YVxEZWZhdWx0XExvY2FsIFN0b3JhZ2VcbGV2ZWxkYlByb2Nlc3NpbmcgZmlsZTogMDAwMDAzLmxvZ1RvdGFsIHRva2VucyBmb3VuZCBpbiBHb29nbGUgQ2hyb21lOiAwUGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogT3BlcmEgYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXFJvYW1pbmdcT3BlcmEgU29mdHdhcmVcT3BlcmEgU3RhYmxlUGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogQnJhdmUgYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGFcRGVmYXVsdFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IFlhbmRleCBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcWWFuZGV4XFlhbmRleEJyb3dzZXJcVXNlciBEYXRhXERlZmF1bHRDaGVja2luZzogTWljcm9zb2Z0IEVkZ2UgYXQgcGF0aDogQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXE1pY3Jvc29mdFxFZGdlXFVzZXIgRGF0YVxEZWZhdWx0XExvY2FsIFN0b3JhZ2VcbGV2ZWxkYlByb2Nlc3NpbmcgZmlsZTogMDAwMDAzLmxkYlByb2Nlc3NpbmcgZmlsZTogMDAwMDA2LmxkYlByb2Nlc3NpbmcgZmlsZTogMDAwMDA3LmxvZ1RvdGFsIHRva2VucyBmb3VuZCBpbiBNaWNyb3NvZnQgRWRnZTogMFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IFZpdmFsZGkgYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFZpdmFsZGlcVXNlciBEYXRhXERlZmF1bHRQbGF0Zm9ybSBwYXRoIGRvZXMgbm90IGV4aXN0OiBDaHJvbWl1bSBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcQ2hyb21pdW1cVXNlciBEYXRhXERlZmF1bHRDaGVja2luZzogTW96aWxsYSBGaXJlZm94IGF0IHBhdGg6IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1vemlsbGFcRmlyZWZveFxQcm9maWxlc1xMb2NhbCBTdG9yYWdlXGxldmVsZGJQYXRoIGRvZXMgbm90IGV4aXN0OiBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xNb3ppbGxhXEZpcmVmb3hcUHJvZmlsZXNcTG9jYWwgU3RvcmFnZVxsZXZlbGRiUGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogV2F0ZXJmb3ggYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXFJvYW1pbmdcV2F0ZXJmb3hcUHJvZmlsZXNQbGF0Zm9ybSBwYXRoIGRvZXMgbm90IGV4aXN0OiBUb3IgQnJvd3NlciBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xUb3IgQnJvd3NlclxCcm93c2VyXFRvckJyb3dzZXJcRGF0YVxCcm93c2VyXHByb2ZpbGUuZGVmYXVsdFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IEVwaWMgUHJpdmFjeSBCcm93c2VyIGF0IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxMb2NhbFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGFcRGVmYXVsdFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IENvbW9kbyBEcmFnb24gYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXENvbW9kb1xEcmFnb25cVXNlciBEYXRhXERlZmF1bHRQbGF0Zm9ybSBwYXRoIGRvZXMgbm90IGV4aXN0OiBTbGltamV0IGF0IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxMb2NhbFxTbGltamV0XFVzZXIgRGF0YVxEZWZhdWx0UGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogQ29jIENvYyBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhXERlZmF1bHRQbGF0Zm9ybSBwYXRoIGRvZXMgbm90IGV4aXN0OiBNYXh0aG9uIGF0IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1heHRob241XFVzZXJzXGd1ZXN0UGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogMzYwIEJyb3dzZXIgYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGFcRGVmYXVsdFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IFVSIEJyb3dzZXIgYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFVSIEJyb3dzZXJcVXNlciBEYXRhXERlZmF1bHRQbGF0Zm9ybSBwYXRoIGRvZXMgbm90IGV4aXN0OiBBdmFzdCBTZWN1cmUgQnJvd3NlciBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcQVZBU1QgU29mdHdhcmVcQnJvd3NlclxVc2VyIERhdGFcRGVmYXVsdFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IE9wZXJhIEdYIGF0IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE9wZXJhIFNvZnR3YXJlXE9wZXJhIEdYIFN0YWJsZVBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IEZhbGtvbiBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xGYWxrb25Ub3RhbCB0b2tlbnMgZm91bmQgYWNyb3NzIGFsbCBwbGF0Zm9ybXM6IDBQcm9jZXNzaW5nIEZpcmVmb3ggcHJvZmlsZXMgYXQ6IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1vemlsbGFcRmlyZWZveFxQcm9maWxlc0ZvdW5kIEZpcmVmb3ggcHJvZmlsZTogQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXFJvYW1pbmdcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzXHl3enU3ODcwLmRlZmF1bHRDaGVja2luZzogRmlyZWZveCBQcm9maWxlIGF0IHBhdGg6IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1vemlsbGFcRmlyZWZveFxQcm9maWxlc1x5d3p1Nzg3MC5kZWZhdWx0XExvY2FsIFN0b3JhZ2VcbGV2ZWxkYlBhdGggZG9lcyBub3QgZXhpc3Q6IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1vemlsbGFcRmlyZWZveFxQcm9maWxlc1x5d3p1Nzg3MC5kZWZhdWx0XExvY2FsIFN0b3JhZ2VcbGV2ZWxkYldyaXRpbmcgdG9rZW5zIHRvOiAiQzpcXFVzZXJzXFw5WlVHVTJ1XFxBcHBEYXRhXFxMb2NhbFxcVGVtcFxccnVudGltZVxcYnJvd3NlclxcdG9rZW5zLnR4dCJObyB0b2tlbnMgZm91bmQgdG8gd3JpdGU=83:T54dc,U1FMaXRlIGZvcm1hdCAzQS9lYXJseV9leHBpcmF0aW9uX3RocmVzaG9sZDEzMzE1NDE2Mzk5NjcyNTQ0bGFzdF9jb21wYXRpYmxlX3ZlcnNpb24xNnZlcnNpb241OW1tYXBfc3RhdHVzLTFlYXJseV9leHBpcmF0aW9uX3RocmVzaG9sZGxhc3RfY29tcGF0aWJsZV92ZXJzaW9udmVyc2lvbiNtbWFwX3N0YXR1c3Zpc2l0c3VybHNESXpPQ1V5Tm1SelgyRmZiR2xrSlROa2EzZGtMVEV3TkRjNE5qSXpNVGd6SlRJMkpUSTJaSE5mWlY5aFpHbGtKVE5rT0RBeE9UVTNNamt5TnpBeU9UUWxNalprYzE5bFgzUmhjbWRsZEY5cFpDVXpaR3QzWkMwNE1ERTVOVGd6TmpNME1UY3lPQ1V6WVd4dll5MHpNaVV5TmlVeU5tUnpYMlZmYm1WMGQyOXlheVV6Wkc4bE1qWmtjMTkxY214ZmRpVXpaRElsTWpaa2MxOWtaWE4wWDNWeWJDVXpaR2gwZEhCekpUTmhKVEptSlRKbWQzZDNMbWR2YjJkc1pTNWpiMjBsTW1aamFISnZiV1VsTW1aaWMyVnRKVEptWkc5M2JteHZZV1FsTW1abGJsOWpZU1V6Wm1KeVlXNWtKVE5rVmtSTFFpVXlObVJ6WDJ0cFpDVXpaRFF6TnpBd01EVXlPREEyTkRZeE1qTTJKVEkyWjJOc2FXUWxNMlJoTmprNVltUTBOVEE0TURNeFlUSTBNemcwWVdRNFlXVXpabVZqTXpOaVpTVXlObWRqYkhOeVl5VXpaRE53TG1SekpUSTJKVEkyZFhSdFgzTnZkWEpqWlNVelpHSnBibWNsTWpaMWRHMWZiV1ZrYVhWdEpUTmtZM0JqSlRJMmRYUnRYMk5oYlhCaGFXZHVKVE5rTVRjd056TXpNaVV5TlRJd0pUSTFOME1sTWpVeU1FTm9jbTl0WlNVeU5USXdWMmx1TVRFbE1qVXlNQ1V5TlRkREpUSTFNakJFVWlVeU5USXdKVEkxTjBNbE1qVXlNRVZUVXpBeEpUSTFNakFsTWpVM1F5VXlOVEl3VGtFbE1qVXlNQ1V5TlRkREpUSTFNakJEUVNVeU5USXdKVEkxTjBNbE1qVXlNR1Z1SlRJMU1qQWxNalUzUXlVeU5USXdSR1Z6YXlVeU5USXdKVEkxTjBNbE1qVXlNRk5GVFNVeU5USXdKVEkxTjBNbE1qVXlNRUpMVjFNbE1qVXlNQzBsTWpVeU1FVllRU1V5TlRJd0pUSTFOME1sTWpVeU1GUjRkQ1V5TlRJd0pUSTFOME1sTWpVeU1FSnBibWRmVkc5d0pUSTFNakJMVjBSVEpUSTJkWFJ0WDNSbGNtMGxNMlJuYjI5bmJHVWxNalV5TUdOb2NtOXRaU1V5Tm5WMGJWOWpiMjUwWlc1MEpUTmtSR1Z6YXlVeU5USXdKVEkxTjBNbE1qVXlNRUpMVjFNbE1qVXlNQzBsTWpVeU1FVllRU1V5TlRJd0pUSTFOME1sTWpVeU1GUjRkRjlIYjI5bmJHVWxNalV5TUVOb2NtOXRaU1V5TlRJd1ZHOXdKVEkxTWpCTFYwUlQmcmxpZD1hNjk5YmQ0NTA4MDMxYTI0Mzg0YWQ4YWUzZmVjMzNiZSZudGI9MWdvb2dsZSBjaHJvbWVnb29nbGUgY2hyb21lZ29vZ2xlIGNocm9tZWdvb2dsZSBjaHJvbWUrKzM2YzlkNWY2LTllNmMtNGM4Yi1iNmY3LTlhNGE3Yzg0M2UzNiVVU0VSUFJPRklMRSVcRG93bmxvYWRzXE1TTiBDYW5hZGEgXyBPdXRsb29rLCBPZmZpY2UsIFNreXBlLCBCaW5nLCBMYXRlc3QgTmV3cyBhbmQgVmlkZW9zLnBkZkM6XFVzZXJzXCVVU0VSTkFNRSVcRG93bmxvYWRzXE1TTiBDYW5hZGEgXyBPdXRsb29rLCBPZmZpY2UsIFNreXBlLCBCaW5nLCBMYXRlc3QgTmV3cyBhbmQgVmlkZW9zLnBkZmh0dHA6Ly93d3cubXNuLmNvbS9odHRwOi8vd3d3Lm1zbi5jb20vYXBwbGljYXRpb24vcGRmYXBwbGljYXRpb24vcGRmMUc9PTZkMGMwZTg0LTk2MjEtNDFmYy1hNjU0LWEyMzEyNDdiZDY0OEM6XFVzZXJzXCVVU0VSTkFNRSVcRG93bmxvYWRzXENocm9tZVNldHVwLmV4ZUM6XFVzZXJzXCVVU0VSTkFNRSVcRG93bmxvYWRzXENocm9tZVNldHVwLmV4ZS42Z2h0dHBzOi8vd3d3Lmdvb2dsZS5jb20vaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9jaHJvbWUvYnNlbS9kb3dubG9hZC9lbl9jYT9icmFuZD1WREtCJmRzX2tpZD00MzcwMDA1MjgwNjQ2MTIzNiYmdXRtX3NvdXJjZT1iaW5nJnV0bV9tZWRpdW09Y3BjJnV0bV9jYW1wYWlnbj0xNzA3MzMyJTIwJTdDJTIwQ2hyb21lJTIwV2luMTElMjAlN0MlMjBEUiUyMCU3QyUyMEVTUzAxJTIwJTdDJTIwTkElMjAlN0MlMjBDQSUyMCU3QyUyMGVuJTIwJTdDJTIwRGVzayUyMCU3QyUyMFNFTSUyMCU3QyUyMEJLV1MlMjAtJTIwRVhBJTIwJTdDJTIwVHh0JTIwJTdDJTIwQmluZ19Ub3AlMjBLV0RTJnV0bV90ZXJtPWdvb2dsZSUyMGNocm9tZSZ1dG1fY29udGVudD1EZXNrJTIwJTdDJTIwQktXUyUyMC0lMjBFWEElMjAlN0MlMjBUeHRfR29vZ2xlJTIwQ2hyb21lJTIwVG9wJTIwS1dEUyZnY2xpZD1hNjk5YmQ0NTA4MDMxYTI0Mzg0YWQ4YWUzZmVjMzNiZSZnY2xzcmM9M3AuZHNodHRwczovL3d3dy5iaW5nLmNvbS8iMjFmODZlOC1jMTFkMTk4YyJXZWQsIDEwIEphbiAyMDI0IDA1OjM5OjIxIEdNVGFwcGxpY2F0aW9uL3gtbXNkb3dubG9hZGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbUc9PTRjNDgyOGQ5LWFmNzEtNDlmOS1iMDZmLTAyOGMxYTc4MmExNEM6XFVzZXJzXCVVU0VSTkFNRSVcRG93bmxvYWRzXFZDX3JlZGlzdC54NjQuZXhlQzpcVXNlcnNcJVVTRVJOQU1FJVxEb3dubG9hZHNcVkNfcmVkaXN0Lng2NC5leGVodHRwczovL2xlYXJuLm1pY3Jvc29mdC5jb20vaHR0cHM6Ly9sZWFybi5taWNyb3NvZnQuY29tL2VuLXVzL2NwcC93aW5kb3dzL2xhdGVzdC1zdXBwb3J0ZWQtdmMtcmVkaXN0P3ZpZXc9bXN2Yy0xNzBodHRwczovL3d3dy5iaW5nLmNvbS8iMHhEM0RENTRFMDM3NzExMUI1NjUzMUMwNTVFRUQ5NkQ0ODUyMkRBRjhBNTYzNDlFNUU0OTUzQzMxN0MzNzAyM0E2IkZyaSwgMjcgSmFuIDIwMjMgMTk6MTI6NTYgR01UYXBwbGljYXRpb24veC1tc2Rvd25sb2FkYXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtRz09ZTA2NWU5OWUtMDRmMy00ZTFlLWI1ZmQtYTg4OGUwZjY0OTZjQzpcVXNlcnNcJVVTRVJOQU1FJVxEb3dubG9hZHNcVkNfcmVkaXN0Lng4Ni5leGVDOlxVc2Vyc1wlVVNFUk5BTUUlXERvd25sb2Fkc1xWQ19yZWRpc3QueDg2LmV4ZWh0dHBzOi8vbGVhcm4ubWljcm9zb2Z0LmNvbS9odHRwczovL2xlYXJuLm1pY3Jvc29mdC5jb20vZW4tdXMvY3BwL3dpbmRvd3MvbGF0ZXN0LXN1cHBvcnRlZC12Yy1yZWRpc3Q/dmlldz1tc3ZjLTE3MGh0dHBzOi8vd3d3LmJpbmcuY29tLyIweDg3Nzg5RjAwNjY0QjVDNDM0NTBCRUNCMzk5MkE2OUEwNDlGNDdGOTY4NjRERjc0OTNDRjIwNDQxNTYwNzRGOTEiV2VkLCAxNSBGZWIgMjAyMyAwNzozNjo0NCBHTVRhcHBsaWNhdGlvbi94LW1zZG93bmxvYWRhcHBsaWNhdGlvbi9vY3RldC1zdHJlYW0zR0U9YjBkZjAzMjUtZmM1Ni00NzU2LWExY2ItNWIzYjllYjA1MmRlQzpcVXNlcnNcJVVTRVJOQU1FJVxEb3dubG9hZHNcbnBwLjguNC43LnBvcnRhYmxlLng2NC56aXBDOlxVc2Vyc1wlVVNFUk5BTUUlXERvd25sb2Fkc1xucHAuOC40LjcucG9ydGFibGUueDY0LnppcC9NYW9wVmRVL01hb3hodHRwczovL25vdGVwYWQtcGx1cy1wbHVzLm9yZy9odHRwczovL25vdGVwYWQtcGx1cy1wbHVzLm9yZy9kb3dubG9hZHMvdjguNC43L2h0dHBzOi8vbm90ZXBhZC1wbHVzLXBsdXMub3JnLyIweDhEQUMxOUJFQUI4RDZCQSJUdWUsIDA4IE5vdiAyMDIyIDE1OjE0OjIyIEdNVGFwcGxpY2F0aW9uL3gtemlwLWNvbXByZXNzZWRhcHBsaWNhdGlvbi9vY3RldC1zdHJlYW0zRz09MTZkYmZiMTMtNmMxMS00NmVjLTkyYzMtODEwYjI4YWE4YWY3QzpcVXNlcnNcJVVTRVJOQU1FJVxEb3dubG9hZHNcbnBwLjguNC43LnBvcnRhYmxlLng2NC43ekM6XFVzZXJzXCVVU0VSTkFNRSVcRG93bmxvYWRzXG5wcC44LjQuNy5wb3J0YWJsZS54NjQuN3ovTWFvL01hb1JxaHR0cHM6Ly9ub3RlcGFkLXBsdXMtcGx1cy5vcmcvaHR0cHM6Ly9ub3RlcGFkLXBsdXMtcGx1cy5vcmcvZG93bmxvYWRzL3Y4LjQuNy9odHRwczovL25vdGVwYWQtcGx1cy1wbHVzLm9yZy8iMHg4REFDMTlCRTdFQzNCRUEiVHVlLCAwOCBOb3YgMjAyMiAxNToxNDoxOCBHTVRhcHBsaWNhdGlvbi9vY3RldC1zdHJlYW1hcHBsaWNhdGlvbi9vY3RldC1zdHJlYW1odHRwOi8vd3d3Lm1zbi5jb20vaHR0cHM6Ly9kbC5nb29nbGUuY29tL3RhZy9zL2FwcGd1aWQlM0QlN0I4QTY5RDM0NS1ENTY0LTQ2M0MtQUZGMS1BNjlEOUU1MzBGOTYlN0QlMjZpaWQlM0QlN0JFRDMyOThBMy1CRUIyLUNBQzMtMzI1QS0wODA5QUE3MDk4MzIlN0QlMjZsYW5nJTNEZW4lMjZicm93c2VyJTNENSUyNnVzYWdlc3RhdHMlM0QwJTI2YXBwbmFtZSUzREdvb2dsZSUyNTIwQ2hyb21lJTI2bmVlZHNhZG1pbiUzRHByZWZlcnMlMjZhcCUzRHg2NC1zdGFibGUtc3RhdHNkZWZfMSUyNmJyYW5kJTNEVkRLQiUyNmluc3RhbGxkYXRhaW5kZXglM0RlbXB0eS91cGRhdGUyL2luc3RhbGxlcnMvQ2hyb21lU2V0dXAuZXhlaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci84YjkyZjQ2MC03ZTAzLTRjNzUtYTEzOS1lMjY0YTc3MDc1OGQvMjZDMkM3MkZCQTY0MzhGNUUyOUFGOEVCQzQ4MjZBMUU0MjQ1ODFCM0M0NDZGOEM3MzUzNjFGMURCN0JFRkY3Mi9WQ19yZWRpc3QueDY0LmV4ZTNodHRwczovL2FrYS5tcy92cy8xNy9yZWxlYXNlL3ZjX3JlZGlzdC54NjQuZXhlaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9iMjUxOTAxNi00YTEzLTQxMjAtOTM2Yy1jYWUwMDNkNTY3YzQvOEFFNTlEODI4NDUxNTlEQjNBNzA3NjNGNUNCMTU3MUU0NUVCRjZBMUFERkVDQzQ3NTc0QkExN0IwMTk0ODNBMC9WQ19yZWRpc3QueDg2LmV4ZTNodHRwczovL2FrYS5tcy92cy8xNy9yZWxlYXNlL3ZjX3JlZGlzdC54ODYuZXhlaHR0cHM6Ly9vYmplY3RzLmdpdGh1YnVzZXJjb250ZW50LmNvbS9naXRodWItcHJvZHVjdGlvbi1yZWxlYXNlLWFzc2V0LTJlNjViZS8zMzAxNDgxMS82NzAwNTgzZC04NTdmLTRiMTQtOGQyMi00YWViNmRmZTQxOGY/WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBSVdOSllBWDRDU1ZFSDUzQSUyRjIwMjIxMjAxJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDIyMTIwMVQyMTQ2MjFaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT00YmI5NWNiMzNmMDNjN2Q1MDVjODQ2ZTQ0MjU0ZGNmNmQ0ZDczYjQyMzNmYTkwYjk3ZmZmMGRmY2FhNDBiZDE0JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MzMwMTQ4MTEmcmVzcG9uc2UtY29udGVudC1kaXNwb3NpdGlvbj1hdHRhY2htZW50JTNCJTIwZmlsZW5hbWUlM0RucHAuOC40LjcucG9ydGFibGUueDY0LnppcCZyZXNwb25zZS1jb250ZW50LXR5cGU9YXBwbGljYXRpb24lMkZvY3RldC1zdHJlYW1waHR0cHM6Ly9naXRodWIuY29tL25vdGVwYWQtcGx1cy1wbHVzL25vdGVwYWQtcGx1cy1wbHVzL3JlbGVhc2VzL2Rvd25sb2FkL3Y4LjQuNy9ucHAuOC40LjcucG9ydGFibGUueDY0LnppcGVodHRwczovL29iamVjdHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2dpdGh1Yi1wcm9kdWN0aW9uLXJlbGVhc2UtYXNzZXQtMmU2NWJlLzMzMDE0ODExLzQyZDliYzM4LTg5ZjAtNDhkOC05NGVjLWQxZjM2NDlkMmZjMz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFJV05KWUFYNENTVkVINTNBJTJGMjAyMjEyMDElMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjIxMjAxVDIxNDYxNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTA2Mzg4ZDc1NTM5ZTc4NjFjNTQzYWJmOWQ5YWVkZDdmOTdlNTg0ODA0Zjg0ZTg4YWM4OWEyZGEwNTI4ZjM0MDgmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0zMzAxNDgxMSZyZXNwb25zZS1jb250ZW50LWRpc3Bvc2l0aW9uPWF0dGFjaG1lbnQlM0IlMjBmaWxlbmFtZSUzRG5wcC44LjQuNy5wb3J0YWJsZS54NjQuN3omcmVzcG9uc2UtY29udGVudC10eXBlPWFwcGxpY2F0aW9uJTJGb2N0ZXQtc3RyZWFtbl9odHRwczovL2dpdGh1Yi5jb20vbm90ZXBhZC1wbHVzLXBsdXMvbm90ZXBhZC1wbHVzLXBsdXMvcmVsZWFzZXMvZG93bmxvYWQvdjguNC43L25wcC44LjQuNy5wb3J0YWJsZS54NjQuN3podHRwOi8vbXNuLmNvbS8raHR0cDovL21zbi5jb20vbWluZGV4c2VnbWVudHNfdXJsX2lkc2VnbWVudHNDUkVBVEUgSU5ERVggc2VnbWVudHNfdXJsX2lkIE9OIHNlZ21lbnRzKHVybF9pZClNZWluZGV4c2VnbWVudHNfbmFtZXNlZ21lbnRzQ1JFQVRFIElOREVYIHNlZ21lbnRzX25hbWUgT04gc2VnbWVudHMobmFtZSlwM3RhYmxlc2VnbWVudHNzZWdtZW50c0NSRUFURSBUQUJMRSBzZWdtZW50cyAoaWQgSU5URUdFUiBQUklNQVJZIEtFWSxuYW1lIFZBUkNIQVIsdXJsX2lkIElOVEVHRVIgTk9OIE5VTEwpdGFibGVkb3dubG9hZHNfcmVyb3V0ZV9pbmZvZG93bmxvYWRzX3Jlcm91dGVfaW5mb0NSRUFURSBUQUJMRSBkb3dubG9hZHNfcmVyb3V0ZV9pbmZvIChkb3dubG9hZF9pZCBJTlRFR0VSIE5PVCBOVUxMLHJlcm91dGVfaW5mb19zZXJpYWxpemVkICBWQVJDSEFSIE5PVCBOVUxMLFBSSU1BUlkgS0VZIChkb3dubG9hZF9pZCkgKT9pbmRleHNxbGl0ZV9hdXRvaW5kZXhfZG93bmxvYWRzX3NsaWNlc18xZG93bmxvYWRzX3NsaWNlc1N0YWJsZWRvd25sb2Fkc2Rvd25sb2Fkc0NSRUFURSBUQUJMRSBkb3dubG9hZHMgKGlkIElOVEVHRVIgUFJJTUFSWSBLRVksZ3VpZCBWQVJDSEFSIE5PVCBOVUxMLGN1cnJlbnRfcGF0aCBMT05HVkFSQ0hBUiBOT1QgTlVMTCx0YXJnZXRfcGF0aCBMT05HVkFSQ0hBUiBOT1QgTlVMTCxzdGFydF90aW1lIElOVEVHRVIgTk9UIE5VTEwscmVjZWl2ZWRfYnl0ZXMgSU5URUdFUiBOT1QgTlVMTCx0b3RhbF9ieXRlcyBJTlRFR0VSIE5PVCBOVUxMLHN0YXRlIElOVEVHRVIgTk9UIE5VTEwsZGFuZ2VyX3R5cGUgSU5URUdFUiBOT1QgTlVMTCxpbnRlcnJ1cHRfcmVhc29uIElOVEVHRVIgTk9UIE5VTEwsaGFzaCBCTE9CIE5PVCBOVUxMLGVuZF90aW1lIElOVEVHRVIgTk9UIE5VTEwsb3BlbmVkIElOVEVHRVIgTk9UIE5VTEwsbGFzdF9hY2Nlc3NfdGltZSBJTlRFR0VSIE5PVCBOVUxMLHRyYW5zaWVudCBJTlRFR0VSIE5PVCBOVUxMLHJlZmVycmVyIFZBUkNIQVIgTk9UIE5VTEwsc2l0ZV91cmwgVkFSQ0hBUiBOT1QgTlVMTCxlbWJlZGRlcl9kb3dubG9hZF9kYXRhIFZBUkNIQVIgTk9UIE5VTEwsdGFiX3VybCBWQVJDSEFSIE5PVCBOVUxMLHRhYl9yZWZlcnJlcl91cmwgVkFSQ0hBUiBOT1QgTlVMTCxodHRwX21ldGhvZCBWQVJDSEFSIE5PVCBOVUxMLGJ5X2V4dF9pZCBWQVJDSEFSIE5PVCBOVUxMLGJ5X2V4dF9uYW1lIFZBUkNIQVIgTk9UIE5VTEwsZXRhZyBWQVJDSEFSIE5PVCBOVUxMLGxhc3RfbW9kaWZpZWQgVkFSQ0hBUiBOT1QgTlVMTCxtaW1lX3R5cGUgVkFSQ0hBUigyNTUpIE5PVCBOVUxMLG9yaWdpbmFsX21pbWVfdHlwZSBWQVJDSEFSKDI1NSkgTk9UIE5VTEwpaW5kZXhrZXl3b3JkX3NlYXJjaF90ZXJtc19pbmRleDNrZXl3b3JkX3NlYXJjaF90ZXJtc0NSRUFURSBJTkRFWCBrZXl3b3JkX3NlYXJjaF90ZXJtc19pbmRleDMgT04ga2V5d29yZF9zZWFyY2hfdGVybXMgKHRlcm0paW5kZXhrZXl3b3JkX3NlYXJjaF90ZXJtc19pbmRleDJrZXl3b3JkX3NlYXJjaF90ZXJtc0NSRUFURSBJTkRFWCBrZXl3b3JkX3NlYXJjaF90ZXJtc19pbmRleDIgT04ga2V5d29yZF9zZWFyY2hfdGVybXMgKHVybF9pZClJaW5kZXhrZXl3b3JkX3NlYXJjaF90ZXJtc19pbmRleDFrZXl3b3JkX3NlYXJjaF90ZXJtc0NSRUFURSBJTkRFWCBrZXl3b3JkX3NlYXJjaF90ZXJtc19pbmRleDEgT04ga2V5d29yZF9zZWFyY2hfdGVybXMgKGtleXdvcmRfaWQsIG5vcm1hbGl6ZWRfdGVybSk5dGFibGVrZXl3b3JkX3NlYXJjaF90ZXJtc2tleXdvcmRfc2VhcmNoX3Rlcm1zQ1JFQVRFIFRBQkxFIGtleXdvcmRfc2VhcmNoX3Rlcm1zIChrZXl3b3JkX2lkIElOVEVHRVIgTk9UIE5VTEwsdXJsX2lkIElOVEVHRVIgTk9UIE5VTEwsdGVybSBMT05HVkFSQ0hBUiBOT1QgTlVMTCxub3JtYWxpemVkX3Rlcm0gTE9OR1ZBUkNIQVIgTk9UIE5VTEwpJ3RhYmxlZG93bmxvYWRzX3VybF9jaGFpbnNkb3dubG9hZHNfdXJsX2NoYWluc0NSRUFURSBUQUJMRSBkb3dubG9hZHNfdXJsX2NoYWlucyAoaWQgSU5URUdFUiBOT1QgTlVMTCxjaGFpbl9pbmRleCBJTlRFR0VSIE5PVCBOVUxMLHVybCBMT05HVkFSQ0hBUiBOT1QgTlVMTCwgUFJJTUFSWSBLRVkgKGlkLCBjaGFpbl9pbmRleCkgKW50YWJsZXZpc2l0X3NvdXJjZXZpc2l0X3NvdXJjZUNSRUFURSBUQUJMRSB2aXNpdF9zb3VyY2UoaWQgSU5URUdFUiBQUklNQVJZIEtFWSxzb3VyY2UgSU5URUdFUiBOT1QgTlVMTCl0YWJsZWRvd25sb2Fkc19zbGljZXNkb3dubG9hZHNfc2xpY2VzQ1JFQVRFIFRBQkxFIGRvd25sb2Fkc19zbGljZXMgKGRvd25sb2FkX2lkIElOVEVHRVIgTk9UIE5VTEwsb2Zmc2V0IElOVEVHRVIgTk9UIE5VTEwscmVjZWl2ZWRfYnl0ZXMgSU5URUdFUiBOT1QgTlVMTCxmaW5pc2hlZCBJTlRFR0VSIE5PVCBOVUxMIERFRkFVTFQgMCxQUklNQVJZIEtFWSAoZG93bmxvYWRfaWQsIG9mZnNldCkgKUdpbmRleHNxbGl0ZV9hdXRvaW5kZXhfZG93bmxvYWRzX3VybF9jaGFpbnNfMWRvd25sb2Fkc191cmxfY2hhaW5zWXRhYmxlc3FsaXRlX3NlcXVlbmNlc3FsaXRlX3NlcXVlbmNlQ1JFQVRFIFRBQkxFIHNxbGl0ZV9zZXF1ZW5jZShuYW1lLHNlcSlhdGFibGV1cmxzdXJsc0NSRUFURSBUQUJMRSB1cmxzKGlkIElOVEVHRVIgUFJJTUFSWSBLRVkgQVVUT0lOQ1JFTUVOVCx1cmwgTE9OR1ZBUkNIQVIsdGl0bGUgTE9OR1ZBUkNIQVIsdmlzaXRfY291bnQgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwsdHlwZWRfY291bnQgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwsbGFzdF92aXNpdF90aW1lIElOVEVHRVIgTk9UIE5VTEwsaGlkZGVuIElOVEVHRVIgREVGQVVMVCAwIE5PVCBOVUxMKWYvdGFibGVtZXRhbWV0YUNSRUFURSBUQUJMRSBtZXRhKGtleSBMT05HVkFSQ0hBUiBOT1QgTlVMTCBVTklRVUUgUFJJTUFSWSBLRVksIHZhbHVlIExPTkdWQVJDSEFSKSdpbmRleHNxbGl0ZV9hdXRvaW5kZXhfbWV0YV8xbWV0YWluZGV4Y2x1c3RlcnNfZm9yX3Zpc2l0Y2x1c3RlcnNfYW5kX3Zpc2l0c0NSRUFURSBJTkRFWCBjbHVzdGVyc19mb3JfdmlzaXQgT04gY2x1c3RlcnNfYW5kX3Zpc2l0cyh2aXNpdF9pZClndGFibGVjbHVzdGVyc19hbmRfdmlzaXRzY2x1c3RlcnNfYW5kX3Zpc2l0c0NSRUFURSBUQUJMRSBjbHVzdGVyc19hbmRfdmlzaXRzKGNsdXN0ZXJfaWQgSU5URUdFUiBOT1QgTlVMTCx2aXNpdF9pZCBJTlRFR0VSIE5PVCBOVUxMLHNjb3JlIE5VTUVSSUMgTk9UIE5VTEwsZW5nYWdlbWVudF9zY29yZSBOVU1FUklDIE5PVCBOVUxMLHVybF9mb3JfZGVkdXBpbmcgTE9OR1ZBUkNIQVIgTk9UIE5VTEwsbm9ybWFsaXplZF91cmwgTE9OR1ZBUkNIQVIgTk9UIE5VTEwsdXJsX2Zvcl9kaXNwbGF5IExPTkdWQVJDSEFSIE5PVCBOVUxMLFBSSU1BUlkgS0VZKGNsdXN0ZXJfaWQsdmlzaXRfaWQpKVdJVEhPVVQgUk9XSUR3aW5kZXh2aXNpdHNfdGltZV9pbmRleHZpc2l0cyJDUkVBVEUgSU5ERVggdmlzaXRzX3RpbWVfaW5kZXggT04gdmlzaXRzICh2aXNpdF90aW1lKVgpd2luZGV4dmlzaXRzX2Zyb21faW5kZXh2aXNpdHMhQ1JFQVRFIElOREVYIHZpc2l0c19mcm9tX2luZGV4IE9OIHZpc2l0cyAoZnJvbV92aXNpdClPKGdpbmRleHZpc2l0c191cmxfaW5kZXh2aXNpdHMgQ1JFQVRFIElOREVYIHZpc2l0c191cmxfaW5kZXggT04gdmlzaXRzICh1cmwpTXRhYmxldmlzaXRzdmlzaXRzJ0NSRUFURSBUQUJMRSAidmlzaXRzIihpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsdXJsIElOVEVHRVIgTk9UIE5VTEwsdmlzaXRfdGltZSBJTlRFR0VSIE5PVCBOVUxMLGZyb21fdmlzaXQgSU5URUdFUix0cmFuc2l0aW9uIElOVEVHRVIgREVGQVVMVCAwIE5PVCBOVUxMLHNlZ21lbnRfaWQgSU5URUdFUix2aXNpdF9kdXJhdGlvbiBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCxpbmNyZW1lbnRlZF9vbW5pYm94X3R5cGVkX3Njb3JlIEJPT0xFQU4gREVGQVVMVCBGQUxTRSBOT1QgTlVMTCxvcGVuZXJfdmlzaXQgSU5URUdFUiwgb3JpZ2luYXRvcl9jYWNoZV9ndWlkIFRFWFQsIG9yaWdpbmF0b3JfdmlzaXRfaWQgSU5URUdFUiwgb3JpZ2luYXRvcl9mcm9tX3Zpc2l0IElOVEVHRVIsIG9yaWdpbmF0b3Jfb3BlbmVyX3Zpc2l0IElOVEVHRVIsIGlzX2tub3duX3RvX3N5bmMgQk9PTEVBTiBERUZBVUxUIEZBTFNFIE5PVCBOVUxMKUF0YWJsZWNsdXN0ZXJfdmlzaXRfZHVwbGljYXRlc2NsdXN0ZXJfdmlzaXRfZHVwbGljYXRlcyZDUkVBVEUgVEFCTEUgY2x1c3Rlcl92aXNpdF9kdXBsaWNhdGVzKHZpc2l0X2lkIElOVEVHRVIgTk9UIE5VTEwsZHVwbGljYXRlX3Zpc2l0X2lkIElOVEVHRVIgTk9UIE5VTEwsUFJJTUFSWSBLRVkodmlzaXRfaWQsZHVwbGljYXRlX3Zpc2l0X2lkKSlXSVRIT1VUIFJPV0lEKWluZGV4Y2x1c3Rlcl9rZXl3b3Jkc19jbHVzdGVyX2lkX2luZGV4Y2x1c3Rlcl9rZXl3b3JkcyVDUkVBVEUgSU5ERVggY2x1c3Rlcl9rZXl3b3Jkc19jbHVzdGVyX2lkX2luZGV4IE9OIGNsdXN0ZXJfa2V5d29yZHMoY2x1c3Rlcl9pZClHdGFibGVjbHVzdGVyX2tleXdvcmRzY2x1c3Rlcl9rZXl3b3JkcyRDUkVBVEUgVEFCTEUgY2x1c3Rlcl9rZXl3b3JkcyhjbHVzdGVyX2lkIElOVEVHRVIgTk9UIE5VTEwsa2V5d29yZCBWQVJDSEFSIE5PVCBOVUxMLHR5cGUgSU5URUdFUiBOT1QgTlVMTCxzY29yZSBOVU1FUklDIE5PVCBOVUxMLGNvbGxlY3Rpb25zIFZBUkNIQVIgTk9UIE5VTEwpRyBfaW5kZXh1cmxzX3VybF9pbmRleHVybHMjQ1JFQVRFIElOREVYIHVybHNfdXJsX2luZGV4IE9OIHVybHMgKHVybClHdGFibGVjbHVzdGVyc2NsdXN0ZXJzQ1JFQVRFIFRBQkxFIGNsdXN0ZXJzKGNsdXN0ZXJfaWQgSU5URUdFUiBQUklNQVJZIEtFWSxzaG91bGRfc2hvd19vbl9wcm9taW5lbnRfdWlfc3VyZmFjZXMgQk9PTEVBTiBOT1QgTlVMTCxsYWJlbCBWQVJDSEFSIE5PVCBOVUxMLHJhd19sYWJlbCBWQVJDSEFSIE5PVCBOVUxMKUF0YWJsZXR5cGVkX3VybF9zeW5jX21ldGFkYXRhdHlwZWRfdXJsX3N5bmNfbWV0YWRhdGFDUkVBVEUgVEFCTEUgdHlwZWRfdXJsX3N5bmNfbWV0YWRhdGEgKHN0b3JhZ2Vfa2V5IElOVEVHRVIgUFJJTUFSWSBLRVkgTk9UIE5VTEwsdmFsdWUgQkxPQiluaW5kZXhzZWdtZW50c191c2FnZV9zZWdfaWRzZWdtZW50X3VzYWdlQ1JFQVRFIElOREVYIHNlZ21lbnRzX3VzYWdlX3NlZ19pZCBPTiBzZWdtZW50X3VzYWdlKHNlZ21lbnRfaWQpO2luZGV4c2VnbWVudF91c2FnZV90aW1lX3Nsb3Rfc2VnbWVudF9pZHNlZ21lbnRfdXNhZ2VDUkVBVEUgSU5ERVggc2VnbWVudF91c2FnZV90aW1lX3Nsb3Rfc2VnbWVudF9pZCBPTiBzZWdtZW50X3VzYWdlKHRpbWVfc2xvdCwgc2VnbWVudF9pZCkvdGFibGVzZWdtZW50X3VzYWdlc2VnbWVudF91c2FnZUNSRUFURSBUQUJMRSBzZWdtZW50X3VzYWdlIChpZCBJTlRFR0VSIFBSSU1BUlkgS0VZLHNlZ21lbnRfaWQgSU5URUdFUiBOT1QgTlVMTCx0aW1lX3Nsb3QgSU5URUdFUiBOT1QgTlVMTCx2aXNpdF9jb3VudCBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCl0YWJsZWNvbnRlbnRfYW5ub3RhdGlvbnNjb250ZW50X2Fubm90YXRpb25zQ1JFQVRFIFRBQkxFIGNvbnRlbnRfYW5ub3RhdGlvbnModmlzaXRfaWQgSU5URUdFUiBQUklNQVJZIEtFWSx2aXNpYmlsaXR5X3Njb3JlIE5VTUVSSUMsZmxvY19wcm90ZWN0ZWRfc2NvcmUgTlVNRVJJQyxjYXRlZ29yaWVzIFZBUkNIQVIscGFnZV90b3BpY3NfbW9kZWxfdmVyc2lvbiBJTlRFR0VSLGFubm90YXRpb25fZmxhZ3MgSU5URUdFUiBOT1QgTlVMTCxlbnRpdGllcyBWQVJDSEFSLHJlbGF0ZWRfc2VhcmNoZXMgVkFSQ0hBUixzZWFyY2hfbm9ybWFsaXplZF91cmwgVkFSQ0hBUixzZWFyY2hfdGVybXMgTE9OR1ZBUkNIQVIsIGFsdGVybmF0aXZlX3RpdGxlLCBwYWdlX2xhbmd1YWdlIFZBUkNIQVIsIHBhc3N3b3JkX3N0YXRlIElOVEVHRVIgREVGQVVMVCAwIE5PVCBOVUxMKUd0YWJsZWNvbnRleHRfYW5ub3RhdGlvbnNjb250ZXh0X2Fubm90YXRpb25zQ1JFQVRFIFRBQkxFIGNvbnRleHRfYW5ub3RhdGlvbnModmlzaXRfaWQgSU5URUdFUiBQUklNQVJZIEtFWSxjb250ZXh0X2Fubm90YXRpb25fZmxhZ3MgSU5URUdFUiBOT1QgTlVMTCxkdXJhdGlvbl9zaW5jZV9sYXN0X3Zpc2l0IElOVEVHRVIscGFnZV9lbmRfcmVhc29uIElOVEVHRVIsdG90YWxfZm9yZWdyb3VuZF9kdXJhdGlvbiBJTlRFR0VSLCBicm93c2VyX3R5cGUgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwsIHdpbmRvd19pZCBJTlRFR0VSIERFRkFVTFQgLTEgTk9UIE5VTEwsIHRhYl9pZCBJTlRFR0VSIERFRkFVTFQgLTEgTk9UIE5VTEwsIHRhc2tfaWQgSU5URUdFUiBERUZBVUxUIC0xIE5PVCBOVUxMLCByb290X3Rhc2tfaWQgSU5URUdFUiBERUZBVUxUIC0xIE5PVCBOVUxMLCBwYXJlbnRfdGFza19pZCBJTlRFR0VSIERFRkFVTFQgLTEgTk9UIE5VTEwsIHJlc3BvbnNlX2NvZGUgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwpaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9jaHJvbWUvYnNlbS9kb3dubG9hZC9lbl9jYT9icmFuZD1WREtCJmRzX2tpZD00MzcwMDA1MjgwNjQ2MTIzNiYmdXRtX3NvdXJjZT1iaW5nJnV0bV9tZWRpdW09Y3BjJnV0bV9jYW1wYWlnbj0xNzA3MzMyJTIwJTdDJTIwQ2hyb21lJTIwV2luMTElMjAlN0MlMjBEUiUyMCU3QyUyMEVTUzAxJTIwJTdDJTIwTkElMjAlN0MlMjBDQSUyMCU3QyUyMGVuJTIwJTdDJTIwRGVzayUyMCU3QyUyMFNFTSUyMCU3QyUyMEJLV1MlMjAtJTIwRVhBJTIwJTdDJTIwVHh0JTIwJTdDJTIwQmluZ19Ub3AlMjBLV0RTJnV0bV90ZXJtPWdvb2dsZSUyMGNocm9tZSZ1dG1fY29udGVudD1EZXNrJTIwJTdDJTIwQktXUyUyMC0lMjBFWEElMjAlN0MlMjBUeHRfR29vZ2xlJTIwQ2hyb21lJTIwVG9wJTIwS1dEUyZnY2xpZD1hNjk5YmQ0NTA4MDMxYTI0Mzg0YWQ4YWUzZmVjMzNiZSZnY2xzcmM9M3AuZHNodHRwczovL2FkLmRvdWJsZWNsaWNrLm5ldC9zZWFyY2hhZHMvbGluay9jbGljaz9saWQ9NDM3MDAwNTI4MDY0NjEyMzYmZHNfc19rd2dpZD01ODcwMDAwNTc4NDYwODU1NSZkc19hX2NpZD00MDU1MjU4MDAmZHNfYV9jYWlkPTk3NjQzODM0MjQmZHNfYV9hZ2lkPTEwMDgyMDM0NDIzOCZkc19hX2xpZD1rd2QtMTA0Nzg2MjMxODMmJmRzX2VfYWRpZD04MDE5NTcyOTI3MDI5NCZkc19lX3RhcmdldF9pZD1rd2QtODAxOTU4MzYzNDE3Mjg6bG9jLTMyJiZkc19lX25ldHdvcms9byZkc191cmxfdj0yJmRzX2Rlc3RfdXJsPWh0dHBzOi8vd3d3Lmdvb2dsZS5jb20vY2hyb21lL2JzZW0vZG93bmxvYWQvZW5fY2E/YnJhbmQ9VkRLQiZkc19raWQ9NDM3MDAwNTI4MDY0NjEyMzYmZ2NsaWQ9YTY5OWJkNDUwODAzMWEyNDM4NGFkOGFlM2ZlYzMzYmUmZ2Nsc3JjPTNwLmRzJiZ1dG1fc291cmNlPWJpbmcmdXRtX21lZGl1bT1jcGMmdXRtX2NhbXBhaWduPTE3MDczMzIlMjAlN0MlMjBDaHJvbWUlMjBXaW4xMSUyMCU3QyUyMERSJTIwJTdDJTIwRVNTMDElMjAlN0MlMjBOQSUyMCU3QyUyMENBJTIwJTdDJTIwZW4lMjAlN0MlMjBEZXNrJTIwJTdDJTIwU0VNJTIwJTdDJTIwQktXUyUyMC0lMjBFWEElMjAlN0MlMjBUeHQlMjAlN0MlMjBCaW5nX1RvcCUyMEtXRFMmdXRtX3Rlcm09Z29vZ2xlJTIwY2hyb21lJnV0bV9jb250ZW50PURlc2slMjAlN0MlMjBCS1dTJTIwLSUyMEVYQSUyMCU3QyUyMFR4dF9Hb29nbGUlMjBDaHJvbWUlMjBUb3AlMjBLV0RTZmlsZTovLy9DOi9Vc2Vycy9IQVBVQldTL0Rlc2t0b3AvdGVzdC5odG1maWxlOi8vL0M6L1VzZXJzL0hBUFVCV1MvRG93bmxvYWRzL05ldyUyMFRleHQlMjBEb2N1bWVudC5odG1saHR0cHM6Ly93d3cubXNuLmNvbS9lbi1jYWh0dHBzOi8vd3d3Lm1zbi5jb20vaHR0cDovL3d3dy5tc24uY29tL2h0dHBzOi8vd3d3Lmdvb2dsZS5jb20vY2hyb21lL25leHQtc3RlcHMuaHRtbD9icmFuZD1WREtCJnN0YXRjYj0wJmluc3RhbGxkYXRhaW5kZXg9ZW1wdHkmZGVmYXVsdGJyb3dzZXI9MGh0dHBzOi8vd3d3LmJpbmcuY29tL2FjbGs/bGQ9ZTgzMVRCTnlrQ2pIZkJ1cVkwd1pqWXBqVlVDVXdZdDQ2UXJsTmhCVG9XdF85QVdhb21neFZqLVM4Y20xdWw3Y0taZzU4S2FVclRxVGFhcmlnc2hUc09FcERVcU1HeUgyUkc1UDJZZjF2VjdrRzdqWU1HakRrSWZTV2J1SjVNbHFjekQ0eEswMm5WNlFsbXRzSVo4bnlxTS1JT1BjVVpwUlotczloR3VNN01LX3lYZmlmUlF0SHJnTmx1VTZZWjk5eDVMamhDVmcmdT1hSFIwY0hNbE0yRWxNbVlsTW1aaFpDNWtiM1ZpYkdWamJHbGpheTV1WlhRbE1tWnpaV0Z5WTJoaFpITWxNbVpzYVc1ckpUSm1ZMnhwWTJzbE0yWnNhV1FsTTJRME16Y3dNREExTWpnd05qUTJNVEl6TmlVeU5tUnpYM05mYTNkbmFXUWxNMlExT0Rjd01EQXdOVGM0TkRZd09EVTFOU1V5Tm1SelgyRmZZMmxrSlROa05EQTFOVEkxT0RBd0pUSTJaSE5mWVY5allXbGtKVE5rT1RjMk5ETTRNelF5TkNVeU5tUnpYMkZmWVdkcFpDVXpaREV3TURneU1ETTBOaHR0cHM6Ly93d3cuYmluZy5jb20vc2VhcmNoP3E9Z29vZ2xlK2Nocm9tZSZjdmlkPTBmMTNjYWZhYWUzNjQ4ZDZhODVkMTE4OWY3YzkyYTNiJmFxcz1lZGdlLjAuMGwzajQ2ajBsNS4zMDU3ajBqMSZGT1JNPUFOU1BBMSZQQz1VNTMxKnFEMCY+bSBodHRwczovL3d3dy5iaW5nLmNvbS9zZWFyY2g/cT1nb29nbGUrY2hyb21lJmN2aWQ9MGYxM2NhZmFhZTM2NDhkNmE4NWQxMTg5ZjdjOTJhM2ImYXFzPWVkZ2UuMC4wbDNqNDZqMGw1LjMwNTdqMGoxJkZPUk09QU5TUEExJlBDPVU1MzFodHRwczovL3d3dy5iaW5nLmNvbS9hY2xrP2xkPWU4MzFUQk55a0NqSGZCdXFZMHdaallwalZVQ1V3WXQ0NlFybE5oQlRvV3RfOUFXYW9tZ3hWai1TOGNtMXVsN2NLWmc1OEthVXJUcVRhYXJpZ3NoVHNPRXBEVXFNR3lIMlJHNVAyWWYxdlY3a0c3allNR2pEa0lmU1didUo1TWxxY3pENHhLMDJuVjZRbG10c0laOG55cU0tSU9QY1VacFJaLXM5aEd1TTdNS195WGZpZlJRdEhyZ05sdVU2WVo5OXg1TGpoQ1ZnJnU9YUhSMGNITWxNMkVsTW1ZbE1tWmhaQzVrYjNWaWJHVmpiR2xqYXk1dVpYUWxNbVp6WldGeVkyaGhaSE1sTW1ac2FXNXJKVEptWTJ4cFkyc2xNMlpzYVdRbE0yUTBNemN3TURBMU1qZ3dOalEyTVRJek5pVXlObVJ6WDNOZmEzZG5hV1FsTTJRMU9EY3dNREF3TlRjNE5EWXdPRFUxTlNVeU5tUnpYMkZmWTJsa0pUTmtOREExTlRJMU9EQXdKVEkyWkhOZllWOWpZV2xrSlROa09UYzJORE00TXpReU5DVXlObVJ6WDJGZllXZHBaQ1V6WkRFd01EZ3lNRE0wTkRJek9DVXlObVJ6WDJGZmJHbGtKVE5rYTNka0xURXdORGM0TmpJek1UZ3pKVEkySlRJMlpITmZaVjloWkdsa0pUTmtPREF4T1RVM01qa3lOekF5T1RRbE1qWmtjMTlsWDNSaGNtZGxkRjlwWkNVelpHdDNaQzA0TURFNU5UZ3pOak0wTVRjeU9DVXpZV3h2WXkwek1pVXlOaVV5Tm1SelgyVmZibVYwZDI5eWF5VXpaRzhsTWpaa2MxOTFjbXhmZGlVelpESWxNalprYzE5a1pYTjBYM1Z5YkNVelpHaDBkSEJ6SlROaEpUSm1KVEptZDNkM0xtZHZiMmRzWlM1amIyMGxNbVpqYUhKdmJXVWxNbVppYzJWdEpUSm1aRzkzYm14dllXUWxNbVpsYmw5allTVXpabUp5WVc1a0pUTmtWa1JMUWlVeU5tUnpYMnRwWkNVelpEUXpOekF3TURVeU9EQTJORFl4TWpNMkpUSTJaMk5zYVdRbE0yUmhOams1WW1RME5UQTRNRE14WVRJME16ZzBZV1E0WVdVelptVmpNek5pWlNVeU5tZGpiSE55WXlVelpETndMbVJ6SlRJMkpUSTJkWFJ0WDNOdmRYSmpaU1V6WkdKcGJtY2xNaloxZEcxZmJXVmthWFZ0SlROa1kzQmpKVEkyZFhSdFgyTmhiWEJoYVdkdUpUTmtNVGN3TnpNek1pVXlOVEl3SlRJMU4wTWxNalV5TUVOb2NtOXRaU1V5TlRJd1YybHVNVEVsTWpVeU1DVXlOVGRESlRJMU1qQkVVaVV5TlRJd0pUSTFOME1sTWpVeU1FVlRVekF4SlRJMU1qQWxNalUzUXlVeU5USXdUa0VsTWpVeU1DVXlOVGRESlRJMU1qQkRRU1V5TlRJd0pUSTFOME1sTWpVeU1HVnVKVEkxTWpBbE1qVTNReVV5TlRJd1JHVnpheVV5TlRJd0pUSTFOME1sTWpVeU1GTkZUU1V5TlRJd0pUSTFOME1sTWpVeU1FSkxWMU1sTWpVeU1DMGxNalV5TUVWWVFTVXlOVEl3SlRJMU4wTWxNalV5TUZSNGRDVXlOVEl3SlRJMU4wTWxNalV5TUVKcGJtZGZWRzl3SlRJMU1qQkxWMFJUSlRJMmRYUnRYM1JsY20wbE0yUm5iMjluYkdVbE1qVXlNR05vY205dFpTVXlOblYwYlY5amIyNTBaVzUwSlROa1JHVnpheVV5TlRJd0pUSTFOME1sTWpVeU1FSkxWMU1sTWpVeU1DMGxNalV5TUVWWVFTVXlOVEl3SlRJMU4wTWxNalV5TUZSNGRGOUhiMjluYkdVbE1qVXlNRU5vY205dFpTVXlOVEl3Vkc5d0pUSTFNakJMVjBSVCZybGlkPWE2OTliZDQ1MDgwMzFhMjQzODRhZDhhZTM=84:T25a0,U1FMaXRlIGZvcm1hdCAzbGFzdF9jb21wYXRpYmxlX3ZlcnNpb24xNnZlcnNpb242OW1tYXBfc3RhdHVzLTFsYXN0X2NvbXBhdGlibGVfdmVyc2lvbnZlcnNpb24jbW1hcF9zdGF0dXNlaW5kZXhzZWluZGV4c3FsaXRlX2F1dG9pbmRleF9kb3dubG9hZHNfc2xpY2VzXzFkb3dubG9hZHNfc2xpY2VzdGFibGVkb3dubG9hZHNfc2xpY2VzZG93bmxvYWRzX3NsaWNlc0NSRUFURSBUQUJMRSBkb3dubG9hZHNfc2xpY2VzIChkb3dubG9hZF9pZCBJTlRFR0VSIE5PVCBOVUxMLG9mZnNldCBJTlRFR0VSIE5PVCBOVUxMLHJlY2VpdmVkX2J5dGVzIElOVEVHRVIgTk9UIE5VTEwsZmluaXNoZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsUFJJTUFSWSBLRVkgKGRvd25sb2FkX2lkLCBvZmZzZXQpIClHaW5kZXhzcWxpdGVfYXV0b2luZGV4X2Rvd25sb2Fkc191cmxfY2hhaW5zXzFkb3dubG9hZHNfdXJsX2NoYWlucyd0YWJsZWRvd25sb2Fkc191cmxfY2hhaW5zZG93bmxvYWRzX3VybF9jaGFpbnNDUkVBVEUgVEFCTEUgZG93bmxvYWRzX3VybF9jaGFpbnMgKGlkIElOVEVHRVIgTk9UIE5VTEwsY2hhaW5faW5kZXggSU5URUdFUiBOT1QgTlVMTCx1cmwgTE9OR1ZBUkNIQVIgTk9UIE5VTEwsIFBSSU1BUlkgS0VZIChpZCwgY2hhaW5faW5kZXgpICl0YWJsZWRvd25sb2Fkc2Rvd25sb2Fkc0NSRUFURSBUQUJMRSBkb3dubG9hZHMgKGlkIElOVEVHRVIgUFJJTUFSWSBLRVksZ3VpZCBWQVJDSEFSIE5PVCBOVUxMLGN1cnJlbnRfcGF0aCBMT05HVkFSQ0hBUiBOT1QgTlVMTCx0YXJnZXRfcGF0aCBMT05HVkFSQ0hBUiBOT1QgTlVMTCxzdGFydF90aW1lIElOVEVHRVIgTk9UIE5VTEwscmVjZWl2ZWRfYnl0ZXMgSU5URUdFUiBOT1QgTlVMTCx0b3RhbF9ieXRlcyBJTlRFR0VSIE5PVCBOVUxMLHN0YXRlIElOVEVHRVIgTk9UIE5VTEwsZGFuZ2VyX3R5cGUgSU5URUdFUiBOT1QgTlVMTCxpbnRlcnJ1cHRfcmVhc29uIElOVEVHRVIgTk9UIE5VTEwsaGFzaCBCTE9CIE5PVCBOVUxMLGVuZF90aW1lIElOVEVHRVIgTk9UIE5VTEwsb3BlbmVkIElOVEVHRVIgTk9UIE5VTEwsbGFzdF9hY2Nlc3NfdGltZSBJTlRFR0VSIE5PVCBOVUxMLHRyYW5zaWVudCBJTlRFR0VSIE5PVCBOVUxMLHJlZmVycmVyIFZBUkNIQVIgTk9UIE5VTEwsc2l0ZV91cmwgVkFSQ0hBUiBOT1QgTlVMTCxlbWJlZGRlcl9kb3dubG9hZF9kYXRhIFZBUkNIQVIgTk9UIE5VTEwsdGFiX3VybCBWQVJDSEFSIE5PVCBOVUxMLHRhYl9yZWZlcnJlcl91cmwgVkFSQ0hBUiBOT1QgTlVMTCxodHRwX21ldGhvZCBWQVJDSEFSIE5PVCBOVUxMLGJ5X2V4dF9pZCBWQVJDSEFSIE5PVCBOVUxMLGJ5X2V4dF9uYW1lIFZBUkNIQVIgTk9UIE5VTEwsYnlfd2ViX2FwcF9pZCBWQVJDSEFSIE5PVCBOVUxMLGV0YWcgVkFSQ0hBUiBOT1QgTlVMTCxsYXN0X21vZGlmaWVkIFZBUkNIQVIgTk9UIE5VTEwsbWltZV90eXBlIFZBUkNIQVIoMjU1KSBOT1QgTlVMTCxvcmlnaW5hbF9taW1lX3R5cGUgVkFSQ0hBUigyNTUpIE5PVCBOVUxMKWluZGV4a2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgza2V5d29yZF9zZWFyY2hfdGVybXNDUkVBVEUgSU5ERVgga2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgzIE9OIGtleXdvcmRfc2VhcmNoX3Rlcm1zICh0ZXJtKWluZGV4a2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgya2V5d29yZF9zZWFyY2hfdGVybXNDUkVBVEUgSU5ERVgga2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgyIE9OIGtleXdvcmRfc2VhcmNoX3Rlcm1zICh1cmxfaWQpSWluZGV4a2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgxa2V5d29yZF9zZWFyY2hfdGVybXNDUkVBVEUgSU5ERVgga2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgxIE9OIGtleXdvcmRfc2VhcmNoX3Rlcm1zIChrZXl3b3JkX2lkLCBub3JtYWxpemVkX3Rlcm0pOXRhYmxla2V5d29yZF9zZWFyY2hfdGVybXNrZXl3b3JkX3NlYXJjaF90ZXJtc0NSRUFURSBUQUJMRSBrZXl3b3JkX3NlYXJjaF90ZXJtcyAoa2V5d29yZF9pZCBJTlRFR0VSIE5PVCBOVUxMLHVybF9pZCBJTlRFR0VSIE5PVCBOVUxMLHRlcm0gTE9OR1ZBUkNIQVIgTk9UIE5VTEwsbm9ybWFsaXplZF90ZXJtIExPTkdWQVJDSEFSIE5PVCBOVUxMKXRpbmRleHZpc2l0c19vcmlnaW5hdG9yX2lkX2luZGV4dmlzaXRzQ1JFQVRFIElOREVYIHZpc2l0c19vcmlnaW5hdG9yX2lkX2luZGV4IE9OIHZpc2l0cyAob3JpZ2luYXRvcl92aXNpdF9pZClYd2luZGV4dmlzaXRzX3RpbWVfaW5kZXh2aXNpdHNDUkVBVEUgSU5ERVggdmlzaXRzX3RpbWVfaW5kZXggT04gdmlzaXRzICh2aXNpdF90aW1lKVh3aW5kZXh2aXNpdHNfZnJvbV9pbmRleHZpc2l0c0NSRUFURSBJTkRFWCB2aXNpdHNfZnJvbV9pbmRleCBPTiB2aXNpdHMgKGZyb21fdmlzaXQpT2dpbmRleHZpc2l0c191cmxfaW5kZXh2aXNpdHNDUkVBVEUgSU5ERVggdmlzaXRzX3VybF9pbmRleCBPTiB2aXNpdHMgKHVybCludGFibGV2aXNpdF9zb3VyY2V2aXNpdF9zb3VyY2VDUkVBVEUgVEFCTEUgdmlzaXRfc291cmNlKGlkIElOVEVHRVIgUFJJTUFSWSBLRVksc291cmNlIElOVEVHRVIgTk9UIE5VTEwpXXRhYmxldmlzaXRzdmlzaXRzQ1JFQVRFIFRBQkxFIHZpc2l0cyhpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsdXJsIElOVEVHRVIgTk9UIE5VTEwsdmlzaXRfdGltZSBJTlRFR0VSIE5PVCBOVUxMLGZyb21fdmlzaXQgSU5URUdFUixleHRlcm5hbF9yZWZlcnJlcl91cmwgVEVYVCx0cmFuc2l0aW9uIElOVEVHRVIgREVGQVVMVCAwIE5PVCBOVUxMLHNlZ21lbnRfaWQgSU5URUdFUix2aXNpdF9kdXJhdGlvbiBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCxpbmNyZW1lbnRlZF9vbW5pYm94X3R5cGVkX3Njb3JlIEJPT0xFQU4gREVGQVVMVCBGQUxTRSBOT1QgTlVMTCxvcGVuZXJfdmlzaXQgSU5URUdFUixvcmlnaW5hdG9yX2NhY2hlX2d1aWQgVEVYVCxvcmlnaW5hdG9yX3Zpc2l0X2lkIElOVEVHRVIsb3JpZ2luYXRvcl9mcm9tX3Zpc2l0IElOVEVHRVIsb3JpZ2luYXRvcl9vcGVuZXJfdmlzaXQgSU5URUdFUixpc19rbm93bl90b19zeW5jIEJPT0xFQU4gREVGQVVMVCBGQUxTRSBOT1QgTlVMTCxjb25zaWRlcl9mb3JfbnRwX21vc3RfdmlzaXRlZCBCT09MRUFOIERFRkFVTFQgRkFMU0UgTk9UIE5VTEwsdmlzaXRlZF9saW5rX2lkIElOVEVHRVIgREVGQVVMVCAwIE5PVCBOVUxMLGFwcF9pZCBURVhUKVBZdGFibGVzcWxpdGVfc2VxdWVuY2VzcWxpdGVfc2VxdWVuY2VDUkVBVEUgVEFCTEUgc3FsaXRlX3NlcXVlbmNlKG5hbWUsc2VxKWF0YWJsZXVybHN1cmxzQ1JFQVRFIFRBQkxFIHVybHMoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULHVybCBMT05HVkFSQ0hBUix0aXRsZSBMT05HVkFSQ0hBUix2aXNpdF9jb3VudCBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCx0eXBlZF9jb3VudCBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCxsYXN0X3Zpc2l0X3RpbWUgSU5URUdFUiBOT1QgTlVMTCxoaWRkZW4gSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwpZi90YWJsZW1ldGFtZXRhQ1JFQVRFIFRBQkxFIG1ldGEoa2V5IExPTkdWQVJDSEFSIE5PVCBOVUxMIFVOSVFVRSBQUklNQVJZIEtFWSwgdmFsdWUgTE9OR1ZBUkNIQVIpJ2luZGV4c3FsaXRlX2F1dG9pbmRleF9tZXRhXzFtZXRhaXRhYmxlY2x1c3RlcnNfYW5kX3Zpc2l0c2NsdXN0ZXJzX2FuZF92aXNpdHMgQ1JFQVRFIFRBQkxFIGNsdXN0ZXJzX2FuZF92aXNpdHMoY2x1c3Rlcl9pZCBJTlRFR0VSIE5PVCBOVUxMLHZpc2l0X2lkIElOVEVHRVIgTk9UIE5VTEwsc2NvcmUgTlVNRVJJQyBERUZBVUxUIDAgTk9UIE5VTEwsZW5nYWdlbWVudF9zY29yZSBOVU1FUklDIERFRkFVTFQgMCBOT1QgTlVMTCx1cmxfZm9yX2RlZHVwaW5nIExPTkdWQVJDSEFSIE5PVCBOVUxMLG5vcm1hbGl6ZWRfdXJsIExPTkdWQVJDSEFSIE5PVCBOVUxMLHVybF9mb3JfZGlzcGxheSBMT05HVkFSQ0hBUiBOT1QgTlVMTCxpbnRlcmFjdGlvbl9zdGF0ZSBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCxQUklNQVJZIEtFWShjbHVzdGVyX2lkLHZpc2l0X2lkKSlXSVRIT1VUIFJPV0lET3RhYmxlY2x1c3RlcnNjbHVzdGVyc0NSRUFURSBUQUJMRSBjbHVzdGVycyhjbHVzdGVyX2lkIElOVEVHRVIgUFJJTUFSWSBLRVkgQVVUT0lOQ1JFTUVOVCxzaG91bGRfc2hvd19vbl9wcm9taW5lbnRfdWlfc3VyZmFjZXMgQk9PTEVBTiBOT1QgTlVMTCxsYWJlbCBWQVJDSEFSIE5PVCBOVUxMLHJhd19sYWJlbCBWQVJDSEFSIE5PVCBOVUxMLHRyaWdnZXJhYmlsaXR5X2NhbGN1bGF0ZWQgQk9PTEVBTiBOT1QgTlVMTCxvcmlnaW5hdG9yX2NhY2hlX2d1aWQgVEVYVCBOT1QgTlVMTCxvcmlnaW5hdG9yX2NsdXN0ZXJfaWQgSU5URUdFUiBOT1QgTlVMTCk5dGFibGVjb250ZXh0X2Fubm90YXRpb25zY29udGV4dF9hbm5vdGF0aW9uc0NSRUFURSBUQUJMRSBjb250ZXh0X2Fubm90YXRpb25zKHZpc2l0X2lkIElOVEVHRVIgUFJJTUFSWSBLRVksY29udGV4dF9hbm5vdGF0aW9uX2ZsYWdzIElOVEVHRVIgTk9UIE5VTEwsZHVyYXRpb25fc2luY2VfbGFzdF92aXNpdCBJTlRFR0VSLHBhZ2VfZW5kX3JlYXNvbiBJTlRFR0VSLHRvdGFsX2ZvcmVncm91bmRfZHVyYXRpb24gSU5URUdFUixicm93c2VyX3R5cGUgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwsd2luZG93X2lkIElOVEVHRVIgREVGQVVMVCAtMSBOT1QgTlVMTCx0YWJfaWQgSU5URUdFUiBERUZBVUxUIC0xIE5PVCBOVUxMLHRhc2tfaWQgSU5URUdFUiBERUZBVUxUIC0xIE5PVCBOVUxMLHJvb3RfdGFza19pZCBJTlRFR0VSIERFRkFVTFQgLTEgTk9UIE5VTEwscGFyZW50X3Rhc2tfaWQgSU5URUdFUiBERUZBVUxUIC0xIE5PVCBOVUxMLHJlc3BvbnNlX2NvZGUgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwpY3RhYmxlY29udGVudF9hbm5vdGF0aW9uc2NvbnRlbnRfYW5ub3RhdGlvbnNDUkVBVEUgVEFCTEUgY29udGVudF9hbm5vdGF0aW9ucyh2aXNpdF9pZCBJTlRFR0VSIFBSSU1BUlkgS0VZLHZpc2liaWxpdHlfc2NvcmUgTlVNRVJJQyxmbG9jX3Byb3RlY3RlZF9zY29yZSBOVU1FUklDLGNhdGVnb3JpZXMgVkFSQ0hBUixwYWdlX3RvcGljc19tb2RlbF92ZXJzaW9uIElOVEVHRVIsYW5ub3RhdGlvbl9mbGFncyBJTlRFR0VSIE5PVCBOVUxMLGVudGl0aWVzIFZBUkNIQVIscmVsYXRlZF9zZWFyY2hlcyBWQVJDSEFSLHNlYXJjaF9ub3JtYWxpemVkX3VybCBWQVJDSEFSLHNlYXJjaF90ZXJtcyBMT05HVkFSQ0hBUixhbHRlcm5hdGl2ZV90aXRsZSBWQVJDSEFSLHBhZ2VfbGFuZ3VhZ2UgVkFSQ0hBUixwYXNzd29yZF9zdGF0ZSBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCxoYXNfdXJsX2tleWVkX2ltYWdlIEJPT0xFQU4gTk9UIE5VTEwpbmluZGV4c2VnbWVudHNfdXNhZ2Vfc2VnX2lkc2VnbWVudF91c2FnZUNSRUFURSBJTkRFWCBzZWdtZW50c191c2FnZV9zZWdfaWQgT04gc2VnbWVudF91c2FnZShzZWdtZW50X2lkKTtpbmRleHNlZ21lbnRfdXNhZ2VfdGltZV9zbG90X3NlZ21lbnRfaWRzZWdtZW50X3VzYWdlQ1JFQVRFIElOREVYIHNlZ21lbnRfdXNhZ2VfdGltZV9zbG90X3NlZ21lbnRfaWQgT04gc2VnbWVudF91c2FnZSh0aW1lX3Nsb3QsIHNlZ21lbnRfaWQpL3RhYmxlc2VnbWVudF91c2FnZXNlZ21lbnRfdXNhZ2VDUkVBVEUgVEFCTEUgc2VnbWVudF91c2FnZSAoaWQgSU5URUdFUiBQUklNQVJZIEtFWSxzZWdtZW50X2lkIElOVEVHRVIgTk9UIE5VTEwsdGltZV9zbG90IElOVEVHRVIgTk9UIE5VTEwsdmlzaXRfY291bnQgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwpU21pbmRleHNlZ21lbnRzX3VybF9pZHNlZ21lbnRzQ1JFQVRFIElOREVYIHNlZ21lbnRzX3VybF9pZCBPTiBzZWdtZW50cyh1cmxfaWQpTWVpbmRleHNlZ21lbnRzX25hbWVzZWdtZW50c0NSRUFURSBJTkRFWCBzZWdtZW50c19uYW1lIE9OIHNlZ21lbnRzKG5hbWUpcDN0YWJsZXNlZ21lbnRzc2VnbWVudHNDUkVBVEUgVEFCTEUgc2VnbWVudHMgKGlkIElOVEVHRVIgUFJJTUFSWSBLRVksbmFtZSBWQVJDSEFSLHVybF9pZCBJTlRFR0VSIE5PTiBOVUxMKV9pbmRleHVybHNfdXJsX2luZGV4dXJscyhDUkVBVEUgSU5ERVggdXJsc191cmxfaW5kZXggT04gdXJscyAodXJsKT90YWJsZWhpc3Rvcnlfc3luY19tZXRhZGF0YWhpc3Rvcnlfc3luY19tZXRhZGF0YSdDUkVBVEUgVEFCTEUgaGlzdG9yeV9zeW5jX21ldGFkYXRhIChzdG9yYWdlX2tleSBJTlRFR0VSIFBSSU1BUlkgS0VZIE5PVCBOVUxMLCB2YWx1ZSBCTE9CKT9pbmRleHZpc2l0ZWRfbGlua3NfaW5kZXh2aXNpdGVkX2xpbmtzJkNSRUFURSBJTkRFWCB2aXNpdGVkX2xpbmtzX2luZGV4IE9OIHZpc2l0ZWRfbGlua3MgKGxpbmtfdXJsX2lkLCB0b3BfbGV2ZWxfdXJsLCBmcmFtZV91cmwpdGFibGV2aXNpdGVkX2xpbmtzdmlzaXRlZF9saW5rcyVDUkVBVEUgVEFCTEUgdmlzaXRlZF9saW5rcyhpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsbGlua191cmxfaWQgSU5URUdFUiBOT1QgTlVMTCx0b3BfbGV2ZWxfdXJsIExPTkdWQVJDSEFSIE5PVCBOVUxMLGZyYW1lX3VybCBMT05HVkFSQ0hBUiBOT1QgTlVMTCx2aXNpdF9jb3VudCBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTClBdGFibGVjbHVzdGVyX3Zpc2l0X2R1cGxpY2F0ZXNjbHVzdGVyX3Zpc2l0X2R1cGxpY2F0ZXMkQ1JFQVRFIFRBQkxFIGNsdXN0ZXJfdmlzaXRfZHVwbGljYXRlcyh2aXNpdF9pZCBJTlRFR0VSIE5PVCBOVUxMLGR1cGxpY2F0ZV92aXNpdF9pZCBJTlRFR0VSIE5PVCBOVUxMLFBSSU1BUlkgS0VZKHZpc2l0X2lkLGR1cGxpY2F0ZV92aXNpdF9pZCkpV0lUSE9VVCBST1dJRClpbmRleGNsdXN0ZXJfa2V5d29yZHNfY2x1c3Rlcl9pZF9pbmRleGNsdXN0ZXJfa2V5d29yZHMjQ1JFQVRFIElOREVYIGNsdXN0ZXJfa2V5d29yZHNfY2x1c3Rlcl9pZF9pbmRleCBPTiBjbHVzdGVyX2tleXdvcmRzKGNsdXN0ZXJfaWQpR3RhYmxlY2x1c3Rlcl9rZXl3b3Jkc2NsdXN0ZXJfa2V5d29yZHMiQ1JFQVRFIFRBQkxFIGNsdXN0ZXJfa2V5d29yZHMoY2x1c3Rlcl9pZCBJTlRFR0VSIE5PVCBOVUxMLGtleXdvcmQgVkFSQ0hBUiBOT1QgTlVMTCx0eXBlIElOVEVHRVIgTk9UIE5VTEwsc2NvcmUgTlVNRVJJQyBOT1QgTlVMTCxjb2xsZWN0aW9ucyBWQVJDSEFSIE5PVCBOVUxMKXJpbmRleGNsdXN0ZXJzX2Zvcl92aXNpdGNsdXN0ZXJzX2FuZF92aXNpdHMhQ1JFQVRFIElOREVYIGNsdXN0ZXJzX2Zvcl92aXNpdCBPTiBjbHVzdGVyc19hbmRfdmlzaXRzKHZpc2l0X2lkKQ==85:Tfd0,U1FMaXRlIGZvcm1hdCAzbGFzdF9jb21wYXRpYmxlX3ZlcnNpb240MHZlcnNpb240MW1tYXBfc3RhdHVzLTFsYXN0X2NvbXBhdGlibGVfdmVyc2lvbnZlcnNpb24jbW1hcF9zdGF0dXN0YWJsZWxvZ2luc2xvZ2luc0NSRUFURSBUQUJMRSBsb2dpbnMgKG9yaWdpbl91cmwgVkFSQ0hBUiBOT1QgTlVMTCwgYWN0aW9uX3VybCBWQVJDSEFSLCB1c2VybmFtZV9lbGVtZW50IFZBUkNIQVIsIHVzZXJuYW1lX3ZhbHVlIFZBUkNIQVIsIHBhc3N3b3JkX2VsZW1lbnQgVkFSQ0hBUiwgcGFzc3dvcmRfdmFsdWUgQkxPQiwgc3VibWl0X2VsZW1lbnQgVkFSQ0hBUiwgc2lnbm9uX3JlYWxtIFZBUkNIQVIgTk9UIE5VTEwsIGRhdGVfY3JlYXRlZCBJTlRFR0VSIE5PVCBOVUxMLCBibGFja2xpc3RlZF9ieV91c2VyIElOVEVHRVIgTk9UIE5VTEwsIHNjaGVtZSBJTlRFR0VSIE5PVCBOVUxMLCBwYXNzd29yZF90eXBlIElOVEVHRVIsIHRpbWVzX3VzZWQgSU5URUdFUiwgZm9ybV9kYXRhIEJMT0IsIGRpc3BsYXlfbmFtZSBWQVJDSEFSLCBpY29uX3VybCBWQVJDSEFSLCBmZWRlcmF0aW9uX3VybCBWQVJDSEFSLCBza2lwX3plcm9fY2xpY2sgSU5URUdFUiwgZ2VuZXJhdGlvbl91cGxvYWRfc3RhdHVzIElOVEVHRVIsIHBvc3NpYmxlX3VzZXJuYW1lX3BhaXJzIEJMT0IsIGlkIElOVEVHRVIgUFJJTUFSWSBLRVkgQVVUT0lOQ1JFTUVOVCwgZGF0ZV9sYXN0X3VzZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIG1vdmluZ19ibG9ja2VkX2ZvciBCTE9CLCBkYXRlX3Bhc3N3b3JkX21vZGlmaWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBzZW5kZXJfZW1haWwgVkFSQ0hBUiwgc2VuZGVyX25hbWUgVkFSQ0hBUiwgZGF0ZV9yZWNlaXZlZCBJTlRFR0VSLCBzaGFyaW5nX25vdGlmaWNhdGlvbl9kaXNwbGF5ZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIGtleWNoYWluX2lkZW50aWZpZXIgQkxPQiwgc2VuZGVyX3Byb2ZpbGVfaW1hZ2VfdXJsIFZBUkNIQVIsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpL3RhYmxlbWV0YW1ldGFDUkVBVEUgVEFCTEUgbWV0YShrZXkgTE9OR1ZBUkNIQVIgTk9UIE5VTEwgVU5JUVVFIFBSSU1BUlkgS0VZLCB2YWx1ZSBMT05HVkFSQ0hBUiknaW5kZXhzcWxpdGVfYXV0b2luZGV4X21ldGFfMW1ldGFvaW5kZXhzdGF0c19vcmlnaW5zdGF0c0NSRUFURSBJTkRFWCBzdGF0c19vcmlnaW4gT04gc3RhdHMob3JpZ2luX2RvbWFpbilfdGFibGVzdGF0c3N0YXRzQ1JFQVRFIFRBQkxFIHN0YXRzIChvcmlnaW5fZG9tYWluIFZBUkNIQVIgTk9UIE5VTEwsIHVzZXJuYW1lX3ZhbHVlIFZBUkNIQVIsIGRpc21pc3NhbF9jb3VudCBJTlRFR0VSLCB1cGRhdGVfdGltZSBJTlRFR0VSIE5PVCBOVUxMLCBVTklRVUUob3JpZ2luX2RvbWFpbiwgdXNlcm5hbWVfdmFsdWUpKSlpbmRleHNxbGl0ZV9hdXRvaW5kZXhfc3RhdHNfMXN0YXRzaW5kZXhmb3JlaWduX2tleV9pbmRleF9ub3Rlc3Bhc3N3b3JkX25vdGVzQ1JFQVRFIElOREVYIGZvcmVpZ25fa2V5X2luZGV4X25vdGVzIE9OIHBhc3N3b3JkX25vdGVzIChwYXJlbnRfaWQpUXRhYmxlcGFzc3dvcmRfbm90ZXNwYXNzd29yZF9ub3Rlc0NSRUFURSBUQUJMRSBwYXNzd29yZF9ub3RlcyAoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULCBwYXJlbnRfaWQgSU5URUdFUiBOT1QgTlVMTCBSRUZFUkVOQ0VTIGxvZ2lucyBPTiBVUERBVEUgQ0FTQ0FERSBPTiBERUxFVEUgQ0FTQ0FERSBERUZFUlJBQkxFIElOSVRJQUxMWSBERUZFUlJFRCwga2V5IFZBUkNIQVIgTk9UIE5VTEwsIHZhbHVlIEJMT0IsIGRhdGVfY3JlYXRlZCBJTlRFR0VSIE5PVCBOVUxMLCBjb25maWRlbnRpYWwgSU5URUdFUiwgVU5JUVVFIChwYXJlbnRfaWQsIGtleSkpO2luZGV4c3FsaXRlX2F1dG9pbmRleF9wYXNzd29yZF9ub3Rlc18xcGFzc3dvcmRfbm90ZXNpbmRleGZvcmVpZ25fa2V5X2luZGV4aW5zZWN1cmVfY3JlZGVudGlhbHNDUkVBVEUgSU5ERVggZm9yZWlnbl9rZXlfaW5kZXggT04gaW5zZWN1cmVfY3JlZGVudGlhbHMgKHBhcmVudF9pZClHaW5kZXhzcWxpdGVfYXV0b2luZGV4X2luc2VjdXJlX2NyZWRlbnRpYWxzXzFpbnNlY3VyZV9jcmVkZW50aWFscy90YWJsZWluc2VjdXJlX2NyZWRlbnRpYWxzaW5zZWN1cmVfY3JlZGVudGlhbHNDUkVBVEUgVEFCTEUgaW5zZWN1cmVfY3JlZGVudGlhbHMgKHBhcmVudF9pZCBJTlRFR0VSIFJFRkVSRU5DRVMgbG9naW5zIE9OIFVQREFURSBDQVNDQURFIE9OIERFTEVURSBDQVNDQURFIERFRkVSUkFCTEUgSU5JVElBTExZIERFRkVSUkVELCBpbnNlY3VyaXR5X3R5cGUgSU5URUdFUiBOT1QgTlVMTCwgY3JlYXRlX3RpbWUgSU5URUdFUiBOT1QgTlVMTCwgaXNfbXV0ZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHRyaWdnZXJfbm90aWZpY2F0aW9uX2Zyb21fYmFja2VuZCBJTlRFR0VSIE5PVCBOVUxMIERFRkFVTFQgMCwgVU5JUVVFIChwYXJlbnRfaWQsIGluc2VjdXJpdHlfdHlwZSkpXXRhYmxlc3luY19tb2RlbF9tZXRhZGF0YXN5bmNfbW9kZWxfbWV0YWRhdGFDUkVBVEUgVEFCTEUgc3luY19tb2RlbF9tZXRhZGF0YSAoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULCBtb2RlbF9tZXRhZGF0YSBWQVJDSEFSIE5PVCBOVUxMKWl0YWJsZXN5bmNfZW50aXRpZXNfbWV0YWRhdGFzeW5jX2VudGl0aWVzX21ldGFkYXRhQ1JFQVRFIFRBQkxFIHN5bmNfZW50aXRpZXNfbWV0YWRhdGEgKHN0b3JhZ2Vfa2V5IElOVEVHRVIgUFJJTUFSWSBLRVkgQVVUT0lOQ1JFTUVOVCwgbWV0YWRhdGEgVkFSQ0hBUiBOT1QgTlVMTClSc2luZGV4bG9naW5zX3NpZ25vbmxvZ2luc0NSRUFURSBJTkRFWCBsb2dpbnNfc2lnbm9uIE9OIGxvZ2lucyAoc2lnbm9uX3JlYWxtKVBZdGFibGVzcWxpdGVfc2VxdWVuY2VzcWxpdGVfc2VxdWVuY2VDUkVBVEUgVEFCTEUgc3FsaXRlX3NlcXVlbmNlKG5hbWUsc2VxKStpbmRleHNxbGl0ZV9hdXRvaW5kZXhfbG9naW5zXzFsb2dpbnM=86:T1494,U1FMaXRlIGZvcm1hdCAzbG9naW5zX2VkZ2VfZXh0ZW5kZWRfdGFibGVfdmVyc2lvbjJlZGdlX2JyZWFjaGVkX3RhYmxlX3ZlcnNpb24zbGFzdF9jb21wYXRpYmxlX3ZlcnNpb24zM3ZlcnNpb24zM21tYXBfc3RhdHVzLTFsb2dpbnNfZWRnZV9leHRlbmRlZF90YWJsZV92ZXJzaW9uZWRnZV9icmVhY2hlZF90YWJsZV92ZXJzaW9ubGFzdF9jb21wYXRpYmxlX3ZlcnNpb252ZXJzaW9uI21tYXBfc3RhdHVzaW5kZXhmb3JlaWduX2tleV9pbmRleGluc2VjdXJlX2NyZWRlbnRpYWxzQ1JFQVRFIElOREVYIGZvcmVpZ25fa2V5X2luZGV4IE9OIGluc2VjdXJlX2NyZWRlbnRpYWxzIChwYXJlbnRfaWQpR2luZGV4c3FsaXRlX2F1dG9pbmRleF9pbnNlY3VyZV9jcmVkZW50aWFsc18xaW5zZWN1cmVfY3JlZGVudGlhbHMzdGFibGVpbnNlY3VyZV9jcmVkZW50aWFsc2luc2VjdXJlX2NyZWRlbnRpYWxzQ1JFQVRFIFRBQkxFIGluc2VjdXJlX2NyZWRlbnRpYWxzIChwYXJlbnRfaWQgSU5URUdFUiBSRUZFUkVOQ0VTIGxvZ2lucyBPTiBVUERBVEUgQ0FTQ0FERSBPTiBERUxFVEUgQ0FTQ0FERSBERUZFUlJBQkxFIElOSVRJQUxMWSBERUZFUlJFRCwgaW5zZWN1cml0eV90eXBlIElOVEVHRVIgTk9UIE5VTEwsIGNyZWF0ZV90aW1lIElOVEVHRVIgTk9UIE5VTEwsIGlzX211dGVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBVTklRVUUgKHBhcmVudF9pZCwgaW5zZWN1cml0eV90eXBlKSlddGFibGVzeW5jX21vZGVsX21ldGFkYXRhc3luY19tb2RlbF9tZXRhZGF0YUNSRUFURSBUQUJMRSBzeW5jX21vZGVsX21ldGFkYXRhIChpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsIG1vZGVsX21ldGFkYXRhIFZBUkNIQVIgTk9UIE5VTEwpaXRhYmxlc3luY19lbnRpdGllc19tZXRhZGF0YXN5bmNfZW50aXRpZXNfbWV0YWRhdGFDUkVBVEUgVEFCTEUgc3luY19lbnRpdGllc19tZXRhZGF0YSAoc3RvcmFnZV9rZXkgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULCBtZXRhZGF0YSBWQVJDSEFSIE5PVCBOVUxMKVJzaW5kZXhsb2dpbnNfc2lnbm9ubG9naW5zQ1JFQVRFIElOREVYIGxvZ2luc19zaWdub24gT04gbG9naW5zIChzaWdub25fcmVhbG0pUFl0YWJsZXNxbGl0ZV9zZXF1ZW5jZXNxbGl0ZV9zZXF1ZW5jZUNSRUFURSBUQUJMRSBzcWxpdGVfc2VxdWVuY2UobmFtZSxzZXEpdGFibGVsb2dpbnNsb2dpbnNDUkVBVEUgVEFCTEUgbG9naW5zIChvcmlnaW5fdXJsIFZBUkNIQVIgTk9UIE5VTEwsIGFjdGlvbl91cmwgVkFSQ0hBUiwgdXNlcm5hbWVfZWxlbWVudCBWQVJDSEFSLCB1c2VybmFtZV92YWx1ZSBWQVJDSEFSLCBwYXNzd29yZF9lbGVtZW50IFZBUkNIQVIsIHBhc3N3b3JkX3ZhbHVlIEJMT0IsIHN1Ym1pdF9lbGVtZW50IFZBUkNIQVIsIHNpZ25vbl9yZWFsbSBWQVJDSEFSIE5PVCBOVUxMLCBkYXRlX2NyZWF0ZWQgSU5URUdFUiBOT1QgTlVMTCwgYmxhY2tsaXN0ZWRfYnlfdXNlciBJTlRFR0VSIE5PVCBOVUxMLCBzY2hlbWUgSU5URUdFUiBOT1QgTlVMTCwgcGFzc3dvcmRfdHlwZSBJTlRFR0VSLCB0aW1lc191c2VkIElOVEVHRVIsIGZvcm1fZGF0YSBCTE9CLCBkaXNwbGF5X25hbWUgVkFSQ0hBUiwgaWNvbl91cmwgVkFSQ0hBUiwgZmVkZXJhdGlvbl91cmwgVkFSQ0hBUiwgc2tpcF96ZXJvX2NsaWNrIElOVEVHRVIsIGdlbmVyYXRpb25fdXBsb2FkX3N0YXR1cyBJTlRFR0VSLCBwb3NzaWJsZV91c2VybmFtZV9wYWlycyBCTE9CLCBpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsIGRhdGVfbGFzdF91c2VkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBtb3ZpbmdfYmxvY2tlZF9mb3IgQkxPQiwgZGF0ZV9wYXNzd29yZF9tb2RpZmllZCBJTlRFR0VSIE5PVCBOVUxMIERFRkFVTFQgMCwgVU5JUVVFIChvcmlnaW5fdXJsLCB1c2VybmFtZV9lbGVtZW50LCB1c2VybmFtZV92YWx1ZSwgcGFzc3dvcmRfZWxlbWVudCwgc2lnbm9uX3JlYWxtKSkraW5kZXhzcWxpdGVfYXV0b2luZGV4X2xvZ2luc18xbG9naW5zL3RhYmxlbWV0YW1ldGFDUkVBVEUgVEFCTEUgbWV0YShrZXkgTE9OR1ZBUkNIQVIgTk9UIE5VTEwgVU5JUVVFIFBSSU1BUlkgS0VZLCB2YWx1ZSBMT05HVkFSQ0hBUiknaW5kZXhzcWxpdGVfYXV0b2luZGV4X21ldGFfMW1ldGFRdGFibGVwYXNzd29yZF9ub3Rlc3Bhc3N3b3JkX25vdGVzQ1JFQVRFIFRBQkxFIHBhc3N3b3JkX25vdGVzIChpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsIHBhcmVudF9pZCBJTlRFR0VSIE5PVCBOVUxMIFJFRkVSRU5DRVMgbG9naW5zIE9OIFVQREFURSBDQVNDQURFIE9OIERFTEVURSBDQVNDQURFIERFRkVSUkFCTEUgSU5JVElBTExZIERFRkVSUkVELCBrZXkgVkFSQ0hBUiBOT1QgTlVMTCwgdmFsdWUgQkxPQiwgZGF0ZV9jcmVhdGVkIElOVEVHRVIgTk9UIE5VTEwsIGNvbmZpZGVudGlhbCBJTlRFR0VSLCBVTklRVUUgKHBhcmVudF9pZCwga2V5KSlOb2luZGV4c3RhdHNfb3JpZ2luc3RhdHNDUkVBVEUgSU5ERVggc3RhdHNfb3JpZ2luIE9OIHN0YXRzKG9yaWdpbl9kb21haW4pX3RhYmxlc3RhdHNzdGF0c0NSRUFURSBUQUJMRSBzdGF0cyAob3JpZ2luX2RvbWFpbiBWQVJDSEFSIE5PVCBOVUxMLCB1c2VybmFtZV92YWx1ZSBWQVJDSEFSLCBkaXNtaXNzYWxfY291bnQgSU5URUdFUiwgdXBkYXRlX3RpbWUgSU5URUdFUiBOT1QgTlVMTCwgVU5JUVVFKG9yaWdpbl9kb21haW4sIHVzZXJuYW1lX3ZhbHVlKSkpaW5kZXhzcWxpdGVfYXV0b2luZGV4X3N0YXRzXzFzdGF0cyd0YWJsZWxvZ2luc19lZGdlX2V4dGVuZGVkbG9naW5zX2VkZ2VfZXh0ZW5kZWRDUkVBVEUgVEFCTEUgbG9naW5zX2VkZ2VfZXh0ZW5kZWQgKGlkIElOVEVHRVIgUFJJTUFSWSBLRVkgQVVUT0lOQ1JFTUVOVCwgc291cmNlIFZBUkNIQVIgTk9UIG51bGwgREVGQVVMVCAwLCBzdHJlbmd0aF9hbGVydF9zdGF0dXMgSU5URUdFUiBOT1QgbnVsbCBERUZBVUxUIDAsIHBhc3N3b3JkX25pY2tuYW1lIFZBUkNIQVIgTk9UIG51bGwgREVGQVVMVCAnJyApZmluZGV4YnJlYWNoZWRfdGFibGVfaW5kZXhicmVhY2hlZENSRUFURSBJTkRFWCBicmVhY2hlZF90YWJsZV9pbmRleCBPTiBicmVhY2hlZCAodXJsLCB1c2VybmFtZSl0YWJsZWJyZWFjaGVkYnJlYWNoZWRDUkVBVEUgVEFCTEUgYnJlYWNoZWQgKHVybCBWQVJDSEFSIE5PVCBudWxsLCB1c2VybmFtZSBWQVJDSEFSIE5PVCBudWxsLCBzdGF0dXMgSU5URUdFUiBOT1QgbnVsbCwgYWxlcnRfc3RhdGUgSU5URUdFUiBOT1QgbnVsbCwgbGFzdF9jaGVja2VkX3RpbWUgSU5URUdFUiBOT1QgbnVsbCwgc2FuaXRpemVkX3VzZXJuYW1lIFZBUkNIQVIsIGFsZXJ0X3NlZW4gSU5URUdFUiwgbGFzdF9zZWVuX3RpbWUgSU5URUdFUiwgVU5JUVVFICh1cmwsIHVzZXJuYW1lKSkvaW5kZXhzcWxpdGVfYXV0b2luZGV4X2JyZWFjaGVkXzFicmVhY2hlZGluZGV4Zm9yZWlnbl9rZXlfaW5kZXhfbm90ZXNwYXNzd29yZF9ub3Rlc0NSRUFURSBJTkRFWCBmb3JlaWduX2tleV9pbmRleF9ub3RlcyBPTiBwYXNzd29yZF9ub3RlcyAocGFyZW50X2lkKTtpbmRleHNxbGl0ZV9hdXRvaW5kZXhfcGFzc3dvcmRfbm90ZXNfMXBhc3N3b3JkX25vdGVzJ2luZGV4ZmllbGRfaW5mb19pbmRleGZpZWxkX2luZm9DUkVBVEUgSU5ERVggZmllbGRfaW5mb19pbmRleCBPTiBmaWVsZF9pbmZvIChmb3JtX3NpZ25hdHVyZSwgZmllbGRfc2lnbmF0dXJlKXRhYmxlZmllbGRfaW5mb2ZpZWxkX2luZm9DUkVBVEUgVEFCTEUgZmllbGRfaW5mbyAoZm9ybV9zaWduYXR1cmUgSU5URUdFUiBOT1QgTlVMTCwgZmllbGRfc2lnbmF0dXJlIElOVEVHRVIgTk9UIE5VTEwsIGZpZWxkX3R5cGUgSU5URUdFUiBOT1QgTlVMTCwgY3JlYXRlX3RpbWUgSU5URUdFUiBOT1QgTlVMTCwgVU5JUVVFIChmb3JtX3NpZ25hdHVyZSwgZmllbGRfc2lnbmF0dXJlKSkzaW5kZXhzcWxpdGVfYXV0b2luZGV4X2ZpZWxkX2luZm9fMWZpZWxkX2luZm8=87:T39f8,U1FMaXRlIGZvcm1hdCAzfXx8en0ze3xHei55RXl0YWJsZW1vel9wbGFjZXNtb3pfcGxhY2VzQ1JFQVRFIFRBQkxFIG1vel9wbGFjZXMgKCAgIGlkIElOVEVHRVIgUFJJTUFSWSBLRVksIHVybCBMT05HVkFSQ0hBUiwgdGl0bGUgTE9OR1ZBUkNIQVIsIHJldl9ob3N0IExPTkdWQVJDSEFSLCB2aXNpdF9jb3VudCBJTlRFR0VSIERFRkFVTFQgMCwgaGlkZGVuIElOVEVHRVIgREVGQVVMVCAwIE5PVCBOVUxMLCB0eXBlZCBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCwgZnJlY2VuY3kgSU5URUdFUiBERUZBVUxUIC0xIE5PVCBOVUxMLCBsYXN0X3Zpc2l0X2RhdGUgSU5URUdFUiAsIGd1aWQgVEVYVCwgZm9yZWlnbl9jb3VudCBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCwgdXJsX2hhc2ggSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwgLCBkZXNjcmlwdGlvbiBURVhULCBwcmV2aWV3X2ltYWdlX3VybCBURVhULCBvcmlnaW5faWQgSU5URUdFUiBSRUZFUkVOQ0VTIG1vel9vcmlnaW5zKGlkKSkrdGFibGVtb3pfb3JpZ2luc21vel9vcmlnaW5zJUNSRUFURSBUQUJMRSBtb3pfb3JpZ2lucyAoIGlkIElOVEVHRVIgUFJJTUFSWSBLRVksIHByZWZpeCBURVhUIE5PVCBOVUxMLCBob3N0IFRFWFQgTk9UIE5VTEwsIGZyZWNlbmN5IElOVEVHRVIgTk9UIE5VTEwsIFVOSVFVRSAocHJlZml4LCBob3N0KSApNSVpbmRleHNxbGl0ZV9hdXRvaW5kZXhfbW96X29yaWdpbnNfMW1vel9vcmlnaW5zJmgjI3RhYmxlbW96X21ldGFtb3pfbWV0YSRDUkVBVEUgVEFCTEUgbW96X21ldGEgKGtleSBURVhUIFBSSU1BUlkgS0VZLCB2YWx1ZSBOT1QgTlVMTCkgV0lUSE9VVCBST1dJRCBZaW5kZXhtb3pfaXRlbXNfYW5ub3NfaXRlbWF0dHJpYnV0ZWluZGV4bW96X2l0ZW1zX2Fubm9zI0NSRUFURSBVTklRVUUgSU5ERVggbW96X2l0ZW1zX2Fubm9zX2l0ZW1hdHRyaWJ1dGVpbmRleCBPTiBtb3pfaXRlbXNfYW5ub3MgKGl0ZW1faWQsIGFubm9fYXR0cmlidXRlX2lkKUVpbmRleG1vel9hbm5vc19wbGFjZWF0dHJpYnV0ZWluZGV4bW96X2Fubm9zIkNSRUFURSBVTklRVUUgSU5ERVggbW96X2Fubm9zX3BsYWNlYXR0cmlidXRlaW5kZXggT04gbW96X2Fubm9zIChwbGFjZV9pZCwgYW5ub19hdHRyaWJ1dGVfaWQpTWluZGV4bW96X2tleXdvcmRzX3BsYWNlcG9zdGRhdGFfdW5pcXVlaW5kZXhtb3pfa2V5d29yZHMhQ1JFQVRFIFVOSVFVRSBJTkRFWCBtb3pfa2V5d29yZHNfcGxhY2Vwb3N0ZGF0YV91bmlxdWVpbmRleCBPTiBtb3pfa2V5d29yZHMgKHBsYWNlX2lkLCBwb3N0X2RhdGEpIWluZGV4bW96X2Jvb2ttYXJrc19ndWlkX3VuaXF1ZWluZGV4bW96X2Jvb2ttYXJrcyBDUkVBVEUgVU5JUVVFIElOREVYIG1vel9ib29rbWFya3NfZ3VpZF91bmlxdWVpbmRleCBPTiBtb3pfYm9va21hcmtzIChndWlkKXxpbmRleG1vel9ib29rbWFya3NfZGF0ZWFkZGVkaW5kZXhtb3pfYm9va21hcmtzQ1JFQVRFIElOREVYIG1vel9ib29rbWFya3NfZGF0ZWFkZGVkaW5kZXggT04gbW96X2Jvb2ttYXJrcyAoZGF0ZUFkZGVkKTVpbmRleG1vel9ib29rbWFya3NfaXRlbWxhc3Rtb2RpZmllZGluZGV4bW96X2Jvb2ttYXJrc0NSRUFURSBJTkRFWCBtb3pfYm9va21hcmtzX2l0ZW1sYXN0bW9kaWZpZWRpbmRleCBPTiBtb3pfYm9va21hcmtzIChmaywgbGFzdE1vZGlmaWVkKX0haW5kZXhtb3pfYm9va21hcmtzX3BhcmVudGluZGV4bW96X2Jvb2ttYXJrc0NSRUFURSBJTkRFWCBtb3pfYm9va21hcmtzX3BhcmVudGluZGV4IE9OIG1vel9ib29rbWFya3MgKHBhcmVudCwgcG9zaXRpb24pcWluZGV4bW96X2Jvb2ttYXJrc19pdGVtaW5kZXhtb3pfYm9va21hcmtzQ1JFQVRFIElOREVYIG1vel9ib29rbWFya3NfaXRlbWluZGV4IE9OIG1vel9ib29rbWFya3MgKGZrLCB0eXBlKSFpbmRleG1vel9oaXN0b3J5dmlzaXRzX2RhdGVpbmRleG1vel9oaXN0b3J5dmlzaXRzQ1JFQVRFIElOREVYIG1vel9oaXN0b3J5dmlzaXRzX2RhdGVpbmRleCBPTiBtb3pfaGlzdG9yeXZpc2l0cyAodmlzaXRfZGF0ZSkhaW5kZXhtb3pfaGlzdG9yeXZpc2l0c19mcm9taW5kZXhtb3pfaGlzdG9yeXZpc2l0c0NSRUFURSBJTkRFWCBtb3pfaGlzdG9yeXZpc2l0c19mcm9taW5kZXggT04gbW96X2hpc3Rvcnl2aXNpdHMgKGZyb21fdmlzaXQpP2luZGV4bW96X2hpc3Rvcnl2aXNpdHNfcGxhY2VkYXRlaW5kZXhtb3pfaGlzdG9yeXZpc2l0c0NSRUFURSBJTkRFWCBtb3pfaGlzdG9yeXZpc2l0c19wbGFjZWRhdGVpbmRleCBPTiBtb3pfaGlzdG9yeXZpc2l0cyAocGxhY2VfaWQsIHZpc2l0X2RhdGUpdmluZGV4bW96X3BsYWNlc19ndWlkX3VuaXF1ZWluZGV4bW96X3BsYWNlc0NSRUFURSBVTklRVUUgSU5ERVggbW96X3BsYWNlc19ndWlkX3VuaXF1ZWluZGV4IE9OIG1vel9wbGFjZXMgKGd1aWQpfiFpbmRleG1vel9wbGFjZXNfbGFzdHZpc2l0ZGF0ZWluZGV4bW96X3BsYWNlc0NSRUFURSBJTkRFWCBtb3pfcGxhY2VzX2xhc3R2aXNpdGRhdGVpbmRleCBPTiBtb3pfcGxhY2VzIChsYXN0X3Zpc2l0X2RhdGUpbWluZGV4bW96X3BsYWNlc19mcmVjZW5jeWluZGV4bW96X3BsYWNlc0NSRUFURSBJTkRFWCBtb3pfcGxhY2VzX2ZyZWNlbmN5aW5kZXggT04gbW96X3BsYWNlcyAoZnJlY2VuY3kpamluZGV4bW96X3BsYWNlc192aXNpdGNvdW50bW96X3BsYWNlc0NSRUFURSBJTkRFWCBtb3pfcGxhY2VzX3Zpc2l0Y291bnQgT04gbW96X3BsYWNlcyAodmlzaXRfY291bnQpZWluZGV4bW96X3BsYWNlc19ob3N0aW5kZXhtb3pfcGxhY2VzQ1JFQVRFIElOREVYIG1vel9wbGFjZXNfaG9zdGluZGV4IE9OIG1vel9wbGFjZXMgKHJldl9ob3N0KW1pbmRleG1vel9wbGFjZXNfdXJsX2hhc2hpbmRleG1vel9wbGFjZXNDUkVBVEUgSU5ERVggbW96X3BsYWNlc191cmxfaGFzaGluZGV4IE9OIG1vel9wbGFjZXMgKHVybF9oYXNoKUtbdGFibGVzcWxpdGVfc3RhdDFzcWxpdGVfc3RhdDFDUkVBVEUgVEFCTEUgc3FsaXRlX3N0YXQxKHRibCxpZHgsc3RhdCkndGFibGVtb3pfaXRlbXNfYW5ub3Ntb3pfaXRlbXNfYW5ub3NDUkVBVEUgVEFCTEUgbW96X2l0ZW1zX2Fubm9zICggIGlkIElOVEVHRVIgUFJJTUFSWSBLRVksIGl0ZW1faWQgSU5URUdFUiBOT1QgTlVMTCwgYW5ub19hdHRyaWJ1dGVfaWQgSU5URUdFUiwgY29udGVudCBMT05HVkFSQ0hBUiwgZmxhZ3MgSU5URUdFUiBERUZBVUxUIDAsIGV4cGlyYXRpb24gSU5URUdFUiBERUZBVUxUIDAsIHR5cGUgSU5URUdFUiBERUZBVUxUIDAsIGRhdGVBZGRlZCBJTlRFR0VSIERFRkFVTFQgMCwgbGFzdE1vZGlmaWVkIElOVEVHRVIgREVGQVVMVCAwKXRhYmxlbW96X2Fubm9zbW96X2Fubm9zQ1JFQVRFIFRBQkxFIG1vel9hbm5vcyAoICBpZCBJTlRFR0VSIFBSSU1BUlkgS0VZLCBwbGFjZV9pZCBJTlRFR0VSIE5PVCBOVUxMLCBhbm5vX2F0dHJpYnV0ZV9pZCBJTlRFR0VSLCBjb250ZW50IExPTkdWQVJDSEFSLCBmbGFncyBJTlRFR0VSIERFRkFVTFQgMCwgZXhwaXJhdGlvbiBJTlRFR0VSIERFRkFVTFQgMCwgdHlwZSBJTlRFR0VSIERFRkFVTFQgMCwgZGF0ZUFkZGVkIElOVEVHRVIgREVGQVVMVCAwLCBsYXN0TW9kaWZpZWQgSU5URUdFUiBERUZBVUxUIDApR3RhYmxlbW96X2Fubm9fYXR0cmlidXRlc21vel9hbm5vX2F0dHJpYnV0ZXNDUkVBVEUgVEFCTEUgbW96X2Fubm9fYXR0cmlidXRlcyAoICBpZCBJTlRFR0VSIFBSSU1BUlkgS0VZLCBuYW1lIFZBUkNIQVIoMzIpIFVOSVFVRSBOT1QgTlVMTClFaW5kZXhzcWxpdGVfYXV0b2luZGV4X21vel9hbm5vX2F0dHJpYnV0ZXNfMW1vel9hbm5vX2F0dHJpYnV0ZXNZdGFibGVzcWxpdGVfc2VxdWVuY2VzcWxpdGVfc2VxdWVuY2VDUkVBVEUgVEFCTEUgc3FsaXRlX3NlcXVlbmNlKG5hbWUsc2VxKXRhYmxlbW96X2tleXdvcmRzbW96X2tleXdvcmRzQ1JFQVRFIFRBQkxFIG1vel9rZXl3b3JkcyAoICBpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsIGtleXdvcmQgVEVYVCBVTklRVUUsIHBsYWNlX2lkIElOVEVHRVIsIHBvc3RfZGF0YSBURVhUKTdpbmRleHNxbGl0ZV9hdXRvaW5kZXhfbW96X2tleXdvcmRzXzFtb3pfa2V5d29yZHNVdGFibGVtb3pfYm9va21hcmtzX2RlbGV0ZWRtb3pfYm9va21hcmtzX2RlbGV0ZWRDUkVBVEUgVEFCTEUgbW96X2Jvb2ttYXJrc19kZWxldGVkICggIGd1aWQgVEVYVCBQUklNQVJZIEtFWSwgZGF0ZVJlbW92ZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDApSWluZGV4c3FsaXRlX2F1dG9pbmRleF9tb3pfYm9va21hcmtzX2RlbGV0ZWRfMW1vel9ib29rbWFya3NfZGVsZXRlZHRhYmxlbW96X2Jvb2ttYXJrc21vel9ib29rbWFya3NDUkVBVEUgVEFCTEUgbW96X2Jvb2ttYXJrcyAoICBpZCBJTlRFR0VSIFBSSU1BUlkgS0VZLCB0eXBlIElOVEVHRVIsIGZrIElOVEVHRVIgREVGQVVMVCBOVUxMLCBwYXJlbnQgSU5URUdFUiwgcG9zaXRpb24gSU5URUdFUiwgdGl0bGUgTE9OR1ZBUkNIQVIsIGtleXdvcmRfaWQgSU5URUdFUiwgZm9sZGVyX3R5cGUgVEVYVCwgZGF0ZUFkZGVkIElOVEVHRVIsIGxhc3RNb2RpZmllZCBJTlRFR0VSLCBndWlkIFRFWFQsIHN5bmNTdGF0dXMgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHN5bmNDaGFuZ2VDb3VudGVyIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAxKSd0YWJsZW1vel9ob3N0c21vel9ob3N0c0NSRUFURSBUQUJMRSBtb3pfaG9zdHMgKCAgaWQgSU5URUdFUiBQUklNQVJZIEtFWSwgaG9zdCBURVhUIE5PVCBOVUxMIFVOSVFVRSwgZnJlY2VuY3kgSU5URUdFUiwgdHlwZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHByZWZpeCBURVhUKTFpbmRleHNxbGl0ZV9hdXRvaW5kZXhfbW96X2hvc3RzXzFtb3pfaG9zdHN0YWJsZW1vel9pbnB1dGhpc3Rvcnltb3pfaW5wdXRoaXN0b3J5Q1JFQVRFIFRBQkxFIG1vel9pbnB1dGhpc3RvcnkgKCAgcGxhY2VfaWQgSU5URUdFUiBOT1QgTlVMTCwgaW5wdXQgTE9OR1ZBUkNIQVIgTk9UIE5VTEwsIHVzZV9jb3VudCBJTlRFR0VSLCBQUklNQVJZIEtFWSAocGxhY2VfaWQsIGlucHV0KSk/aW5kZXhzcWxpdGVfYXV0b2luZGV4X21vel9pbnB1dGhpc3RvcnlfMW1vel9pbnB1dGhpc3Rvcnk9dGFibGVtb3pfaGlzdG9yeXZpc2l0c21vel9oaXN0b3J5dmlzaXRzQ1JFQVRFIFRBQkxFIG1vel9oaXN0b3J5dmlzaXRzICggIGlkIElOVEVHRVIgUFJJTUFSWSBLRVksIGZyb21fdmlzaXQgSU5URUdFUiwgcGxhY2VfaWQgSU5URUdFUiwgdmlzaXRfZGF0ZSBJTlRFR0VSLCB2aXNpdF90eXBlIElOVEVHRVIsIHNlc3Npb24gSU5URUdFUilpbmRleG1vel9wbGFjZXNfb3JpZ2luaWRpbmRleG1vel9wbGFjZXMnQ1JFQVRFIElOREVYIG1vel9wbGFjZXNfb3JpZ2luaWRpbmRleCBPTiBtb3pfcGxhY2VzIChvcmlnaW5faWQpfG58JHpVZlVmVWZVZlVmVWZodHRwczovL3N1cHBvcnQubW96aWxsYS5vcmcvZW4tVVMvcHJvZHVjdHMvZmlyZWZveGdyby5hbGxpem9tLnRyb3BwdXMuSW5aRGE0MkN0M0Y4K2h0dHBzOi8vYXBwLnZzc3BzLnZpc3VhbHN0dWRpby5jb20vX3NpZ25pbj9yZWFsbT1teS52aXN1YWxzdHVkaW8uY29tJnJlcGx5X3RvPWh0dHBzJTNBJTJGJTJGbXkudmlzdWFsc3R1ZGlvLmNvbSUyRkJlbmVmaXRzJTNGd3QubWNfaWQlM0Rvfm1zZnR+dnNjb21+bmF2JTI2Y2FtcGFpZ24lM0Rvfm1zZnR+dnNjb21+bmF2JnJlZGlyZWN0PTEmY29udGV4dD1leUpvZENJNk15d2lhR2xrSWpvaU4yUXhObUU1T1RVdE1EQTBNaTFrTUdaaExXUmhaR1F0WVRRNFl6VXpZV1JrWWpsbElpd2ljWE1pT250OUxDSnljaUk2SWlJc0luWm9Jam9pSWl3aVkzWWlPaUlpTENKamN5STZJaUo5MCNjdHg9ZXlKVGFXZHVTVzVEYjI5cmFXVkViMjFoYVc1eklqcGJJbWgwZEhCek9pOHZiRzluYVc0dWQybHVaRzkzY3k1dVpYUWlMQ0pvZEhSd2N6b3ZMMnh2WjJsdUxtMXBZM0p2YzI5bWRHOXViR2x1WlM1amIyMGlYWDAxbW9jLm9pZHV0c2xhdXNpdi5zcHNzdi5wcGEueWh2SC1tSm8zeE9zTVgraHR0cHM6Ly9tc2RuLm1pY3Jvc29mdC5jb20vZW4tdXMvc3Vic2NyaXB0aW9ucy9hYTMzNjg1OC5hc3B4bW9jLnRmb3NvcmNpbS5uZHNtLjFxc0RQQ2hROU1weitodHRwczovL2FwcC52c2FleC52aXN1YWxzdHVkaW8uY29tL3Byb2ZpbGUvdmlldz9ta3Q9ZW4tVVMmY2FtcGFpZ249b35tc2Z0fnZzY29tfnNpZ25pbm1vYy5vaWR1dHNsYXVzaXYueGVhc3YucHBhLkt1Nkg2Z2lfVnpQQStodHRwczovL2FwcC52c2FleC52aXN1YWxzdHVkaW8uY29tL3Byb2ZpbGUvY3JlYXRlP21rdD1lbi11cyZjYW1wYWlnbj1vfm1zZnR+dnNjb21+c2lnbmlubW9jLm9pZHV0c2xhdXNpdi54ZWFzdi5wcGEua0w0U2ZySUk3eUFoK2h0dHBzOi8vY3Jvd2RzdHJpa2Uub2t0YS5jb20vbG9naW4vc2Vzc2lvbkNvb2tpZVJlZGlyZWN0P2NoZWNrQWNjb3VudFNldHVwQ29tcGxldGU9dHJ1ZSZ0b2tlbj0yMDExMTlLZEJLVkQ2YUVaaVM1N0lFRTJ5WWpBLVlIVmp1cnBNT2RlZG1UZ2hGVllwY1hUc0lBJnJlZGlyZWN0VXJsPWh0dHBzJTNBJTJGJTJGY3Jvd2RzdHJpa2Uub2t0YS5jb20lMkZhcHAlMkZvZmZpY2UzNjUlMkZleGs5bnRrdW82dU5JNUJHQzB4NyUyRnNzbyUyRndzZmVkJTJGcGFzc2l2ZSUzRmNsaWVudC1yZXF1ZXN0LWlkJTNEODMxNzM4NDEtZGZmNS00NDAyLTgwYjMtODI1MmRmNDU1N2I4JTI2d2ElM0R3c2lnbmluMS4wJTI2d3RyZWFsbSUzRHVybiUyNTNhZmVkZXJhdGlvbiUyNTNhTWljcm9zb2Z0T25saW5lJTI2d2N0eCUzRExvZ2luT3B0aW9ucyUyNTNEMyUyNTI2ZXN0c3JlZGlyZWN0JTI1M2QyJTI1MjZlc3RzcmVxdWVzdCUyNTNkclFJSUFaVlN6MnNUVVJET1p0T1lCc0VpZ29LWEhwSWMxTjNzZV92clpTSFFRQnRqcVZvdGFQRVNOcnR2azAxMjkyM2ZlNXZFZ2tFVXhHUHg2RkhCUTd6cHBmZ25lT3E1bDRKZVJBLUtJSGowVmZFa2dzSXdNRFBmOE0xOE14ZGtvQUtuWWpRYVBXUzRuZ0owQ0JRRDJvSGl1c0JXb0dWN3J0V3dUYnVCMW91bUJnelRvS2ZMU3kxMDl1RzNvX3pxX2RjUGJoNnQzZDZmUzVjR25LZk1xZGZkTkZYSGpLVk1IWWNzY3lQR016OGtxa2ZpZXBlRl9RVDdZYkl2U1FlUzlFR1M1dmtLMG9HdEl3TW9maENZaW1Gb1VFRmFUMWNRTktFZkdLWnA5OUJoX3RUMVZzWUg4TmdSR3U3aXJfbkZnTkM0bXhMR244cVA4aFM3VWR6OHhlM2k2Ul9jTllyVDZHNlhrLWJQT2F0NnF3cmJ3djdlSVlwOUlseEtTUkJHdUtxMzR4R3Y2cXM0VVRKV2hkYUVxN0hYRFgyUklyT1lCWHcyWnFKdGRyeGptQWhBdC0tS21wQlhzMnhnbWxCWEFRSVFRZzFZbWdvTWtkUVIwbTJCVEQwOFRRV1cwd3lMTUFzOVBoVmhqR3NEM3RSckNVazgzUHdYbmVaeTVmY1pZamR4LXpqR0NSZkxVS3hPd3NRbkU2WW1tTmRmeVVVeGFVeVNkX0w1MktXZVNzTXhwbVRGbzJUaU0wN0RFVDVXNEtBZ2ZTeWMxR1NuVkNvdjVjN2xsblBmQzlLekJYSC1sLTlMbnpmdTNWcDVjZmxKOHZ4VE9mZDJvVDY1dWgxWm1fN1dWclRaNmdfWGh0UE9kSVNHblkyZDFzN29XZ3AydDI5YzZWQi1zYjF1YWszb2dMMml0RmNzZmlsS2owX2szaXotMV9NY2xzOElEWkdpMlFxd2x3RjBvT1VZNk00UDAlMjZjYmN4dCUzRCUyNnVzZXJuYW1lJTNEbWFyYy5yaXZlcm8lMjU0MGNyb3dkc3RyaWtlLmNvbSUyNm1rdCUzRCUyNmxjJTNEbW9jLmF0a28uZWtpcnRzZHdvcmMuSDFVTWRxVVczWlJSbCtodHRwczovL2FwcC52c2FleC52aXN1YWxzdHVkaW8uY29tL2dvL3Byb2ZpbGU/bWt0PWVuLXVzJnd0Lm1jX2lkPW9+bXNmdH52c2NvbX5zaWduaW4mX2dhPTEuMTA2NzE1NTIzLjE4MTIyMjAxNjAuMTQ2NzEzODgzNyZwY2V4cD10cnVlJnVpY3R4PW1lbW9jLm9pZHV0c2xhdXNpdi54ZWFzdi5wcGEua2VuMzJqTldOR3BjK2h0dHA6Ly93d3cuZ29vZ2xlLmNvbS9tb2MuZWxnb29nLnd3dy5pOFZkV0JpZ0M5OXo1dHImI2h0dHA6Ly9nb29nbGUuY29tL21vYy5lbGdvb2cuN0dGYlROaFNUN2FJciZwbGFjZTp0eXBlPTYmc29ydD0xNCZtYXhSZXN1bHRzPTEwLnZGQ1dmbU9FbHZuQ3BsYWNlOnNvcnQ9OCZtYXhSZXN1bHRzPTEwLm91TnJoRUktVU5FTGh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL3ByaXZhY3kvZmlyZWZveC9ncm8uYWxsaXpvbS53d3cuXzRFOGlrRUd5X3NKK2h0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2VuLVVTL2ZpcmVmb3gvY2VudHJhbC9ncm8uYWxsaXpvbS53d3cuSWN5WF9zRkJWbW1ZK2h0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2VuLVVTL2Fib3V0L2dyby5hbGxpem9tLnd3dy5mR2c0dm5pT29VWTgraHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZW4tVVMvY29udHJpYnV0ZS9ncm8uYWxsaXpvbS53d3cuaUhFZF8tTmxxS08yK2h0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2VuLVVTL2ZpcmVmb3gvY3VzdG9taXplL2dyby5hbGxpem9tLnd3dy5pMUlrUXhwS21SVzErfm5+SH1+dX42fXJvb3RfX19fX19fXy10OEM1XzlJUHMwMjhSZWNlbnQgVGFnc29ZdHZuRVpPcnU0TU1vc3QgVmlzaXRlZDMtUnZuTE52Y2FLcUdldHRpbmcgU3RhcnRlZGhOdVhvMnJEelZDUGc1QWJvdXQgVXN4QUtvR0p1VmV1cUxvOUdldCBJbnZvbHZlZHh1YXlJWGVGeEJwM1E9Q3VzdG9taXplIEZpcmVmb3h4VnpqMnRCZDNNRWlwPUhlbHAgYW5kIFR1dG9yaWFsc3hudmFmQS05N3lwbU08TW96aWxsYSBGaXJlZm94eFFxblNabUVZSkFYRDNtb2JpbGVtb2JpbGVfX19fX19PdGhlciBCb29rbWFya3N1bmZpbGVkX19fX19UYWdzdGFnc19fX19fX19fPUJvb2ttYXJrcyBUb29sYmFydG9vbGJhcl9fX19fQm9va21hcmtzIE1lbnVtZW51X19fX19fX19zdGUxejhEMk1ONjB6RlBYWVBybHdrSUVYLTVUMDM1RGNTUnJZZTgwa0tobkdBbGtCMVhnSXdGekxrQmV6dTh2NXlGai1Fd3pzWTZGUnl6MzUzQ2x5c1pQeUh3Zk5lQktzdGUxejhEMk1ONjB6RlBYWVBybHdrSUVYLTVUMDM1RGNTUnJZZTgwa0tobkdBbGtCMVhnSXdGekxrQmV6dTh2NXlGai1Fd3pzWTZGUnl6MzUzQ2wleXNaUHlId2ZOZUJLMWRvd25sb2Fkcy9tZXRhRGF0YUVkb3dubG9hZHMvZGVzdGluYXRpb25GaWxlVVJJNVBsYWNlcy9TbWFydEJvb2ttYXJrNW1vYmlsZS9ib29rbWFya3NSb290ZG93bmxvYWRzL21ldGFEYXRhZG93bmxvYWRzL2Rlc3RpbmF0aW9uRmlsZVVSSTVtb2JpbGUvYm9va21hcmtzUm9vdFBsYWNlcy9TbWFydEJvb2ttYXJrfWd9R31HfUd9R31HfUd9R31HfUd9R31HfUd9R31HfUdSZWNlbnRUYWdzTW9zdFZpc2l0ZWR9e31LbW96X3BsYWNlc21vel9wbGFjZXNfdXJsX2hhc2hpbmRleDM2IDEmbW96X3BsYWNlc21vel9wbGFjZXNfaG9zdGluZGV4MzYgMy5tb3pfYm9va21hcmtzbW96X2Jvb2ttYXJrc19pdGVtaW5kZXgxNSAyIDIwbW96X2Jvb2ttYXJrc21vel9ib29rbWFya3NfcGFyZW50aW5kZXgxNSAzIDE6bW96X2Jvb2ttYXJrc21vel9ib29rbWFya3NfaXRlbWxhc3Rtb2RpZmllZGluZGV4MTUgMiAyMW1vel9ib29rbWFya3Ntb3pfYm9va21hcmtzX2RhdGVhZGRlZGluZGV4MTUgMzNtb3pfYm9va21hcmtzbW96X2Jvb2ttYXJrc19ndWlkX3VuaXF1ZWluZGV4MTUgMTptb3pfaGlzdG9yeXZpc2l0c21vel9oaXN0b3J5dmlzaXRzX3BsYWNlZGF0ZWluZGV4MyAxIDEzbW96X2hpc3Rvcnl2aXNpdHNtb3pfaGlzdG9yeXZpc2l0c19mcm9taW5kZXgzIDIzbW96X2hpc3Rvcnl2aXNpdHNtb3pfaGlzdG9yeXZpc2l0c19kYXRlaW5kZXgzIDFtb3pfcGxhY2VzbW96X3BsYWNlc192aXNpdGNvdW50MzYgMTIqbW96X3BsYWNlc21vel9wbGFjZXNfZnJlY2VuY3lpbmRleDM2IDQvbW96X3BsYWNlc21vel9wbGFjZXNfbGFzdHZpc2l0ZGF0ZWluZGV4MzYgMi1tb3pfcGxhY2VzbW96X3BsYWNlc19ndWlkX3VuaXF1ZWluZGV4MzYgMSptb3pfcGxhY2VzbW96X3BsYWNlc19vcmlnaW5pZGluZGV4MzYgM34hfiF+IX4hfiF+IX0yfTJ9Mn0yfTJ9Mn0yfW1vYy50Zm9zb3JjaW0ubmRzbS5tb2Mub2lkdXRzbGF1c2l2LnhlYXN2LnBwYS5tb2Mub2lkdXRzbGF1c2l2LnhlYXN2LnBwYS5tb2Mub2lkdXRzbGF1c2l2LnhlYXN2LnBwYS5tb2Mub2lkdXRzbGF1c2l2LnNwc3N2LnBwYS5tb2MuZWxnb29nLnd3dy5tb2MuZWxnb29nLm1vYy5hdGtvLmVraXJ0c2R3b3JjLmdyby5hbGxpem9tLnd3dy5ncm8uYWxsaXpvbS53d3cuZ3JvLmFsbGl6b20ud3d3Lmdyby5hbGxpem9tLnd3dy5ncm8uYWxsaXpvbS53d3cuNWdyby5hbGxpem9tLnRyb3BwdXMufmV+ZX5lfmV+ZX5lfnp+R342fiV9dkgtbUpvM3hPc01YdkZDV2ZtT0Vsdm5DflhvdU5yaEVJLVVORUxrZW4zMmpOV05HcGNrTDRTZnJJSTd5QWhpSEVkXy1ObHFLTzJpMUlrUXhwS21SVzFmR2c0dm5pT29VWThfNEU4aWtFR3lfc0pWZFdCaWdDOTl6NXRLdTZINmdpX1Z6UEElSW5aRGE0MkN0M0Y4SWN5WF9zRkJWbW1ZN0dGYlROaFNUN2FJMXFzRFBDaFE5TXB6MVVNZHFVVzNaUlJsflR+VH5UflR+VH5UflR+VH5UflR+VH5UflR+VH5UflR+VH5UflR+VH5UflR+VHVuZmlsZWRfX19fX3VheUlYZUZ4QnAzUXRvb2xiYXJfX19fX3RhZ3NfX19fX19fXyVyb290X19fX19fX19vWXR2bkVaT3J1NE1udmFmQS05N3lwbU1tb2JpbGVfX19fX19tZW51X19fX19fX19WemoydEJkM01FaXBRcW5TWm1FWUpBWEROdVhvMnJEelZDUGdBS29HSnVWZXVxTG8zLVJ2bkxOdmNhS3EtdDhDNV85SVBzMDJvcmlnaW5fZnJlY2VuY3lfc3VtX29mX3NxdWFyZXNBT29yaWdpbl9mcmVjZW5jeV9zdW1Ab3JpZ2luX2ZyZWNlbmN5X2NvdW50fiJ+In4ifmh0dHBzOi8vc3VwcG9ydC5tb3ppbGxhLm9yZ2h0dHBzOi8vY3Jvd2RzdHJpa2Uub2t0YS5jb21odHRwczovL21zZG4ubWljcm9zb2Z0LmNvbWh0dHBzOi8vYXBwLnZzc3BzLnZpc3VhbHN0dWRpby5jb21odHRwczovL2FwcC52c2FleC52aXN1YWxzdHVkaW8uY29tYWh0dHA6Ly9nb29nbGUuY29taHR0cDovL3d3dy5nb29nbGUuY29tcGxhY2U6dHlwZT02JnNvcnQ9MTQmbWF4UmVzdWx0cz0xMHBsYWNlOnNvcnQ9OCZtYXhSZXN1bHRzPTEwaHR0cHM6Ly93d3cubW96aWxsYS5vcmd+X34/aHR0cHM6Ly9tc2RuLm1pY3Jvc29mdC5jb21odHRwczovL2Nyb3dkc3RyaWtlLm9rdGEuY29taHR0cHM6Ly9hcHAudnNzcHMudmlzdWFsc3R1ZGlvLmNvbWh0dHBzOi8vYXBwLnZzYWV4LnZpc3VhbHN0dWRpby5jb21odHRwOi8vd3d3Lmdvb2dsZS5jb21odHRwOi8vZ29vZ2xlLmNvbXBsYWNlOnR5cGU9NiZzb3J0PTE0Jm1heFJlc3VsdHM9MTBwbGFjZTpzb3J0PTgmbWF4UmVzdWx0cz0xMGh0dHBzOi8vd3d3Lm1vemlsbGEub3JnM2h0dHBzOi8vc3VwcG9ydC5tb3ppbGxhLm9yZw==88:T1018,UGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogRGlzY29yZCBhdCAlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lXFVzZXIgRGF0YVxEZWZhdWx0XExvY2FsIFN0b3JhZ2VcbGV2ZWxkYlByb2Nlc3NpbmcgZmlsZTogMDAwMDAzLmxvZ1RvdGFsIHRva2VucyBmb3VuZCBpbiBHb29nbGUgQ2hyb21lOiAwUGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogT3BlcmEgYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXFJvYW1pbmdcT3BlcmEgU29mdHdhcmVcT3BlcmEgU3RhYmxlUGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogQnJhdmUgYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGFcRGVmYXVsdFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IFlhbmRleCBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcWWFuZGV4XFlhbmRleEJyb3dzZXJcVXNlciBEYXRhXERlZmF1bHRDaGVja2luZzogTWljcm9zb2Z0IEVkZ2UgYXQgcGF0aDogQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXE1pY3Jvc29mdFxFZGdlXFVzZXIgRGF0YVxEZWZhdWx0XExvY2FsIFN0b3JhZ2VcbGV2ZWxkYlByb2Nlc3NpbmcgZmlsZTogMDAwMDAzLmxkYlByb2Nlc3NpbmcgZmlsZTogMDAwMDA2LmxkYlByb2Nlc3NpbmcgZmlsZTogMDAwMDA3LmxvZ1RvdGFsIHRva2VucyBmb3VuZCBpbiBNaWNyb3NvZnQgRWRnZTogMFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IFZpdmFsZGkgYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFZpdmFsZGlcVXNlciBEYXRhXERlZmF1bHRQbGF0Zm9ybSBwYXRoIGRvZXMgbm90IGV4aXN0OiBDaHJvbWl1bSBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcQ2hyb21pdW1cVXNlciBEYXRhXERlZmF1bHRDaGVja2luZzogTW96aWxsYSBGaXJlZm94IGF0IHBhdGg6IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1vemlsbGFcRmlyZWZveFxQcm9maWxlc1xMb2NhbCBTdG9yYWdlXGxldmVsZGJQYXRoIGRvZXMgbm90IGV4aXN0OiBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xNb3ppbGxhXEZpcmVmb3hcUHJvZmlsZXNcTG9jYWwgU3RvcmFnZVxsZXZlbGRiUGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogV2F0ZXJmb3ggYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXFJvYW1pbmdcV2F0ZXJmb3hcUHJvZmlsZXNQbGF0Zm9ybSBwYXRoIGRvZXMgbm90IGV4aXN0OiBUb3IgQnJvd3NlciBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xUb3IgQnJvd3NlclxCcm93c2VyXFRvckJyb3dzZXJcRGF0YVxCcm93c2VyXHByb2ZpbGUuZGVmYXVsdFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IEVwaWMgUHJpdmFjeSBCcm93c2VyIGF0IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxMb2NhbFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGFcRGVmYXVsdFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IENvbW9kbyBEcmFnb24gYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXENvbW9kb1xEcmFnb25cVXNlciBEYXRhXERlZmF1bHRQbGF0Zm9ybSBwYXRoIGRvZXMgbm90IGV4aXN0OiBTbGltamV0IGF0IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxMb2NhbFxTbGltamV0XFVzZXIgRGF0YVxEZWZhdWx0UGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogQ29jIENvYyBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhXERlZmF1bHRQbGF0Zm9ybSBwYXRoIGRvZXMgbm90IGV4aXN0OiBNYXh0aG9uIGF0IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1heHRob241XFVzZXJzXGd1ZXN0UGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogMzYwIEJyb3dzZXIgYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGFcRGVmYXVsdFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IFVSIEJyb3dzZXIgYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFVSIEJyb3dzZXJcVXNlciBEYXRhXERlZmF1bHRQbGF0Zm9ybSBwYXRoIGRvZXMgbm90IGV4aXN0OiBBdmFzdCBTZWN1cmUgQnJvd3NlciBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcQVZBU1QgU29mdHdhcmVcQnJvd3NlclxVc2VyIERhdGFcRGVmYXVsdFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IE9wZXJhIEdYIGF0IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE9wZXJhIFNvZnR3YXJlXE9wZXJhIEdYIFN0YWJsZVBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IEZhbGtvbiBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xGYWxrb25Ub3RhbCB0b2tlbnMgZm91bmQgYWNyb3NzIGFsbCBwbGF0Zm9ybXM6IDBQcm9jZXNzaW5nIEZpcmVmb3ggcHJvZmlsZXMgYXQ6IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1vemlsbGFcRmlyZWZveFxQcm9maWxlc0ZvdW5kIEZpcmVmb3ggcHJvZmlsZTogQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXFJvYW1pbmdcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzXHl3enU3ODcwLmRlZmF1bHRDaGVja2luZzogRmlyZWZveCBQcm9maWxlIGF0IHBhdGg6IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1vemlsbGFcRmlyZWZveFxQcm9maWxlc1x5d3p1Nzg3MC5kZWZhdWx0XExvY2FsIFN0b3JhZ2VcbGV2ZWxkYlBhdGggZG9lcyBub3QgZXhpc3Q6IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1vemlsbGFcRmlyZWZveFxQcm9maWxlc1x5d3p1Nzg3MC5kZWZhdWx0XExvY2FsIFN0b3JhZ2VcbGV2ZWxkYldyaXRpbmcgdG9rZW5zIHRvOiAiQzpcXFVzZXJzXFw5WlVHVTJ1XFxBcHBEYXRhXFxMb2NhbFxcVGVtcFxccnVudGltZVxcYnJvd3NlclxcdG9rZW5zLnR4dCJObyB0b2tlbnMgZm91bmQgdG8gd3JpdGU=89:T25a0,U1FMaXRlIGZvcm1hdCAzbGFzdF9jb21wYXRpYmxlX3ZlcnNpb24xNnZlcnNpb242OW1tYXBfc3RhdHVzLTFsYXN0X2NvbXBhdGlibGVfdmVyc2lvbnZlcnNpb24jbW1hcF9zdGF0dXNlaW5kZXhzZWluZGV4c3FsaXRlX2F1dG9pbmRleF9kb3dubG9hZHNfc2xpY2VzXzFkb3dubG9hZHNfc2xpY2VzdGFibGVkb3dubG9hZHNfc2xpY2VzZG93bmxvYWRzX3NsaWNlc0NSRUFURSBUQUJMRSBkb3dubG9hZHNfc2xpY2VzIChkb3dubG9hZF9pZCBJTlRFR0VSIE5PVCBOVUxMLG9mZnNldCBJTlRFR0VSIE5PVCBOVUxMLHJlY2VpdmVkX2J5dGVzIElOVEVHRVIgTk9UIE5VTEwsZmluaXNoZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsUFJJTUFSWSBLRVkgKGRvd25sb2FkX2lkLCBvZmZzZXQpIClHaW5kZXhzcWxpdGVfYXV0b2luZGV4X2Rvd25sb2Fkc191cmxfY2hhaW5zXzFkb3dubG9hZHNfdXJsX2NoYWlucyd0YWJsZWRvd25sb2Fkc191cmxfY2hhaW5zZG93bmxvYWRzX3VybF9jaGFpbnNDUkVBVEUgVEFCTEUgZG93bmxvYWRzX3VybF9jaGFpbnMgKGlkIElOVEVHRVIgTk9UIE5VTEwsY2hhaW5faW5kZXggSU5URUdFUiBOT1QgTlVMTCx1cmwgTE9OR1ZBUkNIQVIgTk9UIE5VTEwsIFBSSU1BUlkgS0VZIChpZCwgY2hhaW5faW5kZXgpICl0YWJsZWRvd25sb2Fkc2Rvd25sb2Fkc0NSRUFURSBUQUJMRSBkb3dubG9hZHMgKGlkIElOVEVHRVIgUFJJTUFSWSBLRVksZ3VpZCBWQVJDSEFSIE5PVCBOVUxMLGN1cnJlbnRfcGF0aCBMT05HVkFSQ0hBUiBOT1QgTlVMTCx0YXJnZXRfcGF0aCBMT05HVkFSQ0hBUiBOT1QgTlVMTCxzdGFydF90aW1lIElOVEVHRVIgTk9UIE5VTEwscmVjZWl2ZWRfYnl0ZXMgSU5URUdFUiBOT1QgTlVMTCx0b3RhbF9ieXRlcyBJTlRFR0VSIE5PVCBOVUxMLHN0YXRlIElOVEVHRVIgTk9UIE5VTEwsZGFuZ2VyX3R5cGUgSU5URUdFUiBOT1QgTlVMTCxpbnRlcnJ1cHRfcmVhc29uIElOVEVHRVIgTk9UIE5VTEwsaGFzaCBCTE9CIE5PVCBOVUxMLGVuZF90aW1lIElOVEVHRVIgTk9UIE5VTEwsb3BlbmVkIElOVEVHRVIgTk9UIE5VTEwsbGFzdF9hY2Nlc3NfdGltZSBJTlRFR0VSIE5PVCBOVUxMLHRyYW5zaWVudCBJTlRFR0VSIE5PVCBOVUxMLHJlZmVycmVyIFZBUkNIQVIgTk9UIE5VTEwsc2l0ZV91cmwgVkFSQ0hBUiBOT1QgTlVMTCxlbWJlZGRlcl9kb3dubG9hZF9kYXRhIFZBUkNIQVIgTk9UIE5VTEwsdGFiX3VybCBWQVJDSEFSIE5PVCBOVUxMLHRhYl9yZWZlcnJlcl91cmwgVkFSQ0hBUiBOT1QgTlVMTCxodHRwX21ldGhvZCBWQVJDSEFSIE5PVCBOVUxMLGJ5X2V4dF9pZCBWQVJDSEFSIE5PVCBOVUxMLGJ5X2V4dF9uYW1lIFZBUkNIQVIgTk9UIE5VTEwsYnlfd2ViX2FwcF9pZCBWQVJDSEFSIE5PVCBOVUxMLGV0YWcgVkFSQ0hBUiBOT1QgTlVMTCxsYXN0X21vZGlmaWVkIFZBUkNIQVIgTk9UIE5VTEwsbWltZV90eXBlIFZBUkNIQVIoMjU1KSBOT1QgTlVMTCxvcmlnaW5hbF9taW1lX3R5cGUgVkFSQ0hBUigyNTUpIE5PVCBOVUxMKWluZGV4a2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgza2V5d29yZF9zZWFyY2hfdGVybXNDUkVBVEUgSU5ERVgga2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgzIE9OIGtleXdvcmRfc2VhcmNoX3Rlcm1zICh0ZXJtKWluZGV4a2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgya2V5d29yZF9zZWFyY2hfdGVybXNDUkVBVEUgSU5ERVgga2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgyIE9OIGtleXdvcmRfc2VhcmNoX3Rlcm1zICh1cmxfaWQpSWluZGV4a2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgxa2V5d29yZF9zZWFyY2hfdGVybXNDUkVBVEUgSU5ERVgga2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgxIE9OIGtleXdvcmRfc2VhcmNoX3Rlcm1zIChrZXl3b3JkX2lkLCBub3JtYWxpemVkX3Rlcm0pOXRhYmxla2V5d29yZF9zZWFyY2hfdGVybXNrZXl3b3JkX3NlYXJjaF90ZXJtc0NSRUFURSBUQUJMRSBrZXl3b3JkX3NlYXJjaF90ZXJtcyAoa2V5d29yZF9pZCBJTlRFR0VSIE5PVCBOVUxMLHVybF9pZCBJTlRFR0VSIE5PVCBOVUxMLHRlcm0gTE9OR1ZBUkNIQVIgTk9UIE5VTEwsbm9ybWFsaXplZF90ZXJtIExPTkdWQVJDSEFSIE5PVCBOVUxMKXRpbmRleHZpc2l0c19vcmlnaW5hdG9yX2lkX2luZGV4dmlzaXRzQ1JFQVRFIElOREVYIHZpc2l0c19vcmlnaW5hdG9yX2lkX2luZGV4IE9OIHZpc2l0cyAob3JpZ2luYXRvcl92aXNpdF9pZClYd2luZGV4dmlzaXRzX3RpbWVfaW5kZXh2aXNpdHNDUkVBVEUgSU5ERVggdmlzaXRzX3RpbWVfaW5kZXggT04gdmlzaXRzICh2aXNpdF90aW1lKVh3aW5kZXh2aXNpdHNfZnJvbV9pbmRleHZpc2l0c0NSRUFURSBJTkRFWCB2aXNpdHNfZnJvbV9pbmRleCBPTiB2aXNpdHMgKGZyb21fdmlzaXQpT2dpbmRleHZpc2l0c191cmxfaW5kZXh2aXNpdHNDUkVBVEUgSU5ERVggdmlzaXRzX3VybF9pbmRleCBPTiB2aXNpdHMgKHVybCludGFibGV2aXNpdF9zb3VyY2V2aXNpdF9zb3VyY2VDUkVBVEUgVEFCTEUgdmlzaXRfc291cmNlKGlkIElOVEVHRVIgUFJJTUFSWSBLRVksc291cmNlIElOVEVHRVIgTk9UIE5VTEwpXXRhYmxldmlzaXRzdmlzaXRzQ1JFQVRFIFRBQkxFIHZpc2l0cyhpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsdXJsIElOVEVHRVIgTk9UIE5VTEwsdmlzaXRfdGltZSBJTlRFR0VSIE5PVCBOVUxMLGZyb21fdmlzaXQgSU5URUdFUixleHRlcm5hbF9yZWZlcnJlcl91cmwgVEVYVCx0cmFuc2l0aW9uIElOVEVHRVIgREVGQVVMVCAwIE5PVCBOVUxMLHNlZ21lbnRfaWQgSU5URUdFUix2aXNpdF9kdXJhdGlvbiBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCxpbmNyZW1lbnRlZF9vbW5pYm94X3R5cGVkX3Njb3JlIEJPT0xFQU4gREVGQVVMVCBGQUxTRSBOT1QgTlVMTCxvcGVuZXJfdmlzaXQgSU5URUdFUixvcmlnaW5hdG9yX2NhY2hlX2d1aWQgVEVYVCxvcmlnaW5hdG9yX3Zpc2l0X2lkIElOVEVHRVIsb3JpZ2luYXRvcl9mcm9tX3Zpc2l0IElOVEVHRVIsb3JpZ2luYXRvcl9vcGVuZXJfdmlzaXQgSU5URUdFUixpc19rbm93bl90b19zeW5jIEJPT0xFQU4gREVGQVVMVCBGQUxTRSBOT1QgTlVMTCxjb25zaWRlcl9mb3JfbnRwX21vc3RfdmlzaXRlZCBCT09MRUFOIERFRkFVTFQgRkFMU0UgTk9UIE5VTEwsdmlzaXRlZF9saW5rX2lkIElOVEVHRVIgREVGQVVMVCAwIE5PVCBOVUxMLGFwcF9pZCBURVhUKVBZdGFibGVzcWxpdGVfc2VxdWVuY2VzcWxpdGVfc2VxdWVuY2VDUkVBVEUgVEFCTEUgc3FsaXRlX3NlcXVlbmNlKG5hbWUsc2VxKWF0YWJsZXVybHN1cmxzQ1JFQVRFIFRBQkxFIHVybHMoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULHVybCBMT05HVkFSQ0hBUix0aXRsZSBMT05HVkFSQ0hBUix2aXNpdF9jb3VudCBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCx0eXBlZF9jb3VudCBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCxsYXN0X3Zpc2l0X3RpbWUgSU5URUdFUiBOT1QgTlVMTCxoaWRkZW4gSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwpZi90YWJsZW1ldGFtZXRhQ1JFQVRFIFRBQkxFIG1ldGEoa2V5IExPTkdWQVJDSEFSIE5PVCBOVUxMIFVOSVFVRSBQUklNQVJZIEtFWSwgdmFsdWUgTE9OR1ZBUkNIQVIpJ2luZGV4c3FsaXRlX2F1dG9pbmRleF9tZXRhXzFtZXRhaXRhYmxlY2x1c3RlcnNfYW5kX3Zpc2l0c2NsdXN0ZXJzX2FuZF92aXNpdHMgQ1JFQVRFIFRBQkxFIGNsdXN0ZXJzX2FuZF92aXNpdHMoY2x1c3Rlcl9pZCBJTlRFR0VSIE5PVCBOVUxMLHZpc2l0X2lkIElOVEVHRVIgTk9UIE5VTEwsc2NvcmUgTlVNRVJJQyBERUZBVUxUIDAgTk9UIE5VTEwsZW5nYWdlbWVudF9zY29yZSBOVU1FUklDIERFRkFVTFQgMCBOT1QgTlVMTCx1cmxfZm9yX2RlZHVwaW5nIExPTkdWQVJDSEFSIE5PVCBOVUxMLG5vcm1hbGl6ZWRfdXJsIExPTkdWQVJDSEFSIE5PVCBOVUxMLHVybF9mb3JfZGlzcGxheSBMT05HVkFSQ0hBUiBOT1QgTlVMTCxpbnRlcmFjdGlvbl9zdGF0ZSBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCxQUklNQVJZIEtFWShjbHVzdGVyX2lkLHZpc2l0X2lkKSlXSVRIT1VUIFJPV0lET3RhYmxlY2x1c3RlcnNjbHVzdGVyc0NSRUFURSBUQUJMRSBjbHVzdGVycyhjbHVzdGVyX2lkIElOVEVHRVIgUFJJTUFSWSBLRVkgQVVUT0lOQ1JFTUVOVCxzaG91bGRfc2hvd19vbl9wcm9taW5lbnRfdWlfc3VyZmFjZXMgQk9PTEVBTiBOT1QgTlVMTCxsYWJlbCBWQVJDSEFSIE5PVCBOVUxMLHJhd19sYWJlbCBWQVJDSEFSIE5PVCBOVUxMLHRyaWdnZXJhYmlsaXR5X2NhbGN1bGF0ZWQgQk9PTEVBTiBOT1QgTlVMTCxvcmlnaW5hdG9yX2NhY2hlX2d1aWQgVEVYVCBOT1QgTlVMTCxvcmlnaW5hdG9yX2NsdXN0ZXJfaWQgSU5URUdFUiBOT1QgTlVMTCk5dGFibGVjb250ZXh0X2Fubm90YXRpb25zY29udGV4dF9hbm5vdGF0aW9uc0NSRUFURSBUQUJMRSBjb250ZXh0X2Fubm90YXRpb25zKHZpc2l0X2lkIElOVEVHRVIgUFJJTUFSWSBLRVksY29udGV4dF9hbm5vdGF0aW9uX2ZsYWdzIElOVEVHRVIgTk9UIE5VTEwsZHVyYXRpb25fc2luY2VfbGFzdF92aXNpdCBJTlRFR0VSLHBhZ2VfZW5kX3JlYXNvbiBJTlRFR0VSLHRvdGFsX2ZvcmVncm91bmRfZHVyYXRpb24gSU5URUdFUixicm93c2VyX3R5cGUgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwsd2luZG93X2lkIElOVEVHRVIgREVGQVVMVCAtMSBOT1QgTlVMTCx0YWJfaWQgSU5URUdFUiBERUZBVUxUIC0xIE5PVCBOVUxMLHRhc2tfaWQgSU5URUdFUiBERUZBVUxUIC0xIE5PVCBOVUxMLHJvb3RfdGFza19pZCBJTlRFR0VSIERFRkFVTFQgLTEgTk9UIE5VTEwscGFyZW50X3Rhc2tfaWQgSU5URUdFUiBERUZBVUxUIC0xIE5PVCBOVUxMLHJlc3BvbnNlX2NvZGUgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwpY3RhYmxlY29udGVudF9hbm5vdGF0aW9uc2NvbnRlbnRfYW5ub3RhdGlvbnNDUkVBVEUgVEFCTEUgY29udGVudF9hbm5vdGF0aW9ucyh2aXNpdF9pZCBJTlRFR0VSIFBSSU1BUlkgS0VZLHZpc2liaWxpdHlfc2NvcmUgTlVNRVJJQyxmbG9jX3Byb3RlY3RlZF9zY29yZSBOVU1FUklDLGNhdGVnb3JpZXMgVkFSQ0hBUixwYWdlX3RvcGljc19tb2RlbF92ZXJzaW9uIElOVEVHRVIsYW5ub3RhdGlvbl9mbGFncyBJTlRFR0VSIE5PVCBOVUxMLGVudGl0aWVzIFZBUkNIQVIscmVsYXRlZF9zZWFyY2hlcyBWQVJDSEFSLHNlYXJjaF9ub3JtYWxpemVkX3VybCBWQVJDSEFSLHNlYXJjaF90ZXJtcyBMT05HVkFSQ0hBUixhbHRlcm5hdGl2ZV90aXRsZSBWQVJDSEFSLHBhZ2VfbGFuZ3VhZ2UgVkFSQ0hBUixwYXNzd29yZF9zdGF0ZSBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCxoYXNfdXJsX2tleWVkX2ltYWdlIEJPT0xFQU4gTk9UIE5VTEwpbmluZGV4c2VnbWVudHNfdXNhZ2Vfc2VnX2lkc2VnbWVudF91c2FnZUNSRUFURSBJTkRFWCBzZWdtZW50c191c2FnZV9zZWdfaWQgT04gc2VnbWVudF91c2FnZShzZWdtZW50X2lkKTtpbmRleHNlZ21lbnRfdXNhZ2VfdGltZV9zbG90X3NlZ21lbnRfaWRzZWdtZW50X3VzYWdlQ1JFQVRFIElOREVYIHNlZ21lbnRfdXNhZ2VfdGltZV9zbG90X3NlZ21lbnRfaWQgT04gc2VnbWVudF91c2FnZSh0aW1lX3Nsb3QsIHNlZ21lbnRfaWQpL3RhYmxlc2VnbWVudF91c2FnZXNlZ21lbnRfdXNhZ2VDUkVBVEUgVEFCTEUgc2VnbWVudF91c2FnZSAoaWQgSU5URUdFUiBQUklNQVJZIEtFWSxzZWdtZW50X2lkIElOVEVHRVIgTk9UIE5VTEwsdGltZV9zbG90IElOVEVHRVIgTk9UIE5VTEwsdmlzaXRfY291bnQgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwpU21pbmRleHNlZ21lbnRzX3VybF9pZHNlZ21lbnRzQ1JFQVRFIElOREVYIHNlZ21lbnRzX3VybF9pZCBPTiBzZWdtZW50cyh1cmxfaWQpTWVpbmRleHNlZ21lbnRzX25hbWVzZWdtZW50c0NSRUFURSBJTkRFWCBzZWdtZW50c19uYW1lIE9OIHNlZ21lbnRzKG5hbWUpcDN0YWJsZXNlZ21lbnRzc2VnbWVudHNDUkVBVEUgVEFCTEUgc2VnbWVudHMgKGlkIElOVEVHRVIgUFJJTUFSWSBLRVksbmFtZSBWQVJDSEFSLHVybF9pZCBJTlRFR0VSIE5PTiBOVUxMKV9pbmRleHVybHNfdXJsX2luZGV4dXJscyhDUkVBVEUgSU5ERVggdXJsc191cmxfaW5kZXggT04gdXJscyAodXJsKT90YWJsZWhpc3Rvcnlfc3luY19tZXRhZGF0YWhpc3Rvcnlfc3luY19tZXRhZGF0YSdDUkVBVEUgVEFCTEUgaGlzdG9yeV9zeW5jX21ldGFkYXRhIChzdG9yYWdlX2tleSBJTlRFR0VSIFBSSU1BUlkgS0VZIE5PVCBOVUxMLCB2YWx1ZSBCTE9CKT9pbmRleHZpc2l0ZWRfbGlua3NfaW5kZXh2aXNpdGVkX2xpbmtzJkNSRUFURSBJTkRFWCB2aXNpdGVkX2xpbmtzX2luZGV4IE9OIHZpc2l0ZWRfbGlua3MgKGxpbmtfdXJsX2lkLCB0b3BfbGV2ZWxfdXJsLCBmcmFtZV91cmwpdGFibGV2aXNpdGVkX2xpbmtzdmlzaXRlZF9saW5rcyVDUkVBVEUgVEFCTEUgdmlzaXRlZF9saW5rcyhpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsbGlua191cmxfaWQgSU5URUdFUiBOT1QgTlVMTCx0b3BfbGV2ZWxfdXJsIExPTkdWQVJDSEFSIE5PVCBOVUxMLGZyYW1lX3VybCBMT05HVkFSQ0hBUiBOT1QgTlVMTCx2aXNpdF9jb3VudCBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTClBdGFibGVjbHVzdGVyX3Zpc2l0X2R1cGxpY2F0ZXNjbHVzdGVyX3Zpc2l0X2R1cGxpY2F0ZXMkQ1JFQVRFIFRBQkxFIGNsdXN0ZXJfdmlzaXRfZHVwbGljYXRlcyh2aXNpdF9pZCBJTlRFR0VSIE5PVCBOVUxMLGR1cGxpY2F0ZV92aXNpdF9pZCBJTlRFR0VSIE5PVCBOVUxMLFBSSU1BUlkgS0VZKHZpc2l0X2lkLGR1cGxpY2F0ZV92aXNpdF9pZCkpV0lUSE9VVCBST1dJRClpbmRleGNsdXN0ZXJfa2V5d29yZHNfY2x1c3Rlcl9pZF9pbmRleGNsdXN0ZXJfa2V5d29yZHMjQ1JFQVRFIElOREVYIGNsdXN0ZXJfa2V5d29yZHNfY2x1c3Rlcl9pZF9pbmRleCBPTiBjbHVzdGVyX2tleXdvcmRzKGNsdXN0ZXJfaWQpR3RhYmxlY2x1c3Rlcl9rZXl3b3Jkc2NsdXN0ZXJfa2V5d29yZHMiQ1JFQVRFIFRBQkxFIGNsdXN0ZXJfa2V5d29yZHMoY2x1c3Rlcl9pZCBJTlRFR0VSIE5PVCBOVUxMLGtleXdvcmQgVkFSQ0hBUiBOT1QgTlVMTCx0eXBlIElOVEVHRVIgTk9UIE5VTEwsc2NvcmUgTlVNRVJJQyBOT1QgTlVMTCxjb2xsZWN0aW9ucyBWQVJDSEFSIE5PVCBOVUxMKXJpbmRleGNsdXN0ZXJzX2Zvcl92aXNpdGNsdXN0ZXJzX2FuZF92aXNpdHMhQ1JFQVRFIElOREVYIGNsdXN0ZXJzX2Zvcl92aXNpdCBPTiBjbHVzdGVyc19hbmRfdmlzaXRzKHZpc2l0X2lkKQ==8a:Tfd0,U1FMaXRlIGZvcm1hdCAzbGFzdF9jb21wYXRpYmxlX3ZlcnNpb240MHZlcnNpb240MW1tYXBfc3RhdHVzLTFsYXN0X2NvbXBhdGlibGVfdmVyc2lvbnZlcnNpb24jbW1hcF9zdGF0dXN0YWJsZWxvZ2luc2xvZ2luc0NSRUFURSBUQUJMRSBsb2dpbnMgKG9yaWdpbl91cmwgVkFSQ0hBUiBOT1QgTlVMTCwgYWN0aW9uX3VybCBWQVJDSEFSLCB1c2VybmFtZV9lbGVtZW50IFZBUkNIQVIsIHVzZXJuYW1lX3ZhbHVlIFZBUkNIQVIsIHBhc3N3b3JkX2VsZW1lbnQgVkFSQ0hBUiwgcGFzc3dvcmRfdmFsdWUgQkxPQiwgc3VibWl0X2VsZW1lbnQgVkFSQ0hBUiwgc2lnbm9uX3JlYWxtIFZBUkNIQVIgTk9UIE5VTEwsIGRhdGVfY3JlYXRlZCBJTlRFR0VSIE5PVCBOVUxMLCBibGFja2xpc3RlZF9ieV91c2VyIElOVEVHRVIgTk9UIE5VTEwsIHNjaGVtZSBJTlRFR0VSIE5PVCBOVUxMLCBwYXNzd29yZF90eXBlIElOVEVHRVIsIHRpbWVzX3VzZWQgSU5URUdFUiwgZm9ybV9kYXRhIEJMT0IsIGRpc3BsYXlfbmFtZSBWQVJDSEFSLCBpY29uX3VybCBWQVJDSEFSLCBmZWRlcmF0aW9uX3VybCBWQVJDSEFSLCBza2lwX3plcm9fY2xpY2sgSU5URUdFUiwgZ2VuZXJhdGlvbl91cGxvYWRfc3RhdHVzIElOVEVHRVIsIHBvc3NpYmxlX3VzZXJuYW1lX3BhaXJzIEJMT0IsIGlkIElOVEVHRVIgUFJJTUFSWSBLRVkgQVVUT0lOQ1JFTUVOVCwgZGF0ZV9sYXN0X3VzZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIG1vdmluZ19ibG9ja2VkX2ZvciBCTE9CLCBkYXRlX3Bhc3N3b3JkX21vZGlmaWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBzZW5kZXJfZW1haWwgVkFSQ0hBUiwgc2VuZGVyX25hbWUgVkFSQ0hBUiwgZGF0ZV9yZWNlaXZlZCBJTlRFR0VSLCBzaGFyaW5nX25vdGlmaWNhdGlvbl9kaXNwbGF5ZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIGtleWNoYWluX2lkZW50aWZpZXIgQkxPQiwgc2VuZGVyX3Byb2ZpbGVfaW1hZ2VfdXJsIFZBUkNIQVIsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpL3RhYmxlbWV0YW1ldGFDUkVBVEUgVEFCTEUgbWV0YShrZXkgTE9OR1ZBUkNIQVIgTk9UIE5VTEwgVU5JUVVFIFBSSU1BUlkgS0VZLCB2YWx1ZSBMT05HVkFSQ0hBUiknaW5kZXhzcWxpdGVfYXV0b2luZGV4X21ldGFfMW1ldGFvaW5kZXhzdGF0c19vcmlnaW5zdGF0c0NSRUFURSBJTkRFWCBzdGF0c19vcmlnaW4gT04gc3RhdHMob3JpZ2luX2RvbWFpbilfdGFibGVzdGF0c3N0YXRzQ1JFQVRFIFRBQkxFIHN0YXRzIChvcmlnaW5fZG9tYWluIFZBUkNIQVIgTk9UIE5VTEwsIHVzZXJuYW1lX3ZhbHVlIFZBUkNIQVIsIGRpc21pc3NhbF9jb3VudCBJTlRFR0VSLCB1cGRhdGVfdGltZSBJTlRFR0VSIE5PVCBOVUxMLCBVTklRVUUob3JpZ2luX2RvbWFpbiwgdXNlcm5hbWVfdmFsdWUpKSlpbmRleHNxbGl0ZV9hdXRvaW5kZXhfc3RhdHNfMXN0YXRzaW5kZXhmb3JlaWduX2tleV9pbmRleF9ub3Rlc3Bhc3N3b3JkX25vdGVzQ1JFQVRFIElOREVYIGZvcmVpZ25fa2V5X2luZGV4X25vdGVzIE9OIHBhc3N3b3JkX25vdGVzIChwYXJlbnRfaWQpUXRhYmxlcGFzc3dvcmRfbm90ZXNwYXNzd29yZF9ub3Rlc0NSRUFURSBUQUJMRSBwYXNzd29yZF9ub3RlcyAoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULCBwYXJlbnRfaWQgSU5URUdFUiBOT1QgTlVMTCBSRUZFUkVOQ0VTIGxvZ2lucyBPTiBVUERBVEUgQ0FTQ0FERSBPTiBERUxFVEUgQ0FTQ0FERSBERUZFUlJBQkxFIElOSVRJQUxMWSBERUZFUlJFRCwga2V5IFZBUkNIQVIgTk9UIE5VTEwsIHZhbHVlIEJMT0IsIGRhdGVfY3JlYXRlZCBJTlRFR0VSIE5PVCBOVUxMLCBjb25maWRlbnRpYWwgSU5URUdFUiwgVU5JUVVFIChwYXJlbnRfaWQsIGtleSkpO2luZGV4c3FsaXRlX2F1dG9pbmRleF9wYXNzd29yZF9ub3Rlc18xcGFzc3dvcmRfbm90ZXNpbmRleGZvcmVpZ25fa2V5X2luZGV4aW5zZWN1cmVfY3JlZGVudGlhbHNDUkVBVEUgSU5ERVggZm9yZWlnbl9rZXlfaW5kZXggT04gaW5zZWN1cmVfY3JlZGVudGlhbHMgKHBhcmVudF9pZClHaW5kZXhzcWxpdGVfYXV0b2luZGV4X2luc2VjdXJlX2NyZWRlbnRpYWxzXzFpbnNlY3VyZV9jcmVkZW50aWFscy90YWJsZWluc2VjdXJlX2NyZWRlbnRpYWxzaW5zZWN1cmVfY3JlZGVudGlhbHNDUkVBVEUgVEFCTEUgaW5zZWN1cmVfY3JlZGVudGlhbHMgKHBhcmVudF9pZCBJTlRFR0VSIFJFRkVSRU5DRVMgbG9naW5zIE9OIFVQREFURSBDQVNDQURFIE9OIERFTEVURSBDQVNDQURFIERFRkVSUkFCTEUgSU5JVElBTExZIERFRkVSUkVELCBpbnNlY3VyaXR5X3R5cGUgSU5URUdFUiBOT1QgTlVMTCwgY3JlYXRlX3RpbWUgSU5URUdFUiBOT1QgTlVMTCwgaXNfbXV0ZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHRyaWdnZXJfbm90aWZpY2F0aW9uX2Zyb21fYmFja2VuZCBJTlRFR0VSIE5PVCBOVUxMIERFRkFVTFQgMCwgVU5JUVVFIChwYXJlbnRfaWQsIGluc2VjdXJpdHlfdHlwZSkpXXRhYmxlc3luY19tb2RlbF9tZXRhZGF0YXN5bmNfbW9kZWxfbWV0YWRhdGFDUkVBVEUgVEFCTEUgc3luY19tb2RlbF9tZXRhZGF0YSAoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULCBtb2RlbF9tZXRhZGF0YSBWQVJDSEFSIE5PVCBOVUxMKWl0YWJsZXN5bmNfZW50aXRpZXNfbWV0YWRhdGFzeW5jX2VudGl0aWVzX21ldGFkYXRhQ1JFQVRFIFRBQkxFIHN5bmNfZW50aXRpZXNfbWV0YWRhdGEgKHN0b3JhZ2Vfa2V5IElOVEVHRVIgUFJJTUFSWSBLRVkgQVVUT0lOQ1JFTUVOVCwgbWV0YWRhdGEgVkFSQ0hBUiBOT1QgTlVMTClSc2luZGV4bG9naW5zX3NpZ25vbmxvZ2luc0NSRUFURSBJTkRFWCBsb2dpbnNfc2lnbm9uIE9OIGxvZ2lucyAoc2lnbm9uX3JlYWxtKVBZdGFibGVzcWxpdGVfc2VxdWVuY2VzcWxpdGVfc2VxdWVuY2VDUkVBVEUgVEFCTEUgc3FsaXRlX3NlcXVlbmNlKG5hbWUsc2VxKStpbmRleHNxbGl0ZV9hdXRvaW5kZXhfbG9naW5zXzFsb2dpbnM=8b:T1494,U1FMaXRlIGZvcm1hdCAzbG9naW5zX2VkZ2VfZXh0ZW5kZWRfdGFibGVfdmVyc2lvbjJlZGdlX2JyZWFjaGVkX3RhYmxlX3ZlcnNpb24zbGFzdF9jb21wYXRpYmxlX3ZlcnNpb24zM3ZlcnNpb24zM21tYXBfc3RhdHVzLTFsb2dpbnNfZWRnZV9leHRlbmRlZF90YWJsZV92ZXJzaW9uZWRnZV9icmVhY2hlZF90YWJsZV92ZXJzaW9ubGFzdF9jb21wYXRpYmxlX3ZlcnNpb252ZXJzaW9uI21tYXBfc3RhdHVzaW5kZXhmb3JlaWduX2tleV9pbmRleGluc2VjdXJlX2NyZWRlbnRpYWxzQ1JFQVRFIElOREVYIGZvcmVpZ25fa2V5X2luZGV4IE9OIGluc2VjdXJlX2NyZWRlbnRpYWxzIChwYXJlbnRfaWQpR2luZGV4c3FsaXRlX2F1dG9pbmRleF9pbnNlY3VyZV9jcmVkZW50aWFsc18xaW5zZWN1cmVfY3JlZGVudGlhbHMzdGFibGVpbnNlY3VyZV9jcmVkZW50aWFsc2luc2VjdXJlX2NyZWRlbnRpYWxzQ1JFQVRFIFRBQkxFIGluc2VjdXJlX2NyZWRlbnRpYWxzIChwYXJlbnRfaWQgSU5URUdFUiBSRUZFUkVOQ0VTIGxvZ2lucyBPTiBVUERBVEUgQ0FTQ0FERSBPTiBERUxFVEUgQ0FTQ0FERSBERUZFUlJBQkxFIElOSVRJQUxMWSBERUZFUlJFRCwgaW5zZWN1cml0eV90eXBlIElOVEVHRVIgTk9UIE5VTEwsIGNyZWF0ZV90aW1lIElOVEVHRVIgTk9UIE5VTEwsIGlzX211dGVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBVTklRVUUgKHBhcmVudF9pZCwgaW5zZWN1cml0eV90eXBlKSlddGFibGVzeW5jX21vZGVsX21ldGFkYXRhc3luY19tb2RlbF9tZXRhZGF0YUNSRUFURSBUQUJMRSBzeW5jX21vZGVsX21ldGFkYXRhIChpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsIG1vZGVsX21ldGFkYXRhIFZBUkNIQVIgTk9UIE5VTEwpaXRhYmxlc3luY19lbnRpdGllc19tZXRhZGF0YXN5bmNfZW50aXRpZXNfbWV0YWRhdGFDUkVBVEUgVEFCTEUgc3luY19lbnRpdGllc19tZXRhZGF0YSAoc3RvcmFnZV9rZXkgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULCBtZXRhZGF0YSBWQVJDSEFSIE5PVCBOVUxMKVJzaW5kZXhsb2dpbnNfc2lnbm9ubG9naW5zQ1JFQVRFIElOREVYIGxvZ2luc19zaWdub24gT04gbG9naW5zIChzaWdub25fcmVhbG0pUFl0YWJsZXNxbGl0ZV9zZXF1ZW5jZXNxbGl0ZV9zZXF1ZW5jZUNSRUFURSBUQUJMRSBzcWxpdGVfc2VxdWVuY2UobmFtZSxzZXEpdGFibGVsb2dpbnNsb2dpbnNDUkVBVEUgVEFCTEUgbG9naW5zIChvcmlnaW5fdXJsIFZBUkNIQVIgTk9UIE5VTEwsIGFjdGlvbl91cmwgVkFSQ0hBUiwgdXNlcm5hbWVfZWxlbWVudCBWQVJDSEFSLCB1c2VybmFtZV92YWx1ZSBWQVJDSEFSLCBwYXNzd29yZF9lbGVtZW50IFZBUkNIQVIsIHBhc3N3b3JkX3ZhbHVlIEJMT0IsIHN1Ym1pdF9lbGVtZW50IFZBUkNIQVIsIHNpZ25vbl9yZWFsbSBWQVJDSEFSIE5PVCBOVUxMLCBkYXRlX2NyZWF0ZWQgSU5URUdFUiBOT1QgTlVMTCwgYmxhY2tsaXN0ZWRfYnlfdXNlciBJTlRFR0VSIE5PVCBOVUxMLCBzY2hlbWUgSU5URUdFUiBOT1QgTlVMTCwgcGFzc3dvcmRfdHlwZSBJTlRFR0VSLCB0aW1lc191c2VkIElOVEVHRVIsIGZvcm1fZGF0YSBCTE9CLCBkaXNwbGF5X25hbWUgVkFSQ0hBUiwgaWNvbl91cmwgVkFSQ0hBUiwgZmVkZXJhdGlvbl91cmwgVkFSQ0hBUiwgc2tpcF96ZXJvX2NsaWNrIElOVEVHRVIsIGdlbmVyYXRpb25fdXBsb2FkX3N0YXR1cyBJTlRFR0VSLCBwb3NzaWJsZV91c2VybmFtZV9wYWlycyBCTE9CLCBpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsIGRhdGVfbGFzdF91c2VkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBtb3ZpbmdfYmxvY2tlZF9mb3IgQkxPQiwgZGF0ZV9wYXNzd29yZF9tb2RpZmllZCBJTlRFR0VSIE5PVCBOVUxMIERFRkFVTFQgMCwgVU5JUVVFIChvcmlnaW5fdXJsLCB1c2VybmFtZV9lbGVtZW50LCB1c2VybmFtZV92YWx1ZSwgcGFzc3dvcmRfZWxlbWVudCwgc2lnbm9uX3JlYWxtKSkraW5kZXhzcWxpdGVfYXV0b2luZGV4X2xvZ2luc18xbG9naW5zL3RhYmxlbWV0YW1ldGFDUkVBVEUgVEFCTEUgbWV0YShrZXkgTE9OR1ZBUkNIQVIgTk9UIE5VTEwgVU5JUVVFIFBSSU1BUlkgS0VZLCB2YWx1ZSBMT05HVkFSQ0hBUiknaW5kZXhzcWxpdGVfYXV0b2luZGV4X21ldGFfMW1ldGFRdGFibGVwYXNzd29yZF9ub3Rlc3Bhc3N3b3JkX25vdGVzQ1JFQVRFIFRBQkxFIHBhc3N3b3JkX25vdGVzIChpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsIHBhcmVudF9pZCBJTlRFR0VSIE5PVCBOVUxMIFJFRkVSRU5DRVMgbG9naW5zIE9OIFVQREFURSBDQVNDQURFIE9OIERFTEVURSBDQVNDQURFIERFRkVSUkFCTEUgSU5JVElBTExZIERFRkVSUkVELCBrZXkgVkFSQ0hBUiBOT1QgTlVMTCwgdmFsdWUgQkxPQiwgZGF0ZV9jcmVhdGVkIElOVEVHRVIgTk9UIE5VTEwsIGNvbmZpZGVudGlhbCBJTlRFR0VSLCBVTklRVUUgKHBhcmVudF9pZCwga2V5KSlOb2luZGV4c3RhdHNfb3JpZ2luc3RhdHNDUkVBVEUgSU5ERVggc3RhdHNfb3JpZ2luIE9OIHN0YXRzKG9yaWdpbl9kb21haW4pX3RhYmxlc3RhdHNzdGF0c0NSRUFURSBUQUJMRSBzdGF0cyAob3JpZ2luX2RvbWFpbiBWQVJDSEFSIE5PVCBOVUxMLCB1c2VybmFtZV92YWx1ZSBWQVJDSEFSLCBkaXNtaXNzYWxfY291bnQgSU5URUdFUiwgdXBkYXRlX3RpbWUgSU5URUdFUiBOT1QgTlVMTCwgVU5JUVVFKG9yaWdpbl9kb21haW4sIHVzZXJuYW1lX3ZhbHVlKSkpaW5kZXhzcWxpdGVfYXV0b2luZGV4X3N0YXRzXzFzdGF0cyd0YWJsZWxvZ2luc19lZGdlX2V4dGVuZGVkbG9naW5zX2VkZ2VfZXh0ZW5kZWRDUkVBVEUgVEFCTEUgbG9naW5zX2VkZ2VfZXh0ZW5kZWQgKGlkIElOVEVHRVIgUFJJTUFSWSBLRVkgQVVUT0lOQ1JFTUVOVCwgc291cmNlIFZBUkNIQVIgTk9UIG51bGwgREVGQVVMVCAwLCBzdHJlbmd0aF9hbGVydF9zdGF0dXMgSU5URUdFUiBOT1QgbnVsbCBERUZBVUxUIDAsIHBhc3N3b3JkX25pY2tuYW1lIFZBUkNIQVIgTk9UIG51bGwgREVGQVVMVCAnJyApZmluZGV4YnJlYWNoZWRfdGFibGVfaW5kZXhicmVhY2hlZENSRUFURSBJTkRFWCBicmVhY2hlZF90YWJsZV9pbmRleCBPTiBicmVhY2hlZCAodXJsLCB1c2VybmFtZSl0YWJsZWJyZWFjaGVkYnJlYWNoZWRDUkVBVEUgVEFCTEUgYnJlYWNoZWQgKHVybCBWQVJDSEFSIE5PVCBudWxsLCB1c2VybmFtZSBWQVJDSEFSIE5PVCBudWxsLCBzdGF0dXMgSU5URUdFUiBOT1QgbnVsbCwgYWxlcnRfc3RhdGUgSU5URUdFUiBOT1QgbnVsbCwgbGFzdF9jaGVja2VkX3RpbWUgSU5URUdFUiBOT1QgbnVsbCwgc2FuaXRpemVkX3VzZXJuYW1lIFZBUkNIQVIsIGFsZXJ0X3NlZW4gSU5URUdFUiwgbGFzdF9zZWVuX3RpbWUgSU5URUdFUiwgVU5JUVVFICh1cmwsIHVzZXJuYW1lKSkvaW5kZXhzcWxpdGVfYXV0b2luZGV4X2JyZWFjaGVkXzFicmVhY2hlZGluZGV4Zm9yZWlnbl9rZXlfaW5kZXhfbm90ZXNwYXNzd29yZF9ub3Rlc0NSRUFURSBJTkRFWCBmb3JlaWduX2tleV9pbmRleF9ub3RlcyBPTiBwYXNzd29yZF9ub3RlcyAocGFyZW50X2lkKTtpbmRleHNxbGl0ZV9hdXRvaW5kZXhfcGFzc3dvcmRfbm90ZXNfMXBhc3N3b3JkX25vdGVzJ2luZGV4ZmllbGRfaW5mb19pbmRleGZpZWxkX2luZm9DUkVBVEUgSU5ERVggZmllbGRfaW5mb19pbmRleCBPTiBmaWVsZF9pbmZvIChmb3JtX3NpZ25hdHVyZSwgZmllbGRfc2lnbmF0dXJlKXRhYmxlZmllbGRfaW5mb2ZpZWxkX2luZm9DUkVBVEUgVEFCTEUgZmllbGRfaW5mbyAoZm9ybV9zaWduYXR1cmUgSU5URUdFUiBOT1QgTlVMTCwgZmllbGRfc2lnbmF0dXJlIElOVEVHRVIgTk9UIE5VTEwsIGZpZWxkX3R5cGUgSU5URUdFUiBOT1QgTlVMTCwgY3JlYXRlX3RpbWUgSU5URUdFUiBOT1QgTlVMTCwgVU5JUVVFIChmb3JtX3NpZ25hdHVyZSwgZmllbGRfc2lnbmF0dXJlKSkzaW5kZXhzcWxpdGVfYXV0b2luZGV4X2ZpZWxkX2luZm9fMWZpZWxkX2luZm8=8c:T2d6c,QnJvd3NlciBIaXN0b3J5IEV4dHJhY3RlZD09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09QnJhdmUgSGlzdG9yeTotLS0tLUNocm9tZSBIaXN0b3J5Oi0tLS0tLUVkZ2UgSGlzdG9yeTotLS0tRWRnZSAtIDIwMjQtMDctMDMgMDg6MjI6NDAgLSBmaWxlOi8vL0M6L1VzZXJzL0hBUFVCV1MvRGVza3RvcC90ZXN0Lmh0bSAtIEVkZ2UgLSAyMDI0LTA0LTI0IDIwOjI0OjA3IC0gZmlsZTovLy9DOi9Vc2Vycy9IQVBVQldTL0Rvd25sb2Fkcy9OZXclMjBUZXh0JTIwRG9jdW1lbnQuaHRtbCAtIEVkZ2UgLSAyMDI0LTAzLTA4IDE2OjE0OjQzIC0gaHR0cHM6Ly93d3cubXNuLmNvbS9lbi1jYSAtIE1TTiBDYW5hZGEgfCBPdXRsb29rLCBPZmZpY2UsIFNreXBlLCBCaW5nLCBMYXRlc3QgTmV3cyBhbmQgVmlkZW9zRWRnZSAtIDIwMjQtMDMtMDggMTY6MTQ6MDMgLSBodHRwOi8vd3d3Lm1zbi5jb20vIC0gTVNOIENhbmFkYSB8IE91dGxvb2ssIE9mZmljZSwgU2t5cGUsIEJpbmcsIExhdGVzdCBOZXdzIGFuZCBWaWRlb3NFZGdlIC0gMjAyNC0wMy0wOCAxNjoxNDowMyAtIGh0dHBzOi8vd3d3Lm1zbi5jb20vIC0gTVNOIENhbmFkYSB8IE91dGxvb2ssIE9mZmljZSwgU2t5cGUsIEJpbmcsIExhdGVzdCBOZXdzIGFuZCBWaWRlb3NFZGdlIC0gMjAyNC0wMy0wOCAxNjowODoyOSAtIGh0dHBzOi8vd3d3Lmdvb2dsZS5jb20vY2hyb21lL25leHQtc3RlcHMuaHRtbD9icmFuZD1WREtCJnN0YXRjYj0wJmluc3RhbGxkYXRhaW5kZXg9ZW1wdHkmZGVmYXVsdGJyb3dzZXI9MCAtIEdvb2dsZSBDaHJvbWUgV2ViIEJyb3dzZXJFZGdlIC0gMjAyNC0wMy0wOCAxNjowODoxOSAtIGh0dHBzOi8vYWQuZG91YmxlY2xpY2submV0L3NlYXJjaGFkcy9saW5rL2NsaWNrP2xpZD00MzcwMDA1MjgwNjQ2MTIzNiZkc19zX2t3Z2lkPTU4NzAwMDA1Nzg0NjA4NTU1JmRzX2FfY2lkPTQwNTUyNTgwMCZkc19hX2NhaWQ9OTc2NDM4MzQyNCZkc19hX2FnaWQ9MTAwODIwMzQ0MjM4JmRzX2FfbGlkPWt3ZC0xMDQ3ODYyMzE4MyYmZHNfZV9hZGlkPTgwMTk1NzI5MjcwMjk0JmRzX2VfdGFyZ2V0X2lkPWt3ZC04MDE5NTgzNjM0MTcyODpsb2MtMzImJmRzX2VfbmV0d29yaz1vJmRzX3VybF92PTImZHNfZGVzdF91cmw9aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9jaHJvbWUvYnNlbS9kb3dubG9hZC9lbl9jYT9icmFuZD1WREtCJmRzX2tpZD00MzcwMDA1MjgwNjQ2MTIzNiZnY2xpZD1hNjk5YmQ0NTA4MDMxYTI0Mzg0YWQ4YWUzZmVjMzNiZSZnY2xzcmM9M3AuZHMmJnV0bV9zb3VyY2U9YmluZyZ1dG1fbWVkaXVtPWNwYyZ1dG1fY2FtcGFpZ249MTcwNzMzMiUyMCU3QyUyMENocm9tZSUyMFdpbjExJTIwJTdDJTIwRFIlMjAlN0MlMjBFU1MwMSUyMCU3QyUyME5BJTIwJTdDJTIwQ0ElMjAlN0MlMjBlbiUyMCU3QyUyMERlc2slMjAlN0MlMjBTRU0lMjAlN0MlMjBCS1dTJTIwLSUyMEVYQSUyMCU3QyUyMFR4dCUyMCU3QyUyMEJpbmdfVG9wJTIwS1dEUyZ1dG1fdGVybT1nb29nbGUlMjBjaHJvbWUmdXRtX2NvbnRlbnQ9RGVzayUyMCU3QyUyMEJLV1MlMjAtJTIwRVhBJTIwJTdDJTIwVHh0X0dvb2dsZSUyMENocm9tZSUyMFRvcCUyMEtXRFMgLSBHb29nbGUgQ2hyb21lIC0gRG93bmxvYWQgdGhlIEZhc3QsIFNlY3VyZSBCcm93c2VyIGZyb20gR29vZ2xlRWRnZSAtIDIwMjQtMDMtMDggMTY6MDg6MTkgLSBodHRwczovL3d3dy5nb29nbGUuY29tL2Nocm9tZS9ic2VtL2Rvd25sb2FkL2VuX2NhP2JyYW5kPVZES0ImZHNfa2lkPTQzNzAwMDUyODA2NDYxMjM2JiZ1dG1fc291cmNlPWJpbmcmdXRtX21lZGl1bT1jcGMmdXRtX2NhbXBhaWduPTE3MDczMzIlMjAlN0MlMjBDaHJvbWUlMjBXaW4xMSUyMCU3QyUyMERSJTIwJTdDJTIwRVNTMDElMjAlN0MlMjBOQSUyMCU3QyUyMENBJTIwJTdDJTIwZW4lMjAlN0MlMjBEZXNrJTIwJTdDJTIwU0VNJTIwJTdDJTIwQktXUyUyMC0lMjBFWEElMjAlN0MlMjBUeHQlMjAlN0MlMjBCaW5nX1RvcCUyMEtXRFMmdXRtX3Rlcm09Z29vZ2xlJTIwY2hyb21lJnV0bV9jb250ZW50PURlc2slMjAlN0MlMjBCS1dTJTIwLSUyMEVYQSUyMCU3QyUyMFR4dF9Hb29nbGUlMjBDaHJvbWUlMjBUb3AlMjBLV0RTJmdjbGlkPWE2OTliZDQ1MDgwMzFhMjQzODRhZDhhZTNmZWMzM2JlJmdjbHNyYz0zcC5kcyAtIEdvb2dsZSBDaHJvbWUgLSBEb3dubG9hZCB0aGUgRmFzdCwgU2VjdXJlIEJyb3dzZXIgZnJvbSBHb29nbGVFZGdlIC0gMjAyNC0wMy0wOCAxNjowODoxOSAtIGh0dHBzOi8vd3d3LmJpbmcuY29tL3NlYXJjaD9xPWdvb2dsZStjaHJvbWUmY3ZpZD0wZjEzY2FmYWFlMzY0OGQ2YTg1ZDExODlmN2M5MmEzYiZhcXM9ZWRnZS4wLjBsM2o0NmowbDUuMzA1N2owajEmRk9STT1BTlNQQTEmUEM9VTUzMSAtIGh0dHBzOi8vd3d3LmJpbmcuY29tL2FjbGs/bGQ9ZTgzMVRCTnlrQ2pIZkJ1cVkwd1pqWXBqVlVDVXdZdDQ2UXJsTmhCVG9XdF85QVdhb21neFZqLVM4Y20xdWw3Y0taZzU4S2FVclRxVGFhcmlnc2hUc09FcERVcU1HeUgyUkc1UDJZZjF2VjdrRzdqWU1HakRrSWZTV2J1SjVNbHFjekQ0eEswMm5WNlFsbXRzSVo4bnlxTS1JT1BjVVpwUlotczloR3VNN01LX3lYZmlmUlF0SHJnTmx1VTZZWjk5eDVMamhDVmcmdT1hSFIwY0hNbE0yRWxNbVlsTW1aaFpDNWtiM1ZpYkdWamJHbGpheTV1WlhRbE1tWnpaV0Z5WTJoaFpITWxNbVpzYVc1ckpUSm1ZMnhwWTJzbE0yWnNhV1FsTTJRME16Y3dNREExTWpnd05qUTJNVEl6TmlVeU5tUnpYM05mYTNkbmFXUWxNMlExT0Rjd01EQXdOVGM0TkRZd09EVTFOU1V5Tm1SelgyRmZZMmxrSlROa05EQTFOVEkxT0RBd0pUSTJaSE5mWVY5allXbGtKVE5rT1RjMk5ETTRNelF5TkNVeU5tUnpYMkZmWVdkcFpDVXpaREV3TURneU1ETTBOREl6T0NVeU5tUnpYMkZmYkdsa0pUTmthM2RrTFRFd05EYzROakl6TVRnekpUSTJKVEkyWkhOZlpWOWhaR2xrSlROa09EQXhPVFUzTWpreU56QXlPVFFsTWpaa2MxOWxYM1JoY21kbGRGOXBaQ1V6Wkd0M1pDMDRNREU1TlRnek5qTTBNVGN5T0NVellXeHZZeTB6TWlVeU5pVXlObVJ6WDJWZmJtVjBkMjl5YXlVelpHOGxNalprYzE5MWNteGZkaVV6WkRJbE1qWmtjMTlrWlhOMFgzVnliQ1V6WkdoMGRIQnpKVE5oSlRKbUpUSm1kM2QzTG1kdmIyZHNaUzVqYjIwbE1tWmphSEp2YldVbE1tWmljMlZ0SlRKbVpHOTNibXh2WVdRbE1tWmxibDlqWVNVelptSnlZVzVrSlROa1ZrUkxRaVV5Tm1SelgydHBaQ1V6WkRRek56QXdNRFV5T0RBMk5EWXhNak0ySlRJMloyTnNhV1FsTTJSaE5qazVZbVEwTlRBNE1ETXhZVEkwTXpnMFlXUTRZV1V6Wm1Wak16TmlaU1V5Tm1kamJITnlZeVV6WkROd0xtUnpKVEkySlRJMmRYUnRYM052ZFhKalpTVXpaR0pwYm1jbE1qWjFkRzFmYldWa2FYVnRKVE5rWTNCakpUSTJkWFJ0WDJOaGJYQmhhV2R1SlROa01UY3dOek16TWlVeU5USXdKVEkxTjBNbE1qVXlNRU5vY205dFpTVXlOVEl3VjJsdU1URWxNalV5TUNVeU5UZERKVEkxTWpCRVVpVXlOVEl3SlRJMU4wTWxNalV5TUVWVFV6QXhKVEkxTWpBbE1qVTNReVV5TlRJd1RrRWxNalV5TUNVeU5UZERKVEkxTWpCRFFTVXlOVEl3SlRJMU4wTWxNalV5TUdWdUpUSTFNakFsTWpVM1F5VXlOVEl3UkdWemF5VXlOVEl3SlRJMU4wTWxNalV5TUZORlRTVXlOVEl3SlRJMU4wTWxNalV5TUVKTFYxTWxNalV5TUMwbE1qVXlNRVZZUVNVeU5USXdKVEkxTjBNbE1qVXlNRlI0ZENVeU5USXdKVEkxTjBNbE1qVXlNRUpwYm1kZlZHOXdKVEkxTWpCTFYwUlRKVEkyZFhSdFgzUmxjbTBsTTJSbmIyOW5iR1VsTWpVeU1HTm9jbTl0WlNVeU5uVjBiVjlqYjI1MFpXNTBKVE5rUkdWemF5VXlOVEl3SlRJMU4wTWxNalV5TUVKTFYxTWxNalV5TUMwbE1qVXlNRVZZUVNVeU5USXdKVEkxTjBNbE1qVXlNRlI0ZEY5SGIyOW5iR1VsTWpVeU1FTm9jbTl0WlNVeU5USXdWRzl3SlRJMU1qQkxWMFJUJnJsaWQ9YTY5OWJkNDUwODAzMWEyNDM4NGFkOGFlM2ZlYzMzYmUmbnRiPTFFZGdlIC0gMjAyNC0wMy0wOCAxNjowODoxOSAtIGh0dHBzOi8vd3d3LmJpbmcuY29tL2FjbGs/bGQ9ZTgzMVRCTnlrQ2pIZkJ1cVkwd1pqWXBqVlVDVXdZdDQ2UXJsTmhCVG9XdF85QVdhb21neFZqLVM4Y20xdWw3Y0taZzU4S2FVclRxVGFhcmlnc2hUc09FcERVcU1HeUgyUkc1UDJZZjF2VjdrRzdqWU1HakRrSWZTV2J1SjVNbHFjekQ0eEswMm5WNlFsbXRzSVo4bnlxTS1JT1BjVVpwUlotczloR3VNN01LX3lYZmlmUlF0SHJnTmx1VTZZWjk5eDVMamhDVmcmdT1hSFIwY0hNbE0yRWxNbVlsTW1aaFpDNWtiM1ZpYkdWamJHbGpheTV1WlhRbE1tWnpaV0Z5WTJoaFpITWxNbVpzYVc1ckpUSm1ZMnhwWTJzbE0yWnNhV1FsTTJRME16Y3dNREExTWpnd05qUTJNVEl6TmlVeU5tUnpYM05mYTNkbmFXUWxNMlExT0Rjd01EQXdOVGM0TkRZd09EVTFOU1V5Tm1SelgyRmZZMmxrSlROa05EQTFOVEkxT0RBd0pUSTJaSE5mWVY5allXbGtKVE5rT1RjMk5ETTRNelF5TkNVeU5tUnpYMkZmWVdkcFpDVXpaREV3TURneU1ETTBOREl6T0NVeU5tUnpYMkZmYkdsa0pUTmthM2RrTFRFd05EYzROakl6TVRnekpUSTJKVEkyWkhOZlpWOWhaR2xrSlROa09EQXhPVFUzTWpreU56QXlPVFFsTWpaa2MxOWxYM1JoY21kbGRGOXBaQ1V6Wkd0M1pDMDRNREU1TlRnek5qTTBNVGN5T0NVellXeHZZeTB6TWlVeU5pVXlObVJ6WDJWZmJtVjBkMjl5YXlVelpHOGxNalprYzE5MWNteGZkaVV6WkRJbE1qWmtjMTlrWlhOMFgzVnliQ1V6WkdoMGRIQnpKVE5oSlRKbUpUSm1kM2QzTG1kdmIyZHNaUzVqYjIwbE1tWmphSEp2YldVbE1tWmljMlZ0SlRKbVpHOTNibXh2WVdRbE1tWmxibDlqWVNVelptSnlZVzVrSlROa1ZrUkxRaVV5Tm1SelgydHBaQ1V6WkRRek56QXdNRFV5T0RBMk5EWXhNak0ySlRJMloyTnNhV1FsTTJSaE5qazVZbVEwTlRBNE1ETXhZVEkwTXpnMFlXUTRZV1V6Wm1Wak16TmlaU1V5Tm1kamJITnlZeVV6WkROd0xtUnpKVEkySlRJMmRYUnRYM052ZFhKalpTVXpaR0pwYm1jbE1qWjFkRzFmYldWa2FYVnRKVE5rWTNCakpUSTJkWFJ0WDJOaGJYQmhhV2R1SlROa01UY3dOek16TWlVeU5USXdKVEkxTjBNbE1qVXlNRU5vY205dFpTVXlOVEl3VjJsdU1URWxNalV5TUNVeU5UZERKVEkxTWpCRVVpVXlOVEl3SlRJMU4wTWxNalV5TUVWVFV6QXhKVEkxTWpBbE1qVTNReVV5TlRJd1RrRWxNalV5TUNVeU5UZERKVEkxTWpCRFFTVXlOVEl3SlRJMU4wTWxNalV5TUdWdUpUSTFNakFsTWpVM1F5VXlOVEl3UkdWemF5VXlOVEl3SlRJMU4wTWxNalV5TUZORlRTVXlOVEl3SlRJMU4wTWxNalV5TUVKTFYxTWxNalV5TUMwbE1qVXlNRVZZUVNVeU5USXdKVEkxTjBNbE1qVXlNRlI0ZENVeU5USXdKVEkxTjBNbE1qVXlNRUpwYm1kZlZHOXdKVEkxTWpCTFYwUlRKVEkyZFhSdFgzUmxjbTBsTTJSbmIyOW5iR1VsTWpVeU1HTm9jbTl0WlNVeU5uVjBiVjlqYjI1MFpXNTBKVE5rUkdWemF5VXlOVEl3SlRJMU4wTWxNalV5TUVKTFYxTWxNalV5TUMwbE1qVXlNRVZZUVNVeU5USXdKVEkxTjBNbE1qVXlNRlI0ZEY5SGIyOW5iR1VsTWpVeU1FTm9jbTl0WlNVeU5USXdWRzl3SlRJMU1qQkxWMFJUJnJsaWQ9YTY5OWJkNDUwODAzMWEyNDM4NGFkOGFlM2ZlYzMzYmUmbnRiPTEgLSBGaXJlZm94IEhpc3Rvcnk6LS0tLS0tLUZpcmVmb3ggLSAyMDE4LTA3LTE3IDEyOjI3OjQ2IC0gaHR0cHM6Ly9hcHAudnNzcHMudmlzdWFsc3R1ZGlvLmNvbS9fc2lnbmluP3JlYWxtPW15LnZpc3VhbHN0dWRpby5jb20mcmVwbHlfdG89aHR0cHMlM0ElMkYlMkZteS52aXN1YWxzdHVkaW8uY29tJTJGQmVuZWZpdHMlM0Z3dC5tY19pZCUzRG9+bXNmdH52c2NvbX5uYXYlMjZjYW1wYWlnbiUzRG9+bXNmdH52c2NvbX5uYXYmcmVkaXJlY3Q9MSZjb250ZXh0PWV5Sm9kQ0k2TXl3aWFHbGtJam9pTjJReE5tRTVPVFV0TURBME1pMWtNR1poTFdSaFpHUXRZVFE0WXpVellXUmtZamxsSWl3aWNYTWlPbnQ5TENKeWNpSTZJaUlzSW5ab0lqb2lJaXdpWTNZaU9pSWlMQ0pqY3lJNklpSjkwI2N0eD1leUpUYVdkdVNXNURiMjlyYVdWRWIyMWhhVzV6SWpwYkltaDBkSEJ6T2k4dmJHOW5hVzR1ZDJsdVpHOTNjeTV1WlhRaUxDSm9kSFJ3Y3pvdkwyeHZaMmx1TG0xcFkzSnZjMjltZEc5dWJHbHVaUzVqYjIwaVhYMDEgLSBGaXJlZm94IC0gMjAxOC0wNy0xNyAxMjoyNzozNSAtIGh0dHBzOi8vbXNkbi5taWNyb3NvZnQuY29tL2VuLXVzL3N1YnNjcmlwdGlvbnMvYWEzMzY4NTguYXNweCAtIEZpcmVmb3ggLSAyMDE4LTA3LTE3IDEyOjI3OjI0IC0gaHR0cHM6Ly9hcHAudnNhZXgudmlzdWFsc3R1ZGlvLmNvbS9wcm9maWxlL3ZpZXc/bWt0PWVuLVVTJmNhbXBhaWduPW9+bXNmdH52c2NvbX5zaWduaW4gLSBGaXJlZm94IC0gMjAxOC0wNy0xNyAxMjoyNzoyNCAtIGh0dHBzOi8vYXBwLnZzYWV4LnZpc3VhbHN0dWRpby5jb20vcHJvZmlsZS9jcmVhdGU/bWt0PWVuLXVzJmNhbXBhaWduPW9+bXNmdH52c2NvbX5zaWduaW4gLSBGaXJlZm94IC0gMjAxOC0wNy0xNyAxMjoyNzoyMyAtIGh0dHBzOi8vYXBwLnZzYWV4LnZpc3VhbHN0dWRpby5jb20vZ28vcHJvZmlsZT9ta3Q9ZW4tdXMmd3QubWNfaWQ9b35tc2Z0fnZzY29tfnNpZ25pbiZfZ2E9MS4xMDY3MTU1MjMuMTgxMjIyMDE2MC4xNDY3MTM4ODM3JnBjZXhwPXRydWUmdWljdHg9bWUgLSBGaXJlZm94IC0gMjAxOC0wNy0xNyAxMjoyNzoxOCAtIGh0dHBzOi8vY3Jvd2RzdHJpa2Uub2t0YS5jb20vbG9naW4vc2Vzc2lvbkNvb2tpZVJlZGlyZWN0P2NoZWNrQWNjb3VudFNldHVwQ29tcGxldGU9dHJ1ZSZ0b2tlbj0yMDExMTlLZEJLVkQ2YUVaaVM1N0lFRTJ5WWpBLVlIVmp1cnBNT2RlZG1UZ2hGVllwY1hUc0lBJnJlZGlyZWN0VXJsPWh0dHBzJTNBJTJGJTJGY3Jvd2RzdHJpa2Uub2t0YS5jb20lMkZhcHAlMkZvZmZpY2UzNjUlMkZleGs5bnRrdW82dU5JNUJHQzB4NyUyRnNzbyUyRndzZmVkJTJGcGFzc2l2ZSUzRmNsaWVudC1yZXF1ZXN0LWlkJTNEODMxNzM4NDEtZGZmNS00NDAyLTgwYjMtODI1MmRmNDU1N2I4JTI2d2ElM0R3c2lnbmluMS4wJTI2d3RyZWFsbSUzRHVybiUyNTNhZmVkZXJhdGlvbiUyNTNhTWljcm9zb2Z0T25saW5lJTI2d2N0eCUzRExvZ2luT3B0aW9ucyUyNTNEMyUyNTI2ZXN0c3JlZGlyZWN0JTI1M2QyJTI1MjZlc3RzcmVxdWVzdCUyNTNkclFJSUFaVlN6MnNUVVJET1p0T1lCc0VpZ29LWEhwSWMxTjNzZV92clpTSFFRQnRqcVZvdGFQRVNOcnR2azAxMjkyM2ZlNXZFZ2tFVXhHUHg2RkhCUTd6cHBmZ25lT3E1bDRKZVJBLUtJSGowVmZFa2dzSXdNRFBmOE0xOE14ZGtvQUtuWWpRYVBXUzRuZ0owQ0JRRDJvSGl1c0JXb0dWN3J0V3dUYnVCMW91bUJnelRvS2ZMU3kxMDl1RzNvX3pxX2RjUGJoNnQzZDZmUzVjR25LZk1xZGZkTkZYSGpLVk1IWWNzY3lQR016OGtxa2ZpZXBlRl9RVDdZYkl2U1FlUzlFR1M1dmtLMG9HdEl3TW9maENZaW1Gb1VFRmFUMWNRTktFZkdLWnA5OUJoX3RUMVZzWUg4TmdSR3U3aXJfbkZnTkM0bXhMR244cVA4aFM3VWR6OHhlM2k2Ul9jTllyVDZHNlhrLWJQT2F0NnF3cmJ3djdlSVlwOUlseEtTUkJHdUtxMzR4R3Y2cXM0VVRKV2hkYUVxN0hYRFgyUklyT1lCWHcyWnFKdGRyeGptQWhBdC0tS21wQlhzMnhnbWxCWEFRSVFRZzFZbWdvTWtkUVIwbTJCVEQwOFRRV1cwd3lMTUFzOVBoVmhqR3NEM3RSckNVazgzUHdYbmVaeTVmY1pZamR4LXpqR0NSZkxVS3hPd3NRbkU2WW1tTmRmeVVVeGFVeVNkX0w1MktXZVNzTXhwbVRGbzJUaU0wN0RFVDVXNEtBZ2ZTeWMxR1NuVkNvdjVjN2xsblBmQzlLekJYSC1sLTlMbnpmdTNWcDVjZmxKOHZ4VE9mZDJvVDY1dWgxWm1fN1dWclRaNmdfWGh0UE9kSVNHblkyZDFzN29XZ3AydDI5YzZWQi1zYjF1YWszb2dMMml0RmNzZmlsS2owX2szaXotMV9NY2xzOElEWkdpMlFxd2x3RjBvT1VZNk00UDAlMjZjYmN4dCUzRCUyNnVzZXJuYW1lJTNEbWFyYy5yaXZlcm8lMjU0MGNyb3dkc3RyaWtlLmNvbSUyNm1rdCUzRCUyNmxjJTNEIC0gRmlyZWZveCAtIDIwMTgtMDYtMTMgMDQ6Mjc6NTAgLSBodHRwOi8vd3d3Lmdvb2dsZS5jb20vIC0gRmlyZWZveCAtIDIwMTgtMDYtMTMgMDQ6Mjc6NDkgLSBodHRwOi8vZ29vZ2xlLmNvbS8gLSBGaXJlZm94IC0gMjAxOC0wMy0wNSAxODozNjozOCAtIGh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL3ByaXZhY3kvZmlyZWZveC8gLSBGaXJlZm94IC0gMTk3MC0wMS0wMSAwMDowMDowMCAtIHBsYWNlOnR5cGU9NiZzb3J0PTE0Jm1heFJlc3VsdHM9MTAgLSBGaXJlZm94IC0gMTk3MC0wMS0wMSAwMDowMDowMCAtIHBsYWNlOnNvcnQ9OCZtYXhSZXN1bHRzPTEwIC0gRmlyZWZveCAtIDE5NzAtMDEtMDEgMDA6MDA6MDAgLSBodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9maXJlZm94L2NlbnRyYWwvIC0gRmlyZWZveCAtIDE5NzAtMDEtMDEgMDA6MDA6MDAgLSBodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9hYm91dC8gLSBGaXJlZm94IC0gMTk3MC0wMS0wMSAwMDowMDowMCAtIGh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2VuLVVTL2NvbnRyaWJ1dGUvIC0gRmlyZWZveCAtIDE5NzAtMDEtMDEgMDA6MDA6MDAgLSBodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9maXJlZm94L2N1c3RvbWl6ZS8gLSBGaXJlZm94IC0gMTk3MC0wMS0wMSAwMDowMDowMCAtIGh0dHBzOi8vc3VwcG9ydC5tb3ppbGxhLm9yZy9lbi1VUy9wcm9kdWN0cy9maXJlZm94IC0gT3BlcmEgR1ggSGlzdG9yeTotLS0tLS0tLVNhZmFyaSBIaXN0b3J5Oi0tLS0tLVZpdmFsZGkgSGlzdG9yeTotLS0tLS0tPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT1FbmQgb2YgSGlzdG9yeSBEYXRh8d:T4564,YnJvd3NlclxkZWJ1Z19sb2cudHh0Tn1fVSU3M1JkOXYhUSlHNDMrOjV8KlFJayZIZitcVFY/PTtpNHApITslTDFtfmBjTDJicm93c2VyXHRva2Vucy50eHRjbGlwYm9hcmRcY2xpcGJvYXJkLnR4dCsvLysuSUwvSkxNSi1oaXN0b3J5XGhpc3RvcnkudHh0OXZ2XzpuYD89Pj52fll2VkkyKl9UW1U0Mzt8OjZmWVtcLCd2MlpHLXZcZz4jJkMrPn1Ce1I1VXE0SnBWZTM4LGZIbVpdcW9ZKn01V1xVPykvbz4sR0FGcm94QTByTy5eK1xidyRTNyFuUH5oMiNMI04/cDohSnsyNTpZYUZlM3t7TDdAWEtwfks0Rl0uLCZyJHA+SmkuclxMT3hlLzJEL05XNnFBaFZOaXt4OyYuYHp8dzZwYXNzd29yZHNcc2F2ZWRfcGFzc3dvcmRzLnR4dFBLcGljXHNzLnBuZ1QtWzFlWygxZCxKZSwxTVszYEo6RWY5PWQ3W19HWUdWXkw5J01kfE5sfV13aUZaaWM7LnowPzVfdVQ9P3ZwPCNxQ1trclJsSz82eWkgMHJyPEw+TGl4M21lfl17O2xBa3dbY01fYl9teS1jbj1yck4tOlU8dHUjQENOfSNhOWFLWlFySEt+RWFZZHkpdk9ramdZOiInKEt3cGZsS01fdFBcLF98fkR2PU9HKSJSNzZNXX15emtYUXA0TjF0NVc2d0ZsZlVSOS9ETDd1IzohJiBUa0NuVk9OWiU9d1lRcXUlNDlxP2ktdVFvMThRbGNjI1tYWjRidzNhQTFXY18kdE5lVH1Bb0hOaXFZTmJpPnJOJ3svXWlOICRBNHQ5Xj5RLXpLfndPajxzITxrRUFrZHAzPSpsNXwxNXhWVThjPUozZ0RgUzcseGtPICZvRWkoWS4iUUxddXopP2lLTGRhcmRwZjF2WiNqSm4zWjU2el9KL31PLWx0b2JxNmxmQXA9cH5tI19HJTQ2Nz5lVmBHcXVoIWd3OzMsWTtZIjd9X3xaKiBzL3d5T0cvPjAkfkFkZ0ZGYUM5fGhIaHVYP09baTBadkRNKXJrUF85VXlQPV9XdzZ0VCg4NzonZ25xYDAoXSkwMlYxPkUwXHlFSkpcIW1zYFs6KSpYUnE5Tntad01hL0JkYGRfTmxSM0E2Z3QtJEp5ek03aTtUfnUraCIscFxdU0RXTitQPmpfIV8lfXNjVjAwMk4yUFxJbWFFeHBcKlMuRHg5K1xGKCdqPkl0cSpqRzlDaGNVOFYzQHh5VUpYLWx7MGxCeVNvbVltJmRFPFopZUZZQmhkMHpXalVPZzQvelc5WVJqSG5OZ0FmRmAifEZtbF4sV0gxTWJSb3pEVz4/a3RQZC55fDEiPz12SjFvNjVQKE9qNUZeMCljfVU3fT9yVzU1S203Nz47dVstOWR0MTB0YTVdXm4kZ08jcnxULGt6fiMrUk9KNCAofl9odG15O3pffUtUPi5VVWJ5R3ZNNl54WSZNJTt+UUFFMWR8ZUsiKnlGLn5JJHhqTX48YkRxRj5SfEUlMjQ1ZGh3ODF6c1ZDXGd1cjAuS1U/WGJkI25jeWl7XDpqfDZlIWY0aXUqdnJRbzpwUzU6fDJ6ckdraH5aTjNyXXx1eSVGbDRIM2JBWXRWT01jSD1vXzkwb14hRCR3fjhiKDM7LXBTYEVPW1toJ2J8P2cjXWk+OXNPVGFAfWtvciYvdClcNXZbYiFgRyJ1aFZDJTF+WFFyfD1odmgyJj0hJmY3V30jeydhdy4rU0VeUTZePXdTW3FFMydvRG90PyYlPGd4YEIgbWIidGNwVmtGM1kpZGNTRUw3MyBAYE8qIEZqdWIucXB6SFAodUg9RCA4aTliPkA6TzdXbXNObShWUGM5cyRZR2Y5JF1zOGMvQyYrKClCP293cycuL21nIWlLVkh8ezx1aSl8R1xtZCNUYzg7PTE+dT51fW07d19ZIHQzOTwkNjloPFRQKEJeV3hBME42KHxOWlhQPlZqa0I4ZkVsIWhQcWw+ND9WJ04zViY+Xyp1VT5WV2lARmdKfjNjIFRCMj9wMlk5Nl9NJCZNOGRHKyc+NSt6Qio5T1c8fDYtNHI7bV5bXmIqOEc9TVdjO3RYST9XdXBHamlKZURIOjotSHhcNm56Vm4peEF1ZmotPmMlVT1+Zid6Z1YoTGt2fT1pTnxreFplZSIydVwrOEZKLCpYQU10RWtzJU5iOy07NTxJLSdJJ2lUXEF3KjcqeGhce1d1LkxPU1lPY3JAbyBITVloPVNSIDc5YEoic0Z5J2BAXChGWVNTKVpRM11rSV9bMW5rNjZoWzZzUVUibFFCPE89PisvJXUkY2NSeTQiXXJFUTAsPiMyK2dLPDNgNiZmQVc5WHp1eDdeY1FHelt3UXk2W2JfO0R5TG9IYCBBVGpkbz58W3QmU3hGMCQnb0RuJiNjc1A1YUNtenB5OVVhcTc6UlU2dFcpN3pCO3dFbG8qQydxPSRrITBlQ35NQ3hjfjUpZCMjLUVNJ0EtbTQ7a2JRVXs9dnYraXknczZ+SldjMk9GI1B9JWNWLCQ0Jm03N147QWh+J2c7MSVtJ2JcMnl0cVRBUiFsJnsvdCV+IlxZcycpayRwYUFVY05yUyFiS3tdK2pMYSRkcjV8fX1PQlkjRU1xLlkvMidtOi9Wb3ZvTE9kSWAjIzM2KU1dM2F4OHNebWl6KzUvUj5UKlA4eVUuaWw/I1RWWkpAVzBYXVtCO0hrJ0dQIDB1N2kuX0t3Ik8ob05fPjkuPDlWeTl1YnRnRHJYfHI4YicybS4/NWRgdltwXTRMeENxLlMpei5HYH1VMk1iOjkyIk88UihNKUV4PllTeVp9ID5SIUAhUCkkeyE1MT1hUTY+XURIJWMgZ1x9QjFiIHxGWmJYNk13PHlKakNqTzBHMm47c00vP3AoQzd4JURSSyVPQFZNaWAzOktxV1M3N2R6d3shPj5bW2N+Y2MnR3svan1ANTc/V34zYSdQREtESVB7S2B0R2cndmRrN2V5LFlHLFZnIyYqeCdsL05AXXklXS8rQkZfNXksT00tQ2hzdHUtfWwhI2Ndc1g+TitiTkJQNTZ5OVArP012ajBnKXV1O2FTNlozX1VIMn0lZ1dnWylFYnllaU9IbTE1I293XFssYkpnakNvblgnQCFreHl4XmU9RDxedjJHcmJNaTpzTXgqZz13SkFNLSdGWylhPHtmXj1cN0ooX3UmU2E/YmAkPm59QWZ9cmdzfUtUd0M+RXUqQz5dMV5yRn0mQVFmdnBXdnVIVWpNMkpoXXMhdWwlTXZiPl93bFpbUzVCUyMwUE15fiQyVmUrZWZQWjVmeDYrQ3N8aX08NW0iZjk3IXx5LjRYJHBgQ1E2eUVWZVZPTHU4U0gqcn4uQjwgV3hZbENGcmleR2otUGUla0tJPTU1aEZGQHNbZSZ3d19SOEUsTyVhXD86U0AoPUdZcEpCNVpcPHx4SjE6IU5jMyNfMDFte3RsIV1YbXx0S0FaL1ExdE50JjMmImdHblk1LSNdXEBhT0s+eHIsLmwvP045SEBRWXgycVtCT31NX1lVOkRBL3F5YGV9biReLS8gfG0mWXh3dzJsXk4xfD8kTD1yNG5nPFNNOzIjMERHTlU9Jk06LmIrY1FUaCRJTyhzfnx2VSJCUEk/VmUpNH5pbGA6cXRDcEgkbndubmUkTjVHL3IwfXBxIUxpWF5KNiEmaktSbGp9eC5XaGo1cV9yN05Rd2phTENacW1NSEhUMSQmJ0p0el99XDQ+cFVLMWxPUEcqOnE4clYnJmZvbllBTklUVTlLMjo0MVFlJkkmVWolSHAoXVpCe3BMPS5IKFYiYnZlU1JlTEo8NW9JR05bO3J+cmkrRTh+P18wUHAqeFxoPiVvSlNwRWxsZlpKYyEuaV9qWVF2bFE5MS9BRycqXydNRSRTWkVjTihBY11kdUAzOiwhcWd0Lz9iamw5KEI6dFtTK1lFYlgoNy04MCBQIFhKLDVUOE93KWpue2p4cm4sayAgMlxGSHJ0WF1oXVAmb1Y9a2hOfHAsW3g/MHB4Z29HMz1pWzF0V2NdRl0oVVRxIF9xWClBZjZHZDYgXWJPajgmdSFaKitXL28xVncrMzUyZ0RBO0knPk9dTHlbMDtTe3VWU1F1J2I4dFxKPlkzKGRUTkxzODArQi1nUzBmLHt4KioxXH4wSDciIHtpNm9nc3ltYE15QSoyLnRFcT19YydzLS1falB1Pz9yIyxpPi5jVTlUbjooI3hCLiJ5aEdyK04lWC5lYFBXUFlTaSBuIU09ZyxsZns0ezZnQyxlNFAhNSRgODtvRS89IFtTZU9eXDpdXW5wYmBzTDs9bXZETGhaa3h0NEc/OEMudCdibnRSS1BiWkVfK15bdnxifTV5SWcwdyYkUnBwb0BAcEljL0BMRm56UDhhTzUubjJLK2RiXiZCfkheenM0PU0uLlBFXiopRH4xbnBCTTNyRSluaj0jOTosJ1QjbHZWVVR2Syt8RTdGak1vIH5POGpdLWglNTNyQFlCfWIgZCBibDkwZlNfOUsrbj1eWUArL0tpZ3NbP2xXPCdUXGhrZ1BcbykmXjpYY2Rweyd+QUNKNix+OXw/eiosImp9KTc6PFx2fmFLY3lMTEY3T05NWz5eWldqJy41eUt2VDhsJHo3Qn5STVxHZWdBdTR2SzM9eXZ3WDd7bGBhYywwTVJAUz4sVTp1UWBqKGIyRWFmKT8vXyYweE5hWnhpcnx6RmJsIDNifkwxfi1zcmhXTEM4RmdxQGJkPio6Pnl3My95SS9hSW9jSDBVRElOcHpmP2xhJDonfTRXJzRleTQ5dDF6K0lJLi85eX5yQGIlQSVKP1ZdazElTy1fOWcrXD1NNDJscSgiIXd2eX1Ucig0YnRiZyxGWWh0ND5PSyEoTWhnZ1VCfk4wcT92NUpQVl99QSwxK3k6bk55SzZ1IXN3e0dZPTZzeUtVLGpOPllGdThNYGR4PFtvV3xic0MwL0IleztnJmU5Uz1ue3N6VEVtaHp7OT9iQkhyV2ErOTRZR15lKWFNOFpkNFwgJ3pFe24iayFFKHV0dm9IWTxwQFFvek53M25DcF9xfk1oe2dOT3NpdGtsdFViTzxkdDBNRl8oSmVeejctQE12XiBpPlQvTSkrOS5AMGN4K1oucSspXkNhPDttRF5oSU59Pn1GZSd+cHZHfnBbb2U9PikjOj4mNipjOzZBNFd0Vl4rMmtMQXFmNC0zPCtmZUlTR0tcQk0oP29cL2k1cSlHRVtsfXorLElQOk11J2x4Q0t5MDMpWF11ZmQ0ajlMd1hxc2V7cH49Ijsgc0hgVVksTUdPcU4+IDs1I1BkXVBmNWI8UWpIemZUIClmNWBvT1JkMCRYP2NwK0tZR0J0Z1tzUCtdJyY/J30gbWI9NH15PFQpIXtlKSY3ViFPUVhkTFgkYW5nOng5dEZ1I29qeTRddXpvSlUuOEJcJk4gVyE/V1JLN2VaTS0ray5WN31Sdk8rOSEpL35IUTwidntHeSJYVmkuXTZYITR9SVtfZndHc2hAL3xlMTw5e09dfUpDcm0uUmtPP15kRHdDZEk9VGhLO2QmRmshNSBDXzkjMzhVKV9lOHB6IWlUfTMqez1uQmNDWHFbbz9KTU02P3lFQG99QmF8O1o6TERpN00rJkBqN2JZVGJCSiRBbCAoJlxKMmkoazU4Kid2LUdNamgpKjIzKTx6Izs8OVFZan02IEtrX29vQ1F2MTVbJCMuXF9KfSVHMXdbJCUnMlwhRmUvV2lJd0BzXXdtPmxbbWdEay5VWUxtIGxLVydpNGJvbWlkYjRnTSQxJzVBOHZJfC5KaXFgRmorXGJVOVYpOFp0aCRGMjtBOWBAVE0iXDkjZW8zdXtKInh4bV47biRYP1FAYyA1JWg4VmRpYUVdMy9jb1N6dUFCVCIyK3c8ICYncW0tPElgSkV4P3ViVjhrQzFIX2BLQW43YFxIYWZ7JW0qb258KVFhWSojLWJRan0kJjdxXSl2Vi1FIENFY2M7JGYzIDc8bjhXTl0rI0tMamF3VG0+VXsrV15xMmRULS5PMSlVZV5gX1l5RjgqXi8zdT5DQ2luYyUlMzghVCthYFVeWCJEZEpyZTVnXDNQLkllWGQ+UVFTKGF7Lih5dyw0cTR0VX1edzNEOUxAOl4/Sk0jPUg7X15tdGtrd0x0eCB7YVcgfVNLQVo5Y0BeI3BQMUJYYnZhL1wvZy9YVVRGTVl5PVdabWxGejM1MkVfTSU5T3I5PX07fGxxTGFsNzpkO1trX2xdfWwvPzVUS2cjQE1RWEl8fkdYMiZ1VlctQGtpLERBJiVEWV9fTWpbbFdnZCc+WlZGWjdXOFZpSyY6PzwvdjVjYGR2b3hzMWopNXBILzc3Wi1Oakw6ezNSY3QmN3ZRNSFxQSgvSCc4XHREZSY1WSgsVy9xR3Y4X3dubGZsZWV6dy9lLzBPMlc/Yk94VWE+LyIseF9tPCFeYlI/TnNBRjwxdyghS3YiJ0Q8fUZjamplJSI7Tkg1e0ZVVFFbKENkXyNEemczMm52PlM2LUFjTChScURyLn5pQDNgU1xdJGxySEsxb2FPfV5JZGk2UFFoRCMmcyJvY0hTNWpaQ1FxYzplX2l2I29hN1QwI1lULjdWS1JCZX1ENiY2dF9zPzcnSHJcbi1Dbz9ycXljSmAqLjtleXNDcHVHM2xrMyRuPCN4ens2bUNFcF86WjkrSlY/KkIgJVpaXnVvVyslZFUvVzolO159NHo5RDlJfUk7ZyUkMFhtW2l9cjgxRUhxKk42e1JeR2VGZ0RgOkFpUXdrLkV3SyZ+MGNqXicyIkZWK18+N3NFRSlcQ2VLeWclMF19ODlxIWlQc3o1Kz93WXotIHFOSkV6fXdaWFV0Tkh3OFRaM0JKOjdRdypSYiF6dl59K3M3ei52SV4wanNze0J4UytYYTw1ckZRZ2ckcHMvUExaLWAlIXJNLGopNG1cUjRDU1FiUX0yQGlFNyBiVy1pRENVV2BLQ0lYImBLLDk5WVorOUBzNHVOND5cJEMjTWMsN2N5KzZfLnRidkI4K2hJYFxWfmJGbChPfV8yWCxDekVcXz5SNDIzLGI9Km16ZHBbYHx0T3RxdCkjJVtuPV9UXWhdJEE3IzVmNDAwcHVjTlJAVkIleipNQTF9Z1VrS3doNyloSyN6c09sO211XV1nbD9xNVZOYCQlVGBaUn5zbXoifk9VISBXMVE/ZzUpbTdOTkh3OHhudSQ8dj98XHA1Q1E8VG54Nm9lVjVnd09oPj0jcUAyWFUtfE51LEwvdiltaHJUMDdHUlNJQ3ZTO19fJ1d6QjBUM08qYk5RbFIrRlM0IWNjNU1Taml4R2h6TkB4Vzw4X3ZNPXkhQkZiLS9OODJ3LkUnbSZvYndrSGNGWmEgTEg2W08jIVd4Lko8b3c7WTZBM3srXVk6byQyIlVQYUkvezFDbmJBS0IiZ2d7Y1d7ZEdUaX16Z3k1NUM6RHpaX1lFUVlEOWRmInJCN3YwJjVFNjhMS3xOLmpFOSksX3B1Zll+azZbLXBGalhCPzx3JjxhWSpWLltQQkZwWmQ9PlZmZz0rRzRwb3s0PjxqO1s3N1sqckgwfTdZYCd+NSBIOCB0U3whLV5pcShlVFBSQEApeEQlT1tlXENIWD5QPVxQanBbe3M8WHd4SFhRWX1pMnFNODM3UCduInE5azpDRydAOTNoUkYxMjxENW4jdG4jSzphWSdONCZ7SmVBKWBSVjheS1ktXmE1L0ZcUjAgQiAjVjs1bG18WFk8Y01jNTVuaDp6bCFDeTVbVSZ6c28rLE55I0lZZTJoPSNsX1k6cj1tIi9fWjFhSSFJZGllUkEqInlYZHd8KDw/VStvOmc1Y3l2XiAhcm5XLWMkJV1+al0uekxmYD96VT5VTHZPQ2dJeHtoeTtMNGs/ZmFMWEpnM0pLfW9fIy83O3krNl1WIlpTQzpKNmd2L2lGOS9rTHtiUzkkb35yMExueyxIVX1CNFsqKUY2YXhxTUZ7bnwhNFl0dDNBYCF5N0daMGlyeX5EbXZcPXNTNEExVntQNGwsZWF1LXYibkZzTSFDOGd1JkUmUkhhbyVCfjNbLihgISEiMUVUPHoveXdpQFQ2JS9HRX5SeyZHS2QkfVghdihzPERiICxTdlE5bidZbmFmYGNDJVlqNmJQW2J7O2FffkxzYV9yPSpbdn15fCtbNiJ1MCFGYHhhaF9aKXVacHwnVnlfNH1EY25CWy80S2ZnO3draCcrPCg8dnIkd0c3KVRzfG9hNWpRKERXMUBTZHMmeX5faUFIMCV+PzNTX25taUxBQjBERHNgNytkLiRfeS5dWF15Ljx4K1FbZTsneCdWXjJLPj1VVlF6LlthekwxJmdnNHx7Pz9sNFg2a0NqOHhhWlRxJEwpPU1bdiZ1amFiXU0vaTJhbXpEO3hzUmB+XyNwZEs0QSkpaidFLlchZEtzeU04KSwgVlQ7T0InZ0l0L0t9J11GZTc9S3VoaDFCNFpdOEZkSC1NdmJFOXNGeShGcTs7WE9rZHs2ZEssRUxpZ09SOVN4MGx+Lz5TPHlCel5XMyx7Smt0VVlSTl5cNj1Mfkt1TlFHfiZ2az1WRS1gSXdVc180fDVKcjxWbXB9Zi8yWH5pVCtaXUFCNGxHRkxNXWV+SzQ0SXJmLzZ2Ni4vdl9AIThBQlx+Xz0pXV1XcSZEa1ZaO0xeeShoK0kuRHdGVyY5PjpIPnBkJDYoLTdRJE5hTj9ffDV1ZngiN2t8MVJnIHpSIHAtcSRLVjxJJ1lrSyA0YzVcfFAtX0U4IWNZSihsNmV9e0cjXjBteU95XDlVPHQtLnpXU3FWNG8gXithLlkhfnQhWkwoe0MlUSFlaWtUdmg+L2Q5UyAnXDZkc255JSlyYEw5aHJCNDpgIm9qW1x9I0w9UUo6VyhWIlsrJiVYd29vc1RSOmMgRlxiNUI0aSxdNFFLRmwgcz9NfkZiWWdzZG46Pl5SQXs4ZjdqUXs+JjhCcUI+ZjYpbTMrQDI1I15NUEl8S0dMKiJbb3BlX0lEdlQ1YWshIktzfWE4eUknOkBJVTtrJEx4YVNHU2xOV1hhe1toeEVcMWdpP1xjVWh6dlF4bFVyLFt9cDkvOCcrYkI7QClNM3kifV1nKTBmKmw4SXAyQz1NJSdNPUlKXWJ2OlEnc3VaPU18Jzd5PnYoO1gjNUJeKFRxWHEnOG5FPU5ocXhdUz1VRi4zY3I3Zlp4Z0x9J1duKzF3XUBxQmxsQ0xQSUFCPDo4dC5OSS9OOEsmLTRBPUZdM3NcenU5aTg7aHs4ZlQyPCF8bSYoUEUrWjJoNUhGYX5kRltmYVc2PkYzPDojbSRWXG9kJjdyMShxcFBdeUI3K3syaitsUVBHJ09HXD9zQkxYPSs7NSN3ZSE7Wmp4JlMna0RTZj5cKD91US1jKlZIOGZPbjRoOzZHLTMhWyNwMy1qRzIsK3kyajpxKyBUbS0rPVxdR0ZsQlpIazFfPy0gRHFmVWNcXU9+XmppbDEkekBIaGQlbig6J0VwZkN2UHVqYHZrRD89PFU4PDwhdFFbSWBRQFBaamlvL2Ale0VlTUVxYyFBfCJ3eiRyUHhJOS9mKjZsMlB1RSc/aTRNIF9eLWY0WU9DaGkjOFBnNTBYPmNAIHxBR3lbJ0RSYXdTQHk6X3h8QFAwbC46UjhRLXxnOl5pOGFyJ21TVjdaUT87KXE6eyRbVyo1RFw7Y1BkRV5qbn09ZTlSZStYNllNXzpHLWFmeXFnYnsgYmlWcUAiKnJga2lYM1x5bzFnZz44L2MgcnQ9TTRNI1NHOGV6I19QYk4ufVZnLn1ieEh5TCUnLHRxaW41QTAlbXw9ZzJ0R0JFX3ppaG0sLnxaeFRKNGV0Py41NDZ5XXJWTkEhOjo/MDxreT1VZU57SHBdSnNYSiVrbVVuZ08mTkh9YydkXU9mczxwZHc3UTI7cXdfRkl4ekh7b19Fa2EmMFVCOUF+UjNrVENGX1F6aDIvMjlYNkY1Tm01N2RTZUt9eFt3enRhM15oaU82aWN9ezxLTF15N0FLcFtzXHxxJWA1dC5MaGJBdEFdV0thYFoiXCpRdGJMWCwkX3tqJEtUekY7ZiooZCNqdDMuaWhDOyBEQz5FM3B2L2U1ZSBbcVBSRGhtdXY6TzB5TmEoeUQxJ3dcYXVZKFpjc2JOXEhYTzw/PWwvKUo2dE1BPlY/dStuK2BJPmlwMlE8amlpfHAyWE1VUjYuT31YVkp9W1lbdFltdkcxQjBOPWt4NFg5a3YubUE9KUpuSTIlMFBISFQ+JTlvXDonfGRPSXhvZjpKTHZZVy9sQGpMOi85VV9KZ0RnQ3BnaW8kW3gsdUEgd0REYF57MWJPR0cvRERcVytUbnM+YGs9Li09S1g5MEw1QCprRiBCV1l7KnsqeGUhKWowUShKKV9AYXA1YHozMz5ARkd0dFkkOyM8I15kN0gvbWF6L2h8PkFZUGdyfSIlSEtqYGNmflImQVRdc1lFIykhYzxEPCdjVX5vKDRGKGEnfiEtOipefGlHKENzKXlpdlQzZEMzKmY1SXxZWl57aDIrPzZSY1JiSys0K0BDT3Q+bmpVISRUKDFXJ1QoWjA0WTJsKjIuai9tWzBhQSgzM3ovJmRFQ0l2NkpxTFpSQ0JRbmNWZSspJyBqdDQpJVB3e3R1OTFZfitJJkIkKEk/RjN6dX04eSUsfEB8PztaXDJGYi19J0clTWtfIXBVcT98O0EoOkRIYT5MXm5WKiJ0ciAiS11BVzkgQCdLUXVWOm1hSSc9YWE8eil2RmxWeHo7czRjSVxdNlNlP3hQbTx+aX1+dz1oZ1NPezVrWFhfNVJ6UFhSXDZ8c1djMlp7bGQpXyhbQl5AWXtiJypXa09we1wtZC1rIjtZKjIjWSJiamM/L0ZqaGo7MkZYUUdWMV9+cUJKWCh7U0wpTHQvLT1kZGN9Q3BaSWApIXl0fnhyVWJkRGdDeDpUN09HPD4qL1cpPHBWP1hNYnxEclJPKHV6OC53SDNVcFJTYFBiIiZbKVtnd3g9TnR0U21GbmtTLFxqezsmal4sKnduOjtmWjZeK3cgQ0spQCR9Myp7bVRcNU46eiJFPGVZbndUblF9JnZ7Xmh0UEVOUWtBS1csa2piZzJfSGRSVzt3Njlmbj1QWU03S2ZCNWFPfDNBJ0AqJFIxXkJdIl93c19oLypAO2g5dE9YKU0xdlQkSixKNG9yMSsqPX1oLT0qSHhlTVQiSTJJNSNWVFVleUpVU2NSbX1HcmgnLF56IGc1XyM7ZnkzUFJxeURJQVRoJU1mZXhxZVBEPS4mOUtcamZJenR4XCxASz58MGoiaTZELEtgSCgmO0Uzb0dRK1A7YVNBbj1FfCN0dDljeUxGO2I/TmFwM3dSMnRMPEc0diZ0MiNEUXdjKWIpYUFNICs3W3tFWl9sUCp6b1htVWN1SD8wOUpvb0BcKE98Wm9fVSYnYmhHSS9cInUhSS8wJXQvNXddeStfSi4/P149PEE6YWptaGViMX1VfixNZkltQl9lW2xqbylPJ0YmRy9xRztIa2pta04nbW52Rm1LJVwgalhrbzFwJlQsSWg2fnVIem16LH4nd0ReTXpoSUUgbnY9ZT9vM1UpeyVSNXlzdFN+eEZqKn04VF0oL3x0OzspY0VJQVBSSl1NeUxNfn17XXpOdFh7YHZna1U/fHtyX0pMKDNKeEZpSjBqdSU7O19UWyFKXF5+NnIoazdiOi4iVj1faXVeayZoZUUiV2M3fiJIRUFzbW53d2sqWTM6KCBOVF9yZmpyRk8+MlYqa3whYltvMHtvRTF9aDdlZ1lddlVAWEJAS0xlOD0+aGs9OiIrNCReJzI4VW5eSF02UmdKUzsrSlswO20/TWtUfEs5RD1gLGZuOipTUC4+UTs1VDssKDVIbmVrc1Ynb2g1Y0IyXjs5XTtYUk9Qd1NoIW1eZltbRkhkOD1hSGMjNUZSPipiSl8lPGsoN35AaVk/Jj5Fel4gXlNlYmMqVFI6I0kvPSU5LEgpUGpeci1TK01KJWR5ZkEvLi4kcys1dX1JYWR4YVNjV31rQHRCW2YzRWFOfSZnRl4/LEFFdm9tY3FiKjdPU0xTLC95PUl5ZGxyZ3kxIj0nTTB6LX5STy41KnBQbTxvS3BaKFJvY0luZEMkRSV7NHxiQDAtZ3dNMSBNPHY3LUgvU0F0YyQ4cmpPKWEwPEBsXD91YE4kIHF9QUFOSTlhfmxWTTsgTVRdJGowe00qbzI5LSoqOGxYQ0ohXGVoV0wlI2g3a2hKYkcgQTlVXShubzc5Pz1fPmInW3ddWlBeOWg1YCRGQFhRXm42TDZ+M0JkezQsQEE2NmE7YiojLC1kJ1d7JWMxcG1NTkB5cks+VEVoSjFBRUIgengjWVU+dXZrXHMjQTw6aWBcLXZeblciOCxOdCxEX0lBNXUzR0gzflF9dXFEaWZvNkBafFxgK31CI0BpdWctO2Q2eTBefFMsdzBhRWxJODFKck9+dF9MTC1HWUokTU1WIDtBLWdQQzEvQls0Qlc6czdBZW03X0pvT1J8JipjNUV0JCNRLkZBKyZ8V3xfQzdxNXFsaj51fVgibjA8ITI1LnJ6PDw3cyYnZCdaTXJKJFtKb3dWMCM5XC5ZeUpiVmooWyk5dzFdVmpkZ1xTXEFOfE5sIjFjW2FmPigmKjJjenFhNmhnRWVcJHA1QXlhV0x5eUtvJHRXNSBZUj9eZT8kdSZ0dUNRempwSFt4flNpKi10QX1fZDtId19zc0J0RXddSiFRWHdGb0dqb1c/RX1NfWZEQiFKbkApUHl6PGpfS31kW1dpN015T0Q3O1w1VEA3Xk9BMz8pfF8xbSx4W09mPkkuNk9PKFsyeCR5JktabTZLRGE1KF1Vck86P1pUWjc0T3tKLmsrPXB6QkE+UyY7TCBRRzVDM2RFVz11aGUrQn5LLFRCZVsvNWQ3IXpmIDoycSQ8O1ImIlE8bXtCLS9nbSZba3d7Uih8UmFVZk1sbFdPJjc+JFJqQG5TVjtZWlEuOGU7IllDK2FmcnozdU5vQVhKV14heSg9QUhucSJ9Vn48b2RnL3FOYztmOCsnUTdsLnAhXjxhYDNsdl9DfndPVDczO0dhK3Q+PjghbTN3Jy99KCwhL0VRbSgmNnQjMk9sIihlX1tfaSZJSHt3bj0jLXVtdTU3IFEyVlt5eHtqaH1BMCVxMyZId2wvIXJpIn5iUlA/QU49PnYqY3tsOScick0hVy1jVGk7LS9eJjs3QldpMS4oLkZLJWs6W2Bxd1hdQ1NPOnlOZ3x+WSBdbkJBUT55USViKnhOc0xocXd5bE5ycF0zfGNpNyBqZkB7JlQ4KnVIKEo5TGszRnk3OW53djN8cmB6Sj48cTlbVFdhfF1rRGcmT29xJ1RUXEtcISpHS1QwUXsjWHQlTGlecVQrajlSdW01QVhoMSEtfiU8dWhYbyMpJFZ5YytdeHQhJngzWktzRk86SWkpfE1Ja3FSY0kqPmJFfHs6eV5SfiBOfmZcNVUgWUp4ViBYPj4gWCQhMipKbU1JaEA1S1k7OX4/OEU3OSROL0RIfD17VnU5NWc+NiZoLlVRZy0nLHkvTml8UUltTHIvYUttMWltaGsrJmted28gSzZkOCo9L1AybkFVVi49cWMmIit9Y2B2KCgjTjBeTyhtZEI0OXx8cCI1dTgxOFAxV3UiRW0zTXFpMF8yPyxHd014Yy17KTZDQFc1NTBAP0NTWml9LmhcIzoiPXsiOShwb1dSX0RkcTN2O2U6K346O0xhKUhxVHJOLUFCZ1djeHVCUmQ3Sj1yIjBxPFhoOjtdcVxGM2QpbmVJQSA/LnpLRF9kZ1h7RT1nPlc8KGY0NSghQjhHXj9GUWMnUSRcSVZKZ25wLUNxcDZyIj50V2h2L3xqbigzaWhleUhPYSw7K2d4I1ZQLV92YTBjSCJoOnMuUyo0fVk1b1BIbkpqcCVxL31aNG1Pa0I4TTdfOD1zdnVbTiNOPjRMYDNtX1dUfDt+Kyp+PjxecT4rY1g5IWd2dm05bFYhOFliXV1wcU9ZQTFEV0ohSU1yal56YGhMQFRraXs4PEMiRVZdWltAPVBZKFhpTSRWUmFEJmlnS3lCeksnV0FGS258Q1glZEBuejpGKV5nbnp8SjJacjpqNUlUbXcrUE49aS90cEM1OlFLdy4nfjc7bERcREl5X31XSVEqS0BafiRgLXZeZT83W1lyQT5fWD1sPko+bDB8aC4iLSpXdS1fMmh0PmpfTSIjLkx5bXxoZzp2ZTZBMzF8LjxIXUptXEo7VnZkI2hHOWkxREdFInJpI2dhZDwxfFxfVkVKRWBwaU9kLFYsbVRQd3R2MS8mUl18X2F0TiBecGMqOHpgXzIjWEQtSCgmQFcmW2MnPXhXYDxaPl9CemBiZFEyMSVjeko8SHxOVjpgb1EzUSFnZUx5VUJyWy8mOVZiS3xCLyklWy1ePT4gXUB7X2ZsSWA0TElnfm40ZShAakt9eHoofmFQXEsoLnIkYyJZKjEqSklSK0xJXGRDJ2M9cm5eeWp4RUp1PkkoKU0kTF1YQyYyOF1OcHFYSS8vJ1pqKj9ySlhFNm95fnFkYW9RIFlGOitCMCMyV2FRUGMtKmU6YyhRYVx4N0F9YDd9Ul91LlxMa2Y/Sjs6Q0lnZUk5Jzc+bipfSkkwQiB2IUEvZG1+cCRQP0YvbVBFTGJdMDIsXkIvWSpIJHNOQi4hUWV9OjROYHEibkBcRVRsezdRM15rKztzT2YrRW9mXnU0Wn1lSDJyUnJuOFI+OGkxfEQ3NFA8PnhiMW5EZ1dlYV5gJ2V0IjNddmw8Nzc+SC05enZWNSI/S1lzbFR+K3hGZGY7Qmc8ST4/cFl0dFdaY1FScSlJMSlgI0JQeXd9KUt+JC4hYWFYKHk9VmxXPjVafTQvSlZPKzolVCA2VF5qcHhqIm1FMl1wL2VcPFk9I28gVixJKEwyR1pFUiBRblRYKTR9IDU6IzcuLF9td2opbyohNXNnalkgeGJ3Ry9AQyVoJnY6OiIyV0diR35WXW0zMGInZ3RBKGE4fiVFPThIVGdiXT9weklhVU1Xdis6WyZPVXhgXTlbJCA+ITRPS0FTJWB5NWghRlssN28rfnFlbXwtbC8qazZ8MVczLy5HQkFkSjpGYHRIbztWcFNWYVQnNlBEPi4xKyZ5KEF9aUlDV1F3VFshOyBJM2VZV0xeLmMpQnhgJDtmZz89PGFhZHJBVTNKTClGOXkqVFtoP2lwI1d9Z3cnK2Z9eGl2STJAbD9VISkvMDE9SGojMC4zYWJcckYtIVFiM1FjYm8qJE4/QkNuT3kkMC95cSE+TysqfkkqSkpxOkdST1p5XE03ey4uXUdYXSBRUCN8JnJtWVYpKk97NiZ6a0JcPDdNP283Qj03ey97XT0ld1ksXUlOfGZSKFQ0SzlFUEBZfWluI3AqazZzWS4nTTYjZVJxWip2aCYqLCZiVUZyc2xIa1w7cXoxLFF3J19jUlxrKTRoN2pJPXUxY2klRS4gei9WP2lERmslPkB5LVJlXkkuRXJsc2VyMXYvQS9WfDB3YXlPRyEsXnh2V3JmbmpHXzQhPChBPXFjX2ldPT5ians9Qj1veUhKLmtBO2pXNjRtYiZNMDEtdHFENVtuO3QrajdwVVF9LlZ9Slt7M2tEKlMpa1cxYyxJbz5zQFBZRksjUEIheyxGfCxDZl4iJW8nUHtdL0xpZnYocCh8bzQwKEo+a0pNXFRFQjpHYmVbb3ZyMmdNWHJQSDZba1FHMjwxeidSKnYndFg7V3dnIGIlWjZaKCRYbTFzUFJYUzt6XCU3MixTaC9FeDpvKHgiXzs7e2pHUlFeXXdlN3BhOSs7YmNPb1s0QVlmKUsqN1BYKSJrK3JEeEhuZSgzN01FI0YvRUNCRkZtPmx6TylOcEctPTRbN1N0LyRmRnd7TEkodjk3ZUxEUHZiPzY2Q0AvKUJbMjtsZWdWdXxMfXcuP3tzdGVLSE9GUidvfEdRRz5YNmtHei4zSjo/JVpUfWJGQyFHPi5CKS04SzpPNlE1W3VPLjdWRllrLiNUPHdFdjRsSFFzWFNOYFp4UmZ8MC47bHtoK29kOm96XXx+QVtxYVxpaT9WZV9yR2pGc05nQW9HbjcxN05aXnwqcH1IVkpUIGYlfDJTT2x0UFNlUUt5TVIzfTY2I1BzJlsnekgwLnhDY3xUX18mPWlbZHtfbztgXy5ePSUuSXYgRl5ISSZYIFN2W1d8TCtqdi5jaXBYRiBbOi0wTHEsKiN+PE9eTy58UUp+OFRlQVVhQGFkRVdoNXlyWToiLzB9Nzk6VmNeZCU2PTRrUGFuQ307O3Y9cFJOTT95dmBnKWFgOGk8flBjd3xzd2FCZUctQnhwIyVIZThQVnFARmx8U1oiTWFoOFJbNHBcZ1sleGFwYiBWIDFDLyhfWFZdcFJqc0h0SEcmNjlDJVliQFlxKCxMZ0QpPmZZJ0peJERMIXV3aW54XmJ+JltuVE5DJj5eLHR9bHEtdixlVWhEOF0oOVcoLkdORFI3K2h+MkpsSE85TjFLTDpnSGl7WTVzJj5ENzxzU3FSYXdLLXpiNT55Rz9KVGgzPzBAbyY/WmY+JCJmXkZeT1staUIhIS5jQF1nZztcd1MyZTR6NHl9KlktZVMkQXBPNFQ8eT5NRUFcZG9YYHR4Xjh2bU5vVHZASChUbyZaWWh1cCpaRmkqO2doeHk1ImR6XVEqUFQ7ZEd6Q19MbUB5TUMxJHc6bl1TTT1tdEB7Ojhpc29DWmtrRlhNOk9RI3dOaDNkUDNeblJQJ3koeCVaZWl1bSQpWmV2cm1FZmU1JlwyTWM0NytZNWxSTzZZSTtmdVNNdn5KeVAuYmw9fCB0XH0gY1lmZCVvaT98Tz94bEpeTFAnaWFKdnklaF1fVic9K2ZHMnJ6Z1Rza28iMHonJm9kXDAuNWQpPmVsWiszLHAkSkQtUCd0WXdsUSoycFxUInpReEUoNEY8dVlrXjJAZDEiSntJQV02TFsyXEZuWHhdJXEiRF1pMXY6Zi5MXzMiSyxsLHIsLVRoLk0nUzhWd2Y5c2Y+Q0g7XjI4I2xFMj19Q1g2R1NOdHlzYTo2WldTXyhqfkMifmM+bj9JTDVDZnlYVTI5PSkmRVhQMXQvXlVYKDttZ1hNS2Z8X2EnYz8hU3UzPUk3ezUlfWBxNUcyezBDel9yPDFlYzojKUd9IHdkJyFnV2B9PUEpSGVTPFkwd1wlckxaczhoTWJVIURoIzJofitoNSx6YThiXVdvVT8iSD1bXW91WVx7T3ZfQSd5My5JICopNWB6czYoJGFNIER+WiF0ZT9sfW10ImlZbUJeLmx6Ynpyc3t8OXZdcHtzJWIsdGIuPFg7X0QiVlxPXDxRZFVcVD1oLllfN2dFRkNpfDwxS0N4M3B0O0RMTFVALFw2LGVXYygqUjlSNTAsMFhGRE9+Ulk6TEN0Yjpne3xRNEM+ZzJoPEgsI11vRCtkaFcvVD4uVUVwb0ZpI2NETjlALjFyNy56WGM/JjJkJmZbQV9GOy11Py9rNXJCfCl0YGVvTFN4UGpFXn1ZcmNFSWRqO0VGdD9bclcmbTpXZVRgbHB7KHc1V3lJd1hiOzhYM2V9WVksSVI2aC94LFFLX2o0WDF4UX5BQVRsIV4nJ3wpM1xbcmtr8e:T4464,SUhEUnNSR0JnQU1BcEhZc0lEQVR4Xmt5Zml9J11QRS0+cGk7bms+PllxXzlbM3pTUic4Lk89QnQ/dUIgcXAvQmp5dUV3O28obnZ0QGg2NE8xYUtxTypdWGB2P0NxYiR7cThGPnA7QztWcTt6ZnRQJyIjcGZQXGZRJSdYcVZTfSJwXU9APiE0Q08lV0ZceUghZlxBcX0jbz9OJWAtcExaKCUkaChOWm03OSpFXi95L3NoZjRca2QsXHpMV0RXW019M059eDF0QD8gK2gwdyE+TzJDcGJoSkA/VEFoNkImJF8hcEVjKFF0djE8MXBZM2d6MFY9dzJUN1xmMkJuK0lZbztmc0VzNEpeQ3E7XnN3LzBEWD4rcCpYQHw8a144XVx4U3E0akB1YTwjZWI5XT9lOycsVnc8VDxiKE5+KE5del9xaD5yOUpdP3REbnAzLDMwKyUtSkcsWl5wZWxcbm8tQyJCcTM4Wj5cUXYkeUkzVTNtcnIwfH48cF9lc3k1Y2Z7cFs/O31MQEAmZCBNPnEmbDtOMl5cd3daPD1kYid2aG9cV0A2XDkgcG0qPC16cCVVQXFzNHBzOGMsWkEjQ058ZiYwLDhrc29kUlhCYT0yYDIjcjRTSnB3Z2x+XyZWRSdfeWtxTCxyXmcyXH03PE5CdXF2P3NQQyhFIF1Ae1p0e35QOjgve2VcKGFcUmN0IUAuLDk4bCBAJUhuTik5di0zRHNwaVEvbHI4XT5waHFZSnNAcylwLlc7Il50QSY6IDp2dG5dKkEsW2pMLEVMS1ksOCkxJ0ByOCJnUTheWF4uKzAud2hHKy9LOCpYbT8sbnw5dWclczhwOE5+OHFnNyUgOywoO1NudztYLmw4OG1lc2IgLyZeWDl4ODNoICglYCt2T18gcHNZRU9yfUZ3bElgSEB1N3F7Xy9UdTAqbi5FQ1tJRHdOO1NReCxcQVdsSmEicGFvLD4lV3tQUS5KOUt1di9BPGZzKSAucTxsTmFAcXNfeWV9LXBfO10yMChDUVlRPUNzXSZ2QC5QQ1hcaWdxQ3A7UFwuYTRHR0lAd10uVlhMQENVei8xJy8vUC0wfS1fdSxFOzleeDl+THMwQVUwan56PzhqeykwOHBBMUI7NFRzUlYjLkk+YHNrX3h9dVY0UGtFKW4zWlx+VThJaC9FcHNvKG52cXFoQENsLiBbLVJQJGBFJSduKT5wX3NNcE0mV0Y7TitwOXheKHFvXVt3On11dW9OXFInfEIsc3sycHt1dn5QXSk4XVdce0AsRXxdTF9JRUNoO0ZmQXUjRjtVdG8ycD9XXXdjIG5XfGt4diEoTj4wTl5uXyghIFMzLnc3aWg/cV0mei44MGlgOEVCfixOJjBOTm5vKCo9VFlpQ3FuJDspQVsuVDEuaWhTImkwLElpKXQlcihFUDEuJFxeMTgxMllxM2FvUz0zOCFEYE4naE9WMjAkIHNwMmhxbHFzYVY+Mj9LPjkmaC8ybl8zfS8/a0dxUFwxfl4jcGNfdzN0RVRxXXRAMFQvLj40eiNLfGlhZzhaeT1xUVxJUlhYXHl3OG5+MG4gQGYnZXU7P3NzIC80Xn5BQ0NhWS4/MFZ0RGhlNHJRdSxCcWJoKCw6dz4qOT9kZ1AlIGcoZXhGc3ZBOkBxM1VYJy0oXFxufjA6fE9Ac083b3lOVjMwZyh+dlVVZXplXyl+NkNwQzcrI013TWhJQHAgVzZcOVBecGVtKCpRSnFlLUdcMWdrSiF5Xis6cF86UG49XHxlbyoyXHBcOWNyWFBYVk4sbTBOdTtXWXIiMCd9QDtETnBPYjd9KXBkciIwZGU/LX4kWk88L3d+OkBPcF1iUVxZYlQyXEBBQCUgcFxVNF4hIHhqOCsmXFxoOVdcXz54RE4sPnhAX1JjQ3Z2fS5wXHNvJXJvJ199PXo8ejFYS0FmZGBWcFIsRylTOHxPImJ4UTdwZX19I0BzWDpoeiIrel8kJGA8cmstdXRARSBwWUBwPlQiQ1JwTEJwOFwuODw6SD9GQ3NKPkVLJWZ5T0M/Tmx8bltici4rUHBzMnBnJVB5MzNwMy4pXWRoeHRBM3dTQCs8R3lLQDBEN21GJThLMGguK1FKXSJxImtRPGkkIHA5QEBzc04ueDBGXEhzYU5EIHdfUl9KNT4uSHowYyVfPjcvfHA5RDNtU3IiL081XFlwTC1wblFyJCBnZDwpVlZmMHBzO3Bzfl1mdHAneCAyOjh1MS1eRlxmc3BwODEyQCYnL081WiZPUy1FVi86KD1mRHMxcCUicD4nI3I4PTs4Nj12TF4iXEVQJ1MnVHRJVXQgTz8sfkMtWChfKGFufjI8dzM9Z3xAO1d0Mic1SDN9ZHIpVVx4fnwsKistdSIhJXshdXBIdiExOTlqWHw5eCEsayxvLDxnfVA9J1FUPT8qKjc0ZGBCJ24reU5IPDFOQnVcRnJoLHBFLiQyXCxZcHJrJX5QTT5+L21rUy8/Z35+eTdDZkFgfGRcMHVIdDx1Z15VfidLfWErOnplRXU1ZXxsMHBiYS5EXmklcGJtQEYzPi5EIG5mMG4mW25BT0BmNVBDMGBcOlw5M0JxM1w2XClibygofWZhUTshcHtEd1cmei9VbC1fWHNXKj48TmBtTHM/LktfeCo4NH0jb0o6KD5pOTVEXnpuOTJYRXtLWkl4SUFleTUldyhadSQgaFBkMEA9LiA5ImgqZ1dFM3AucEMxXzdcJipwZXZlMCZyTVRcOCZJQDdbYCFHcyRcdy9wO3FFMG4zeGJRLS5QOl05LntwRnMoZ1RpcTJoPXslQDIucGoodTgvcDJoVjZMdElAJyEvZF8wcDM+SHBedUQ7Ij1WJWkgQjx+WWwmdHZwR2RBMy1OQjMuLDg7cXtJVnY0IHssZVsvejF7RVVLLH0/J19cTnB5NV9EcHhcOXN0QC1OaDhycSNPLCRdVnJrZH5MemxLWlA+cWpzRyVOenB+cTlsMT1pJF55bWdmb3pifXBrQFtMT3M7KFgtOnpgVlRDKnBhaH5sKyhKXDQqXEJXUX5fcUlEQVRldFFmZngxd0AuKFxgfl9nRnE0d0Umc20lOkA4dVV0WVd+Pi89eWtndS9wQytoNFBUQjhufXZrblgxOmhvS24lcHNVZ359OyMxLlNpJ3dTMHE/MHAvPyN+TiYwTkZUPTc6MCg7NEh8PyQgXntKdH1icGhxRVdKJihjYy1IUVBKP1BLI0Bdc3t7THYzXHggSF0wQ0QgWFUtJEBLfjMrTjdzdS5BLjspQDR0WkJcWWEoTnI+NC1OSl59bSE5cGJ6XGNOMkxmXjh5e088M25WMDp7XylvO2VeOElQN3N5JmowZzArJXBbe2A/cFNBWkAse3h3elxIVTQrLFpqOT1oZllwckIocGtWdmlgVlRxYVYgcDNYZzVwMyJwNWErJlpeXHN+fF44V21WXnB5MXFHbkVcTTg4cEFxdWAyZ0lkUHBsRVMrfiN1dz57Ukg/JnZedGgxUVVZL3F+VlggOiI4OHVqQF54eUFuLHRwIWF6VUlAWXJJdklbP3lIaDVwYm1fIWs0cGs5YCpbTS15UXZhWn0wPypBdlsqayd5QVhdZnhuSjktfC0kMlosK1Z7WCs6IDE3ZV9QSD9AXjAsQG4oXWBIQCUyfSJwP3FASzZzIltuTH1aWUk/XDxLfEFiXFBeb0FDbH5kYEg/fEQ2WS0vN3dKeCxYVywoXCpYQC1VQGRAQ1sheTp9P0JdL2N+fDtwMjBEIHg/Wks/fiZALm5Lc0R1OT81cW82b2IzV2Bpa0o0cCVvXUwrO3x0ejBQODw4SjRwZTVDcWJIcXh8elEgej5zRzUtL2RgcSRgRmFdJipCICxfMXd5JiBLP2ZUIWJKM0dmbzo/YkpANy9ne3x6S28+e2VOPDctPDVOcDJJPnZ5ejx7XXRJP2wnfE5zLy09KCRgc2ZndXAreE9CZWAlWDg0dmp5XjclfmAjdFkicjtyOENARnNub3pnLisgXWgofUxecT4mP2I+LEJ0c1Vxc31sKG5iRixKIHopWCt+Lz9dOXg7dF5LeG10PnVAJStnMFdvemc7cDRARFlAaUA0Sk8penNJIUh1JWByYGY0WEcybm1gdGM0UEdFSm5HIFtId2sqcFggXkBzTGdbI2Z7IVxtU2cvOSJQWHF9MjlyJnJnInBxVWBcU1M/PXVJQCcnTmYtaH5XICBLQHY0cEU1cEUuJkAtKVxgazg/LSBASzlbJWAhW04rOSQxWDBkQjBFYCEjMERCdzxaYDNEcTNHJSA5ITA+R05IXnN1fVo7d3RxZ15sI3w/cGsvbGZ4MG9sIDZCYFZTK3RKQ2h4diF8WDVFOW58VH5Od2I/YG0+IHxyUGUmXioqUWpPNz1PWSI6W3RPfm0tRmFkbElTVDhUbjg/ejJMIH04My0sfTItKnYmQDAvPiZAdD9mZHtuKkt7WXQhdEBXZkd5W3hHcjszLHImZCJvaT5TOTszTU5JcE9AbzgxUUAybk44ZnVxQjNaRThcfUBXJlhsRzg5fmJxUnIhUXh0P19UNyRwZStmfWhwWiNyIGZIcHtvTW55RCZjQiBTdjN8OjoxOnIvdXZmczgkYEJBdUVHdD8yXGhdMyE9JnBlWCtAczQgeThHZz99SmUgdzAvbi07LyRgITlUNHVzXTNAIDJhKz8sM1RyUDhJQC16SlUuXHFmUS8uXkAueF1ibyhGUSE2SXpcXlA4a3BaTlIxayczSXNdZz5nPXEuLSovaEEleDAoLEtBK0dCTXclYC5yPCh+KXUscGtMYy4+Q2c9SzJdIjBpMShJOiAjQEdlcF96WCA1cT0vJEozIGZQUWxgQWtDLGFrdEk+JTgwRnl0IDI7MC5rME92MCF4JCBwXS90PWclLyVeLHk+aD5XVktLV0AnUUs/bUg2fD9wUmhQeC1xaU5zWTlvP2wiXzprTChmJ0VwYTAsZCY9NnNALlwheC0ud3I+c1g6QCxuTHkhSnpOTChdO0NKdD83I2N+MkBne3BAcVJCOnt0TjonQT1Xa2Y/MTU/IiBDLjtEODQnfW8wQHN3Tns8I3wyLF0hd2g1cihHaD88KnVJPiIwQTdGR3YlbihubC42YHdmPz0jcXtiKFxkXH1dOCFwYmVaVDY0T3gldVBwLXFrYngxaylAQidgWmFMNWBwaWR9blBkSEIvODIvOSpsXiklVXU/ZEIwWXopSSU8YyB4RWBtXydDJ0ljQERALyc1KUAuS2FWXnpBaHVFU0BCVEVfOiUuMjhcckhINHFDaCIoaGNOQ0cyZDM2ODB4PUdbN3Nvejw5bX1APC5+b0QkX3UjWFskVDZkImA0eCM8PkVSQEIlZC8sfG49YiZzInh9PHJvNHhgRGQ+YzZoQFkjZUlAP1N2MH06LHlQV2heciJzXiNeQ15fXmZCUFtWI3w9fVtkPX4lMkhLKHBeI15DLF5dakJ+JTJII1pJVyBxNHM7ZXkuQ1VJKUgkUkRRKjQpfD4kQ0ooQGshQC53Q198bzcrLG1hI2lSJkd9RCQgP1xpaz4vfDBCKWhzZDR3Inc1YF0nRV8vYGpQWEgnUXBlT0FyKWRZS0JAPzRyeFlOd1N4bW5zZD0oLlA+J0MyJjpNfCpJQ3gjJ01mJUNtc094JGAqNEhQX2RoQi0+Xzh8NnRoIEBtcCNlTTI0TX5lQyw+TVF8TCJ8QG1uIDR3fW0xQzh4TS1caUB5bG9yOXwyKVc8ZEA6SHRBdFl7NGlVUGVeV1FPInhfRCBCfT9lIChFIElAT0B0aTdKTVlRbHNSV2QoUix9ZnhjSGVQR2RSLkghSj5DJlIsZ1EkVzZoclowS3J4XmYgI2xgO1t4M29YQEg4aHFhc0R4TSUyYiBkQEFlTzZwQERbJyV8byN9MEM8Z0pCbkQjTjkjckk7OlouZGg/I3gkYH0ia2FfVX5JK35xLkk0dEgkSEAmP0RbV0A/RzJ4QiA8LzsnX349XFJ6IFxoaHIlSj9tXEg+QCQie0hNLV1vXntAO3B9SURBVCk7NCFBcWhCKV00ekFRUS84M2ZAWXhFRC5qWG9udWoseCk7NCFnQWRfR00zYFcwe0dhfk8mIidYKiF+QCJJPz1oelg7Wn0qLiNlIEA9PCh+LXxsJzgqMFtyaDwnTUBlYUApLEApITRZbER7byBdNXggWmBBSFwyaWg9XHJfVzh1fi1RaWFOYEIzZko/RDZTICB4YCAieyd8KHIgc1AmQ1JAREpALlx6X1dLO1xwR0w4LUUjVlhYRWRoY0MmSkBfQzcjO2RoY0NDQClmNENoMkhDe2tHOEg5cCVUYk1KWStnL2s+bCUgLSpYXEwheD5WfCFPLXp0eHloQH51aCcrY2QuLW0ucnB3eS9sMj1zekdkVkkmSUBOJz9AXysnb3s4YSBoPSonLU1qJUNGaGMhOChdNEEnWXgjPFNAJHA0MSZNTDZ0eSMqRG8iXUBeeHlROmYtWzJ4ZiclSzpUZGhjWDZPJDRUK2Q9STVcd0M7KzlZeSYnOmkvRU8jP2tiZ3IsaGMuaGNYZUBNfmA9QE5FIjtpJDogbn43NmxeQkxDNUFSP2pxXkVmPUI/MH0tUyNNR2JTP0Q2b0klJzQ0ci5ocylvPmpzRFJAJCAic2lARipZQF9cQERDcWhjLkh8Pz4yLD17KHItcF9EOE9mJH4mbVtlQy1aLU5FXDZsYl5vbGYvX2t0ZCBAQjNabSJVXndJTkRrPiEjbW5EUkBOKSdoPmdyXkZNYGUhYEQrXCY4IShNWlQiZVJqNEliMm1EbVAid1NtfGtlLUBkLy42a3ckYFJzNCAieycpNERwXDQzfi9dMkFOd0NYPD1kcUVtLnw6X0h4dTgnRS1YSkc/XFRMNmdeLG90JmQhTClOSElpJUZwaD1JJkNIQn4ycEB+JWBNUH1AJiRUNEh9VHZuNjtZcFBjYjYvYUMxMnF+WmhGKFRMbUdYX2M9MjJ0PHhwSEhKQGRCcDtTQDpAQy9NcGRBQDwiMHw9Ji9hYSUgKyBEKWE0UUFocUpAXWZlKFwkaWg+Nn1lQzI4bGJETTxOUVVwfG1SICQgLXwvZktKP3A5MiAjMkQ5Ul5ZUCJrKSIuXlVie31zXVJAIlFnVndoMkZDUjRJImJNdHE0WUZEeEMydDw8RkMmQiExYV9KUEpNYFJ8SDRZb1xkJH4+P0FFLCRcZURKP1lHeFNaYCxaXzBkcyh8Wl0kZF1FeCtgTVtQeGhBViF4JGA1bDRUYV5AYGUlVFRcMCBSQEY6JSAtUkNoYXN+X0NFJXZ7cCJBaFN8XF18M1xuQnpVNWxvN1VCaSZXP2F4a2F9VSVUVVVBM3EsbSckYFJrVFkgUk9AaH1EYDsmLlx8P0htOWwmMTgkPChyLiNRI11MdkNoYXNeJiRIcltzcF84OH5qXzhhajhlenc4bWFTOVRaOH5KbytFQ1tULERkI09Ne0NlNVRbUWlCJTVVUCYxOCQ8SD47UCoxQltMIiAtTlIxRiYtSkpheWsoMj9jVW1dIWhmLTFrW31fRWRfQjJQQElAe0o4eUpHaEJZSTlcVmp+VilrayphcVxuIFJCSUomb30tLCkhWk8nRH1ALkpYXlJATTpwNHltfUAuaiheWzVba2B1bWgpfG9lVEc4aSA1T1pzRTksXCAuXV1iam4xK3dqZXErNCwpMWBAW1hQUmZoP2M8OGM7Kjh3QjV+MnozX1ZdKl00WUZkJXB1Zyc8NmszdDx7XWVuLTw2dzw6eytSOGVcKWt4JXx3WDVVVVA6dSpML3t0IEApWGpKeGJWNTw6XD9pI0AqJFhUUGkqOEBzOz56JWA2cyEoamgpR2YtLFt9fiV0XG0nbzc3IUl2fGMubTAhbHdBQCQyXCM9KSlPcShLP2YjJTo8XCpXOVBxNnZWTllscHlTJkF1czZsT1lZO2NJKEwvIWlZSEBRX18jRltdeGAyOSM3YD4xLCtYXk9Cek5NKisuTC8haVk7NztxO01vWjtuICQuW21zVzlwbXhDQVVUUFN8eHF3TX43O3E6fSE4ek97QnhKOy4kcyRoWUg2Kkh3WEwmUn4lMkB5XkhAKWMyQEl9L05GIyNYQDFhejNuTig1VkorLl1hZXZULU91OH5nT2t9OyN4fjtyXztIUCFbPXh4fC8iNjN5RnxvTjBoMl9TbjJYeXRgcl00STg1JSkuJUREIil4L099QUs7fVssRUR6Ri1uWSN1MTw4fnIrTVtoXTNtbzpXTzRtJ2hla0lQWHs6MXRSPHR2Jk00Qml3RGJwUjpXMEJ7X1xJJjgtZk1WaE12aFxmYHggfEVAZWozWlkjW214aFZYcHEhIyxBNzstO0g4XEhYelx0XC9ONn1MVzd6RWF1clNONzQ9Lj16NT1fdEZ0Kz19a1p0JjRGXDhde2N4eGcuMWJeMWVmRmFWalA3cSJ6Sm86I0R4YXFKN088aiNcOzwgUl4wPSIjRi5pMHBKSiM4dSYsQEJRS0ZgRWlWVFRjeSV2IEFFV1MrOkNBRHlYVn5dcipWWERpYWw8VlUoekIuYmtWIGFdSWFIXXcvOTdyU2A2Wmd0MVY8WysofS8vZWVlZk9NZjJNeitqdD5FbjFaciF0JDpDJV1rMVFiQUEldnJLKTxlUFFYK0RYa0tHYndDK1FPaUs5NXRaV0tpeH5nYUh6XiorXEhIIm96ZGI/Pk03eGoyS2IjLl5sb0dqcFZRIV13Sj40cjRceT1VZ2BXXiVwYmguV2BjSWpoTipPKj5YcjtPaVtLI2s3YFJaKShAYz57OUFTYVdROUkuM2U0X05QNylQb2xzYXtvL341fjRbNyZGJnx1VFhjdkc7dHZ1UitYUz5GfTZqcmU6Vmo9X3NwR1E1VmJPYSFqJjRbbGhITXlZWlZgU1E5VldUYndoaGwueX5McC5lbE85X3c0UCFUR2dAUyNoKCwmWH02JURESzs6XT0qQV1RQ1paZ1ZgZ3EwXENvL2N4PiN0LCxrPnleXiZgQEYqXHQ5fnwnYWhROUpzLUBOeFkzW1ImTHh0XzNBP3x0dDtdQH0zIVQ5VEVDcHdAXidfeFxfOmhsRiIsQytgOENHNEx0JXpETT9OdCZoazo6bC1EbUFgb0kudlpgcGA1eWAuLkZ9QSFjV1E1JWR5UkA1als4fFwrSidAOWRTKmE4clhaWS46VidDR2BXZF8meEtFOl9feSpWJXpcQ1x8Yyt+aHZFYWVVI1ZIKDUwMXckMSNqVmktQmteM1BfUGdpU0xVQXsyaCxqWXQ1cnNUejpPPV13cnhNTjM4eyJUZkVnWzMgajcgVXE1VFRqWD5aPFdcfCk/bnNMUzF0bUlKeXEiVlVcW2pLSSk2cmxhSjE8Qm52aG1+QGV2QmNyQ2dyQU0odCstby0taGhSPHtAZjVaO1o8V2NFalA5W2YkVG1IaDwoRSw0MTpdKk5FTW41VHJUYG5KU0orTXtyWTU+RnE4Y30tclNMeXRGSFRkSHwpL3dmW1VWNHl1I34+V2haPFNLYEk0UTV5I2I1e2BdeF59YE8kJCJheDp7K0lPN2hdLUBQW1AuWElxNEIhX3drLkU/cXQ+ZitcM1BCKntmTmdDPS05SkwgRi15ZTApL0c7QHN+OUlEQVQ0I0ZxNjpPS14hWkVXOCYjPD1DRGFeXl0+PXA2N1p6bzRQfC9ETXFSKmNoUXkvLCUqZ31uPi5+fS5mdC5bckF6eFEkeDB+cG1RZjp4IFI8On1KY2s7YkBePlp5eS0uXmhnKFE4XTR5eiFiciAoNlxIb303VUNRXClqS3VKMS1YWzZhOCNhezV6I3csN1tlYy4vM1x2fiJiYyhDZ204RmotWlRaOjZdcSU2L0M7LTdFZWglVEV4Qiw8YjxiLmxTZyE8YnJhdHhcSFViIiU0JkNAJlMoIWUsOipkUkFnazBibThuckFoLX5MNnRTPHomdlV9cHl8Yl1bOzcvLnR3d2RncHdee3F7aT0gbF4/LEVhW1xQbSRoe3hwZmhee2VVRl5yJ3IoQE5oKX1cPlc+RkVII1BfMH5EelghRD1RfXExPVh0Xzp1Rig+KS1wMFltMFVGaz9TXk5yc2IraTBMfD0mKyJ3STV2MXdRWnpKL3tyPkRNNiVUfk1sJ1ojIS8zP0ZcPkd5Klw0W0Y9Tnp1dVVnQkFwLTwhUVJFcCpRU1BFV0BfNExHJ3g6Wl9LOE1QODlCLmsoRlJ4KGZVOj1aSlw0R0MwOzxdQllcLjwvPnFYOThfdE93T3d1d013SkciRVNfRHQmej4rQmltK1lwM25Fd2M3dFhQJGA5OzUuND0oJSZvQ091cUs+VXVkKWgobjZ2fl0saCZPaT89U2l8TEooKUApemgnfnc3TnVAPWBsN0hjbThcN24pX3Noe0E9RmZSVXRSWmgxdmUjPVc7KF1dLCx3MkpCbCY4cGV9fFgmVEI7aTtpUD5PIShtfVNKOjdOe3hsOlkrJUJ4bDZ2VXlMPG51OTptKz0qNSxtRFk+KFQ2LHhhMGZdM2MxN0lQeUFAZTgoKWVQTypHP117a2ZjfDw3c0NBQEYpbDRvMHdjL2Y9JlVDNVNbSXVuKn08NmA1emZSfiU0Uj5qQVNfUWtuflNpfnhtKCEmPnBKOCJhLExdWnonICB9WjQ/PVVqOk9uXk9TI1hZPihUUFFwSVJ+YCphRn44JVhYUzd0YVowfk1qXG5oV3F+YygkYGE/IVo2ZDpOfEtAaytIRmkqIE5EYzJoJ1ZZOFRRT1NJJT1jKkUsPzFnT0ZZP1F8WjBmdT1VQDU8LlBLdFVIJFNIR3UzTiwoT2UjcWR7KCMqc0o6PF5mU1ktTno1LVdbc0FBQDNoc3hmJDJ2Ujp4OzBPWWBhRi9dRzxId3ZRdE4tQzMpJEJxNC1jKUNkTUYxfmUjdjd0VkxmP3R2QHldQVBucz5JICJaYSMhOF54dTM6Sk17aTo4WjlLRFwlWkxyZEwkJlBhc1hgcF1zWSVWdjhxcEBrd0NvaEBHcWxKJS4tQUdoLy0sUFF+ZU5MeTxEZHUlTX5oN356QEFTVkBocnRwem0sSjEwdSpyISp7aXQqJSRgW1VKLXV4XHBwd30oK0V7WTwxaFw+aGxESGdFbDM4XF1PYHleRmojfDo0Jjc0VmNaLTplRkZZZzIhcXAmeitmXnpWIkQgcjZ2fWljaS1baVspKnEtS0MhdkRnanQue2spYCZFaWAqMUhFQnZwWyMiUkckelRZYDVWfll6SXtKPTRXcz09I2YrLTduIy5bfmwzaldoUydOZC56Kzw6VjxAQmx1SildZzlxKzBwOyJwOWNwOGR3QG93QXM6XURraWVDRS1xK09gLGBKJmBPTyl3IVo0VFVEVS1ecDd4bkVwZEFMWVh7Syw/cnZEInBHQHtpPTpkKV1SOCpwRU51fmkzJlZCe20sd1EuPExHY1k9diBgcSBzLDhRPSxtM0FtckFtdENvdntpPW9CIlApeCd9JjhOaTpVRzBuNGgnTUR5aWJCKklpS3tWYHcqSl8lOmlddTheNVJabik2MHJgUjk0RD9+QzU4Xj0yfT5ebiwgcz54Nih7XXR5T0BdbHMtN2kmOlIlflo1NFNKekNJOSVSQi5NOFw9Zl4vInpdSDsxbFt0K3ciYHdrdENleiZYKGNVKy5bbGhKZiVkO3o6ez5eXXRtdzt0X05pb0dPdyQuX3JsJXpXLkdpSmlLJTk5aEdMfWIsQFJ0LV4yNC9ZUD5fS3lqVF5gJVcuO3h6eXtOU0NzbkBzVHBUYEIpRENJQilkQkFkXXRsPjh6KF1dVkdrdHxNdz9UPX18VXB2RWVhckRBfnRqNCVHJHhMM05jSGhkOjg+JH0uJWhdPDNSJiFEIUdTJ3QnLHR8fTojVDxuI1p6c0BlV2ZjTkNZJ2EyUn1uQnIhSVkwO052PHNCbC8/ZkFVOnVZLXRYIiFaS2IwSjhdcUIiIWRfJiFKdzRIeVVYQTpOMG44Qm4/bk0oNHojYVZNaCxHTz9taFlrL31lN2VZTkZZWHl+SFNpYHghZGBvVTcsJCAhQFpOIThIaUhlRC8lQmc4SWllLEtRfEB5IHx0Tjx3WWBwO2BkIW42Q0VnQjN3LFAkaD4sZDIpRGAsKiQgWWplaF0jRCJ0bEciSnAxTHkqRnkqe0NdfTsoWilAbngyWTgwIzBIeTBfaGk/XTRyK0BVOXFCZUJUXlQlKDNhUTpQdCE+Rl98VEg7Y1Z3Q29pNWNUdF91ZyJCPyxhbnY6XyY/Snp0UyV9IzgqajZ6K0ZjNE0gSUxaRGxmOGBINEhZYnNeOVQvfl4yR3FIQT86aG04ant0IlpwQyxxd159KjMhU0AjWjlFLD5JL2Mob0NzdWtgSGZKSC1OI356ZydOYycwaWliYz8oc3decy8hJDAuW35EIDd7IzBlLDllQ286MU93YztUZnR2J255SC4oKWw2dCUzfUlBQVQnYEtCY1Zseno2PTI3LXNDZXNBO0ozWGZYVV1VXV1VQH1sQypZeGIzTS1KKzR+TFh0JzRUID1mbkNze0JwOCF6Lz87aFs2dVVuZD9qPSxCR3lEOU1fS3lXKit+eiIlfndTY1o8MT1+OGR7MjBiOi06Kz5EfCE4Qj50WX5pPDdveHxRWERaWFheRVRRY3BsfG5nO1RWI31KTT8zO0AhOn51KDNuVGFLVHA0a0xwUmgsKUJTTmA2c00weVFrUSh6fjJjN34uPzdDNl9ELHt9PCh0TUs9YTUpeHomXHM1IG1ZeGBLJmRqLEgvSVB5dnNtQEQvKEZ5TEUlXi8hIkNrKmhabn1nX0EpMnlRZnRRUDhlKmEofW5lezBgUXQnbUE8NGsoei45JzMwcCc9TThQWmtGcUA1blIrPjZLTHw8LiNAZkR2KG1AYmlsPmx5MFVwWEwwQzwyc1E8NHdBVEJRNEQ1JzBoemNNTGBoQGV4Zm1jd2RhY201XHR4OyZJRWk9YHMjYCRNcDU0Il50WXhZdF99TzUiPV9mcSkpU0NsOXg8clE8eTpyajZuRXV7YWc8YXxnP2UzekxRdF5PRChaJ0Y2IV5beiV0XnVdV01tblRYPEJ0W1NyaV0mem4tRWlvJVFVeGB3L1JGfjxqV25QMXgiNCMmIiNQMHQiP2gqKUNzdURuWF52XnwmSEEoakB6Zix2VDQ2JiwuMnFBKkF5U0U1eHN7OlhxXmtHKipyfCBLP1pBImVockYnSDB7OyhnZGorcUxQNHA0ZVZ8fjY8Nm0zOytrYW06fF4xOjB6bEhHZUxYc1wuWFx+ay14L18/O1JANS1+dmN7MTozalwgVF5uS3BWUEMpL0F9cTQrKH1+WzZQaUI2PDh5I30mbUZ5R109cjF0W3ROPDtvPyQ6Lz5+Xyd9M11LQ11XX0dtdH4sXVFcdjRzNWBebT4wNmB1eHZzJlhcQWlgfEwuX34uajtlI3pOWklEQVRqaEBpTS58ZUYxOEdbLShxNWF6cXBaZ0VKSTNDKkdeZjlYPHBSPDx5PW8vfXdtKiZvaz56bS1ATTl4emNWWiFIL2kjUDZkNEpLJ1hNOj18VykgezprO15wLn58YnQ6WGA5UUZNRH06S1tmbnJcM3A0YVg4MnRPc006OCZfLUBpXTo6Y2svYn1WXkNzJj8qeHF3NjdfQD1AfjFAXlZQJCBXTUFMT2sheWEleGoyS31TI3x9P2M9NXJtTH4taV5fPDxQJUhxRVA8X2tFeTNSdHYsaUclOk4tem5FWkk1bnZaVlFLZUUiXih4d11rPmRUR345PUArMiJTP0spYk5pcjwxeTtoSkw/fTdGTnwwWV0wW20kJl0vM214cygmaCUxSlxSQiVgfDlFWWZkV0I7Z3wsWi5McDhcQklEbiFxfG8rTHY5XCc8MFo1Plx1RFVpKD9hfmU6ZFFWZSZhPHJwLzFBbmlELlFOIEJ8XCJIbEFDKzIpLWprYTFKbCJtXUstWF9iJEhTaVl3LHJPYXRELytGfUVDRiB9fXJtPl07Jkg+Omd3ZUQpUWIgaFpiSlpfVVZSTlQzJmx7UEdRUkYhNyEwXXtaRXNbVSBNIyE+V0V5X3k1J29oLXhreCoiMz9DUCVRIHMtPyowai0oIlxFdTV2XDBHMVg0ZCQxQiFRIy5MXkQiLD5IcG07JyFqeyE8Pjp9JUQtKG8pKEZhWTVGUFp2OV1aMTc/UWwgZjJqLH4yalluc1RtUlpxNV5ATkIiPkZcOXQ0LmdEeGBBR2lcRSBcJ09EM2JxOmxwOG0wMDtpW0pjdHYndHxac2s0biYsKFVpIyx8TnElREBFdyNcbS9QJEtASD8/Ok1BWG9Bayg1Uj5hMCU6PUp1RGZZJX43a204WlM6V0p9XiVKIVMnfksnTjdLQEJLKFNKLUBRYWhGMUU6M0p1SnNgLV51MUFpW1pWaDsvXXhcYzJCKF8pPChIXnw6U0hCMSFfS15YfV44QDc3J3BTWm42K0c9bVtCLCR9dFwgfUdJT3x0X1NpQGY3aVpWQ2klOiI2SjAmemkxeFFBTVFaPm87ZFwrUWxLfEcib3VwUmEtcE0tcS1AUWI0YGlZZWJ0M0hsb0BDYWNRNGQkSkEqfDt4NUFbaH1sXk4gY1NabihUPk1hdjhhSSQvZCFnKDdyLG12WyUgLycqdENrckBvcCR6dlRaP2ctWm5tLj9pOUYqLkEoNUMnIns1W1BjYG51Ulo3O2VtQFlVKDh2LEx8YU9pJXxUbjI8JiJFdFBJJEo6VndHYjcwcj5gbmVLfjgrUTxPRS5zSj9GdiVwKy1LLyMxdztyTUA1LypDKCNEeV08RGUvWUBGLXM2T35APy19N2p2VzByPl99fX0qMWNUUWJvP3Y9XzwnPDZ8cyF4P3VxbGAjPExHaFQie0M/ZVhzS01GMy9bR19wTTBHcigkIHd8Vkp8TStvJWhudyEyQzNfKX4zfj9RN1x6YCRgPHQ1bHp8ezwlK1hmeEY3fj9GN34/ZX5OQz1+fHBZXT81fU1nQjp6Vmt+KCwzbnVzQHZrSjFIT11UKDQgPT5oclUiJ3s4Vy9KbDBecFRZTDc0RWAkICU+PEg7YHwtIXwoakl4ezdtL1Yhe0goVyFiRkFmQX4pMz9XSz9wPkB1cWNQKkg6KDlUNWIoKz5xc108XVw0XkJZaHgkNEpEdW8pXnAkYH51aCxycWBVYXBqYnZedX17bCw+cGxBOUd9KEFfd1R9JDVLMTx9bjQsV3pJP0ZJP2NANDZqclNFPSd9aj0maiQgPjtHWFdsKU5eelwtMGotMWo0SnJ5byh+eVF8Oz1bdC9kME1GbyhYPX4wVkM0U2goSk5NNHhPM2p8PXtyZ0o/MFowY192dXdWM3JubElkWEpeR19OVHhhOGlFdWkmfkhWKntMKjMsS2dpSUA4JG98JSBQITRRMkh6Wlt+LW9VX2ZaZlhgVjx7KXEkYHpNWltqPXVvLEdJeTVkWHBnUXwuQlFdSklBPCxIPCxSKHE3LX4qMF99fT42OENnN19zYF9zRnFHYmd6WGEnZEVJKCk2TVs/UD1BJGhDRHFvY3hSXkBwSVAyazBUbzYlOCJiNEpyTW90QEZMNUdfe1sjfipALyx+KHBkYSUwYC9Maj13X15+MFlgQixEODkmIVhiLy0+emwoLiglM1h0eG9sTTRRMGY2SHNGZixDe0g/YD5fRHthJUR2P1BtKGZce1tTXXRAR19wVXFMI0QgWC0kIEAmSWZASiFqIz4vUElrLHhkW3c7UmYwSD9AST8wSjwvZHNDIUA+P3BfYUdiTXxeLjMrZ1lmbHdAY1o5TCY4bDJkQUAwR094T212VWJALydccn0nT2tgJ0BObnBbMWdxRWBsUiJQQERgdUZwP1Q9WVYyfENWT3lpWTNTXTV9MFpsNXppMy9nMWZmIXpVOFZRQmMoSlx0Y0FNamw2XW9JQCUgUEMkNUtAcCtMQENJPi1oPVBrdVJYJWEvd34yVU1TNTxzZ3B+Y31XdGEvRj5wcD0wW2p+YWxiQEMlYDxKcVBrVGp+YVgleSZBQHdAeyxxb29+b1NXUmAkTjBPYTkoYHcxT3o8PjRxPFkoXmEuQXk+eHI4NVpWe0ElSTxKbCEoQTcuX2c4VHZxKDZSNkUgLms+Q1ZReE83SFJ+YDVuayEkX258fGsgfG9tIS8gNzI2Z3BcST9QQFBAKiR5OFRxVWdVTVZmQT8vMENPWzI2Z3BReGE1bThAI1BJUTJremsxQFhDYCVgYDEocTMscENgYiMoe0IgTnNsKGhPXjR7MUxsKm4wLSRzeC4lfk0+RXxbbytuLk4xSipEJVc6MFFCZ1YoPlZ7fnc/XWwwPyxQZExLYmdoP1B4eCxofCY0NShdfnZXN0lAZnBgM1QwYlIweDZSIGR7am5Ld3sxJ0o6KDl3KixQXkh4WTMsayJ5dV9calZQMydcckMvITxKan49PENqXzBqT3U7VSc9eTZgUFhcOlJkVmZ8KjV0MXE4fFgyWCBeS0BCalYoKUc6Wy9oZy1XeFZSMzgoUXlnRDt4ZF5cfHBAXEcvPTwsTWcoOTVKNlA1UDxiLCc3bS5leCFydj9VUGBMUz5SQz1HX3BtX3ljcVo0ZGA3elBAIWBDUmpgY3hDZSBjIUBAJCF4eFxLZi92ZTpScDlVfFlISURBVHAoa0Exaj13Kjh6fDBQOC54UHJiLFlfZy5bQD9DY3d+b3ouaFhDMVBheHwuQXZFIVd+SShzKnM0OSx6VGhwaDRUfjZeOWhVMzYhQ1FiUidRXkE+Q1FSKygoLlZoVDFYfi4gOV8oaj10WlhiNVI/TDt4Zmd8Zk1KPlNmM1U4UHAgUCF7KHxdZnFeW0x4WzAodkElSmI1OzNZeDhKNClKQl9scEJtMEpAamUgS0ArKDxzZ25+UzM0fFA8NCwweSwlSjgpaSI/eCxrdHAgMFRwelRwZT4oN0JUUSJmNFFCb1xacm1zJWQ/RHtALVdGaTFRcm1cITRFX3orMmA1b3NtVTVGQD9jPi9hYCBkMW18JGR2MGomMjA7JTMqcHEobnx0emkvcE09Y0tAYDc2PlIhQEVCLEE4VEFSYSEraWY5fUVJKDw+MjA0dSU3V0BDQH5QNnhGbXx8R1V0QF9uVS9jfC9fWi9VPUpCMElYJFsgR3BFU2Y+UVNrJjE9X3c7SlYva2hKQC1LNTUvKT9kYT8qJDVRcmd8MTguXlhlfnx2X3wyZE42eCR4fm03ZkFjJUBcfXhxNClKcmVyPm9nQHYnLEdAJVBHR1I+XDY2e3w/aEhYVltdZjlmKD9tIUAlMEBkNGRebnouQF84K3E5JCshXEVCIDxTcDpJVzBtNH1DSytKQkFSNWwyNj86eSItIyI3Vm1qYyFVUDBGRlxIWXpUQGZUeSYwbF5AP0MxamdFNVNOS1QqeHVhVVg2fD1GPU5rd3dAPT9gcyBFPj8xW2VsY2NzTmxCLTpPdTIrMi19SjkvK0k/MD5BLnk+J0k/UD9XPHl5US5JMiw4TWY=8f:T1018,UGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogRGlzY29yZCBhdCAlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lXFVzZXIgRGF0YVxEZWZhdWx0XExvY2FsIFN0b3JhZ2VcbGV2ZWxkYlByb2Nlc3NpbmcgZmlsZTogMDAwMDAzLmxvZ1RvdGFsIHRva2VucyBmb3VuZCBpbiBHb29nbGUgQ2hyb21lOiAwUGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogT3BlcmEgYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXFJvYW1pbmdcT3BlcmEgU29mdHdhcmVcT3BlcmEgU3RhYmxlUGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogQnJhdmUgYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGFcRGVmYXVsdFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IFlhbmRleCBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcWWFuZGV4XFlhbmRleEJyb3dzZXJcVXNlciBEYXRhXERlZmF1bHRDaGVja2luZzogTWljcm9zb2Z0IEVkZ2UgYXQgcGF0aDogQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXE1pY3Jvc29mdFxFZGdlXFVzZXIgRGF0YVxEZWZhdWx0XExvY2FsIFN0b3JhZ2VcbGV2ZWxkYlByb2Nlc3NpbmcgZmlsZTogMDAwMDAzLmxkYlByb2Nlc3NpbmcgZmlsZTogMDAwMDA2LmxkYlByb2Nlc3NpbmcgZmlsZTogMDAwMDA3LmxvZ1RvdGFsIHRva2VucyBmb3VuZCBpbiBNaWNyb3NvZnQgRWRnZTogMFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IFZpdmFsZGkgYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFZpdmFsZGlcVXNlciBEYXRhXERlZmF1bHRQbGF0Zm9ybSBwYXRoIGRvZXMgbm90IGV4aXN0OiBDaHJvbWl1bSBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcQ2hyb21pdW1cVXNlciBEYXRhXERlZmF1bHRDaGVja2luZzogTW96aWxsYSBGaXJlZm94IGF0IHBhdGg6IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1vemlsbGFcRmlyZWZveFxQcm9maWxlc1xMb2NhbCBTdG9yYWdlXGxldmVsZGJQYXRoIGRvZXMgbm90IGV4aXN0OiBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xNb3ppbGxhXEZpcmVmb3hcUHJvZmlsZXNcTG9jYWwgU3RvcmFnZVxsZXZlbGRiUGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogV2F0ZXJmb3ggYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXFJvYW1pbmdcV2F0ZXJmb3hcUHJvZmlsZXNQbGF0Zm9ybSBwYXRoIGRvZXMgbm90IGV4aXN0OiBUb3IgQnJvd3NlciBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xUb3IgQnJvd3NlclxCcm93c2VyXFRvckJyb3dzZXJcRGF0YVxCcm93c2VyXHByb2ZpbGUuZGVmYXVsdFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IEVwaWMgUHJpdmFjeSBCcm93c2VyIGF0IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxMb2NhbFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGFcRGVmYXVsdFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IENvbW9kbyBEcmFnb24gYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXENvbW9kb1xEcmFnb25cVXNlciBEYXRhXERlZmF1bHRQbGF0Zm9ybSBwYXRoIGRvZXMgbm90IGV4aXN0OiBTbGltamV0IGF0IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxMb2NhbFxTbGltamV0XFVzZXIgRGF0YVxEZWZhdWx0UGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogQ29jIENvYyBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhXERlZmF1bHRQbGF0Zm9ybSBwYXRoIGRvZXMgbm90IGV4aXN0OiBNYXh0aG9uIGF0IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1heHRob241XFVzZXJzXGd1ZXN0UGxhdGZvcm0gcGF0aCBkb2VzIG5vdCBleGlzdDogMzYwIEJyb3dzZXIgYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGFcRGVmYXVsdFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IFVSIEJyb3dzZXIgYXQgQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXExvY2FsXFVSIEJyb3dzZXJcVXNlciBEYXRhXERlZmF1bHRQbGF0Zm9ybSBwYXRoIGRvZXMgbm90IGV4aXN0OiBBdmFzdCBTZWN1cmUgQnJvd3NlciBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcTG9jYWxcQVZBU1QgU29mdHdhcmVcQnJvd3NlclxVc2VyIERhdGFcRGVmYXVsdFBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IE9wZXJhIEdYIGF0IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE9wZXJhIFNvZnR3YXJlXE9wZXJhIEdYIFN0YWJsZVBsYXRmb3JtIHBhdGggZG9lcyBub3QgZXhpc3Q6IEZhbGtvbiBhdCBDOlxVc2Vyc1wlVVNFUk5BTUUlXEFwcERhdGFcUm9hbWluZ1xGYWxrb25Ub3RhbCB0b2tlbnMgZm91bmQgYWNyb3NzIGFsbCBwbGF0Zm9ybXM6IDBQcm9jZXNzaW5nIEZpcmVmb3ggcHJvZmlsZXMgYXQ6IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1vemlsbGFcRmlyZWZveFxQcm9maWxlc0ZvdW5kIEZpcmVmb3ggcHJvZmlsZTogQzpcVXNlcnNcJVVTRVJOQU1FJVxBcHBEYXRhXFJvYW1pbmdcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzXHl3enU3ODcwLmRlZmF1bHRDaGVja2luZzogRmlyZWZveCBQcm9maWxlIGF0IHBhdGg6IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1vemlsbGFcRmlyZWZveFxQcm9maWxlc1x5d3p1Nzg3MC5kZWZhdWx0XExvY2FsIFN0b3JhZ2VcbGV2ZWxkYlBhdGggZG9lcyBub3QgZXhpc3Q6IEM6XFVzZXJzXCVVU0VSTkFNRSVcQXBwRGF0YVxSb2FtaW5nXE1vemlsbGFcRmlyZWZveFxQcm9maWxlc1x5d3p1Nzg3MC5kZWZhdWx0XExvY2FsIFN0b3JhZ2VcbGV2ZWxkYldyaXRpbmcgdG9rZW5zIHRvOiAiQzpcXFVzZXJzXFw5WlVHVTJ1XFxBcHBEYXRhXFxMb2NhbFxcVGVtcFxccnVudGltZVxcYnJvd3NlclxcdG9rZW5zLnR4dCJObyB0b2tlbnMgZm91bmQgdG8gd3JpdGU=90:T54dc,U1FMaXRlIGZvcm1hdCAzQS9lYXJseV9leHBpcmF0aW9uX3RocmVzaG9sZDEzMzE1NDE2Mzk5NjcyNTQ0bGFzdF9jb21wYXRpYmxlX3ZlcnNpb24xNnZlcnNpb241OW1tYXBfc3RhdHVzLTFlYXJseV9leHBpcmF0aW9uX3RocmVzaG9sZGxhc3RfY29tcGF0aWJsZV92ZXJzaW9udmVyc2lvbiNtbWFwX3N0YXR1c3Zpc2l0c3VybHNESXpPQ1V5Tm1SelgyRmZiR2xrSlROa2EzZGtMVEV3TkRjNE5qSXpNVGd6SlRJMkpUSTJaSE5mWlY5aFpHbGtKVE5rT0RBeE9UVTNNamt5TnpBeU9UUWxNalprYzE5bFgzUmhjbWRsZEY5cFpDVXpaR3QzWkMwNE1ERTVOVGd6TmpNME1UY3lPQ1V6WVd4dll5MHpNaVV5TmlVeU5tUnpYMlZmYm1WMGQyOXlheVV6Wkc4bE1qWmtjMTkxY214ZmRpVXpaRElsTWpaa2MxOWtaWE4wWDNWeWJDVXpaR2gwZEhCekpUTmhKVEptSlRKbWQzZDNMbWR2YjJkc1pTNWpiMjBsTW1aamFISnZiV1VsTW1aaWMyVnRKVEptWkc5M2JteHZZV1FsTW1abGJsOWpZU1V6Wm1KeVlXNWtKVE5rVmtSTFFpVXlObVJ6WDJ0cFpDVXpaRFF6TnpBd01EVXlPREEyTkRZeE1qTTJKVEkyWjJOc2FXUWxNMlJoTmprNVltUTBOVEE0TURNeFlUSTBNemcwWVdRNFlXVXpabVZqTXpOaVpTVXlObWRqYkhOeVl5VXpaRE53TG1SekpUSTJKVEkyZFhSdFgzTnZkWEpqWlNVelpHSnBibWNsTWpaMWRHMWZiV1ZrYVhWdEpUTmtZM0JqSlRJMmRYUnRYMk5oYlhCaGFXZHVKVE5rTVRjd056TXpNaVV5TlRJd0pUSTFOME1sTWpVeU1FTm9jbTl0WlNVeU5USXdWMmx1TVRFbE1qVXlNQ1V5TlRkREpUSTFNakJFVWlVeU5USXdKVEkxTjBNbE1qVXlNRVZUVXpBeEpUSTFNakFsTWpVM1F5VXlOVEl3VGtFbE1qVXlNQ1V5TlRkREpUSTFNakJEUVNVeU5USXdKVEkxTjBNbE1qVXlNR1Z1SlRJMU1qQWxNalUzUXlVeU5USXdSR1Z6YXlVeU5USXdKVEkxTjBNbE1qVXlNRk5GVFNVeU5USXdKVEkxTjBNbE1qVXlNRUpMVjFNbE1qVXlNQzBsTWpVeU1FVllRU1V5TlRJd0pUSTFOME1sTWpVeU1GUjRkQ1V5TlRJd0pUSTFOME1sTWpVeU1FSnBibWRmVkc5d0pUSTFNakJMVjBSVEpUSTJkWFJ0WDNSbGNtMGxNMlJuYjI5bmJHVWxNalV5TUdOb2NtOXRaU1V5Tm5WMGJWOWpiMjUwWlc1MEpUTmtSR1Z6YXlVeU5USXdKVEkxTjBNbE1qVXlNRUpMVjFNbE1qVXlNQzBsTWpVeU1FVllRU1V5TlRJd0pUSTFOME1sTWpVeU1GUjRkRjlIYjI5bmJHVWxNalV5TUVOb2NtOXRaU1V5TlRJd1ZHOXdKVEkxTWpCTFYwUlQmcmxpZD1hNjk5YmQ0NTA4MDMxYTI0Mzg0YWQ4YWUzZmVjMzNiZSZudGI9MWdvb2dsZSBjaHJvbWVnb29nbGUgY2hyb21lZ29vZ2xlIGNocm9tZWdvb2dsZSBjaHJvbWUrKzM2YzlkNWY2LTllNmMtNGM4Yi1iNmY3LTlhNGE3Yzg0M2UzNiVVU0VSUFJPRklMRSVcRG93bmxvYWRzXE1TTiBDYW5hZGEgXyBPdXRsb29rLCBPZmZpY2UsIFNreXBlLCBCaW5nLCBMYXRlc3QgTmV3cyBhbmQgVmlkZW9zLnBkZkM6XFVzZXJzXCVVU0VSTkFNRSVcRG93bmxvYWRzXE1TTiBDYW5hZGEgXyBPdXRsb29rLCBPZmZpY2UsIFNreXBlLCBCaW5nLCBMYXRlc3QgTmV3cyBhbmQgVmlkZW9zLnBkZmh0dHA6Ly93d3cubXNuLmNvbS9odHRwOi8vd3d3Lm1zbi5jb20vYXBwbGljYXRpb24vcGRmYXBwbGljYXRpb24vcGRmMUc9PTZkMGMwZTg0LTk2MjEtNDFmYy1hNjU0LWEyMzEyNDdiZDY0OEM6XFVzZXJzXCVVU0VSTkFNRSVcRG93bmxvYWRzXENocm9tZVNldHVwLmV4ZUM6XFVzZXJzXCVVU0VSTkFNRSVcRG93bmxvYWRzXENocm9tZVNldHVwLmV4ZS42Z2h0dHBzOi8vd3d3Lmdvb2dsZS5jb20vaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9jaHJvbWUvYnNlbS9kb3dubG9hZC9lbl9jYT9icmFuZD1WREtCJmRzX2tpZD00MzcwMDA1MjgwNjQ2MTIzNiYmdXRtX3NvdXJjZT1iaW5nJnV0bV9tZWRpdW09Y3BjJnV0bV9jYW1wYWlnbj0xNzA3MzMyJTIwJTdDJTIwQ2hyb21lJTIwV2luMTElMjAlN0MlMjBEUiUyMCU3QyUyMEVTUzAxJTIwJTdDJTIwTkElMjAlN0MlMjBDQSUyMCU3QyUyMGVuJTIwJTdDJTIwRGVzayUyMCU3QyUyMFNFTSUyMCU3QyUyMEJLV1MlMjAtJTIwRVhBJTIwJTdDJTIwVHh0JTIwJTdDJTIwQmluZ19Ub3AlMjBLV0RTJnV0bV90ZXJtPWdvb2dsZSUyMGNocm9tZSZ1dG1fY29udGVudD1EZXNrJTIwJTdDJTIwQktXUyUyMC0lMjBFWEElMjAlN0MlMjBUeHRfR29vZ2xlJTIwQ2hyb21lJTIwVG9wJTIwS1dEUyZnY2xpZD1hNjk5YmQ0NTA4MDMxYTI0Mzg0YWQ4YWUzZmVjMzNiZSZnY2xzcmM9M3AuZHNodHRwczovL3d3dy5iaW5nLmNvbS8iMjFmODZlOC1jMTFkMTk4YyJXZWQsIDEwIEphbiAyMDI0IDA1OjM5OjIxIEdNVGFwcGxpY2F0aW9uL3gtbXNkb3dubG9hZGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbUc9PTRjNDgyOGQ5LWFmNzEtNDlmOS1iMDZmLTAyOGMxYTc4MmExNEM6XFVzZXJzXCVVU0VSTkFNRSVcRG93bmxvYWRzXFZDX3JlZGlzdC54NjQuZXhlQzpcVXNlcnNcJVVTRVJOQU1FJVxEb3dubG9hZHNcVkNfcmVkaXN0Lng2NC5leGVodHRwczovL2xlYXJuLm1pY3Jvc29mdC5jb20vaHR0cHM6Ly9sZWFybi5taWNyb3NvZnQuY29tL2VuLXVzL2NwcC93aW5kb3dzL2xhdGVzdC1zdXBwb3J0ZWQtdmMtcmVkaXN0P3ZpZXc9bXN2Yy0xNzBodHRwczovL3d3dy5iaW5nLmNvbS8iMHhEM0RENTRFMDM3NzExMUI1NjUzMUMwNTVFRUQ5NkQ0ODUyMkRBRjhBNTYzNDlFNUU0OTUzQzMxN0MzNzAyM0E2IkZyaSwgMjcgSmFuIDIwMjMgMTk6MTI6NTYgR01UYXBwbGljYXRpb24veC1tc2Rvd25sb2FkYXBwbGljYXRpb24vb2N0ZXQtc3RyZWFtRz09ZTA2NWU5OWUtMDRmMy00ZTFlLWI1ZmQtYTg4OGUwZjY0OTZjQzpcVXNlcnNcJVVTRVJOQU1FJVxEb3dubG9hZHNcVkNfcmVkaXN0Lng4Ni5leGVDOlxVc2Vyc1wlVVNFUk5BTUUlXERvd25sb2Fkc1xWQ19yZWRpc3QueDg2LmV4ZWh0dHBzOi8vbGVhcm4ubWljcm9zb2Z0LmNvbS9odHRwczovL2xlYXJuLm1pY3Jvc29mdC5jb20vZW4tdXMvY3BwL3dpbmRvd3MvbGF0ZXN0LXN1cHBvcnRlZC12Yy1yZWRpc3Q/dmlldz1tc3ZjLTE3MGh0dHBzOi8vd3d3LmJpbmcuY29tLyIweDg3Nzg5RjAwNjY0QjVDNDM0NTBCRUNCMzk5MkE2OUEwNDlGNDdGOTY4NjRERjc0OTNDRjIwNDQxNTYwNzRGOTEiV2VkLCAxNSBGZWIgMjAyMyAwNzozNjo0NCBHTVRhcHBsaWNhdGlvbi94LW1zZG93bmxvYWRhcHBsaWNhdGlvbi9vY3RldC1zdHJlYW0zR0U9YjBkZjAzMjUtZmM1Ni00NzU2LWExY2ItNWIzYjllYjA1MmRlQzpcVXNlcnNcJVVTRVJOQU1FJVxEb3dubG9hZHNcbnBwLjguNC43LnBvcnRhYmxlLng2NC56aXBDOlxVc2Vyc1wlVVNFUk5BTUUlXERvd25sb2Fkc1xucHAuOC40LjcucG9ydGFibGUueDY0LnppcC9NYW9wVmRVL01hb3hodHRwczovL25vdGVwYWQtcGx1cy1wbHVzLm9yZy9odHRwczovL25vdGVwYWQtcGx1cy1wbHVzLm9yZy9kb3dubG9hZHMvdjguNC43L2h0dHBzOi8vbm90ZXBhZC1wbHVzLXBsdXMub3JnLyIweDhEQUMxOUJFQUI4RDZCQSJUdWUsIDA4IE5vdiAyMDIyIDE1OjE0OjIyIEdNVGFwcGxpY2F0aW9uL3gtemlwLWNvbXByZXNzZWRhcHBsaWNhdGlvbi9vY3RldC1zdHJlYW0zRz09MTZkYmZiMTMtNmMxMS00NmVjLTkyYzMtODEwYjI4YWE4YWY3QzpcVXNlcnNcJVVTRVJOQU1FJVxEb3dubG9hZHNcbnBwLjguNC43LnBvcnRhYmxlLng2NC43ekM6XFVzZXJzXCVVU0VSTkFNRSVcRG93bmxvYWRzXG5wcC44LjQuNy5wb3J0YWJsZS54NjQuN3ovTWFvL01hb1JxaHR0cHM6Ly9ub3RlcGFkLXBsdXMtcGx1cy5vcmcvaHR0cHM6Ly9ub3RlcGFkLXBsdXMtcGx1cy5vcmcvZG93bmxvYWRzL3Y4LjQuNy9odHRwczovL25vdGVwYWQtcGx1cy1wbHVzLm9yZy8iMHg4REFDMTlCRTdFQzNCRUEiVHVlLCAwOCBOb3YgMjAyMiAxNToxNDoxOCBHTVRhcHBsaWNhdGlvbi9vY3RldC1zdHJlYW1hcHBsaWNhdGlvbi9vY3RldC1zdHJlYW1odHRwOi8vd3d3Lm1zbi5jb20vaHR0cHM6Ly9kbC5nb29nbGUuY29tL3RhZy9zL2FwcGd1aWQlM0QlN0I4QTY5RDM0NS1ENTY0LTQ2M0MtQUZGMS1BNjlEOUU1MzBGOTYlN0QlMjZpaWQlM0QlN0JFRDMyOThBMy1CRUIyLUNBQzMtMzI1QS0wODA5QUE3MDk4MzIlN0QlMjZsYW5nJTNEZW4lMjZicm93c2VyJTNENSUyNnVzYWdlc3RhdHMlM0QwJTI2YXBwbmFtZSUzREdvb2dsZSUyNTIwQ2hyb21lJTI2bmVlZHNhZG1pbiUzRHByZWZlcnMlMjZhcCUzRHg2NC1zdGFibGUtc3RhdHNkZWZfMSUyNmJyYW5kJTNEVkRLQiUyNmluc3RhbGxkYXRhaW5kZXglM0RlbXB0eS91cGRhdGUyL2luc3RhbGxlcnMvQ2hyb21lU2V0dXAuZXhlaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci84YjkyZjQ2MC03ZTAzLTRjNzUtYTEzOS1lMjY0YTc3MDc1OGQvMjZDMkM3MkZCQTY0MzhGNUUyOUFGOEVCQzQ4MjZBMUU0MjQ1ODFCM0M0NDZGOEM3MzUzNjFGMURCN0JFRkY3Mi9WQ19yZWRpc3QueDY0LmV4ZTNodHRwczovL2FrYS5tcy92cy8xNy9yZWxlYXNlL3ZjX3JlZGlzdC54NjQuZXhlaHR0cHM6Ly9kb3dubG9hZC52aXN1YWxzdHVkaW8ubWljcm9zb2Z0LmNvbS9kb3dubG9hZC9wci9iMjUxOTAxNi00YTEzLTQxMjAtOTM2Yy1jYWUwMDNkNTY3YzQvOEFFNTlEODI4NDUxNTlEQjNBNzA3NjNGNUNCMTU3MUU0NUVCRjZBMUFERkVDQzQ3NTc0QkExN0IwMTk0ODNBMC9WQ19yZWRpc3QueDg2LmV4ZTNodHRwczovL2FrYS5tcy92cy8xNy9yZWxlYXNlL3ZjX3JlZGlzdC54ODYuZXhlaHR0cHM6Ly9vYmplY3RzLmdpdGh1YnVzZXJjb250ZW50LmNvbS9naXRodWItcHJvZHVjdGlvbi1yZWxlYXNlLWFzc2V0LTJlNjViZS8zMzAxNDgxMS82NzAwNTgzZC04NTdmLTRiMTQtOGQyMi00YWViNmRmZTQxOGY/WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBSVdOSllBWDRDU1ZFSDUzQSUyRjIwMjIxMjAxJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDIyMTIwMVQyMTQ2MjFaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT00YmI5NWNiMzNmMDNjN2Q1MDVjODQ2ZTQ0MjU0ZGNmNmQ0ZDczYjQyMzNmYTkwYjk3ZmZmMGRmY2FhNDBiZDE0JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MzMwMTQ4MTEmcmVzcG9uc2UtY29udGVudC1kaXNwb3NpdGlvbj1hdHRhY2htZW50JTNCJTIwZmlsZW5hbWUlM0RucHAuOC40LjcucG9ydGFibGUueDY0LnppcCZyZXNwb25zZS1jb250ZW50LXR5cGU9YXBwbGljYXRpb24lMkZvY3RldC1zdHJlYW1waHR0cHM6Ly9naXRodWIuY29tL25vdGVwYWQtcGx1cy1wbHVzL25vdGVwYWQtcGx1cy1wbHVzL3JlbGVhc2VzL2Rvd25sb2FkL3Y4LjQuNy9ucHAuOC40LjcucG9ydGFibGUueDY0LnppcGVodHRwczovL29iamVjdHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tL2dpdGh1Yi1wcm9kdWN0aW9uLXJlbGVhc2UtYXNzZXQtMmU2NWJlLzMzMDE0ODExLzQyZDliYzM4LTg5ZjAtNDhkOC05NGVjLWQxZjM2NDlkMmZjMz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFJV05KWUFYNENTVkVINTNBJTJGMjAyMjEyMDElMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjIxMjAxVDIxNDYxNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTA2Mzg4ZDc1NTM5ZTc4NjFjNTQzYWJmOWQ5YWVkZDdmOTdlNTg0ODA0Zjg0ZTg4YWM4OWEyZGEwNTI4ZjM0MDgmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0zMzAxNDgxMSZyZXNwb25zZS1jb250ZW50LWRpc3Bvc2l0aW9uPWF0dGFjaG1lbnQlM0IlMjBmaWxlbmFtZSUzRG5wcC44LjQuNy5wb3J0YWJsZS54NjQuN3omcmVzcG9uc2UtY29udGVudC10eXBlPWFwcGxpY2F0aW9uJTJGb2N0ZXQtc3RyZWFtbl9odHRwczovL2dpdGh1Yi5jb20vbm90ZXBhZC1wbHVzLXBsdXMvbm90ZXBhZC1wbHVzLXBsdXMvcmVsZWFzZXMvZG93bmxvYWQvdjguNC43L25wcC44LjQuNy5wb3J0YWJsZS54NjQuN3podHRwOi8vbXNuLmNvbS8raHR0cDovL21zbi5jb20vbWluZGV4c2VnbWVudHNfdXJsX2lkc2VnbWVudHNDUkVBVEUgSU5ERVggc2VnbWVudHNfdXJsX2lkIE9OIHNlZ21lbnRzKHVybF9pZClNZWluZGV4c2VnbWVudHNfbmFtZXNlZ21lbnRzQ1JFQVRFIElOREVYIHNlZ21lbnRzX25hbWUgT04gc2VnbWVudHMobmFtZSlwM3RhYmxlc2VnbWVudHNzZWdtZW50c0NSRUFURSBUQUJMRSBzZWdtZW50cyAoaWQgSU5URUdFUiBQUklNQVJZIEtFWSxuYW1lIFZBUkNIQVIsdXJsX2lkIElOVEVHRVIgTk9OIE5VTEwpdGFibGVkb3dubG9hZHNfcmVyb3V0ZV9pbmZvZG93bmxvYWRzX3Jlcm91dGVfaW5mb0NSRUFURSBUQUJMRSBkb3dubG9hZHNfcmVyb3V0ZV9pbmZvIChkb3dubG9hZF9pZCBJTlRFR0VSIE5PVCBOVUxMLHJlcm91dGVfaW5mb19zZXJpYWxpemVkICBWQVJDSEFSIE5PVCBOVUxMLFBSSU1BUlkgS0VZIChkb3dubG9hZF9pZCkgKT9pbmRleHNxbGl0ZV9hdXRvaW5kZXhfZG93bmxvYWRzX3NsaWNlc18xZG93bmxvYWRzX3NsaWNlc1N0YWJsZWRvd25sb2Fkc2Rvd25sb2Fkc0NSRUFURSBUQUJMRSBkb3dubG9hZHMgKGlkIElOVEVHRVIgUFJJTUFSWSBLRVksZ3VpZCBWQVJDSEFSIE5PVCBOVUxMLGN1cnJlbnRfcGF0aCBMT05HVkFSQ0hBUiBOT1QgTlVMTCx0YXJnZXRfcGF0aCBMT05HVkFSQ0hBUiBOT1QgTlVMTCxzdGFydF90aW1lIElOVEVHRVIgTk9UIE5VTEwscmVjZWl2ZWRfYnl0ZXMgSU5URUdFUiBOT1QgTlVMTCx0b3RhbF9ieXRlcyBJTlRFR0VSIE5PVCBOVUxMLHN0YXRlIElOVEVHRVIgTk9UIE5VTEwsZGFuZ2VyX3R5cGUgSU5URUdFUiBOT1QgTlVMTCxpbnRlcnJ1cHRfcmVhc29uIElOVEVHRVIgTk9UIE5VTEwsaGFzaCBCTE9CIE5PVCBOVUxMLGVuZF90aW1lIElOVEVHRVIgTk9UIE5VTEwsb3BlbmVkIElOVEVHRVIgTk9UIE5VTEwsbGFzdF9hY2Nlc3NfdGltZSBJTlRFR0VSIE5PVCBOVUxMLHRyYW5zaWVudCBJTlRFR0VSIE5PVCBOVUxMLHJlZmVycmVyIFZBUkNIQVIgTk9UIE5VTEwsc2l0ZV91cmwgVkFSQ0hBUiBOT1QgTlVMTCxlbWJlZGRlcl9kb3dubG9hZF9kYXRhIFZBUkNIQVIgTk9UIE5VTEwsdGFiX3VybCBWQVJDSEFSIE5PVCBOVUxMLHRhYl9yZWZlcnJlcl91cmwgVkFSQ0hBUiBOT1QgTlVMTCxodHRwX21ldGhvZCBWQVJDSEFSIE5PVCBOVUxMLGJ5X2V4dF9pZCBWQVJDSEFSIE5PVCBOVUxMLGJ5X2V4dF9uYW1lIFZBUkNIQVIgTk9UIE5VTEwsZXRhZyBWQVJDSEFSIE5PVCBOVUxMLGxhc3RfbW9kaWZpZWQgVkFSQ0hBUiBOT1QgTlVMTCxtaW1lX3R5cGUgVkFSQ0hBUigyNTUpIE5PVCBOVUxMLG9yaWdpbmFsX21pbWVfdHlwZSBWQVJDSEFSKDI1NSkgTk9UIE5VTEwpaW5kZXhrZXl3b3JkX3NlYXJjaF90ZXJtc19pbmRleDNrZXl3b3JkX3NlYXJjaF90ZXJtc0NSRUFURSBJTkRFWCBrZXl3b3JkX3NlYXJjaF90ZXJtc19pbmRleDMgT04ga2V5d29yZF9zZWFyY2hfdGVybXMgKHRlcm0paW5kZXhrZXl3b3JkX3NlYXJjaF90ZXJtc19pbmRleDJrZXl3b3JkX3NlYXJjaF90ZXJtc0NSRUFURSBJTkRFWCBrZXl3b3JkX3NlYXJjaF90ZXJtc19pbmRleDIgT04ga2V5d29yZF9zZWFyY2hfdGVybXMgKHVybF9pZClJaW5kZXhrZXl3b3JkX3NlYXJjaF90ZXJtc19pbmRleDFrZXl3b3JkX3NlYXJjaF90ZXJtc0NSRUFURSBJTkRFWCBrZXl3b3JkX3NlYXJjaF90ZXJtc19pbmRleDEgT04ga2V5d29yZF9zZWFyY2hfdGVybXMgKGtleXdvcmRfaWQsIG5vcm1hbGl6ZWRfdGVybSk5dGFibGVrZXl3b3JkX3NlYXJjaF90ZXJtc2tleXdvcmRfc2VhcmNoX3Rlcm1zQ1JFQVRFIFRBQkxFIGtleXdvcmRfc2VhcmNoX3Rlcm1zIChrZXl3b3JkX2lkIElOVEVHRVIgTk9UIE5VTEwsdXJsX2lkIElOVEVHRVIgTk9UIE5VTEwsdGVybSBMT05HVkFSQ0hBUiBOT1QgTlVMTCxub3JtYWxpemVkX3Rlcm0gTE9OR1ZBUkNIQVIgTk9UIE5VTEwpJ3RhYmxlZG93bmxvYWRzX3VybF9jaGFpbnNkb3dubG9hZHNfdXJsX2NoYWluc0NSRUFURSBUQUJMRSBkb3dubG9hZHNfdXJsX2NoYWlucyAoaWQgSU5URUdFUiBOT1QgTlVMTCxjaGFpbl9pbmRleCBJTlRFR0VSIE5PVCBOVUxMLHVybCBMT05HVkFSQ0hBUiBOT1QgTlVMTCwgUFJJTUFSWSBLRVkgKGlkLCBjaGFpbl9pbmRleCkgKW50YWJsZXZpc2l0X3NvdXJjZXZpc2l0X3NvdXJjZUNSRUFURSBUQUJMRSB2aXNpdF9zb3VyY2UoaWQgSU5URUdFUiBQUklNQVJZIEtFWSxzb3VyY2UgSU5URUdFUiBOT1QgTlVMTCl0YWJsZWRvd25sb2Fkc19zbGljZXNkb3dubG9hZHNfc2xpY2VzQ1JFQVRFIFRBQkxFIGRvd25sb2Fkc19zbGljZXMgKGRvd25sb2FkX2lkIElOVEVHRVIgTk9UIE5VTEwsb2Zmc2V0IElOVEVHRVIgTk9UIE5VTEwscmVjZWl2ZWRfYnl0ZXMgSU5URUdFUiBOT1QgTlVMTCxmaW5pc2hlZCBJTlRFR0VSIE5PVCBOVUxMIERFRkFVTFQgMCxQUklNQVJZIEtFWSAoZG93bmxvYWRfaWQsIG9mZnNldCkgKUdpbmRleHNxbGl0ZV9hdXRvaW5kZXhfZG93bmxvYWRzX3VybF9jaGFpbnNfMWRvd25sb2Fkc191cmxfY2hhaW5zWXRhYmxlc3FsaXRlX3NlcXVlbmNlc3FsaXRlX3NlcXVlbmNlQ1JFQVRFIFRBQkxFIHNxbGl0ZV9zZXF1ZW5jZShuYW1lLHNlcSlhdGFibGV1cmxzdXJsc0NSRUFURSBUQUJMRSB1cmxzKGlkIElOVEVHRVIgUFJJTUFSWSBLRVkgQVVUT0lOQ1JFTUVOVCx1cmwgTE9OR1ZBUkNIQVIsdGl0bGUgTE9OR1ZBUkNIQVIsdmlzaXRfY291bnQgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwsdHlwZWRfY291bnQgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwsbGFzdF92aXNpdF90aW1lIElOVEVHRVIgTk9UIE5VTEwsaGlkZGVuIElOVEVHRVIgREVGQVVMVCAwIE5PVCBOVUxMKWYvdGFibGVtZXRhbWV0YUNSRUFURSBUQUJMRSBtZXRhKGtleSBMT05HVkFSQ0hBUiBOT1QgTlVMTCBVTklRVUUgUFJJTUFSWSBLRVksIHZhbHVlIExPTkdWQVJDSEFSKSdpbmRleHNxbGl0ZV9hdXRvaW5kZXhfbWV0YV8xbWV0YWluZGV4Y2x1c3RlcnNfZm9yX3Zpc2l0Y2x1c3RlcnNfYW5kX3Zpc2l0c0NSRUFURSBJTkRFWCBjbHVzdGVyc19mb3JfdmlzaXQgT04gY2x1c3RlcnNfYW5kX3Zpc2l0cyh2aXNpdF9pZClndGFibGVjbHVzdGVyc19hbmRfdmlzaXRzY2x1c3RlcnNfYW5kX3Zpc2l0c0NSRUFURSBUQUJMRSBjbHVzdGVyc19hbmRfdmlzaXRzKGNsdXN0ZXJfaWQgSU5URUdFUiBOT1QgTlVMTCx2aXNpdF9pZCBJTlRFR0VSIE5PVCBOVUxMLHNjb3JlIE5VTUVSSUMgTk9UIE5VTEwsZW5nYWdlbWVudF9zY29yZSBOVU1FUklDIE5PVCBOVUxMLHVybF9mb3JfZGVkdXBpbmcgTE9OR1ZBUkNIQVIgTk9UIE5VTEwsbm9ybWFsaXplZF91cmwgTE9OR1ZBUkNIQVIgTk9UIE5VTEwsdXJsX2Zvcl9kaXNwbGF5IExPTkdWQVJDSEFSIE5PVCBOVUxMLFBSSU1BUlkgS0VZKGNsdXN0ZXJfaWQsdmlzaXRfaWQpKVdJVEhPVVQgUk9XSUR3aW5kZXh2aXNpdHNfdGltZV9pbmRleHZpc2l0cyJDUkVBVEUgSU5ERVggdmlzaXRzX3RpbWVfaW5kZXggT04gdmlzaXRzICh2aXNpdF90aW1lKVgpd2luZGV4dmlzaXRzX2Zyb21faW5kZXh2aXNpdHMhQ1JFQVRFIElOREVYIHZpc2l0c19mcm9tX2luZGV4IE9OIHZpc2l0cyAoZnJvbV92aXNpdClPKGdpbmRleHZpc2l0c191cmxfaW5kZXh2aXNpdHMgQ1JFQVRFIElOREVYIHZpc2l0c191cmxfaW5kZXggT04gdmlzaXRzICh1cmwpTXRhYmxldmlzaXRzdmlzaXRzJ0NSRUFURSBUQUJMRSAidmlzaXRzIihpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsdXJsIElOVEVHRVIgTk9UIE5VTEwsdmlzaXRfdGltZSBJTlRFR0VSIE5PVCBOVUxMLGZyb21fdmlzaXQgSU5URUdFUix0cmFuc2l0aW9uIElOVEVHRVIgREVGQVVMVCAwIE5PVCBOVUxMLHNlZ21lbnRfaWQgSU5URUdFUix2aXNpdF9kdXJhdGlvbiBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCxpbmNyZW1lbnRlZF9vbW5pYm94X3R5cGVkX3Njb3JlIEJPT0xFQU4gREVGQVVMVCBGQUxTRSBOT1QgTlVMTCxvcGVuZXJfdmlzaXQgSU5URUdFUiwgb3JpZ2luYXRvcl9jYWNoZV9ndWlkIFRFWFQsIG9yaWdpbmF0b3JfdmlzaXRfaWQgSU5URUdFUiwgb3JpZ2luYXRvcl9mcm9tX3Zpc2l0IElOVEVHRVIsIG9yaWdpbmF0b3Jfb3BlbmVyX3Zpc2l0IElOVEVHRVIsIGlzX2tub3duX3RvX3N5bmMgQk9PTEVBTiBERUZBVUxUIEZBTFNFIE5PVCBOVUxMKUF0YWJsZWNsdXN0ZXJfdmlzaXRfZHVwbGljYXRlc2NsdXN0ZXJfdmlzaXRfZHVwbGljYXRlcyZDUkVBVEUgVEFCTEUgY2x1c3Rlcl92aXNpdF9kdXBsaWNhdGVzKHZpc2l0X2lkIElOVEVHRVIgTk9UIE5VTEwsZHVwbGljYXRlX3Zpc2l0X2lkIElOVEVHRVIgTk9UIE5VTEwsUFJJTUFSWSBLRVkodmlzaXRfaWQsZHVwbGljYXRlX3Zpc2l0X2lkKSlXSVRIT1VUIFJPV0lEKWluZGV4Y2x1c3Rlcl9rZXl3b3Jkc19jbHVzdGVyX2lkX2luZGV4Y2x1c3Rlcl9rZXl3b3JkcyVDUkVBVEUgSU5ERVggY2x1c3Rlcl9rZXl3b3Jkc19jbHVzdGVyX2lkX2luZGV4IE9OIGNsdXN0ZXJfa2V5d29yZHMoY2x1c3Rlcl9pZClHdGFibGVjbHVzdGVyX2tleXdvcmRzY2x1c3Rlcl9rZXl3b3JkcyRDUkVBVEUgVEFCTEUgY2x1c3Rlcl9rZXl3b3JkcyhjbHVzdGVyX2lkIElOVEVHRVIgTk9UIE5VTEwsa2V5d29yZCBWQVJDSEFSIE5PVCBOVUxMLHR5cGUgSU5URUdFUiBOT1QgTlVMTCxzY29yZSBOVU1FUklDIE5PVCBOVUxMLGNvbGxlY3Rpb25zIFZBUkNIQVIgTk9UIE5VTEwpRyBfaW5kZXh1cmxzX3VybF9pbmRleHVybHMjQ1JFQVRFIElOREVYIHVybHNfdXJsX2luZGV4IE9OIHVybHMgKHVybClHdGFibGVjbHVzdGVyc2NsdXN0ZXJzQ1JFQVRFIFRBQkxFIGNsdXN0ZXJzKGNsdXN0ZXJfaWQgSU5URUdFUiBQUklNQVJZIEtFWSxzaG91bGRfc2hvd19vbl9wcm9taW5lbnRfdWlfc3VyZmFjZXMgQk9PTEVBTiBOT1QgTlVMTCxsYWJlbCBWQVJDSEFSIE5PVCBOVUxMLHJhd19sYWJlbCBWQVJDSEFSIE5PVCBOVUxMKUF0YWJsZXR5cGVkX3VybF9zeW5jX21ldGFkYXRhdHlwZWRfdXJsX3N5bmNfbWV0YWRhdGFDUkVBVEUgVEFCTEUgdHlwZWRfdXJsX3N5bmNfbWV0YWRhdGEgKHN0b3JhZ2Vfa2V5IElOVEVHRVIgUFJJTUFSWSBLRVkgTk9UIE5VTEwsdmFsdWUgQkxPQiluaW5kZXhzZWdtZW50c191c2FnZV9zZWdfaWRzZWdtZW50X3VzYWdlQ1JFQVRFIElOREVYIHNlZ21lbnRzX3VzYWdlX3NlZ19pZCBPTiBzZWdtZW50X3VzYWdlKHNlZ21lbnRfaWQpO2luZGV4c2VnbWVudF91c2FnZV90aW1lX3Nsb3Rfc2VnbWVudF9pZHNlZ21lbnRfdXNhZ2VDUkVBVEUgSU5ERVggc2VnbWVudF91c2FnZV90aW1lX3Nsb3Rfc2VnbWVudF9pZCBPTiBzZWdtZW50X3VzYWdlKHRpbWVfc2xvdCwgc2VnbWVudF9pZCkvdGFibGVzZWdtZW50X3VzYWdlc2VnbWVudF91c2FnZUNSRUFURSBUQUJMRSBzZWdtZW50X3VzYWdlIChpZCBJTlRFR0VSIFBSSU1BUlkgS0VZLHNlZ21lbnRfaWQgSU5URUdFUiBOT1QgTlVMTCx0aW1lX3Nsb3QgSU5URUdFUiBOT1QgTlVMTCx2aXNpdF9jb3VudCBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCl0YWJsZWNvbnRlbnRfYW5ub3RhdGlvbnNjb250ZW50X2Fubm90YXRpb25zQ1JFQVRFIFRBQkxFIGNvbnRlbnRfYW5ub3RhdGlvbnModmlzaXRfaWQgSU5URUdFUiBQUklNQVJZIEtFWSx2aXNpYmlsaXR5X3Njb3JlIE5VTUVSSUMsZmxvY19wcm90ZWN0ZWRfc2NvcmUgTlVNRVJJQyxjYXRlZ29yaWVzIFZBUkNIQVIscGFnZV90b3BpY3NfbW9kZWxfdmVyc2lvbiBJTlRFR0VSLGFubm90YXRpb25fZmxhZ3MgSU5URUdFUiBOT1QgTlVMTCxlbnRpdGllcyBWQVJDSEFSLHJlbGF0ZWRfc2VhcmNoZXMgVkFSQ0hBUixzZWFyY2hfbm9ybWFsaXplZF91cmwgVkFSQ0hBUixzZWFyY2hfdGVybXMgTE9OR1ZBUkNIQVIsIGFsdGVybmF0aXZlX3RpdGxlLCBwYWdlX2xhbmd1YWdlIFZBUkNIQVIsIHBhc3N3b3JkX3N0YXRlIElOVEVHRVIgREVGQVVMVCAwIE5PVCBOVUxMKUd0YWJsZWNvbnRleHRfYW5ub3RhdGlvbnNjb250ZXh0X2Fubm90YXRpb25zQ1JFQVRFIFRBQkxFIGNvbnRleHRfYW5ub3RhdGlvbnModmlzaXRfaWQgSU5URUdFUiBQUklNQVJZIEtFWSxjb250ZXh0X2Fubm90YXRpb25fZmxhZ3MgSU5URUdFUiBOT1QgTlVMTCxkdXJhdGlvbl9zaW5jZV9sYXN0X3Zpc2l0IElOVEVHRVIscGFnZV9lbmRfcmVhc29uIElOVEVHRVIsdG90YWxfZm9yZWdyb3VuZF9kdXJhdGlvbiBJTlRFR0VSLCBicm93c2VyX3R5cGUgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwsIHdpbmRvd19pZCBJTlRFR0VSIERFRkFVTFQgLTEgTk9UIE5VTEwsIHRhYl9pZCBJTlRFR0VSIERFRkFVTFQgLTEgTk9UIE5VTEwsIHRhc2tfaWQgSU5URUdFUiBERUZBVUxUIC0xIE5PVCBOVUxMLCByb290X3Rhc2tfaWQgSU5URUdFUiBERUZBVUxUIC0xIE5PVCBOVUxMLCBwYXJlbnRfdGFza19pZCBJTlRFR0VSIERFRkFVTFQgLTEgTk9UIE5VTEwsIHJlc3BvbnNlX2NvZGUgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwpaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9jaHJvbWUvYnNlbS9kb3dubG9hZC9lbl9jYT9icmFuZD1WREtCJmRzX2tpZD00MzcwMDA1MjgwNjQ2MTIzNiYmdXRtX3NvdXJjZT1iaW5nJnV0bV9tZWRpdW09Y3BjJnV0bV9jYW1wYWlnbj0xNzA3MzMyJTIwJTdDJTIwQ2hyb21lJTIwV2luMTElMjAlN0MlMjBEUiUyMCU3QyUyMEVTUzAxJTIwJTdDJTIwTkElMjAlN0MlMjBDQSUyMCU3QyUyMGVuJTIwJTdDJTIwRGVzayUyMCU3QyUyMFNFTSUyMCU3QyUyMEJLV1MlMjAtJTIwRVhBJTIwJTdDJTIwVHh0JTIwJTdDJTIwQmluZ19Ub3AlMjBLV0RTJnV0bV90ZXJtPWdvb2dsZSUyMGNocm9tZSZ1dG1fY29udGVudD1EZXNrJTIwJTdDJTIwQktXUyUyMC0lMjBFWEElMjAlN0MlMjBUeHRfR29vZ2xlJTIwQ2hyb21lJTIwVG9wJTIwS1dEUyZnY2xpZD1hNjk5YmQ0NTA4MDMxYTI0Mzg0YWQ4YWUzZmVjMzNiZSZnY2xzcmM9M3AuZHNodHRwczovL2FkLmRvdWJsZWNsaWNrLm5ldC9zZWFyY2hhZHMvbGluay9jbGljaz9saWQ9NDM3MDAwNTI4MDY0NjEyMzYmZHNfc19rd2dpZD01ODcwMDAwNTc4NDYwODU1NSZkc19hX2NpZD00MDU1MjU4MDAmZHNfYV9jYWlkPTk3NjQzODM0MjQmZHNfYV9hZ2lkPTEwMDgyMDM0NDIzOCZkc19hX2xpZD1rd2QtMTA0Nzg2MjMxODMmJmRzX2VfYWRpZD04MDE5NTcyOTI3MDI5NCZkc19lX3RhcmdldF9pZD1rd2QtODAxOTU4MzYzNDE3Mjg6bG9jLTMyJiZkc19lX25ldHdvcms9byZkc191cmxfdj0yJmRzX2Rlc3RfdXJsPWh0dHBzOi8vd3d3Lmdvb2dsZS5jb20vY2hyb21lL2JzZW0vZG93bmxvYWQvZW5fY2E/YnJhbmQ9VkRLQiZkc19raWQ9NDM3MDAwNTI4MDY0NjEyMzYmZ2NsaWQ9YTY5OWJkNDUwODAzMWEyNDM4NGFkOGFlM2ZlYzMzYmUmZ2Nsc3JjPTNwLmRzJiZ1dG1fc291cmNlPWJpbmcmdXRtX21lZGl1bT1jcGMmdXRtX2NhbXBhaWduPTE3MDczMzIlMjAlN0MlMjBDaHJvbWUlMjBXaW4xMSUyMCU3QyUyMERSJTIwJTdDJTIwRVNTMDElMjAlN0MlMjBOQSUyMCU3QyUyMENBJTIwJTdDJTIwZW4lMjAlN0MlMjBEZXNrJTIwJTdDJTIwU0VNJTIwJTdDJTIwQktXUyUyMC0lMjBFWEElMjAlN0MlMjBUeHQlMjAlN0MlMjBCaW5nX1RvcCUyMEtXRFMmdXRtX3Rlcm09Z29vZ2xlJTIwY2hyb21lJnV0bV9jb250ZW50PURlc2slMjAlN0MlMjBCS1dTJTIwLSUyMEVYQSUyMCU3QyUyMFR4dF9Hb29nbGUlMjBDaHJvbWUlMjBUb3AlMjBLV0RTZmlsZTovLy9DOi9Vc2Vycy9IQVBVQldTL0Rlc2t0b3AvdGVzdC5odG1maWxlOi8vL0M6L1VzZXJzL0hBUFVCV1MvRG93bmxvYWRzL05ldyUyMFRleHQlMjBEb2N1bWVudC5odG1saHR0cHM6Ly93d3cubXNuLmNvbS9lbi1jYWh0dHBzOi8vd3d3Lm1zbi5jb20vaHR0cDovL3d3dy5tc24uY29tL2h0dHBzOi8vd3d3Lmdvb2dsZS5jb20vY2hyb21lL25leHQtc3RlcHMuaHRtbD9icmFuZD1WREtCJnN0YXRjYj0wJmluc3RhbGxkYXRhaW5kZXg9ZW1wdHkmZGVmYXVsdGJyb3dzZXI9MGh0dHBzOi8vd3d3LmJpbmcuY29tL2FjbGs/bGQ9ZTgzMVRCTnlrQ2pIZkJ1cVkwd1pqWXBqVlVDVXdZdDQ2UXJsTmhCVG9XdF85QVdhb21neFZqLVM4Y20xdWw3Y0taZzU4S2FVclRxVGFhcmlnc2hUc09FcERVcU1HeUgyUkc1UDJZZjF2VjdrRzdqWU1HakRrSWZTV2J1SjVNbHFjekQ0eEswMm5WNlFsbXRzSVo4bnlxTS1JT1BjVVpwUlotczloR3VNN01LX3lYZmlmUlF0SHJnTmx1VTZZWjk5eDVMamhDVmcmdT1hSFIwY0hNbE0yRWxNbVlsTW1aaFpDNWtiM1ZpYkdWamJHbGpheTV1WlhRbE1tWnpaV0Z5WTJoaFpITWxNbVpzYVc1ckpUSm1ZMnhwWTJzbE0yWnNhV1FsTTJRME16Y3dNREExTWpnd05qUTJNVEl6TmlVeU5tUnpYM05mYTNkbmFXUWxNMlExT0Rjd01EQXdOVGM0TkRZd09EVTFOU1V5Tm1SelgyRmZZMmxrSlROa05EQTFOVEkxT0RBd0pUSTJaSE5mWVY5allXbGtKVE5rT1RjMk5ETTRNelF5TkNVeU5tUnpYMkZmWVdkcFpDVXpaREV3TURneU1ETTBOaHR0cHM6Ly93d3cuYmluZy5jb20vc2VhcmNoP3E9Z29vZ2xlK2Nocm9tZSZjdmlkPTBmMTNjYWZhYWUzNjQ4ZDZhODVkMTE4OWY3YzkyYTNiJmFxcz1lZGdlLjAuMGwzajQ2ajBsNS4zMDU3ajBqMSZGT1JNPUFOU1BBMSZQQz1VNTMxKnFEMCY+bSBodHRwczovL3d3dy5iaW5nLmNvbS9zZWFyY2g/cT1nb29nbGUrY2hyb21lJmN2aWQ9MGYxM2NhZmFhZTM2NDhkNmE4NWQxMTg5ZjdjOTJhM2ImYXFzPWVkZ2UuMC4wbDNqNDZqMGw1LjMwNTdqMGoxJkZPUk09QU5TUEExJlBDPVU1MzFodHRwczovL3d3dy5iaW5nLmNvbS9hY2xrP2xkPWU4MzFUQk55a0NqSGZCdXFZMHdaallwalZVQ1V3WXQ0NlFybE5oQlRvV3RfOUFXYW9tZ3hWai1TOGNtMXVsN2NLWmc1OEthVXJUcVRhYXJpZ3NoVHNPRXBEVXFNR3lIMlJHNVAyWWYxdlY3a0c3allNR2pEa0lmU1didUo1TWxxY3pENHhLMDJuVjZRbG10c0laOG55cU0tSU9QY1VacFJaLXM5aEd1TTdNS195WGZpZlJRdEhyZ05sdVU2WVo5OXg1TGpoQ1ZnJnU9YUhSMGNITWxNMkVsTW1ZbE1tWmhaQzVrYjNWaWJHVmpiR2xqYXk1dVpYUWxNbVp6WldGeVkyaGhaSE1sTW1ac2FXNXJKVEptWTJ4cFkyc2xNMlpzYVdRbE0yUTBNemN3TURBMU1qZ3dOalEyTVRJek5pVXlObVJ6WDNOZmEzZG5hV1FsTTJRMU9EY3dNREF3TlRjNE5EWXdPRFUxTlNVeU5tUnpYMkZmWTJsa0pUTmtOREExTlRJMU9EQXdKVEkyWkhOZllWOWpZV2xrSlROa09UYzJORE00TXpReU5DVXlObVJ6WDJGZllXZHBaQ1V6WkRFd01EZ3lNRE0wTkRJek9DVXlObVJ6WDJGZmJHbGtKVE5rYTNka0xURXdORGM0TmpJek1UZ3pKVEkySlRJMlpITmZaVjloWkdsa0pUTmtPREF4T1RVM01qa3lOekF5T1RRbE1qWmtjMTlsWDNSaGNtZGxkRjlwWkNVelpHdDNaQzA0TURFNU5UZ3pOak0wTVRjeU9DVXpZV3h2WXkwek1pVXlOaVV5Tm1SelgyVmZibVYwZDI5eWF5VXpaRzhsTWpaa2MxOTFjbXhmZGlVelpESWxNalprYzE5a1pYTjBYM1Z5YkNVelpHaDBkSEJ6SlROaEpUSm1KVEptZDNkM0xtZHZiMmRzWlM1amIyMGxNbVpqYUhKdmJXVWxNbVppYzJWdEpUSm1aRzkzYm14dllXUWxNbVpsYmw5allTVXpabUp5WVc1a0pUTmtWa1JMUWlVeU5tUnpYMnRwWkNVelpEUXpOekF3TURVeU9EQTJORFl4TWpNMkpUSTJaMk5zYVdRbE0yUmhOams1WW1RME5UQTRNRE14WVRJME16ZzBZV1E0WVdVelptVmpNek5pWlNVeU5tZGpiSE55WXlVelpETndMbVJ6SlRJMkpUSTJkWFJ0WDNOdmRYSmpaU1V6WkdKcGJtY2xNaloxZEcxZmJXVmthWFZ0SlROa1kzQmpKVEkyZFhSdFgyTmhiWEJoYVdkdUpUTmtNVGN3TnpNek1pVXlOVEl3SlRJMU4wTWxNalV5TUVOb2NtOXRaU1V5TlRJd1YybHVNVEVsTWpVeU1DVXlOVGRESlRJMU1qQkVVaVV5TlRJd0pUSTFOME1sTWpVeU1FVlRVekF4SlRJMU1qQWxNalUzUXlVeU5USXdUa0VsTWpVeU1DVXlOVGRESlRJMU1qQkRRU1V5TlRJd0pUSTFOME1sTWpVeU1HVnVKVEkxTWpBbE1qVTNReVV5TlRJd1JHVnpheVV5TlRJd0pUSTFOME1sTWpVeU1GTkZUU1V5TlRJd0pUSTFOME1sTWpVeU1FSkxWMU1sTWpVeU1DMGxNalV5TUVWWVFTVXlOVEl3SlRJMU4wTWxNalV5TUZSNGRDVXlOVEl3SlRJMU4wTWxNalV5TUVKcGJtZGZWRzl3SlRJMU1qQkxWMFJUSlRJMmRYUnRYM1JsY20wbE0yUm5iMjluYkdVbE1qVXlNR05vY205dFpTVXlOblYwYlY5amIyNTBaVzUwSlROa1JHVnpheVV5TlRJd0pUSTFOME1sTWpVeU1FSkxWMU1sTWpVeU1DMGxNalV5TUVWWVFTVXlOVEl3SlRJMU4wTWxNalV5TUZSNGRGOUhiMjluYkdVbE1qVXlNRU5vY205dFpTVXlOVEl3Vkc5d0pUSTFNakJMVjBSVCZybGlkPWE2OTliZDQ1MDgwMzFhMjQzODRhZDhhZTM=91:T25a0,U1FMaXRlIGZvcm1hdCAzbGFzdF9jb21wYXRpYmxlX3ZlcnNpb24xNnZlcnNpb242OW1tYXBfc3RhdHVzLTFsYXN0X2NvbXBhdGlibGVfdmVyc2lvbnZlcnNpb24jbW1hcF9zdGF0dXNlaW5kZXhzZWluZGV4c3FsaXRlX2F1dG9pbmRleF9kb3dubG9hZHNfc2xpY2VzXzFkb3dubG9hZHNfc2xpY2VzdGFibGVkb3dubG9hZHNfc2xpY2VzZG93bmxvYWRzX3NsaWNlc0NSRUFURSBUQUJMRSBkb3dubG9hZHNfc2xpY2VzIChkb3dubG9hZF9pZCBJTlRFR0VSIE5PVCBOVUxMLG9mZnNldCBJTlRFR0VSIE5PVCBOVUxMLHJlY2VpdmVkX2J5dGVzIElOVEVHRVIgTk9UIE5VTEwsZmluaXNoZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsUFJJTUFSWSBLRVkgKGRvd25sb2FkX2lkLCBvZmZzZXQpIClHaW5kZXhzcWxpdGVfYXV0b2luZGV4X2Rvd25sb2Fkc191cmxfY2hhaW5zXzFkb3dubG9hZHNfdXJsX2NoYWlucyd0YWJsZWRvd25sb2Fkc191cmxfY2hhaW5zZG93bmxvYWRzX3VybF9jaGFpbnNDUkVBVEUgVEFCTEUgZG93bmxvYWRzX3VybF9jaGFpbnMgKGlkIElOVEVHRVIgTk9UIE5VTEwsY2hhaW5faW5kZXggSU5URUdFUiBOT1QgTlVMTCx1cmwgTE9OR1ZBUkNIQVIgTk9UIE5VTEwsIFBSSU1BUlkgS0VZIChpZCwgY2hhaW5faW5kZXgpICl0YWJsZWRvd25sb2Fkc2Rvd25sb2Fkc0NSRUFURSBUQUJMRSBkb3dubG9hZHMgKGlkIElOVEVHRVIgUFJJTUFSWSBLRVksZ3VpZCBWQVJDSEFSIE5PVCBOVUxMLGN1cnJlbnRfcGF0aCBMT05HVkFSQ0hBUiBOT1QgTlVMTCx0YXJnZXRfcGF0aCBMT05HVkFSQ0hBUiBOT1QgTlVMTCxzdGFydF90aW1lIElOVEVHRVIgTk9UIE5VTEwscmVjZWl2ZWRfYnl0ZXMgSU5URUdFUiBOT1QgTlVMTCx0b3RhbF9ieXRlcyBJTlRFR0VSIE5PVCBOVUxMLHN0YXRlIElOVEVHRVIgTk9UIE5VTEwsZGFuZ2VyX3R5cGUgSU5URUdFUiBOT1QgTlVMTCxpbnRlcnJ1cHRfcmVhc29uIElOVEVHRVIgTk9UIE5VTEwsaGFzaCBCTE9CIE5PVCBOVUxMLGVuZF90aW1lIElOVEVHRVIgTk9UIE5VTEwsb3BlbmVkIElOVEVHRVIgTk9UIE5VTEwsbGFzdF9hY2Nlc3NfdGltZSBJTlRFR0VSIE5PVCBOVUxMLHRyYW5zaWVudCBJTlRFR0VSIE5PVCBOVUxMLHJlZmVycmVyIFZBUkNIQVIgTk9UIE5VTEwsc2l0ZV91cmwgVkFSQ0hBUiBOT1QgTlVMTCxlbWJlZGRlcl9kb3dubG9hZF9kYXRhIFZBUkNIQVIgTk9UIE5VTEwsdGFiX3VybCBWQVJDSEFSIE5PVCBOVUxMLHRhYl9yZWZlcnJlcl91cmwgVkFSQ0hBUiBOT1QgTlVMTCxodHRwX21ldGhvZCBWQVJDSEFSIE5PVCBOVUxMLGJ5X2V4dF9pZCBWQVJDSEFSIE5PVCBOVUxMLGJ5X2V4dF9uYW1lIFZBUkNIQVIgTk9UIE5VTEwsYnlfd2ViX2FwcF9pZCBWQVJDSEFSIE5PVCBOVUxMLGV0YWcgVkFSQ0hBUiBOT1QgTlVMTCxsYXN0X21vZGlmaWVkIFZBUkNIQVIgTk9UIE5VTEwsbWltZV90eXBlIFZBUkNIQVIoMjU1KSBOT1QgTlVMTCxvcmlnaW5hbF9taW1lX3R5cGUgVkFSQ0hBUigyNTUpIE5PVCBOVUxMKWluZGV4a2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgza2V5d29yZF9zZWFyY2hfdGVybXNDUkVBVEUgSU5ERVgga2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgzIE9OIGtleXdvcmRfc2VhcmNoX3Rlcm1zICh0ZXJtKWluZGV4a2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgya2V5d29yZF9zZWFyY2hfdGVybXNDUkVBVEUgSU5ERVgga2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgyIE9OIGtleXdvcmRfc2VhcmNoX3Rlcm1zICh1cmxfaWQpSWluZGV4a2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgxa2V5d29yZF9zZWFyY2hfdGVybXNDUkVBVEUgSU5ERVgga2V5d29yZF9zZWFyY2hfdGVybXNfaW5kZXgxIE9OIGtleXdvcmRfc2VhcmNoX3Rlcm1zIChrZXl3b3JkX2lkLCBub3JtYWxpemVkX3Rlcm0pOXRhYmxla2V5d29yZF9zZWFyY2hfdGVybXNrZXl3b3JkX3NlYXJjaF90ZXJtc0NSRUFURSBUQUJMRSBrZXl3b3JkX3NlYXJjaF90ZXJtcyAoa2V5d29yZF9pZCBJTlRFR0VSIE5PVCBOVUxMLHVybF9pZCBJTlRFR0VSIE5PVCBOVUxMLHRlcm0gTE9OR1ZBUkNIQVIgTk9UIE5VTEwsbm9ybWFsaXplZF90ZXJtIExPTkdWQVJDSEFSIE5PVCBOVUxMKXRpbmRleHZpc2l0c19vcmlnaW5hdG9yX2lkX2luZGV4dmlzaXRzQ1JFQVRFIElOREVYIHZpc2l0c19vcmlnaW5hdG9yX2lkX2luZGV4IE9OIHZpc2l0cyAob3JpZ2luYXRvcl92aXNpdF9pZClYd2luZGV4dmlzaXRzX3RpbWVfaW5kZXh2aXNpdHNDUkVBVEUgSU5ERVggdmlzaXRzX3RpbWVfaW5kZXggT04gdmlzaXRzICh2aXNpdF90aW1lKVh3aW5kZXh2aXNpdHNfZnJvbV9pbmRleHZpc2l0c0NSRUFURSBJTkRFWCB2aXNpdHNfZnJvbV9pbmRleCBPTiB2aXNpdHMgKGZyb21fdmlzaXQpT2dpbmRleHZpc2l0c191cmxfaW5kZXh2aXNpdHNDUkVBVEUgSU5ERVggdmlzaXRzX3VybF9pbmRleCBPTiB2aXNpdHMgKHVybCludGFibGV2aXNpdF9zb3VyY2V2aXNpdF9zb3VyY2VDUkVBVEUgVEFCTEUgdmlzaXRfc291cmNlKGlkIElOVEVHRVIgUFJJTUFSWSBLRVksc291cmNlIElOVEVHRVIgTk9UIE5VTEwpXXRhYmxldmlzaXRzdmlzaXRzQ1JFQVRFIFRBQkxFIHZpc2l0cyhpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsdXJsIElOVEVHRVIgTk9UIE5VTEwsdmlzaXRfdGltZSBJTlRFR0VSIE5PVCBOVUxMLGZyb21fdmlzaXQgSU5URUdFUixleHRlcm5hbF9yZWZlcnJlcl91cmwgVEVYVCx0cmFuc2l0aW9uIElOVEVHRVIgREVGQVVMVCAwIE5PVCBOVUxMLHNlZ21lbnRfaWQgSU5URUdFUix2aXNpdF9kdXJhdGlvbiBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCxpbmNyZW1lbnRlZF9vbW5pYm94X3R5cGVkX3Njb3JlIEJPT0xFQU4gREVGQVVMVCBGQUxTRSBOT1QgTlVMTCxvcGVuZXJfdmlzaXQgSU5URUdFUixvcmlnaW5hdG9yX2NhY2hlX2d1aWQgVEVYVCxvcmlnaW5hdG9yX3Zpc2l0X2lkIElOVEVHRVIsb3JpZ2luYXRvcl9mcm9tX3Zpc2l0IElOVEVHRVIsb3JpZ2luYXRvcl9vcGVuZXJfdmlzaXQgSU5URUdFUixpc19rbm93bl90b19zeW5jIEJPT0xFQU4gREVGQVVMVCBGQUxTRSBOT1QgTlVMTCxjb25zaWRlcl9mb3JfbnRwX21vc3RfdmlzaXRlZCBCT09MRUFOIERFRkFVTFQgRkFMU0UgTk9UIE5VTEwsdmlzaXRlZF9saW5rX2lkIElOVEVHRVIgREVGQVVMVCAwIE5PVCBOVUxMLGFwcF9pZCBURVhUKVBZdGFibGVzcWxpdGVfc2VxdWVuY2VzcWxpdGVfc2VxdWVuY2VDUkVBVEUgVEFCTEUgc3FsaXRlX3NlcXVlbmNlKG5hbWUsc2VxKWF0YWJsZXVybHN1cmxzQ1JFQVRFIFRBQkxFIHVybHMoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULHVybCBMT05HVkFSQ0hBUix0aXRsZSBMT05HVkFSQ0hBUix2aXNpdF9jb3VudCBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCx0eXBlZF9jb3VudCBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCxsYXN0X3Zpc2l0X3RpbWUgSU5URUdFUiBOT1QgTlVMTCxoaWRkZW4gSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwpZi90YWJsZW1ldGFtZXRhQ1JFQVRFIFRBQkxFIG1ldGEoa2V5IExPTkdWQVJDSEFSIE5PVCBOVUxMIFVOSVFVRSBQUklNQVJZIEtFWSwgdmFsdWUgTE9OR1ZBUkNIQVIpJ2luZGV4c3FsaXRlX2F1dG9pbmRleF9tZXRhXzFtZXRhaXRhYmxlY2x1c3RlcnNfYW5kX3Zpc2l0c2NsdXN0ZXJzX2FuZF92aXNpdHMgQ1JFQVRFIFRBQkxFIGNsdXN0ZXJzX2FuZF92aXNpdHMoY2x1c3Rlcl9pZCBJTlRFR0VSIE5PVCBOVUxMLHZpc2l0X2lkIElOVEVHRVIgTk9UIE5VTEwsc2NvcmUgTlVNRVJJQyBERUZBVUxUIDAgTk9UIE5VTEwsZW5nYWdlbWVudF9zY29yZSBOVU1FUklDIERFRkFVTFQgMCBOT1QgTlVMTCx1cmxfZm9yX2RlZHVwaW5nIExPTkdWQVJDSEFSIE5PVCBOVUxMLG5vcm1hbGl6ZWRfdXJsIExPTkdWQVJDSEFSIE5PVCBOVUxMLHVybF9mb3JfZGlzcGxheSBMT05HVkFSQ0hBUiBOT1QgTlVMTCxpbnRlcmFjdGlvbl9zdGF0ZSBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCxQUklNQVJZIEtFWShjbHVzdGVyX2lkLHZpc2l0X2lkKSlXSVRIT1VUIFJPV0lET3RhYmxlY2x1c3RlcnNjbHVzdGVyc0NSRUFURSBUQUJMRSBjbHVzdGVycyhjbHVzdGVyX2lkIElOVEVHRVIgUFJJTUFSWSBLRVkgQVVUT0lOQ1JFTUVOVCxzaG91bGRfc2hvd19vbl9wcm9taW5lbnRfdWlfc3VyZmFjZXMgQk9PTEVBTiBOT1QgTlVMTCxsYWJlbCBWQVJDSEFSIE5PVCBOVUxMLHJhd19sYWJlbCBWQVJDSEFSIE5PVCBOVUxMLHRyaWdnZXJhYmlsaXR5X2NhbGN1bGF0ZWQgQk9PTEVBTiBOT1QgTlVMTCxvcmlnaW5hdG9yX2NhY2hlX2d1aWQgVEVYVCBOT1QgTlVMTCxvcmlnaW5hdG9yX2NsdXN0ZXJfaWQgSU5URUdFUiBOT1QgTlVMTCk5dGFibGVjb250ZXh0X2Fubm90YXRpb25zY29udGV4dF9hbm5vdGF0aW9uc0NSRUFURSBUQUJMRSBjb250ZXh0X2Fubm90YXRpb25zKHZpc2l0X2lkIElOVEVHRVIgUFJJTUFSWSBLRVksY29udGV4dF9hbm5vdGF0aW9uX2ZsYWdzIElOVEVHRVIgTk9UIE5VTEwsZHVyYXRpb25fc2luY2VfbGFzdF92aXNpdCBJTlRFR0VSLHBhZ2VfZW5kX3JlYXNvbiBJTlRFR0VSLHRvdGFsX2ZvcmVncm91bmRfZHVyYXRpb24gSU5URUdFUixicm93c2VyX3R5cGUgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwsd2luZG93X2lkIElOVEVHRVIgREVGQVVMVCAtMSBOT1QgTlVMTCx0YWJfaWQgSU5URUdFUiBERUZBVUxUIC0xIE5PVCBOVUxMLHRhc2tfaWQgSU5URUdFUiBERUZBVUxUIC0xIE5PVCBOVUxMLHJvb3RfdGFza19pZCBJTlRFR0VSIERFRkFVTFQgLTEgTk9UIE5VTEwscGFyZW50X3Rhc2tfaWQgSU5URUdFUiBERUZBVUxUIC0xIE5PVCBOVUxMLHJlc3BvbnNlX2NvZGUgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwpY3RhYmxlY29udGVudF9hbm5vdGF0aW9uc2NvbnRlbnRfYW5ub3RhdGlvbnNDUkVBVEUgVEFCTEUgY29udGVudF9hbm5vdGF0aW9ucyh2aXNpdF9pZCBJTlRFR0VSIFBSSU1BUlkgS0VZLHZpc2liaWxpdHlfc2NvcmUgTlVNRVJJQyxmbG9jX3Byb3RlY3RlZF9zY29yZSBOVU1FUklDLGNhdGVnb3JpZXMgVkFSQ0hBUixwYWdlX3RvcGljc19tb2RlbF92ZXJzaW9uIElOVEVHRVIsYW5ub3RhdGlvbl9mbGFncyBJTlRFR0VSIE5PVCBOVUxMLGVudGl0aWVzIFZBUkNIQVIscmVsYXRlZF9zZWFyY2hlcyBWQVJDSEFSLHNlYXJjaF9ub3JtYWxpemVkX3VybCBWQVJDSEFSLHNlYXJjaF90ZXJtcyBMT05HVkFSQ0hBUixhbHRlcm5hdGl2ZV90aXRsZSBWQVJDSEFSLHBhZ2VfbGFuZ3VhZ2UgVkFSQ0hBUixwYXNzd29yZF9zdGF0ZSBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCxoYXNfdXJsX2tleWVkX2ltYWdlIEJPT0xFQU4gTk9UIE5VTEwpbmluZGV4c2VnbWVudHNfdXNhZ2Vfc2VnX2lkc2VnbWVudF91c2FnZUNSRUFURSBJTkRFWCBzZWdtZW50c191c2FnZV9zZWdfaWQgT04gc2VnbWVudF91c2FnZShzZWdtZW50X2lkKTtpbmRleHNlZ21lbnRfdXNhZ2VfdGltZV9zbG90X3NlZ21lbnRfaWRzZWdtZW50X3VzYWdlQ1JFQVRFIElOREVYIHNlZ21lbnRfdXNhZ2VfdGltZV9zbG90X3NlZ21lbnRfaWQgT04gc2VnbWVudF91c2FnZSh0aW1lX3Nsb3QsIHNlZ21lbnRfaWQpL3RhYmxlc2VnbWVudF91c2FnZXNlZ21lbnRfdXNhZ2VDUkVBVEUgVEFCTEUgc2VnbWVudF91c2FnZSAoaWQgSU5URUdFUiBQUklNQVJZIEtFWSxzZWdtZW50X2lkIElOVEVHRVIgTk9UIE5VTEwsdGltZV9zbG90IElOVEVHRVIgTk9UIE5VTEwsdmlzaXRfY291bnQgSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwpU21pbmRleHNlZ21lbnRzX3VybF9pZHNlZ21lbnRzQ1JFQVRFIElOREVYIHNlZ21lbnRzX3VybF9pZCBPTiBzZWdtZW50cyh1cmxfaWQpTWVpbmRleHNlZ21lbnRzX25hbWVzZWdtZW50c0NSRUFURSBJTkRFWCBzZWdtZW50c19uYW1lIE9OIHNlZ21lbnRzKG5hbWUpcDN0YWJsZXNlZ21lbnRzc2VnbWVudHNDUkVBVEUgVEFCTEUgc2VnbWVudHMgKGlkIElOVEVHRVIgUFJJTUFSWSBLRVksbmFtZSBWQVJDSEFSLHVybF9pZCBJTlRFR0VSIE5PTiBOVUxMKV9pbmRleHVybHNfdXJsX2luZGV4dXJscyhDUkVBVEUgSU5ERVggdXJsc191cmxfaW5kZXggT04gdXJscyAodXJsKT90YWJsZWhpc3Rvcnlfc3luY19tZXRhZGF0YWhpc3Rvcnlfc3luY19tZXRhZGF0YSdDUkVBVEUgVEFCTEUgaGlzdG9yeV9zeW5jX21ldGFkYXRhIChzdG9yYWdlX2tleSBJTlRFR0VSIFBSSU1BUlkgS0VZIE5PVCBOVUxMLCB2YWx1ZSBCTE9CKT9pbmRleHZpc2l0ZWRfbGlua3NfaW5kZXh2aXNpdGVkX2xpbmtzJkNSRUFURSBJTkRFWCB2aXNpdGVkX2xpbmtzX2luZGV4IE9OIHZpc2l0ZWRfbGlua3MgKGxpbmtfdXJsX2lkLCB0b3BfbGV2ZWxfdXJsLCBmcmFtZV91cmwpdGFibGV2aXNpdGVkX2xpbmtzdmlzaXRlZF9saW5rcyVDUkVBVEUgVEFCTEUgdmlzaXRlZF9saW5rcyhpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsbGlua191cmxfaWQgSU5URUdFUiBOT1QgTlVMTCx0b3BfbGV2ZWxfdXJsIExPTkdWQVJDSEFSIE5PVCBOVUxMLGZyYW1lX3VybCBMT05HVkFSQ0hBUiBOT1QgTlVMTCx2aXNpdF9jb3VudCBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTClBdGFibGVjbHVzdGVyX3Zpc2l0X2R1cGxpY2F0ZXNjbHVzdGVyX3Zpc2l0X2R1cGxpY2F0ZXMkQ1JFQVRFIFRBQkxFIGNsdXN0ZXJfdmlzaXRfZHVwbGljYXRlcyh2aXNpdF9pZCBJTlRFR0VSIE5PVCBOVUxMLGR1cGxpY2F0ZV92aXNpdF9pZCBJTlRFR0VSIE5PVCBOVUxMLFBSSU1BUlkgS0VZKHZpc2l0X2lkLGR1cGxpY2F0ZV92aXNpdF9pZCkpV0lUSE9VVCBST1dJRClpbmRleGNsdXN0ZXJfa2V5d29yZHNfY2x1c3Rlcl9pZF9pbmRleGNsdXN0ZXJfa2V5d29yZHMjQ1JFQVRFIElOREVYIGNsdXN0ZXJfa2V5d29yZHNfY2x1c3Rlcl9pZF9pbmRleCBPTiBjbHVzdGVyX2tleXdvcmRzKGNsdXN0ZXJfaWQpR3RhYmxlY2x1c3Rlcl9rZXl3b3Jkc2NsdXN0ZXJfa2V5d29yZHMiQ1JFQVRFIFRBQkxFIGNsdXN0ZXJfa2V5d29yZHMoY2x1c3Rlcl9pZCBJTlRFR0VSIE5PVCBOVUxMLGtleXdvcmQgVkFSQ0hBUiBOT1QgTlVMTCx0eXBlIElOVEVHRVIgTk9UIE5VTEwsc2NvcmUgTlVNRVJJQyBOT1QgTlVMTCxjb2xsZWN0aW9ucyBWQVJDSEFSIE5PVCBOVUxMKXJpbmRleGNsdXN0ZXJzX2Zvcl92aXNpdGNsdXN0ZXJzX2FuZF92aXNpdHMhQ1JFQVRFIElOREVYIGNsdXN0ZXJzX2Zvcl92aXNpdCBPTiBjbHVzdGVyc19hbmRfdmlzaXRzKHZpc2l0X2lkKQ==92:Tfd0,U1FMaXRlIGZvcm1hdCAzbGFzdF9jb21wYXRpYmxlX3ZlcnNpb240MHZlcnNpb240MW1tYXBfc3RhdHVzLTFsYXN0X2NvbXBhdGlibGVfdmVyc2lvbnZlcnNpb24jbW1hcF9zdGF0dXN0YWJsZWxvZ2luc2xvZ2luc0NSRUFURSBUQUJMRSBsb2dpbnMgKG9yaWdpbl91cmwgVkFSQ0hBUiBOT1QgTlVMTCwgYWN0aW9uX3VybCBWQVJDSEFSLCB1c2VybmFtZV9lbGVtZW50IFZBUkNIQVIsIHVzZXJuYW1lX3ZhbHVlIFZBUkNIQVIsIHBhc3N3b3JkX2VsZW1lbnQgVkFSQ0hBUiwgcGFzc3dvcmRfdmFsdWUgQkxPQiwgc3VibWl0X2VsZW1lbnQgVkFSQ0hBUiwgc2lnbm9uX3JlYWxtIFZBUkNIQVIgTk9UIE5VTEwsIGRhdGVfY3JlYXRlZCBJTlRFR0VSIE5PVCBOVUxMLCBibGFja2xpc3RlZF9ieV91c2VyIElOVEVHRVIgTk9UIE5VTEwsIHNjaGVtZSBJTlRFR0VSIE5PVCBOVUxMLCBwYXNzd29yZF90eXBlIElOVEVHRVIsIHRpbWVzX3VzZWQgSU5URUdFUiwgZm9ybV9kYXRhIEJMT0IsIGRpc3BsYXlfbmFtZSBWQVJDSEFSLCBpY29uX3VybCBWQVJDSEFSLCBmZWRlcmF0aW9uX3VybCBWQVJDSEFSLCBza2lwX3plcm9fY2xpY2sgSU5URUdFUiwgZ2VuZXJhdGlvbl91cGxvYWRfc3RhdHVzIElOVEVHRVIsIHBvc3NpYmxlX3VzZXJuYW1lX3BhaXJzIEJMT0IsIGlkIElOVEVHRVIgUFJJTUFSWSBLRVkgQVVUT0lOQ1JFTUVOVCwgZGF0ZV9sYXN0X3VzZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIG1vdmluZ19ibG9ja2VkX2ZvciBCTE9CLCBkYXRlX3Bhc3N3b3JkX21vZGlmaWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBzZW5kZXJfZW1haWwgVkFSQ0hBUiwgc2VuZGVyX25hbWUgVkFSQ0hBUiwgZGF0ZV9yZWNlaXZlZCBJTlRFR0VSLCBzaGFyaW5nX25vdGlmaWNhdGlvbl9kaXNwbGF5ZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIGtleWNoYWluX2lkZW50aWZpZXIgQkxPQiwgc2VuZGVyX3Byb2ZpbGVfaW1hZ2VfdXJsIFZBUkNIQVIsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpL3RhYmxlbWV0YW1ldGFDUkVBVEUgVEFCTEUgbWV0YShrZXkgTE9OR1ZBUkNIQVIgTk9UIE5VTEwgVU5JUVVFIFBSSU1BUlkgS0VZLCB2YWx1ZSBMT05HVkFSQ0hBUiknaW5kZXhzcWxpdGVfYXV0b2luZGV4X21ldGFfMW1ldGFvaW5kZXhzdGF0c19vcmlnaW5zdGF0c0NSRUFURSBJTkRFWCBzdGF0c19vcmlnaW4gT04gc3RhdHMob3JpZ2luX2RvbWFpbilfdGFibGVzdGF0c3N0YXRzQ1JFQVRFIFRBQkxFIHN0YXRzIChvcmlnaW5fZG9tYWluIFZBUkNIQVIgTk9UIE5VTEwsIHVzZXJuYW1lX3ZhbHVlIFZBUkNIQVIsIGRpc21pc3NhbF9jb3VudCBJTlRFR0VSLCB1cGRhdGVfdGltZSBJTlRFR0VSIE5PVCBOVUxMLCBVTklRVUUob3JpZ2luX2RvbWFpbiwgdXNlcm5hbWVfdmFsdWUpKSlpbmRleHNxbGl0ZV9hdXRvaW5kZXhfc3RhdHNfMXN0YXRzaW5kZXhmb3JlaWduX2tleV9pbmRleF9ub3Rlc3Bhc3N3b3JkX25vdGVzQ1JFQVRFIElOREVYIGZvcmVpZ25fa2V5X2luZGV4X25vdGVzIE9OIHBhc3N3b3JkX25vdGVzIChwYXJlbnRfaWQpUXRhYmxlcGFzc3dvcmRfbm90ZXNwYXNzd29yZF9ub3Rlc0NSRUFURSBUQUJMRSBwYXNzd29yZF9ub3RlcyAoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULCBwYXJlbnRfaWQgSU5URUdFUiBOT1QgTlVMTCBSRUZFUkVOQ0VTIGxvZ2lucyBPTiBVUERBVEUgQ0FTQ0FERSBPTiBERUxFVEUgQ0FTQ0FERSBERUZFUlJBQkxFIElOSVRJQUxMWSBERUZFUlJFRCwga2V5IFZBUkNIQVIgTk9UIE5VTEwsIHZhbHVlIEJMT0IsIGRhdGVfY3JlYXRlZCBJTlRFR0VSIE5PVCBOVUxMLCBjb25maWRlbnRpYWwgSU5URUdFUiwgVU5JUVVFIChwYXJlbnRfaWQsIGtleSkpO2luZGV4c3FsaXRlX2F1dG9pbmRleF9wYXNzd29yZF9ub3Rlc18xcGFzc3dvcmRfbm90ZXNpbmRleGZvcmVpZ25fa2V5X2luZGV4aW5zZWN1cmVfY3JlZGVudGlhbHNDUkVBVEUgSU5ERVggZm9yZWlnbl9rZXlfaW5kZXggT04gaW5zZWN1cmVfY3JlZGVudGlhbHMgKHBhcmVudF9pZClHaW5kZXhzcWxpdGVfYXV0b2luZGV4X2luc2VjdXJlX2NyZWRlbnRpYWxzXzFpbnNlY3VyZV9jcmVkZW50aWFscy90YWJsZWluc2VjdXJlX2NyZWRlbnRpYWxzaW5zZWN1cmVfY3JlZGVudGlhbHNDUkVBVEUgVEFCTEUgaW5zZWN1cmVfY3JlZGVudGlhbHMgKHBhcmVudF9pZCBJTlRFR0VSIFJFRkVSRU5DRVMgbG9naW5zIE9OIFVQREFURSBDQVNDQURFIE9OIERFTEVURSBDQVNDQURFIERFRkVSUkFCTEUgSU5JVElBTExZIERFRkVSUkVELCBpbnNlY3VyaXR5X3R5cGUgSU5URUdFUiBOT1QgTlVMTCwgY3JlYXRlX3RpbWUgSU5URUdFUiBOT1QgTlVMTCwgaXNfbXV0ZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHRyaWdnZXJfbm90aWZpY2F0aW9uX2Zyb21fYmFja2VuZCBJTlRFR0VSIE5PVCBOVUxMIERFRkFVTFQgMCwgVU5JUVVFIChwYXJlbnRfaWQsIGluc2VjdXJpdHlfdHlwZSkpXXRhYmxlc3luY19tb2RlbF9tZXRhZGF0YXN5bmNfbW9kZWxfbWV0YWRhdGFDUkVBVEUgVEFCTEUgc3luY19tb2RlbF9tZXRhZGF0YSAoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULCBtb2RlbF9tZXRhZGF0YSBWQVJDSEFSIE5PVCBOVUxMKWl0YWJsZXN5bmNfZW50aXRpZXNfbWV0YWRhdGFzeW5jX2VudGl0aWVzX21ldGFkYXRhQ1JFQVRFIFRBQkxFIHN5bmNfZW50aXRpZXNfbWV0YWRhdGEgKHN0b3JhZ2Vfa2V5IElOVEVHRVIgUFJJTUFSWSBLRVkgQVVUT0lOQ1JFTUVOVCwgbWV0YWRhdGEgVkFSQ0hBUiBOT1QgTlVMTClSc2luZGV4bG9naW5zX3NpZ25vbmxvZ2luc0NSRUFURSBJTkRFWCBsb2dpbnNfc2lnbm9uIE9OIGxvZ2lucyAoc2lnbm9uX3JlYWxtKVBZdGFibGVzcWxpdGVfc2VxdWVuY2VzcWxpdGVfc2VxdWVuY2VDUkVBVEUgVEFCTEUgc3FsaXRlX3NlcXVlbmNlKG5hbWUsc2VxKStpbmRleHNxbGl0ZV9hdXRvaW5kZXhfbG9naW5zXzFsb2dpbnM=93:T1494,U1FMaXRlIGZvcm1hdCAzbG9naW5zX2VkZ2VfZXh0ZW5kZWRfdGFibGVfdmVyc2lvbjJlZGdlX2JyZWFjaGVkX3RhYmxlX3ZlcnNpb24zbGFzdF9jb21wYXRpYmxlX3ZlcnNpb24zM3ZlcnNpb24zM21tYXBfc3RhdHVzLTFsb2dpbnNfZWRnZV9leHRlbmRlZF90YWJsZV92ZXJzaW9uZWRnZV9icmVhY2hlZF90YWJsZV92ZXJzaW9ubGFzdF9jb21wYXRpYmxlX3ZlcnNpb252ZXJzaW9uI21tYXBfc3RhdHVzaW5kZXhmb3JlaWduX2tleV9pbmRleGluc2VjdXJlX2NyZWRlbnRpYWxzQ1JFQVRFIElOREVYIGZvcmVpZ25fa2V5X2luZGV4IE9OIGluc2VjdXJlX2NyZWRlbnRpYWxzIChwYXJlbnRfaWQpR2luZGV4c3FsaXRlX2F1dG9pbmRleF9pbnNlY3VyZV9jcmVkZW50aWFsc18xaW5zZWN1cmVfY3JlZGVudGlhbHMzdGFibGVpbnNlY3VyZV9jcmVkZW50aWFsc2luc2VjdXJlX2NyZWRlbnRpYWxzQ1JFQVRFIFRBQkxFIGluc2VjdXJlX2NyZWRlbnRpYWxzIChwYXJlbnRfaWQgSU5URUdFUiBSRUZFUkVOQ0VTIGxvZ2lucyBPTiBVUERBVEUgQ0FTQ0FERSBPTiBERUxFVEUgQ0FTQ0FERSBERUZFUlJBQkxFIElOSVRJQUxMWSBERUZFUlJFRCwgaW5zZWN1cml0eV90eXBlIElOVEVHRVIgTk9UIE5VTEwsIGNyZWF0ZV90aW1lIElOVEVHRVIgTk9UIE5VTEwsIGlzX211dGVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBVTklRVUUgKHBhcmVudF9pZCwgaW5zZWN1cml0eV90eXBlKSlddGFibGVzeW5jX21vZGVsX21ldGFkYXRhc3luY19tb2RlbF9tZXRhZGF0YUNSRUFURSBUQUJMRSBzeW5jX21vZGVsX21ldGFkYXRhIChpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsIG1vZGVsX21ldGFkYXRhIFZBUkNIQVIgTk9UIE5VTEwpaXRhYmxlc3luY19lbnRpdGllc19tZXRhZGF0YXN5bmNfZW50aXRpZXNfbWV0YWRhdGFDUkVBVEUgVEFCTEUgc3luY19lbnRpdGllc19tZXRhZGF0YSAoc3RvcmFnZV9rZXkgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULCBtZXRhZGF0YSBWQVJDSEFSIE5PVCBOVUxMKVJzaW5kZXhsb2dpbnNfc2lnbm9ubG9naW5zQ1JFQVRFIElOREVYIGxvZ2luc19zaWdub24gT04gbG9naW5zIChzaWdub25fcmVhbG0pUFl0YWJsZXNxbGl0ZV9zZXF1ZW5jZXNxbGl0ZV9zZXF1ZW5jZUNSRUFURSBUQUJMRSBzcWxpdGVfc2VxdWVuY2UobmFtZSxzZXEpdGFibGVsb2dpbnNsb2dpbnNDUkVBVEUgVEFCTEUgbG9naW5zIChvcmlnaW5fdXJsIFZBUkNIQVIgTk9UIE5VTEwsIGFjdGlvbl91cmwgVkFSQ0hBUiwgdXNlcm5hbWVfZWxlbWVudCBWQVJDSEFSLCB1c2VybmFtZV92YWx1ZSBWQVJDSEFSLCBwYXNzd29yZF9lbGVtZW50IFZBUkNIQVIsIHBhc3N3b3JkX3ZhbHVlIEJMT0IsIHN1Ym1pdF9lbGVtZW50IFZBUkNIQVIsIHNpZ25vbl9yZWFsbSBWQVJDSEFSIE5PVCBOVUxMLCBkYXRlX2NyZWF0ZWQgSU5URUdFUiBOT1QgTlVMTCwgYmxhY2tsaXN0ZWRfYnlfdXNlciBJTlRFR0VSIE5PVCBOVUxMLCBzY2hlbWUgSU5URUdFUiBOT1QgTlVMTCwgcGFzc3dvcmRfdHlwZSBJTlRFR0VSLCB0aW1lc191c2VkIElOVEVHRVIsIGZvcm1fZGF0YSBCTE9CLCBkaXNwbGF5X25hbWUgVkFSQ0hBUiwgaWNvbl91cmwgVkFSQ0hBUiwgZmVkZXJhdGlvbl91cmwgVkFSQ0hBUiwgc2tpcF96ZXJvX2NsaWNrIElOVEVHRVIsIGdlbmVyYXRpb25fdXBsb2FkX3N0YXR1cyBJTlRFR0VSLCBwb3NzaWJsZV91c2VybmFtZV9wYWlycyBCTE9CLCBpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsIGRhdGVfbGFzdF91c2VkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBtb3ZpbmdfYmxvY2tlZF9mb3IgQkxPQiwgZGF0ZV9wYXNzd29yZF9tb2RpZmllZCBJTlRFR0VSIE5PVCBOVUxMIERFRkFVTFQgMCwgVU5JUVVFIChvcmlnaW5fdXJsLCB1c2VybmFtZV9lbGVtZW50LCB1c2VybmFtZV92YWx1ZSwgcGFzc3dvcmRfZWxlbWVudCwgc2lnbm9uX3JlYWxtKSkraW5kZXhzcWxpdGVfYXV0b2luZGV4X2xvZ2luc18xbG9naW5zL3RhYmxlbWV0YW1ldGFDUkVBVEUgVEFCTEUgbWV0YShrZXkgTE9OR1ZBUkNIQVIgTk9UIE5VTEwgVU5JUVVFIFBSSU1BUlkgS0VZLCB2YWx1ZSBMT05HVkFSQ0hBUiknaW5kZXhzcWxpdGVfYXV0b2luZGV4X21ldGFfMW1ldGFRdGFibGVwYXNzd29yZF9ub3Rlc3Bhc3N3b3JkX25vdGVzQ1JFQVRFIFRBQkxFIHBhc3N3b3JkX25vdGVzIChpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsIHBhcmVudF9pZCBJTlRFR0VSIE5PVCBOVUxMIFJFRkVSRU5DRVMgbG9naW5zIE9OIFVQREFURSBDQVNDQURFIE9OIERFTEVURSBDQVNDQURFIERFRkVSUkFCTEUgSU5JVElBTExZIERFRkVSUkVELCBrZXkgVkFSQ0hBUiBOT1QgTlVMTCwgdmFsdWUgQkxPQiwgZGF0ZV9jcmVhdGVkIElOVEVHRVIgTk9UIE5VTEwsIGNvbmZpZGVudGlhbCBJTlRFR0VSLCBVTklRVUUgKHBhcmVudF9pZCwga2V5KSlOb2luZGV4c3RhdHNfb3JpZ2luc3RhdHNDUkVBVEUgSU5ERVggc3RhdHNfb3JpZ2luIE9OIHN0YXRzKG9yaWdpbl9kb21haW4pX3RhYmxlc3RhdHNzdGF0c0NSRUFURSBUQUJMRSBzdGF0cyAob3JpZ2luX2RvbWFpbiBWQVJDSEFSIE5PVCBOVUxMLCB1c2VybmFtZV92YWx1ZSBWQVJDSEFSLCBkaXNtaXNzYWxfY291bnQgSU5URUdFUiwgdXBkYXRlX3RpbWUgSU5URUdFUiBOT1QgTlVMTCwgVU5JUVVFKG9yaWdpbl9kb21haW4sIHVzZXJuYW1lX3ZhbHVlKSkpaW5kZXhzcWxpdGVfYXV0b2luZGV4X3N0YXRzXzFzdGF0cyd0YWJsZWxvZ2luc19lZGdlX2V4dGVuZGVkbG9naW5zX2VkZ2VfZXh0ZW5kZWRDUkVBVEUgVEFCTEUgbG9naW5zX2VkZ2VfZXh0ZW5kZWQgKGlkIElOVEVHRVIgUFJJTUFSWSBLRVkgQVVUT0lOQ1JFTUVOVCwgc291cmNlIFZBUkNIQVIgTk9UIG51bGwgREVGQVVMVCAwLCBzdHJlbmd0aF9hbGVydF9zdGF0dXMgSU5URUdFUiBOT1QgbnVsbCBERUZBVUxUIDAsIHBhc3N3b3JkX25pY2tuYW1lIFZBUkNIQVIgTk9UIG51bGwgREVGQVVMVCAnJyApZmluZGV4YnJlYWNoZWRfdGFibGVfaW5kZXhicmVhY2hlZENSRUFURSBJTkRFWCBicmVhY2hlZF90YWJsZV9pbmRleCBPTiBicmVhY2hlZCAodXJsLCB1c2VybmFtZSl0YWJsZWJyZWFjaGVkYnJlYWNoZWRDUkVBVEUgVEFCTEUgYnJlYWNoZWQgKHVybCBWQVJDSEFSIE5PVCBudWxsLCB1c2VybmFtZSBWQVJDSEFSIE5PVCBudWxsLCBzdGF0dXMgSU5URUdFUiBOT1QgbnVsbCwgYWxlcnRfc3RhdGUgSU5URUdFUiBOT1QgbnVsbCwgbGFzdF9jaGVja2VkX3RpbWUgSU5URUdFUiBOT1QgbnVsbCwgc2FuaXRpemVkX3VzZXJuYW1lIFZBUkNIQVIsIGFsZXJ0X3NlZW4gSU5URUdFUiwgbGFzdF9zZWVuX3RpbWUgSU5URUdFUiwgVU5JUVVFICh1cmwsIHVzZXJuYW1lKSkvaW5kZXhzcWxpdGVfYXV0b2luZGV4X2JyZWFjaGVkXzFicmVhY2hlZGluZGV4Zm9yZWlnbl9rZXlfaW5kZXhfbm90ZXNwYXNzd29yZF9ub3Rlc0NSRUFURSBJTkRFWCBmb3JlaWduX2tleV9pbmRleF9ub3RlcyBPTiBwYXNzd29yZF9ub3RlcyAocGFyZW50X2lkKTtpbmRleHNxbGl0ZV9hdXRvaW5kZXhfcGFzc3dvcmRfbm90ZXNfMXBhc3N3b3JkX25vdGVzJ2luZGV4ZmllbGRfaW5mb19pbmRleGZpZWxkX2luZm9DUkVBVEUgSU5ERVggZmllbGRfaW5mb19pbmRleCBPTiBmaWVsZF9pbmZvIChmb3JtX3NpZ25hdHVyZSwgZmllbGRfc2lnbmF0dXJlKXRhYmxlZmllbGRfaW5mb2ZpZWxkX2luZm9DUkVBVEUgVEFCTEUgZmllbGRfaW5mbyAoZm9ybV9zaWduYXR1cmUgSU5URUdFUiBOT1QgTlVMTCwgZmllbGRfc2lnbmF0dXJlIElOVEVHRVIgTk9UIE5VTEwsIGZpZWxkX3R5cGUgSU5URUdFUiBOT1QgTlVMTCwgY3JlYXRlX3RpbWUgSU5URUdFUiBOT1QgTlVMTCwgVU5JUVVFIChmb3JtX3NpZ25hdHVyZSwgZmllbGRfc2lnbmF0dXJlKSkzaW5kZXhzcWxpdGVfYXV0b2luZGV4X2ZpZWxkX2luZm9fMWZpZWxkX2luZm8=94:T39f8,U1FMaXRlIGZvcm1hdCAzfXx8en0ze3xHei55RXl0YWJsZW1vel9wbGFjZXNtb3pfcGxhY2VzQ1JFQVRFIFRBQkxFIG1vel9wbGFjZXMgKCAgIGlkIElOVEVHRVIgUFJJTUFSWSBLRVksIHVybCBMT05HVkFSQ0hBUiwgdGl0bGUgTE9OR1ZBUkNIQVIsIHJldl9ob3N0IExPTkdWQVJDSEFSLCB2aXNpdF9jb3VudCBJTlRFR0VSIERFRkFVTFQgMCwgaGlkZGVuIElOVEVHRVIgREVGQVVMVCAwIE5PVCBOVUxMLCB0eXBlZCBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCwgZnJlY2VuY3kgSU5URUdFUiBERUZBVUxUIC0xIE5PVCBOVUxMLCBsYXN0X3Zpc2l0X2RhdGUgSU5URUdFUiAsIGd1aWQgVEVYVCwgZm9yZWlnbl9jb3VudCBJTlRFR0VSIERFRkFVTFQgMCBOT1QgTlVMTCwgdXJsX2hhc2ggSU5URUdFUiBERUZBVUxUIDAgTk9UIE5VTEwgLCBkZXNjcmlwdGlvbiBURVhULCBwcmV2aWV3X2ltYWdlX3VybCBURVhULCBvcmlnaW5faWQgSU5URUdFUiBSRUZFUkVOQ0VTIG1vel9vcmlnaW5zKGlkKSkrdGFibGVtb3pfb3JpZ2luc21vel9vcmlnaW5zJUNSRUFURSBUQUJMRSBtb3pfb3JpZ2lucyAoIGlkIElOVEVHRVIgUFJJTUFSWSBLRVksIHByZWZpeCBURVhUIE5PVCBOVUxMLCBob3N0IFRFWFQgTk9UIE5VTEwsIGZyZWNlbmN5IElOVEVHRVIgTk9UIE5VTEwsIFVOSVFVRSAocHJlZml4LCBob3N0KSApNSVpbmRleHNxbGl0ZV9hdXRvaW5kZXhfbW96X29yaWdpbnNfMW1vel9vcmlnaW5zJmgjI3RhYmxlbW96X21ldGFtb3pfbWV0YSRDUkVBVEUgVEFCTEUgbW96X21ldGEgKGtleSBURVhUIFBSSU1BUlkgS0VZLCB2YWx1ZSBOT1QgTlVMTCkgV0lUSE9VVCBST1dJRCBZaW5kZXhtb3pfaXRlbXNfYW5ub3NfaXRlbWF0dHJpYnV0ZWluZGV4bW96X2l0ZW1zX2Fubm9zI0NSRUFURSBVTklRVUUgSU5ERVggbW96X2l0ZW1zX2Fubm9zX2l0ZW1hdHRyaWJ1dGVpbmRleCBPTiBtb3pfaXRlbXNfYW5ub3MgKGl0ZW1faWQsIGFubm9fYXR0cmlidXRlX2lkKUVpbmRleG1vel9hbm5vc19wbGFjZWF0dHJpYnV0ZWluZGV4bW96X2Fubm9zIkNSRUFURSBVTklRVUUgSU5ERVggbW96X2Fubm9zX3BsYWNlYXR0cmlidXRlaW5kZXggT04gbW96X2Fubm9zIChwbGFjZV9pZCwgYW5ub19hdHRyaWJ1dGVfaWQpTWluZGV4bW96X2tleXdvcmRzX3BsYWNlcG9zdGRhdGFfdW5pcXVlaW5kZXhtb3pfa2V5d29yZHMhQ1JFQVRFIFVOSVFVRSBJTkRFWCBtb3pfa2V5d29yZHNfcGxhY2Vwb3N0ZGF0YV91bmlxdWVpbmRleCBPTiBtb3pfa2V5d29yZHMgKHBsYWNlX2lkLCBwb3N0X2RhdGEpIWluZGV4bW96X2Jvb2ttYXJrc19ndWlkX3VuaXF1ZWluZGV4bW96X2Jvb2ttYXJrcyBDUkVBVEUgVU5JUVVFIElOREVYIG1vel9ib29rbWFya3NfZ3VpZF91bmlxdWVpbmRleCBPTiBtb3pfYm9va21hcmtzIChndWlkKXxpbmRleG1vel9ib29rbWFya3NfZGF0ZWFkZGVkaW5kZXhtb3pfYm9va21hcmtzQ1JFQVRFIElOREVYIG1vel9ib29rbWFya3NfZGF0ZWFkZGVkaW5kZXggT04gbW96X2Jvb2ttYXJrcyAoZGF0ZUFkZGVkKTVpbmRleG1vel9ib29rbWFya3NfaXRlbWxhc3Rtb2RpZmllZGluZGV4bW96X2Jvb2ttYXJrc0NSRUFURSBJTkRFWCBtb3pfYm9va21hcmtzX2l0ZW1sYXN0bW9kaWZpZWRpbmRleCBPTiBtb3pfYm9va21hcmtzIChmaywgbGFzdE1vZGlmaWVkKX0haW5kZXhtb3pfYm9va21hcmtzX3BhcmVudGluZGV4bW96X2Jvb2ttYXJrc0NSRUFURSBJTkRFWCBtb3pfYm9va21hcmtzX3BhcmVudGluZGV4IE9OIG1vel9ib29rbWFya3MgKHBhcmVudCwgcG9zaXRpb24pcWluZGV4bW96X2Jvb2ttYXJrc19pdGVtaW5kZXhtb3pfYm9va21hcmtzQ1JFQVRFIElOREVYIG1vel9ib29rbWFya3NfaXRlbWluZGV4IE9OIG1vel9ib29rbWFya3MgKGZrLCB0eXBlKSFpbmRleG1vel9oaXN0b3J5dmlzaXRzX2RhdGVpbmRleG1vel9oaXN0b3J5dmlzaXRzQ1JFQVRFIElOREVYIG1vel9oaXN0b3J5dmlzaXRzX2RhdGVpbmRleCBPTiBtb3pfaGlzdG9yeXZpc2l0cyAodmlzaXRfZGF0ZSkhaW5kZXhtb3pfaGlzdG9yeXZpc2l0c19mcm9taW5kZXhtb3pfaGlzdG9yeXZpc2l0c0NSRUFURSBJTkRFWCBtb3pfaGlzdG9yeXZpc2l0c19mcm9taW5kZXggT04gbW96X2hpc3Rvcnl2aXNpdHMgKGZyb21fdmlzaXQpP2luZGV4bW96X2hpc3Rvcnl2aXNpdHNfcGxhY2VkYXRlaW5kZXhtb3pfaGlzdG9yeXZpc2l0c0NSRUFURSBJTkRFWCBtb3pfaGlzdG9yeXZpc2l0c19wbGFjZWRhdGVpbmRleCBPTiBtb3pfaGlzdG9yeXZpc2l0cyAocGxhY2VfaWQsIHZpc2l0X2RhdGUpdmluZGV4bW96X3BsYWNlc19ndWlkX3VuaXF1ZWluZGV4bW96X3BsYWNlc0NSRUFURSBVTklRVUUgSU5ERVggbW96X3BsYWNlc19ndWlkX3VuaXF1ZWluZGV4IE9OIG1vel9wbGFjZXMgKGd1aWQpfiFpbmRleG1vel9wbGFjZXNfbGFzdHZpc2l0ZGF0ZWluZGV4bW96X3BsYWNlc0NSRUFURSBJTkRFWCBtb3pfcGxhY2VzX2xhc3R2aXNpdGRhdGVpbmRleCBPTiBtb3pfcGxhY2VzIChsYXN0X3Zpc2l0X2RhdGUpbWluZGV4bW96X3BsYWNlc19mcmVjZW5jeWluZGV4bW96X3BsYWNlc0NSRUFURSBJTkRFWCBtb3pfcGxhY2VzX2ZyZWNlbmN5aW5kZXggT04gbW96X3BsYWNlcyAoZnJlY2VuY3kpamluZGV4bW96X3BsYWNlc192aXNpdGNvdW50bW96X3BsYWNlc0NSRUFURSBJTkRFWCBtb3pfcGxhY2VzX3Zpc2l0Y291bnQgT04gbW96X3BsYWNlcyAodmlzaXRfY291bnQpZWluZGV4bW96X3BsYWNlc19ob3N0aW5kZXhtb3pfcGxhY2VzQ1JFQVRFIElOREVYIG1vel9wbGFjZXNfaG9zdGluZGV4IE9OIG1vel9wbGFjZXMgKHJldl9ob3N0KW1pbmRleG1vel9wbGFjZXNfdXJsX2hhc2hpbmRleG1vel9wbGFjZXNDUkVBVEUgSU5ERVggbW96X3BsYWNlc191cmxfaGFzaGluZGV4IE9OIG1vel9wbGFjZXMgKHVybF9oYXNoKUtbdGFibGVzcWxpdGVfc3RhdDFzcWxpdGVfc3RhdDFDUkVBVEUgVEFCTEUgc3FsaXRlX3N0YXQxKHRibCxpZHgsc3RhdCkndGFibGVtb3pfaXRlbXNfYW5ub3Ntb3pfaXRlbXNfYW5ub3NDUkVBVEUgVEFCTEUgbW96X2l0ZW1zX2Fubm9zICggIGlkIElOVEVHRVIgUFJJTUFSWSBLRVksIGl0ZW1faWQgSU5URUdFUiBOT1QgTlVMTCwgYW5ub19hdHRyaWJ1dGVfaWQgSU5URUdFUiwgY29udGVudCBMT05HVkFSQ0hBUiwgZmxhZ3MgSU5URUdFUiBERUZBVUxUIDAsIGV4cGlyYXRpb24gSU5URUdFUiBERUZBVUxUIDAsIHR5cGUgSU5URUdFUiBERUZBVUxUIDAsIGRhdGVBZGRlZCBJTlRFR0VSIERFRkFVTFQgMCwgbGFzdE1vZGlmaWVkIElOVEVHRVIgREVGQVVMVCAwKXRhYmxlbW96X2Fubm9zbW96X2Fubm9zQ1JFQVRFIFRBQkxFIG1vel9hbm5vcyAoICBpZCBJTlRFR0VSIFBSSU1BUlkgS0VZLCBwbGFjZV9pZCBJTlRFR0VSIE5PVCBOVUxMLCBhbm5vX2F0dHJpYnV0ZV9pZCBJTlRFR0VSLCBjb250ZW50IExPTkdWQVJDSEFSLCBmbGFncyBJTlRFR0VSIERFRkFVTFQgMCwgZXhwaXJhdGlvbiBJTlRFR0VSIERFRkFVTFQgMCwgdHlwZSBJTlRFR0VSIERFRkFVTFQgMCwgZGF0ZUFkZGVkIElOVEVHRVIgREVGQVVMVCAwLCBsYXN0TW9kaWZpZWQgSU5URUdFUiBERUZBVUxUIDApR3RhYmxlbW96X2Fubm9fYXR0cmlidXRlc21vel9hbm5vX2F0dHJpYnV0ZXNDUkVBVEUgVEFCTEUgbW96X2Fubm9fYXR0cmlidXRlcyAoICBpZCBJTlRFR0VSIFBSSU1BUlkgS0VZLCBuYW1lIFZBUkNIQVIoMzIpIFVOSVFVRSBOT1QgTlVMTClFaW5kZXhzcWxpdGVfYXV0b2luZGV4X21vel9hbm5vX2F0dHJpYnV0ZXNfMW1vel9hbm5vX2F0dHJpYnV0ZXNZdGFibGVzcWxpdGVfc2VxdWVuY2VzcWxpdGVfc2VxdWVuY2VDUkVBVEUgVEFCTEUgc3FsaXRlX3NlcXVlbmNlKG5hbWUsc2VxKXRhYmxlbW96X2tleXdvcmRzbW96X2tleXdvcmRzQ1JFQVRFIFRBQkxFIG1vel9rZXl3b3JkcyAoICBpZCBJTlRFR0VSIFBSSU1BUlkgS0VZIEFVVE9JTkNSRU1FTlQsIGtleXdvcmQgVEVYVCBVTklRVUUsIHBsYWNlX2lkIElOVEVHRVIsIHBvc3RfZGF0YSBURVhUKTdpbmRleHNxbGl0ZV9hdXRvaW5kZXhfbW96X2tleXdvcmRzXzFtb3pfa2V5d29yZHNVdGFibGVtb3pfYm9va21hcmtzX2RlbGV0ZWRtb3pfYm9va21hcmtzX2RlbGV0ZWRDUkVBVEUgVEFCTEUgbW96X2Jvb2ttYXJrc19kZWxldGVkICggIGd1aWQgVEVYVCBQUklNQVJZIEtFWSwgZGF0ZVJlbW92ZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDApSWluZGV4c3FsaXRlX2F1dG9pbmRleF9tb3pfYm9va21hcmtzX2RlbGV0ZWRfMW1vel9ib29rbWFya3NfZGVsZXRlZHRhYmxlbW96X2Jvb2ttYXJrc21vel9ib29rbWFya3NDUkVBVEUgVEFCTEUgbW96X2Jvb2ttYXJrcyAoICBpZCBJTlRFR0VSIFBSSU1BUlkgS0VZLCB0eXBlIElOVEVHRVIsIGZrIElOVEVHRVIgREVGQVVMVCBOVUxMLCBwYXJlbnQgSU5URUdFUiwgcG9zaXRpb24gSU5URUdFUiwgdGl0bGUgTE9OR1ZBUkNIQVIsIGtleXdvcmRfaWQgSU5URUdFUiwgZm9sZGVyX3R5cGUgVEVYVCwgZGF0ZUFkZGVkIElOVEVHRVIsIGxhc3RNb2RpZmllZCBJTlRFR0VSLCBndWlkIFRFWFQsIHN5bmNTdGF0dXMgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHN5bmNDaGFuZ2VDb3VudGVyIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAxKSd0YWJsZW1vel9ob3N0c21vel9ob3N0c0NSRUFURSBUQUJMRSBtb3pfaG9zdHMgKCAgaWQgSU5URUdFUiBQUklNQVJZIEtFWSwgaG9zdCBURVhUIE5PVCBOVUxMIFVOSVFVRSwgZnJlY2VuY3kgSU5URUdFUiwgdHlwZWQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHByZWZpeCBURVhUKTFpbmRleHNxbGl0ZV9hdXRvaW5kZXhfbW96X2hvc3RzXzFtb3pfaG9zdHN0YWJsZW1vel9pbnB1dGhpc3Rvcnltb3pfaW5wdXRoaXN0b3J5Q1JFQVRFIFRBQkxFIG1vel9pbnB1dGhpc3RvcnkgKCAgcGxhY2VfaWQgSU5URUdFUiBOT1QgTlVMTCwgaW5wdXQgTE9OR1ZBUkNIQVIgTk9UIE5VTEwsIHVzZV9jb3VudCBJTlRFR0VSLCBQUklNQVJZIEtFWSAocGxhY2VfaWQsIGlucHV0KSk/aW5kZXhzcWxpdGVfYXV0b2luZGV4X21vel9pbnB1dGhpc3RvcnlfMW1vel9pbnB1dGhpc3Rvcnk9dGFibGVtb3pfaGlzdG9yeXZpc2l0c21vel9oaXN0b3J5dmlzaXRzQ1JFQVRFIFRBQkxFIG1vel9oaXN0b3J5dmlzaXRzICggIGlkIElOVEVHRVIgUFJJTUFSWSBLRVksIGZyb21fdmlzaXQgSU5URUdFUiwgcGxhY2VfaWQgSU5URUdFUiwgdmlzaXRfZGF0ZSBJTlRFR0VSLCB2aXNpdF90eXBlIElOVEVHRVIsIHNlc3Npb24gSU5URUdFUilpbmRleG1vel9wbGFjZXNfb3JpZ2luaWRpbmRleG1vel9wbGFjZXMnQ1JFQVRFIElOREVYIG1vel9wbGFjZXNfb3JpZ2luaWRpbmRleCBPTiBtb3pfcGxhY2VzIChvcmlnaW5faWQpfG58JHpVZlVmVWZVZlVmVWZodHRwczovL3N1cHBvcnQubW96aWxsYS5vcmcvZW4tVVMvcHJvZHVjdHMvZmlyZWZveGdyby5hbGxpem9tLnRyb3BwdXMuSW5aRGE0MkN0M0Y4K2h0dHBzOi8vYXBwLnZzc3BzLnZpc3VhbHN0dWRpby5jb20vX3NpZ25pbj9yZWFsbT1teS52aXN1YWxzdHVkaW8uY29tJnJlcGx5X3RvPWh0dHBzJTNBJTJGJTJGbXkudmlzdWFsc3R1ZGlvLmNvbSUyRkJlbmVmaXRzJTNGd3QubWNfaWQlM0Rvfm1zZnR+dnNjb21+bmF2JTI2Y2FtcGFpZ24lM0Rvfm1zZnR+dnNjb21+bmF2JnJlZGlyZWN0PTEmY29udGV4dD1leUpvZENJNk15d2lhR2xrSWpvaU4yUXhObUU1T1RVdE1EQTBNaTFrTUdaaExXUmhaR1F0WVRRNFl6VXpZV1JrWWpsbElpd2ljWE1pT250OUxDSnljaUk2SWlJc0luWm9Jam9pSWl3aVkzWWlPaUlpTENKamN5STZJaUo5MCNjdHg9ZXlKVGFXZHVTVzVEYjI5cmFXVkViMjFoYVc1eklqcGJJbWgwZEhCek9pOHZiRzluYVc0dWQybHVaRzkzY3k1dVpYUWlMQ0pvZEhSd2N6b3ZMMnh2WjJsdUxtMXBZM0p2YzI5bWRHOXViR2x1WlM1amIyMGlYWDAxbW9jLm9pZHV0c2xhdXNpdi5zcHNzdi5wcGEueWh2SC1tSm8zeE9zTVgraHR0cHM6Ly9tc2RuLm1pY3Jvc29mdC5jb20vZW4tdXMvc3Vic2NyaXB0aW9ucy9hYTMzNjg1OC5hc3B4bW9jLnRmb3NvcmNpbS5uZHNtLjFxc0RQQ2hROU1weitodHRwczovL2FwcC52c2FleC52aXN1YWxzdHVkaW8uY29tL3Byb2ZpbGUvdmlldz9ta3Q9ZW4tVVMmY2FtcGFpZ249b35tc2Z0fnZzY29tfnNpZ25pbm1vYy5vaWR1dHNsYXVzaXYueGVhc3YucHBhLkt1Nkg2Z2lfVnpQQStodHRwczovL2FwcC52c2FleC52aXN1YWxzdHVkaW8uY29tL3Byb2ZpbGUvY3JlYXRlP21rdD1lbi11cyZjYW1wYWlnbj1vfm1zZnR+dnNjb21+c2lnbmlubW9jLm9pZHV0c2xhdXNpdi54ZWFzdi5wcGEua0w0U2ZySUk3eUFoK2h0dHBzOi8vY3Jvd2RzdHJpa2Uub2t0YS5jb20vbG9naW4vc2Vzc2lvbkNvb2tpZVJlZGlyZWN0P2NoZWNrQWNjb3VudFNldHVwQ29tcGxldGU9dHJ1ZSZ0b2tlbj0yMDExMTlLZEJLVkQ2YUVaaVM1N0lFRTJ5WWpBLVlIVmp1cnBNT2RlZG1UZ2hGVllwY1hUc0lBJnJlZGlyZWN0VXJsPWh0dHBzJTNBJTJGJTJGY3Jvd2RzdHJpa2Uub2t0YS5jb20lMkZhcHAlMkZvZmZpY2UzNjUlMkZleGs5bnRrdW82dU5JNUJHQzB4NyUyRnNzbyUyRndzZmVkJTJGcGFzc2l2ZSUzRmNsaWVudC1yZXF1ZXN0LWlkJTNEODMxNzM4NDEtZGZmNS00NDAyLTgwYjMtODI1MmRmNDU1N2I4JTI2d2ElM0R3c2lnbmluMS4wJTI2d3RyZWFsbSUzRHVybiUyNTNhZmVkZXJhdGlvbiUyNTNhTWljcm9zb2Z0T25saW5lJTI2d2N0eCUzRExvZ2luT3B0aW9ucyUyNTNEMyUyNTI2ZXN0c3JlZGlyZWN0JTI1M2QyJTI1MjZlc3RzcmVxdWVzdCUyNTNkclFJSUFaVlN6MnNUVVJET1p0T1lCc0VpZ29LWEhwSWMxTjNzZV92clpTSFFRQnRqcVZvdGFQRVNOcnR2azAxMjkyM2ZlNXZFZ2tFVXhHUHg2RkhCUTd6cHBmZ25lT3E1bDRKZVJBLUtJSGowVmZFa2dzSXdNRFBmOE0xOE14ZGtvQUtuWWpRYVBXUzRuZ0owQ0JRRDJvSGl1c0JXb0dWN3J0V3dUYnVCMW91bUJnelRvS2ZMU3kxMDl1RzNvX3pxX2RjUGJoNnQzZDZmUzVjR25LZk1xZGZkTkZYSGpLVk1IWWNzY3lQR016OGtxa2ZpZXBlRl9RVDdZYkl2U1FlUzlFR1M1dmtLMG9HdEl3TW9maENZaW1Gb1VFRmFUMWNRTktFZkdLWnA5OUJoX3RUMVZzWUg4TmdSR3U3aXJfbkZnTkM0bXhMR244cVA4aFM3VWR6OHhlM2k2Ul9jTllyVDZHNlhrLWJQT2F0NnF3cmJ3djdlSVlwOUlseEtTUkJHdUtxMzR4R3Y2cXM0VVRKV2hkYUVxN0hYRFgyUklyT1lCWHcyWnFKdGRyeGptQWhBdC0tS21wQlhzMnhnbWxCWEFRSVFRZzFZbWdvTWtkUVIwbTJCVEQwOFRRV1cwd3lMTUFzOVBoVmhqR3NEM3RSckNVazgzUHdYbmVaeTVmY1pZamR4LXpqR0NSZkxVS3hPd3NRbkU2WW1tTmRmeVVVeGFVeVNkX0w1MktXZVNzTXhwbVRGbzJUaU0wN0RFVDVXNEtBZ2ZTeWMxR1NuVkNvdjVjN2xsblBmQzlLekJYSC1sLTlMbnpmdTNWcDVjZmxKOHZ4VE9mZDJvVDY1dWgxWm1fN1dWclRaNmdfWGh0UE9kSVNHblkyZDFzN29XZ3AydDI5YzZWQi1zYjF1YWszb2dMMml0RmNzZmlsS2owX2szaXotMV9NY2xzOElEWkdpMlFxd2x3RjBvT1VZNk00UDAlMjZjYmN4dCUzRCUyNnVzZXJuYW1lJTNEbWFyYy5yaXZlcm8lMjU0MGNyb3dkc3RyaWtlLmNvbSUyNm1rdCUzRCUyNmxjJTNEbW9jLmF0a28uZWtpcnRzZHdvcmMuSDFVTWRxVVczWlJSbCtodHRwczovL2FwcC52c2FleC52aXN1YWxzdHVkaW8uY29tL2dvL3Byb2ZpbGU/bWt0PWVuLXVzJnd0Lm1jX2lkPW9+bXNmdH52c2NvbX5zaWduaW4mX2dhPTEuMTA2NzE1NTIzLjE4MTIyMjAxNjAuMTQ2NzEzODgzNyZwY2V4cD10cnVlJnVpY3R4PW1lbW9jLm9pZHV0c2xhdXNpdi54ZWFzdi5wcGEua2VuMzJqTldOR3BjK2h0dHA6Ly93d3cuZ29vZ2xlLmNvbS9tb2MuZWxnb29nLnd3dy5pOFZkV0JpZ0M5OXo1dHImI2h0dHA6Ly9nb29nbGUuY29tL21vYy5lbGdvb2cuN0dGYlROaFNUN2FJciZwbGFjZTp0eXBlPTYmc29ydD0xNCZtYXhSZXN1bHRzPTEwLnZGQ1dmbU9FbHZuQ3BsYWNlOnNvcnQ9OCZtYXhSZXN1bHRzPTEwLm91TnJoRUktVU5FTGh0dHBzOi8vd3d3Lm1vemlsbGEub3JnL3ByaXZhY3kvZmlyZWZveC9ncm8uYWxsaXpvbS53d3cuXzRFOGlrRUd5X3NKK2h0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2VuLVVTL2ZpcmVmb3gvY2VudHJhbC9ncm8uYWxsaXpvbS53d3cuSWN5WF9zRkJWbW1ZK2h0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2VuLVVTL2Fib3V0L2dyby5hbGxpem9tLnd3dy5mR2c0dm5pT29VWTgraHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZW4tVVMvY29udHJpYnV0ZS9ncm8uYWxsaXpvbS53d3cuaUhFZF8tTmxxS08yK2h0dHBzOi8vd3d3Lm1vemlsbGEub3JnL2VuLVVTL2ZpcmVmb3gvY3VzdG9taXplL2dyby5hbGxpem9tLnd3dy5pMUlrUXhwS21SVzErfm5+SH1+dX42fXJvb3RfX19fX19fXy10OEM1XzlJUHMwMjhSZWNlbnQgVGFnc29ZdHZuRVpPcnU0TU1vc3QgVmlzaXRlZDMtUnZuTE52Y2FLcUdldHRpbmcgU3RhcnRlZGhOdVhvMnJEelZDUGc1QWJvdXQgVXN4QUtvR0p1VmV1cUxvOUdldCBJbnZvbHZlZHh1YXlJWGVGeEJwM1E9Q3VzdG9taXplIEZpcmVmb3h4VnpqMnRCZDNNRWlwPUhlbHAgYW5kIFR1dG9yaWFsc3hudmFmQS05N3lwbU08TW96aWxsYSBGaXJlZm94eFFxblNabUVZSkFYRDNtb2JpbGVtb2JpbGVfX19fX19PdGhlciBCb29rbWFya3N1bmZpbGVkX19fX19UYWdzdGFnc19fX19fX19fPUJvb2ttYXJrcyBUb29sYmFydG9vbGJhcl9fX19fQm9va21hcmtzIE1lbnVtZW51X19fX19fX19zdGUxejhEMk1ONjB6RlBYWVBybHdrSUVYLTVUMDM1RGNTUnJZZTgwa0tobkdBbGtCMVhnSXdGekxrQmV6dTh2NXlGai1Fd3pzWTZGUnl6MzUzQ2x5c1pQeUh3Zk5lQktzdGUxejhEMk1ONjB6RlBYWVBybHdrSUVYLTVUMDM1RGNTUnJZZTgwa0tobkdBbGtCMVhnSXdGekxrQmV6dTh2NXlGai1Fd3pzWTZGUnl6MzUzQ2wleXNaUHlId2ZOZUJLMWRvd25sb2Fkcy9tZXRhRGF0YUVkb3dubG9hZHMvZGVzdGluYXRpb25GaWxlVVJJNVBsYWNlcy9TbWFydEJvb2ttYXJrNW1vYmlsZS9ib29rbWFya3NSb290ZG93bmxvYWRzL21ldGFEYXRhZG93bmxvYWRzL2Rlc3RpbmF0aW9uRmlsZVVSSTVtb2JpbGUvYm9va21hcmtzUm9vdFBsYWNlcy9TbWFydEJvb2ttYXJrfWd9R31HfUd9R31HfUd9R31HfUd9R31HfUd9R31HfUdSZWNlbnRUYWdzTW9zdFZpc2l0ZWR9e31LbW96X3BsYWNlc21vel9wbGFjZXNfdXJsX2hhc2hpbmRleDM2IDEmbW96X3BsYWNlc21vel9wbGFjZXNfaG9zdGluZGV4MzYgMy5tb3pfYm9va21hcmtzbW96X2Jvb2ttYXJrc19pdGVtaW5kZXgxNSAyIDIwbW96X2Jvb2ttYXJrc21vel9ib29rbWFya3NfcGFyZW50aW5kZXgxNSAzIDE6bW96X2Jvb2ttYXJrc21vel9ib29rbWFya3NfaXRlbWxhc3Rtb2RpZmllZGluZGV4MTUgMiAyMW1vel9ib29rbWFya3Ntb3pfYm9va21hcmtzX2RhdGVhZGRlZGluZGV4MTUgMzNtb3pfYm9va21hcmtzbW96X2Jvb2ttYXJrc19ndWlkX3VuaXF1ZWluZGV4MTUgMTptb3pfaGlzdG9yeXZpc2l0c21vel9oaXN0b3J5dmlzaXRzX3BsYWNlZGF0ZWluZGV4MyAxIDEzbW96X2hpc3Rvcnl2aXNpdHNtb3pfaGlzdG9yeXZpc2l0c19mcm9taW5kZXgzIDIzbW96X2hpc3Rvcnl2aXNpdHNtb3pfaGlzdG9yeXZpc2l0c19kYXRlaW5kZXgzIDFtb3pfcGxhY2VzbW96X3BsYWNlc192aXNpdGNvdW50MzYgMTIqbW96X3BsYWNlc21vel9wbGFjZXNfZnJlY2VuY3lpbmRleDM2IDQvbW96X3BsYWNlc21vel9wbGFjZXNfbGFzdHZpc2l0ZGF0ZWluZGV4MzYgMi1tb3pfcGxhY2VzbW96X3BsYWNlc19ndWlkX3VuaXF1ZWluZGV4MzYgMSptb3pfcGxhY2VzbW96X3BsYWNlc19vcmlnaW5pZGluZGV4MzYgM34hfiF+IX4hfiF+IX0yfTJ9Mn0yfTJ9Mn0yfW1vYy50Zm9zb3JjaW0ubmRzbS5tb2Mub2lkdXRzbGF1c2l2LnhlYXN2LnBwYS5tb2Mub2lkdXRzbGF1c2l2LnhlYXN2LnBwYS5tb2Mub2lkdXRzbGF1c2l2LnhlYXN2LnBwYS5tb2Mub2lkdXRzbGF1c2l2LnNwc3N2LnBwYS5tb2MuZWxnb29nLnd3dy5tb2MuZWxnb29nLm1vYy5hdGtvLmVraXJ0c2R3b3JjLmdyby5hbGxpem9tLnd3dy5ncm8uYWxsaXpvbS53d3cuZ3JvLmFsbGl6b20ud3d3Lmdyby5hbGxpem9tLnd3dy5ncm8uYWxsaXpvbS53d3cuNWdyby5hbGxpem9tLnRyb3BwdXMufmV+ZX5lfmV+ZX5lfnp+R342fiV9dkgtbUpvM3hPc01YdkZDV2ZtT0Vsdm5DflhvdU5yaEVJLVVORUxrZW4zMmpOV05HcGNrTDRTZnJJSTd5QWhpSEVkXy1ObHFLTzJpMUlrUXhwS21SVzFmR2c0dm5pT29VWThfNEU4aWtFR3lfc0pWZFdCaWdDOTl6NXRLdTZINmdpX1Z6UEElSW5aRGE0MkN0M0Y4SWN5WF9zRkJWbW1ZN0dGYlROaFNUN2FJMXFzRFBDaFE5TXB6MVVNZHFVVzNaUlJsflR+VH5UflR+VH5UflR+VH5UflR+VH5UflR+VH5UflR+VH5UflR+VH5UflR+VHVuZmlsZWRfX19fX3VheUlYZUZ4QnAzUXRvb2xiYXJfX19fX3RhZ3NfX19fX19fXyVyb290X19fX19fX19vWXR2bkVaT3J1NE1udmFmQS05N3lwbU1tb2JpbGVfX19fX19tZW51X19fX19fX19WemoydEJkM01FaXBRcW5TWm1FWUpBWEROdVhvMnJEelZDUGdBS29HSnVWZXVxTG8zLVJ2bkxOdmNhS3EtdDhDNV85SVBzMDJvcmlnaW5fZnJlY2VuY3lfc3VtX29mX3NxdWFyZXNBT29yaWdpbl9mcmVjZW5jeV9zdW1Ab3JpZ2luX2ZyZWNlbmN5X2NvdW50fiJ+In4ifmh0dHBzOi8vc3VwcG9ydC5tb3ppbGxhLm9yZ2h0dHBzOi8vY3Jvd2RzdHJpa2Uub2t0YS5jb21odHRwczovL21zZG4ubWljcm9zb2Z0LmNvbWh0dHBzOi8vYXBwLnZzc3BzLnZpc3VhbHN0dWRpby5jb21odHRwczovL2FwcC52c2FleC52aXN1YWxzdHVkaW8uY29tYWh0dHA6Ly9nb29nbGUuY29taHR0cDovL3d3dy5nb29nbGUuY29tcGxhY2U6dHlwZT02JnNvcnQ9MTQmbWF4UmVzdWx0cz0xMHBsYWNlOnNvcnQ9OCZtYXhSZXN1bHRzPTEwaHR0cHM6Ly93d3cubW96aWxsYS5vcmd+X34/aHR0cHM6Ly9tc2RuLm1pY3Jvc29mdC5jb21odHRwczovL2Nyb3dkc3RyaWtlLm9rdGEuY29taHR0cHM6Ly9hcHAudnNzcHMudmlzdWFsc3R1ZGlvLmNvbWh0dHBzOi8vYXBwLnZzYWV4LnZpc3VhbHN0dWRpby5jb21odHRwOi8vd3d3Lmdvb2dsZS5jb21odHRwOi8vZ29vZ2xlLmNvbXBsYWNlOnR5cGU9NiZzb3J0PTE0Jm1heFJlc3VsdHM9MTBwbGFjZTpzb3J0PTgmbWF4UmVzdWx0cz0xMGh0dHBzOi8vd3d3Lm1vemlsbGEub3JnM2h0dHBzOi8vc3VwcG9ydC5tb3ppbGxhLm9yZw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"job_id":"682f1077421fe9a5d3046379","environment_id":160,"environment_description":"Windows 10 64 bit","size":6203320,"type":"PE32+ executable (GUI) x86-64, for MS Windows, 7 sections","type_short":["peexe","64bits","executable"],"type_short_id":"64-bit exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c","md5":"faeb88275ab0c27dd496c539adad8f33","sha1":"87446260ad83c0c77f5a0c55459f91efb18328a1","sha256":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c","sha512":"4a96c1ddedb65b8cb5b69651c73a1d1dac0ae28ef31d42bd8694c29d9b9ec23544f19b1e65162e4c69543ee19de474e9c0e034d63ee6382090a5b0d9242ce4fd","ssdeep":"98304:ahHn8sSozkCEi3zI20AkhUrMgBC4qdMNKFK5nZA+J:SHneozkCEijI20AIUggBC4qdMNKFWA","imphash":"bee3511554e6c6bace1275d7d6f76dbd","entrypoint":"0x140425508","entrypoint_section":".text","image_base":"0x140000000","subsystem":"Windows Gui","image_file_characteristics":["EXECUTABLE_IMAGE","LARGE_ADDRESS_AWARE"],"dll_characteristics":["HIGH_ENTROPY_VA","DYNAMIC_BASE","NX_COMPAT","TERMINAL_SERVER_AWARE"],"major_os_version":"6","minor_os_version":"0","av_detect":20,"vx_family":null,"url_analysis":false,"analysis_start_time":"2025-05-22T11:54:32+00:00","threat_score":100,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[{"owner":"CN=Microsoft Corporation","issuer":"CN=Microsoft Corporation","serial_number":"313bca228278369e4728782de0cc8f53","md5":"77:10:75:7C:55:35:2E:41:EC:E1:D2:11:FE:B8:95:65","sha1":"02:49:73:49:72:A7:2C:8C:7A:49:A8:3E:AB:A5:D7:28:5D:5D:69:15","valid_from":"2025-03-16T10:20:55+00:00","valid_until":"2026-03-16T10:40:55+00:00"},{"owner":"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US","issuer":"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US","serial_number":"e9b188ef9d02de7efdb50e20840185a","md5":"8D:DD:0B:C6:D9:D7:70:EB:6B:2B:67:1A:86:28:55:CC","sha1":"A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6","valid_from":"2022-08-01T00:00:00+00:00","valid_until":"2031-11-09T23:59:59+00:00"},{"owner":"CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA, O=\"DigiCert, Inc.\", C=US","issuer":"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US","serial_number":"73637b724547cd847acfd28662a5e5b","md5":"9E:3E:4F:A4:41:17:44:1D:BA:73:C2:8E:98:3F:C0:5F","sha1":"B6:C8:AF:83:4D:4E:53:B6:73:C7:68:72:AA:8C:95:0C:7C:54:DF:5F","valid_from":"2022-03-23T00:00:00+00:00","valid_until":"2037-03-22T23:59:59+00:00"},{"owner":"CN=DigiCert Timestamp 2024, O=DigiCert, C=US","issuer":"CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA, O=\"DigiCert, Inc.\", C=US","serial_number":"bae66bc5aba7f9587c6f9e904e33304","md5":"EF:F1:36:76:73:0E:52:42:54:31:E3:28:75:DB:D6:05","sha1":"DB:D3:85:EE:62:DB:D2:3E:7B:E4:F6:71:48:50:87:24:D5:86:5B:45","valid_from":"2024-09-26T00:00:00+00:00","valid_until":"2035-11-25T23:59:59+00:00"}],"is_certificates_valid":false,"certificates_validation_message":"A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","domains":["api.telegram.org"],"compromised_hosts":[],"hosts":["149.154.167.220"],"total_network_connections":1,"total_processes":37,"total_signatures":344,"extracted_files":[{"name":"svchost.exe","file_path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe","file_size":5246976,"md5":"214fed6ca5463cc51e4bd97338372029","sha1":"418740eccd35711787d72b3e55c7f689ca939fc9","sha256":"0d557f762da311ec766c0585cc0247702589c7fd2303deb2afdb8320afb7067e","sha512":"fb5563b490cc1e45e08345d97b71e9b6114875aeef44c6c4c5e928ea547c919360442fc370254f3877c3fee35ca9cf2d76df5235ddcd6d37c1ace5c3cd019a5d","type_tags":["peexe","64bits","executable"],"description":"PE32+ executable (GUI) x86-64, for MS Windows, 7 sections","runtime_process":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe (PID: 5044)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=3602d5c8603535b8e5846fbf783b676eb45b102420c1c0863bb677012b8a359b252996cc21d3ec9e37449523f23b3e43d99c747cdd403543c4ee45b41a255264f5b7e3543a","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=3602d5c8603535b8e5846fbf783b676eb45b102420c1c0863bb677012b8a359b252996cc21d3ec9e37449523f23b3e43d99c747cdd403543c4ee45b41a255264f5b7e3543a","has_overview":true,"extended_details":null},{"name":"runtime.zip","file_path":"%TEMP%\\runtime.zip","file_size":439336,"md5":"2669b0c43057882fc3a8988b0ab038b0","sha1":"acb6288c66c75463531798cfb272426f4b8417cf","sha256":"1a8fcf517ac79b8e6c67aae7880beba7f8b495b6f347680426dc8579eb9307f3","sha512":"6d060c88b9332e167863b4addb30aacfe681666a5cba1d5a1220b9c1551c7305eb7e88bbad5bba6d74aff348fb349686b9d23649fa9133969e0d59c46b40f784","type_tags":["data","compressed","zip"],"description":"Zip archive data, at least v2.0 to extract, compression method=deflate","runtime_process":"powershell.exe (PID: 6864)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=32e339e7748d9443b3fafa91cfa2897eb746b507d4a7f988326fb3f9cf941e7775c029ecda4951acd5dbbd7ed08fdb0ef24e2e3913852708d8dac57ee58c64edb8bbf6ba7427","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=32e339e7748d9443b3fafa91cfa2897eb746b507d4a7f988326fb3f9cf941e7775c029ecda4951acd5dbbd7ed08fdb0ef24e2e3913852708d8dac57ee58c64edb8bbf6ba7427","has_overview":false,"extended_details":null},{"name":"util.bat","file_path":"C:\\util.bat","file_size":143,"md5":"fd60180a75770005f4a7150a398e88e7","sha1":"1575b81aa20caf3d179d6bc979622bb5e9ad2df6","sha256":"c807df5e4e41d412037b827c000367c5692a9730b73fb1aabd2d87439dcb5346","sha512":"a6a368d198e3aecdd5cd2d8043eacb5a91ab2f4cf9aa47ab8df648332d3a58bc5e4a80e4b7e45d35c710e3bd1933ba005120af194720e667763796291590e73c","type_tags":["text"],"description":"DOS batch file, ASCII text, with CRLF line terminators","runtime_process":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe (PID: 5044)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=01c9229a3c3ea09134acd86dc2138daf66a58163b2b98f208e96002c5086c0d86fd0cbd582fce254fd0ce9ea90d77321d19df45c28644cb4c73cd2b889347d5eb96bcb","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=01c9229a3c3ea09134acd86dc2138daf66a58163b2b98f208e96002c5086c0d86fd0cbd582fce254fd0ce9ea90d77321d19df45c28644cb4c73cd2b889347d5eb96bcb","has_overview":false,"extended_details":null},{"name":"StartupProfileData-NonInteractive","file_path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","file_size":64,"md5":"446dd1cf97eaba21cf14d03aebc79f27","sha1":"36e4cc7367e0c7b40f4a8ace272941ea46373799","sha256":"a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf","sha512":"a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7","type_tags":["data"],"description":"data","runtime_process":"powershell.exe (PID: 2116)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=06b320d37df5d21e3b290f65b3088cfa2ed88ce1028c1c18693382593087f53a46ce4bdbc9153b448035cfb93bc46507cf300aea1f1ce0045767a232088013a0559965e7ceed02da052bd16fdd29eb70d94ce0414dbf3d4bc0a9b3","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=06b320d37df5d21e3b290f65b3088cfa2ed88ce1028c1c18693382593087f53a46ce4bdbc9153b448035cfb93bc46507cf300aea1f1ce0045767a232088013a0559965e7ceed02da052bd16fdd29eb70d94ce0414dbf3d4bc0a9b3","has_overview":true,"extended_details":null},{"name":"debug_log.txt","file_path":"%TEMP%\\runtime\\browser\\debug_log.txt","file_size":3362,"md5":"8dfd0e2af8960d86723fb61f1d46fdeb","sha1":"88c6d878a0c7e7d8cd36afde08cc867ca7bd1d28","sha256":"84ca0a9a6aa2a6b8db204074fafc22214e3aaf87c8740a7709ae5a2ea973eb92","sha512":"bb23c384ff7ebe57f554db989a809b51a5bb7127a9622568d6d75c738767037ff602c51ce90afc5290aaa6c0ac2a89ffbc8c85e21d5d2a68d13b2aace61bfb6d","type_tags":["text"],"description":"ASCII text, with CRLF line terminators","runtime_process":"powershell.exe (PID: 6864)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=2d6a9ac8b4e1d24e0d0acda642e977064b13a42478eee7eabd1948820abb62cdaaa447ca96402e166ed7095f6c9fe641d3ae1d118532fd664d84a4636449ba055994a135837e8fab","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=2d6a9ac8b4e1d24e0d0acda642e977064b13a42478eee7eabd1948820abb62cdaaa447ca96402e166ed7095f6c9fe641d3ae1d118532fd664d84a4636449ba055994a135837e8fab","has_overview":false,"extended_details":null},{"name":"tokens.txt","file_path":"%TEMP%\\runtime\\browser\\tokens.txt","file_size":18,"md5":"8d0ff846845ff8a022b5396db6c64a2d","sha1":"45bad60356e62a6625ebada3a253bb66adc6026c","sha256":"20b7a7938086b6049a988cb73bc73b53a1123e53ee65ac7a60e3adced6773347","sha512":"4f89a0a1170fb1f936625fd33af5a56291649fde5065813e50759589aa48ef6d2adfedcc8c16ef061567fc09ec367c1a9cf5fe0ef53cb956b9dcb08ceaba95de","type_tags":["text"],"description":"ASCII text, with CRLF line terminators","runtime_process":"powershell.exe (PID: 6864)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=0dff961bd27f81764da76f5e6f3ac1b77c77e9a043d11959cea1e60de6bcd7b42f1bdac30c21ba82f925d93e492d5680d0eaf5a26788821bffa67a8e6ba62a515d6593b2","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=0dff961bd27f81764da76f5e6f3ac1b77c77e9a043d11959cea1e60de6bcd7b42f1bdac30c21ba82f925d93e492d5680d0eaf5a26788821bffa67a8e6ba62a515d6593b2","has_overview":false,"extended_details":null},{"name":"clipboard.txt","file_path":"%TEMP%\\runtime\\clipboard\\clipboard.txt","file_size":30,"md5":"2a8e2251177e53eea87ae49107ae2698","sha1":"b378b7e488af671bf24f4713047158c3ab9a3d0f","sha256":"48aa6791c4c012a261a1a54dc38ab6cfb28e1e2056327d70bb2d462a90e3b476","sha512":"d5007a5692891feb926c9bba44f912b9ecfcef96698ab9430a7aa6bc16bb904b5df79a8ad01ac11785b96634aa3dadc1f6c1606dec5d630d69acd599d06d3298","type_tags":["text"],"description":"ASCII text, with no line terminators","runtime_process":"powershell.exe (PID: 6864)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=f698dd93133ebde816a3d1d8028b3f2508d9438cbbe575ea2e9a601369f34bc2ab38051bfd06be7e18a30526fc9a08ab19eb41db6cd045ffc52d0a4b785fb5edcf7c309310395f4e","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=f698dd93133ebde816a3d1d8028b3f2508d9438cbbe575ea2e9a601369f34bc2ab38051bfd06be7e18a30526fc9a08ab19eb41db6cd045ffc52d0a4b785fb5edcf7c309310395f4e","has_overview":false,"extended_details":null},{"name":"history.txt","file_path":"%TEMP%\\runtime\\history\\history.txt","file_size":8837,"md5":"c881ed46bb0088944ec3176281ece628","sha1":"c329f6190b44fa118daa259223ed5be07cfc4fda","sha256":"c9f36d8235790f58b9634ce228d561500eeac5a5c4bd887b5b350bb4b8309544","sha512":"73b4aa05353467e0d3fa0c8f2aa102f0461469d1557a790e4eb2a85089ea67626cacd96f6efdc40fbf1c64eca5e5fa793458fd739be79b8b306ace5112ddcdfd","type_tags":["text"],"description":"ASCII text, with very long lines (1728), with CRLF line terminators","runtime_process":"powershell.exe (PID: 6864)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=3eb518891da042ac9ab688a54f3136a21ce23427cf06649b3c5c3f4089c8393052b81bc841a4d4fcd7031fda272511ea24ff226ba07dfdf74bd3d5daa04c2e1d8094c76e9c0a","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=3eb518891da042ac9ab688a54f3136a21ce23427cf06649b3c5c3f4089c8393052b81bc841a4d4fcd7031fda272511ea24ff226ba07dfdf74bd3d5daa04c2e1d8094c76e9c0a","has_overview":false,"extended_details":null},{"name":"ss.png","file_path":"%TEMP%\\runtime\\pic\\ss.png","file_size":445087,"md5":"ed132afc88d03ca59ac804e95dae0b00","sha1":"3ee65d265c9043618c3f5d7b0f77c22f7a30a00a","sha256":"4883d88b836b84ae6d10f4bcb17505bed8c525a55e8a4230f6ab4440050d19a9","sha512":"66805e1a7c1dcb5780409bcdc1995eb6244d5e281c71b1aaeb2aced7f9d9fc19397040cfa37d66df4cbbb140dca9f6daa78a4b1359251b03e64f6b2c786d1b1a","type_tags":["image","png"],"description":"PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced","runtime_process":"powershell.exe (PID: 6864)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=2ab586113aeed952759daae42ff64e17d4ad0d3654daf5d3936fa29574e65f2408b51c59ce84421e9cead87f1f173be4ab14b63837d247d1319a9b1fe8d93bd4","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=2ab586113aeed952759daae42ff64e17d4ad0d3654daf5d3936fa29574e65f2408b51c59ce84421e9cead87f1f173be4ab14b63837d247d1319a9b1fe8d93bd4","has_overview":false,"extended_details":null},{"name":"chrome_Data.db","file_path":"C:\\chrome_Data.db","file_size":40960,"md5":"a182561a527f929489bf4b8f74f65cd7","sha1":"8cd6866594759711ea1836e86a5b7ca64ee8911f","sha256":"42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914","sha512":"9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558","type_tags":["data"],"description":"SQLite 3.x database, last written using SQLite version 3044002, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1","runtime_process":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe (PID: 5044)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=78e3b51ef6bd90a53e310c2ec926e1caf7764773d09d4feadbc433718ba7cd875a43ea6a705cb88e3a97932df5b58578bac40bdf80dc3a4800006aeb1357503518d4e5ee6284dbb0dd","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=78e3b51ef6bd90a53e310c2ec926e1caf7764773d09d4feadbc433718ba7cd875a43ea6a705cb88e3a97932df5b58578bac40bdf80dc3a4800006aeb1357503518d4e5ee6284dbb0dd","has_overview":false,"extended_details":null},{"name":"chrome_history_temp.db","file_path":"C:\\chrome_history_temp.db","file_size":163840,"md5":"f310cf1ff562ae14449e0167a3e1fe46","sha1":"85c58afa9049467031c6c2b17f5c12ca73bb2788","sha256":"e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855","sha512":"1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad","type_tags":["data"],"description":"SQLite 3.x database, last written using SQLite version 3044002, file counter 1, database pages 40, cookie 0x21, schema 4, UTF-8, version-valid-for 1","runtime_process":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe (PID: 5044)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=b350f28e5998cead24e3de1774a5f64f20fce962a3cff6c2f06ddd140cc6ac6fd8df7d9e06ee0499d15740b68d863b1af4a3415f1db6c2cdf8832ce1e289e49c625334a5a995c7b120bd9b54a9fc5614","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=b350f28e5998cead24e3de1774a5f64f20fce962a3cff6c2f06ddd140cc6ac6fd8df7d9e06ee0499d15740b68d863b1af4a3415f1db6c2cdf8832ce1e289e49c625334a5a995c7b120bd9b54a9fc5614","has_overview":false,"extended_details":null},{"name":"edge_Data.db","file_path":"C:\\edge_Data.db","file_size":57344,"md5":"256d556947a93297c78c792237e2abb4","sha1":"822eff57aae8936c871926b11098df00ecee4127","sha256":"c75084ee623451406f12a4e30624ffd844cfdada8204356a14084a3e10073926","sha512":"07db7fd6725fd40cf33b6e3f0f9c655d576359edc0fa70359ea6bf7b3e9f273278a86eb59a4b7135aebdd53bb53c884b137fee1350f4e83996cbd6e5413e2f86","type_tags":["data"],"description":"SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 27, cookie 0x10, schema 4, UTF-8, version-valid-for 2","runtime_process":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe (PID: 5044)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=ef2e30d2b13a0646b1e3d8f17bb83d987a3e957d10ea5c25c08d4ac40d68a587bc4559991e058ee5f94dbe4242622fd2a2947b49b6dcfdb8604301af3a7caadd63233d5e1f61f4","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=ef2e30d2b13a0646b1e3d8f17bb83d987a3e957d10ea5c25c08d4ac40d68a587bc4559991e058ee5f94dbe4242622fd2a2947b49b6dcfdb8604301af3a7caadd63233d5e1f61f4","has_overview":false,"extended_details":null},{"name":"edge_history_temp.db","file_path":"C:\\edge_history_temp.db","file_size":196608,"md5":"80acb23acc8ed8b3a5e7d4322e7deee9","sha1":"7bf2db45b263d1c1a8606bad6eec4ec71f424b59","sha256":"89e0e1968026da95da52d5d2ca1f805b35620aeff654a9965c4399e07391ffde","sha512":"d39e24d0a56b5b78340f93d34f8ef5fbaa687aae4ebcc00a9779ff921fed31d34c03202a5b31b61dde1ad326ad37c909af05f1dec6b7a6d2ce3266f7ec8627b0","type_tags":["data"],"description":"SQLite 3.x database, last written using SQLite version 3039003, file counter 17, database pages 41, cookie 0x39, schema 4, UTF-8, version-valid-for 17","runtime_process":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe (PID: 5044)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=59e5dd4edb2945b541ef5ab2e66ad919f813443e166eee089e28c8b632926e418970b55abc50b1bd9db6023fad9258aa8555d41b7ec7d3ac7f696cb053c107fec4b82ab967e2731c8d1609a28b772b","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=59e5dd4edb2945b541ef5ab2e66ad919f813443e166eee089e28c8b632926e418970b55abc50b1bd9db6023fad9258aa8555d41b7ec7d3ac7f696cb053c107fec4b82ab967e2731c8d1609a28b772b","has_overview":false,"extended_details":null},{"name":"firefox_profile_temp.db","file_path":"C:\\firefox_profile_temp.db","file_size":5242880,"md5":"04beb4a77fed93d0bcc5ee620c583627","sha1":"dfa25302d9220a5ad6af75d97311c128848f9cd0","sha256":"227f88fea68415375925e54980f793b8d19fefcfe48ad62984951e7c4e4758a5","sha512":"8b6849b47dc3393cb118a1dbe5fc8afd3d0d590caa243d13c460fbaaf2380aba1434ef60a5d986857eb0d366fbff1c0422c82afd97e1cba78cf013692ddd6ec8","type_tags":["data"],"description":"SQLite 3.x database, user version 52, last written using SQLite version 3025001, page size 32768, writer version 2, read version 2, file counter 5, database pages 39, cookie 0x21, schema 4, UTF-8, version-valid-for 5","runtime_process":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe (PID: 5044)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=a3e68cee16f093ca4824d52b9e87239857fc8a6532c5aa4562eedbfde065aca1ecd7cdb71163ef90748dca63362b40085845744b54ca73145d108c67f7e8c563c29a344b73de886d2b7e029252380e00","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=a3e68cee16f093ca4824d52b9e87239857fc8a6532c5aa4562eedbfde065aca1ecd7cdb71163ef90748dca63362b40085845744b54ca73145d108c67f7e8c563c29a344b73de886d2b7e029252380e00","has_overview":false,"extended_details":null},{"name":"svchost.exe.bin","file_path":null,"file_size":6203320,"md5":"faeb88275ab0c27dd496c539adad8f33","sha1":"87446260ad83c0c77f5a0c55459f91efb18328a1","sha256":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c","sha512":"4a96c1ddedb65b8cb5b69651c73a1d1dac0ae28ef31d42bd8694c29d9b9ec23544f19b1e65162e4c69543ee19de474e9c0e034d63ee6382090a5b0d9242ce4fd","type_tags":["peexe","64bits","executable"],"description":"PE32+ executable (GUI) x86-64, for MS Windows, 7 sections","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=d7237974428286fa3b1cd0f6697996cbdfd91551f696f224b3a8d17725059f00703b7174699d98fdccf7098779d94db04b653a137a00b601e3f64e49843c68","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=d7237974428286fa3b1cd0f6697996cbdfd91551f696f224b3a8d17725059f00703b7174699d98fdccf7098779d94db04b653a137a00b601e3f64e49843c68","has_overview":true,"extended_details":null},{"name":"svchost.exe%3AZone.Identifier","file_path":null,"file_size":26,"md5":"cb9db8b13f2e7d1ae122b5b6c2381b25","sha1":"ea06df82dba8cc567e95c43e6214872e52fdb05b","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","sha512":"937778c5cd8c35ec2a0811856214ad95446b14f91c306632117e9bc79740b5baa57c2051ba21765acbf0fced496ca547a08b8bdda85d8c8b700a44826a602ed0","type_tags":["text"],"description":"ASCII text, with CRLF line terminators","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/682f1077421fe9a5d3046379/download/dropped-file?key=73aa8da1031c08639b7c6f5fede187a545edadfd1eab69f67413c794dfcd048b1b762749fbdf96419828516b650c80e0c0c08f5afb2f05a9c486b0ed5d9bd39433bd6e841e325e9e1707106a164b2da59d2199fcb762eabd","submit_link":"/bff/report/682f1077421fe9a5d3046379/submit/dropped-file?key=73aa8da1031c08639b7c6f5fede187a545edadfd1eab69f67413c794dfcd048b1b762749fbdf96419828516b650c80e0c0c08f5afb2f05a9c486b0ed5d9bd39433bd6e841e325e9e1707106a164b2da59d2199fcb762eabd","has_overview":true,"extended_details":null}],"file_metadata":{"file_compositions":["1 .OBJ Files (COFF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 34809)","1 Unknown Resource Files (build: 0)","11 .BAS Files compiled with C2.EXE 5.0 (Visual Basic 6) (build: 34809)"],"imported_objects":["901 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 34809)","89 .OBJ Files (OMF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 34321)","19 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 34321)","10 .OBJ Files (OMF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 34321)","8 .OBJ Files (OMF) linked with LINK.EXE 5.10 (Visual Studio 5) (build: 33140)","18 .OBJ Files (COFF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 33140)","210 .OBJ Files (OMF) linked with LINK.EXE 6.00 (Visual Studio 6) (build: 33140)"],"file_analysis":["File contains Visual Basic code","File appears to contain raw COFF/OMF content","File is the product of a medium codebase (11 files)"],"total_file_compositions_imports":19},"processes":[{"uid":"00000000-00005044","parentuid":null,"name":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe","normalized_path":"C:\\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe","command_line":null,"sha256":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c","av_label":"Gen:Variant.Lazy","av_matched":5,"av_total":24,"pid":"5044","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","process_flags":[{"name":"Extracted Streams","data":null},{"name":"Network Activity","data":null},{"name":"Multiscan Match","data":"5/24"}]},{"uid":"00000000-00007612","parentuid":"00000000-00005044","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c wmic diskdrive get model,serialnumber","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"7612","icon":null,"process_flags":[]},{"uid":"00000000-00007984","parentuid":"00000000-00007612","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","command_line":"wmic diskdrive get model,serialnumber","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","av_label":null,"av_matched":null,"av_total":null,"pid":"7984","icon":null,"process_flags":[]},{"uid":"00000000-00002092","parentuid":"00000000-00005044","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c wmic path Win32_Keyboard get Description,DeviceID","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"2092","icon":null,"process_flags":[]},{"uid":"00000000-00004104","parentuid":"00000000-00002092","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","command_line":"wmic path Win32_Keyboard get Description,DeviceID","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","av_label":null,"av_matched":null,"av_total":null,"pid":"4104","icon":null,"process_flags":[]},{"uid":"00000000-00004448","parentuid":"00000000-00005044","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c wmic path Win32_PointingDevice get Description,PNPDeviceID","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"4448","icon":null,"process_flags":[]},{"uid":"00000000-00004276","parentuid":"00000000-00004448","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","command_line":"wmic path Win32_PointingDevice get Description,PNPDeviceID","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","av_label":null,"av_matched":null,"av_total":null,"pid":"4276","icon":null,"process_flags":[]},{"uid":"00000000-00003012","parentuid":"00000000-00005044","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c wmic path Win32_PointingDevice get Description,PNPDeviceID","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"3012","icon":null,"process_flags":[]},{"uid":"00000000-00000796","parentuid":"00000000-00003012","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","command_line":"wmic path Win32_PointingDevice get Description,PNPDeviceID","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"796","icon":null,"process_flags":[]},{"uid":"00000000-00002596","parentuid":"00000000-00000796","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","command_line":"wmic path Win32_DesktopMonitor get Description,PNPDeviceID","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","av_label":null,"av_matched":null,"av_total":null,"pid":"2596","icon":null,"process_flags":[]},{"uid":"00000000-00007884","parentuid":"00000000-00005044","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c wmic path Win32_DesktopMonitor get Description,PNPDeviceID","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"7884","icon":null,"process_flags":[]},{"uid":"00000000-00005688","parentuid":"00000000-00007884","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","command_line":"wmic path Win32_DesktopMonitor get Description,PNPDeviceID","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","av_label":null,"av_matched":null,"av_total":null,"pid":"5688","icon":null,"process_flags":[]},{"uid":"00000000-00002920","parentuid":"00000000-00005044","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c wmic get name","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"2920","icon":null,"process_flags":[]},{"uid":"00000000-00007968","parentuid":"00000000-00002920","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","command_line":"wmic get name","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","av_label":null,"av_matched":null,"av_total":null,"pid":"7968","icon":null,"process_flags":[]},{"uid":"00000000-00007200","parentuid":"00000000-00005044","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"7200","icon":null,"process_flags":[]},{"uid":"00000000-00002116","parentuid":"00000000-00007200","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","command_line":"powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","av_label":null,"av_matched":null,"av_total":null,"pid":"2116","icon":null,"process_flags":[]},{"uid":"00000000-00002124","parentuid":"00000000-00005044","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -DestinationPath '%TEMP%\\runtime.zip' -Force\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"2124","icon":null,"process_flags":[]},{"uid":"00000000-00006864","parentuid":"00000000-00002124","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","command_line":"powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -DestinationPath '%TEMP%\\runtime.zip' -Force\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","av_label":null,"av_matched":null,"av_total":null,"pid":"6864","icon":null,"process_flags":[]},{"uid":"00000000-00008036","parentuid":"00000000-00005044","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c \"\"C:\\util.bat\" \"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"8036","icon":null,"process_flags":[]},{"uid":"00000000-00005028","parentuid":"00000000-00008036","name":"timeout.exe","normalized_path":"%WINDIR%\\system32\\timeout.exe","command_line":"timeout /t 2 /nobreak","sha256":"b6d49416f9ad736b0de3e8e2f3b9174f7f274751de9cff9f5d0840dd1e03b56a","av_label":null,"av_matched":null,"av_total":null,"pid":"5028","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00000000-00001060","parentuid":null,"name":"svchost.exe","normalized_path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe","command_line":null,"sha256":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c","av_label":"Gen:Variant.Lazy","av_matched":5,"av_total":24,"pid":"1060","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII=","process_flags":[{"name":"Network Activity","data":null},{"name":"Multiscan Match","data":"5/24"}]},{"uid":"00000000-00007552","parentuid":"00000000-00001060","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c wmic diskdrive get model,serialnumber","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"7552","icon":null,"process_flags":[]},{"uid":"00000000-00000692","parentuid":"00000000-00007552","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","command_line":"wmic diskdrive get model,serialnumber","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","av_label":null,"av_matched":null,"av_total":null,"pid":"692","icon":null,"process_flags":[]},{"uid":"00000000-00002024","parentuid":"00000000-00001060","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c wmic path Win32_Keyboard get Description,DeviceID","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"2024","icon":null,"process_flags":[]},{"uid":"00000000-00001260","parentuid":"00000000-00002024","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","command_line":"wmic path Win32_Keyboard get Description,DeviceID","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","av_label":null,"av_matched":null,"av_total":null,"pid":"1260","icon":null,"process_flags":[]},{"uid":"00000000-00005676","parentuid":"00000000-00001060","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c wmic path Win32_PointingDevice get Description,PNPDeviceID","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"5676","icon":null,"process_flags":[]},{"uid":"00000000-00006364","parentuid":"00000000-00005676","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","command_line":"wmic path Win32_PointingDevice get Description,PNPDeviceID","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","av_label":null,"av_matched":null,"av_total":null,"pid":"6364","icon":null,"process_flags":[]},{"uid":"00000000-00006804","parentuid":"00000000-00001060","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c wmic path Win32_PointingDevice get Description,PNPDeviceID","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"6804","icon":null,"process_flags":[]},{"uid":"00000000-00006688","parentuid":"00000000-00006804","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","command_line":"wmic path Win32_PointingDevice get Description,PNPDeviceID","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","av_label":null,"av_matched":null,"av_total":null,"pid":"6688","icon":null,"process_flags":[]},{"uid":"00000000-00005476","parentuid":"00000000-00001060","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c wmic get name","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"5476","icon":null,"process_flags":[]},{"uid":"00000000-00002976","parentuid":"00000000-00005476","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\Wbem\\WMIC.exe","command_line":"wmic get name","sha256":"a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e","av_label":null,"av_matched":null,"av_total":null,"pid":"2976","icon":null,"process_flags":[]},{"uid":"00000000-00007808","parentuid":"00000000-00001060","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"7808","icon":null,"process_flags":[]},{"uid":"00000000-00001036","parentuid":"00000000-00007808","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","command_line":"powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","av_label":null,"av_matched":null,"av_total":null,"pid":"1036","icon":null,"process_flags":[]},{"uid":"00000000-00005244","parentuid":"00000000-00001060","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -DestinationPath '%TEMP%\\runtime.zip' -Force\"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"5244","icon":null,"process_flags":[]},{"uid":"00000000-00007088","parentuid":"00000000-00005244","name":"powershell.exe","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","command_line":"powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -DestinationPath '%TEMP%\\runtime.zip' -Force\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","av_label":null,"av_matched":null,"av_total":null,"pid":"7088","icon":null,"process_flags":[]},{"uid":"00000000-00008116","parentuid":"00000000-00001060","name":"cmd.exe","normalized_path":"%WINDIR%\\system32\\cmd.exe","command_line":"/c \"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\util.bat\" \"","sha256":"ec436aeee41857eee5875efdb7166fe043349db5f58f3ee9fc4ff7f50005767f","av_label":null,"av_matched":null,"av_total":null,"pid":"8116","icon":null,"process_flags":[]},{"uid":"00000000-00003924","parentuid":"00000000-00008116","name":"timeout.exe","normalized_path":"%WINDIR%\\system32\\timeout.exe","command_line":"timeout /t 2 /nobreak","sha256":"b6d49416f9ad736b0de3e8e2f3b9174f7f274751de9cff9f5d0840dd1e03b56a","av_label":null,"av_matched":null,"av_total":null,"pid":"3924","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]}],"mitre_attcks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attck_id":"T1590","attck_id_wiki":"https://attack.mitre.org/techniques/T1590","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to access user sensitive domain"],"parent":null},{"tactic":"Resource Development","technique":"Digital Certificates","attck_id":"T1588.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1588/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Obtain Capabilities","attck_id":"T1588","attck_id_wiki":"https://attack.mitre.org/techniques/T1588"}},{"tactic":"Execution","technique":"Native API","attck_id":"T1106","attck_id_wiki":"https://attack.mitre.org/techniques/T1106","malicious_identifiers_count":1,"malicious_identifiers":["Calls an API typically used to execute an application"],"suspicious_identifiers_count":3,"suspicious_identifiers":["Imports suspicious APIs"],"informative_identifiers_count":16,"informative_identifiers":["Contains ability to create a new process (API string)","Contains ability to create/open files (API string)","Contains ability to execute an application (API string)","Contains ability to execute Windows APIs","Contains ability to load modules (API string)","Contains ability to set/get the last-error code for a calling thread (API string)","Contains ability to retrieve the fully qualified path of module (API string)","Contains ability to retrieve/modify process thread (API string)","Contains ability to retrieve address of exported function from a DLL (API string)","Contains ability to find and load resources of specific modules (API string)","Calls an API typically used to retrieve function addresses","Calls an API typically used to create a process","Calls an API typically used to load a resource in memory","Calls an API typically used to find a resource in a module","Contains ability to dynamically load libraries","Imports GetCommandLine API"],"parent":null},{"tactic":"Execution","technique":"Inter-Process Communication","attck_id":"T1559","attck_id_wiki":"https://attack.mitre.org/techniques/T1559","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to create/connect to a named pipe (API string)","Found named pipe like strings"],"parent":null},{"tactic":"Execution","technique":"Windows Command Shell","attck_id":"T1059.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve the command-line string for the current process (API string)","Contains ability to executes commands or batch file"],"parent":{"technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059"}},{"tactic":"Execution","technique":"Windows Management Instrumentation","attck_id":"T1047","attck_id_wiki":"https://attack.mitre.org/techniques/T1047","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":4,"suspicious_identifiers":["Contains references to WMI/WMIC"],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to call WMI method (Powershell command string)","Executes WMI queries"],"parent":null},{"tactic":"Execution","technique":"PowerShell","attck_id":"T1059.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1059/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":8,"informative_identifiers":["Contains ability to add modules to the current session (Powershell command string)","Contains ability to run commands or expressions (Powershell command string)","Observed Powershell command strings","References powershell process","Contains ability to run commands (Powershell command string)","Contains ability to run commands from session history (Powershell command string)","Contains ability to receive remote commands (Powershell command string)","Executes Powershell command strings"],"parent":{"technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059"}},{"tactic":"Execution","technique":"Service Execution","attck_id":"T1569.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1569/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to start services (Powershell command string)"],"parent":{"technique":"System Services","attck_id":"T1569","attck_id_wiki":"https://attack.mitre.org/techniques/T1569"}},{"tactic":"Execution","technique":"Shared Modules","attck_id":"T1129","attck_id_wiki":"https://attack.mitre.org/techniques/T1129","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Loads modules at runtime","Calls an API typically used to load libraries","Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","Loads the RPC (Remote Procedure Call) module DLL","Loads the .NET runtime environment"],"parent":null},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attck_id":"T1059","attck_id_wiki":"https://attack.mitre.org/techniques/T1059","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Executes batch file"],"parent":null},{"tactic":"Persistence","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Contains ability to modify registry key/value (API string)","Contains ability to create/load registry keys (API string)","Contains ability to create/modify item values (Powershell command string)","Accesses System Certificates Settings"],"parent":null},{"tactic":"Persistence","technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","Contains ability to start a process (Powershell command string)"],"parent":null},{"tactic":"Persistence","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to access device drivers","Contains ability to create/modify Windows services (Powershell command string)","Contains ability to set/modify configuration (Powershell command string)","Creates or modifies windows services"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Persistence","technique":"BITS Jobs","attck_id":"T1197","attck_id_wiki":"https://attack.mitre.org/techniques/T1197","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to background jobs (Powershell command string)"],"parent":null},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attck_id":"T1547.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to Windows Startup folder"],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Persistence","technique":"Windows Management Instrumentation Event Subscription","attck_id":"T1546.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create/update instances of WMI classes (Powershell command string)"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Persistence","technique":"DLL Side-Loading","attck_id":"T1574.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Fails to load modules at runtime"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","Contains ability to start a process (Powershell command string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":1,"malicious_identifiers":["Creates a process in suspended mode (likely for process injection)"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to inject code into another process (API string)"],"parent":null},{"tactic":"Privilege Escalation","technique":"Windows Service","attck_id":"T1543.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to access device drivers","Contains ability to create/modify Windows services (Powershell command string)","Contains ability to set/modify configuration (Powershell command string)","Creates or modifies windows services"],"parent":{"technique":"Create or Modify System Process","attck_id":"T1543","attck_id_wiki":"https://attack.mitre.org/techniques/T1543"}},{"tactic":"Privilege Escalation","technique":"Registry Run Keys / Startup Folder","attck_id":"T1547.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1547/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to Windows Startup folder"],"parent":{"technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547"}},{"tactic":"Privilege Escalation","technique":"Windows Management Instrumentation Event Subscription","attck_id":"T1546.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to create/update instances of WMI classes (Powershell command string)"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Privilege Escalation","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to modify access token privileges (API string)","Calls an API typically used to enable or disable privileges in the specified access token"],"parent":null},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attck_id":"T1547","attck_id_wiki":"https://attack.mitre.org/techniques/T1547","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Privilege Escalation","technique":"Component Object Model Hijacking","attck_id":"T1546.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Overview of unique CLSIDs touched in registry"],"parent":{"technique":"Event Triggered Execution","attck_id":"T1546","attck_id_wiki":"https://attack.mitre.org/techniques/T1546"}},{"tactic":"Privilege Escalation","technique":"DLL Side-Loading","attck_id":"T1574.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Fails to load modules at runtime"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/techniques/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Contains ability to disable/close registry key (API string)","Contains ability to modify registry key/value (API string)","Contains ability to create/load registry keys (API string)","Contains ability to create/modify item values (Powershell command string)","Accesses System Certificates Settings"],"parent":null},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":8,"suspicious_identifiers":["CRC value set in PE header does not match actual value","YARA signature match - ChaCha20 128-bit algorithm","YARA signature match - ChaCha20 256-bit algorithm"],"informative_identifiers_count":9,"informative_identifiers":["Contains ability to perform AES/RC4 encryption (API string)","Contains ability to encrypt/encode message (API string)","Contains CRYPTO related strings","Contains ability to use Cryptographic classes","Loads the Bcrypt module DLL","YARA signature match - Djb2 Hash Algorithm","Matched Compiler/Packer signature (DIE)","YARA signature match - AES encryption","Shows ability to obfuscate file or information"],"parent":null},{"tactic":"Defense Evasion","technique":"Timestomp","attck_id":"T1070.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve file time (API string)","Contains ability to query local/system time as file time"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attck_id":"T1055.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to load/free library (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to check debugger is running (API string)","Contains ability to register a top-level exception handler (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attck_id":"T1140","attck_id_wiki":"https://attack.mitre.org/techniques/T1140","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to perform decryption (API string)","Shows ability to deobfuscate/decode files or information"],"parent":null},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to identify virtual environment by using user activity (API string)","Able to identify virtual environment by using web history"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1070.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Marks file for deletion","Opens file with deletion access rights"],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to delete files","Contains ability to delete files/directories (API string)","Able to delete items (Powershell command string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)","Contains ability to delay execution (Powershell command string)","Contains ability to delay the execution of current thread"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055","malicious_identifiers_count":1,"malicious_identifiers":["Creates a process in suspended mode (likely for process injection)"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to inject code into another process (API string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attck_id":"T1562.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","malicious_identifiers_count":1,"malicious_identifiers":["Disables Windows Task Manager (taskmgr)"],"suspicious_identifiers_count":1,"suspicious_identifiers":["Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"],"informative_identifiers_count":6,"informative_identifiers":["Contains strings related to AMSI (Anti Malware Scan Interface)","Contains ability to delete a property and its value from an item (Powershell command string)","Contains ability to terminate services/features (Powershell command string)","Contains ability to disable Windows Defender using PowerShell","Loads the AMSI (Antimalware Scan Interface) DLL","Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"],"parent":{"technique":"Impair Defenses","attck_id":"T1562","attck_id_wiki":"https://attack.mitre.org/techniques/T1562"}},{"tactic":"Defense Evasion","technique":"BITS Jobs","attck_id":"T1197","attck_id_wiki":"https://attack.mitre.org/techniques/T1197","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to background jobs (Powershell command string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Rename Legitimate Utilities","attck_id":"T1036.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1036/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to rename items (Powershell command string)"],"parent":{"technique":"Masquerading","attck_id":"T1036","attck_id_wiki":"https://attack.mitre.org/techniques/T1036"}},{"tactic":"Defense Evasion","technique":"Clear Command History","attck_id":"T1070.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1070/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to clear Powershell session command history (Powershell command string)"],"parent":{"technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070"}},{"tactic":"Defense Evasion","technique":"ListPlanting","attck_id":"T1055.015","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to visualize and control listed components (API string)"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found virtual disk drive like strings"],"parent":null},{"tactic":"Defense Evasion","technique":"System Checks","attck_id":"T1497.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to identify virtual environment by using API string"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attck_id":"T1134","attck_id_wiki":"https://attack.mitre.org/techniques/T1134","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to modify access token privileges (API string)","Calls an API typically used to enable or disable privileges in the specified access token"],"parent":null},{"tactic":"Defense Evasion","technique":"Hidden Window","attck_id":"T1564.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to show a graphical window (API string)"],"parent":{"technique":"Hide Artifacts","attck_id":"T1564","attck_id_wiki":"https://attack.mitre.org/techniques/T1564"}},{"tactic":"Defense Evasion","technique":"Indicator Removal","attck_id":"T1070","attck_id_wiki":"https://attack.mitre.org/techniques/T1070","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to clear content (Powershell command string)"],"parent":null},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attck_id":"T1036.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1036/005","malicious_identifiers_count":2,"malicious_identifiers":["Creates a fake system process","Found a system process name at an unusual pathway"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to write/modify file content (Powershell command string)"],"parent":{"technique":"Masquerading","attck_id":"T1036","attck_id_wiki":"https://attack.mitre.org/techniques/T1036"}},{"tactic":"Defense Evasion","technique":"Extra Window Memory Injection","attck_id":"T1055.011","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/011","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Thread Execution Hijacking","attck_id":"T1055.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Creates a thread in a self process"],"parent":{"technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/techniques/T1055"}},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attck_id":"T1480","attck_id_wiki":"https://attack.mitre.org/techniques/T1480","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Creates mutants","Shows ability to use execution guardrails"],"parent":null},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":1,"malicious_identifiers":["The input sample contains a known anti-VM trick"],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Attempts to call APIs commonly associated with anti-analysis and evasion techniques"],"parent":null},{"tactic":"Defense Evasion","technique":"DLL Side-Loading","attck_id":"T1574.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1574/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Fails to load modules at runtime"],"parent":{"technique":"Hijack Execution Flow","attck_id":"T1574","attck_id_wiki":"https://attack.mitre.org/techniques/T1574"}},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attck_id":"T1620","attck_id_wiki":"https://attack.mitre.org/techniques/T1620","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Loads the CLR Loader DLL"],"parent":null},{"tactic":"Defense Evasion","technique":"Code Signing","attck_id":"T1553.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","malicious_identifiers_count":1,"malicious_identifiers":["The input sample is signed with an invalid certificate"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["The input sample is signed with a certificate"],"parent":{"technique":"Subvert Trust Controls","attck_id":"T1553","attck_id_wiki":"https://attack.mitre.org/techniques/T1553"}},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attck_id":"T1027.009","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/009","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Section contains high entropy"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Software Packing","attck_id":"T1027.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attck_id":"T1036.008","attck_id_wiki":"https://attack.mitre.org/techniques/T1036/008","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Masquerading","attck_id":"T1036","attck_id_wiki":"https://attack.mitre.org/techniques/T1036"}},{"tactic":"Defense Evasion","technique":"Masquerading","attck_id":"T1036","attck_id_wiki":"https://attack.mitre.org/techniques/T1036","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Drops files inside appdata directory"],"parent":null},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attck_id":"T1027.007","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to dynamically determine API calls"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attck_id":"T1027.005","attck_id_wiki":"https://attack.mitre.org/techniques/T1027/005","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains XOR operation loops [Stream disassembly]"],"parent":{"technique":"Obfuscated Files or Information","attck_id":"T1027","attck_id_wiki":"https://attack.mitre.org/techniques/T1027"}},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attck_id":"T1555","attck_id_wiki":"https://attack.mitre.org/techniques/T1555","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains string like password/secret"],"parent":null},{"tactic":"Credential Access","technique":"OS Credential Dumping","attck_id":"T1003","attck_id_wiki":"https://attack.mitre.org/techniques/T1003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve credential objects (Powershell command string)","Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"],"parent":null},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attck_id":"T1555.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1555/003","malicious_identifiers_count":1,"malicious_identifiers":["Attempts to obtain browser login credentials (file access)"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Credentials from Password Stores","attck_id":"T1555","attck_id_wiki":"https://attack.mitre.org/techniques/T1555"}},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/techniques/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Reads configuration files (.ini files)"],"informative_identifiers_count":14,"informative_identifiers":["Contains ability to retrieve file and directory information (API string)","Contains ability to read files (API string)","Contains ability to enumerate files on disk (API string)","References Windows file paths for DLLs (possible dropped files)","Tries to access non-existent files (executable)","Contains ability to retrieve list of files and subdirectories","Reads files","Contains ability to retrieve files based on search patterns","Touches files","Tries to access non-existent files (non-executable)","Calls an API typically used for searching a directory for files","Touches files in the Windows directory","Tries to access Powershell profile file","Contains ability to enumerate files inside a directory"],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/techniques/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":7,"suspicious_identifiers":[],"informative_identifiers_count":31,"informative_identifiers":["Contains ability to retrieve the OS information (API string)","Contains reference to mutex-related activity (API string)","Contains ability to retrieve the host's architecture (API string)","Contains ability to retrieve a module handle (API string)","Contains ability to query volume/memory size (API string)","Contains ability to retrieve information about the current system (API string)","Contains ability to determine disk drive type (API string)","References to WMI query strings used for information discovery","Able to retrieve geographical location information","Contains ability to retrieve the specified system metric or system configuration setting (API string)","Contains ability to retrieve the host name of a computer (API string)","Contains ability to retrieve environment variable settings","Contains ability to retrieve specified item(s) (Powershell command string)","Attempts to call APIs to gather system and hardware detail","Contains ability to enumerate objects (Powershell command string)","Contains ability to retrieve information about operating system (API string)","Contains ability to read software policies","Queries volume information","Calls an API typically used to retrieve computer name","Calls an API typically used to get system version information","Calls an API typically used to retrieve OS information","Calls an API typically used to get product type","Reads the active computer name","Queries volume information of an entire harddrive","Calls an API typically used to retrieve information about the current system","Reads information about supported languages","Reads system-defined device setup information from registry","Retrieves specified items using PowerShell","Reads the cryptographic machine GUID","Attempts to get system information using PowerShell","Calls an APIs used to retrieve geographical location information"],"parent":null},{"tactic":"Discovery","technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Able to query system locale information (API string)","Contains ability to retrieve geographical location","Calls an API typically used to retrieve local language","Contains ability to query the system locale"],"parent":null},{"tactic":"Discovery","technique":"Debugger Evasion","attck_id":"T1622","attck_id_wiki":"https://attack.mitre.org/techniques/T1622","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to check debugger is running (API string)","Contains ability to register a top-level exception handler (API string)"],"parent":null},{"tactic":"Discovery","technique":"User Activity Based Checks","attck_id":"T1497.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Able to identify virtual environment by using user activity (API string)","Able to identify virtual environment by using web history"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/techniques/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":6,"informative_identifiers":["Contains registry location strings","Contains ability to query registry keys (API string)","Opens registry keys","Queries registry keys","Accesses Software Policy Settings","Reads Windows Trust Settings"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/techniques/T1057","malicious_identifiers_count":1,"malicious_identifiers":["Spawns a lot of processes"],"suspicious_identifiers_count":3,"suspicious_identifiers":[],"informative_identifiers_count":10,"informative_identifiers":["Contains ability to retrieve/open a process (API string)","Contains ability to enumerate process and/or its information (API string)","Contains ability to retrieve processes (Powershell command string)","Contains ability to determine if process is running under WOW64 (API string)","Queries basic information of the specified process","Calls an API typically used for taking snapshot of the specified processes","Calls an API typically used to determine if process is running under WOW64","Spawns new processes","Spawns new processes that are not known child processes","Process launched with changed environment"],"parent":null},{"tactic":"Discovery","technique":"System Time Discovery","attck_id":"T1124","attck_id_wiki":"https://attack.mitre.org/techniques/T1124","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to retrieve machine time (API string)","Contains ability to retrieve machine timezone (API string)","Contains ability to query machine time"],"parent":null},{"tactic":"Discovery","technique":"Time Based Evasion","attck_id":"T1497.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Contains ability to delay execution by waiting for signal/timeout (API string)","Contains ability to retrieve the time elapsed since the system was started (API string)","Contains ability to delay execution (Powershell command string)","Contains ability to delay the execution of current thread"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"System Owner/User Discovery","attck_id":"T1033","attck_id_wiki":"https://attack.mitre.org/techniques/T1033","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to retrieve usernames and/or user information (API string)","Calls an API typically used to retrieve user name","Calls an API typically used to retrieve account information for specified SID"],"parent":null},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attck_id":"T1016","attck_id_wiki":"https://attack.mitre.org/techniques/T1016","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to retrieve the local name for a socket (API string)"],"parent":null},{"tactic":"Discovery","technique":"Browser Information Discovery","attck_id":"T1217","attck_id_wiki":"https://attack.mitre.org/techniques/T1217","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"System Checks","attck_id":"T1497.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to identify virtual environment by using API string"],"parent":{"technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497"}},{"tactic":"Discovery","technique":"Log Enumeration","attck_id":"T1654","attck_id_wiki":"https://attack.mitre.org/techniques/T1654","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to retrieve security-related event logs (PowerShell command string)"],"parent":null},{"tactic":"Discovery","technique":"System Language Discovery","attck_id":"T1614.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to retrieve system language (API string)","Reads the windows installation language"],"parent":{"technique":"System Location Discovery","attck_id":"T1614","attck_id_wiki":"https://attack.mitre.org/techniques/T1614"}},{"tactic":"Discovery","technique":"Device Driver Discovery","attck_id":"T1652","attck_id_wiki":"https://attack.mitre.org/techniques/T1652","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Tries to retrieve device driver information"],"parent":null},{"tactic":"Discovery","technique":"System Service Discovery","attck_id":"T1007","attck_id_wiki":"https://attack.mitre.org/techniques/T1007","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries services related registry keys"],"parent":null},{"tactic":"Discovery","technique":"Application Window Discovery","attck_id":"T1010","attck_id_wiki":"https://attack.mitre.org/techniques/T1010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Calls an API possibly used to retrieve a handle to the foreground window","Calls an API typically used to enumerate active windows"],"parent":null},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attck_id":"T1497","attck_id_wiki":"https://attack.mitre.org/techniques/T1497","malicious_identifiers_count":1,"malicious_identifiers":["The input sample contains a known anti-VM trick"],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Attempts to call APIs commonly associated with anti-analysis and evasion techniques"],"parent":null},{"tactic":"Discovery","technique":"Account Discovery","attck_id":"T1087","attck_id_wiki":"https://attack.mitre.org/techniques/T1087","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"Software Discovery","attck_id":"T1518","attck_id_wiki":"https://attack.mitre.org/techniques/T1518","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Reads the registry for installed applications"],"parent":null},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attck_id":"T1570","attck_id_wiki":"https://attack.mitre.org/techniques/T1570","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to move file or directory (API string)","Contains ability to move items (Powershell command string)","Calls an API typically used to create an instance of a named pipe"],"parent":null},{"tactic":"Lateral Movement","technique":"Windows Remote Management","attck_id":"T1021.006","attck_id_wiki":"https://attack.mitre.org/techniques/T1021/006","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains reference to remote powershell session activity (Powershell command string)"],"parent":{"technique":"Remote Services","attck_id":"T1021","attck_id_wiki":"https://attack.mitre.org/techniques/T1021"}},{"tactic":"Collection","technique":"Screen Capture","attck_id":"T1113","attck_id_wiki":"https://attack.mitre.org/techniques/T1113","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to capture screen (API string)","Calls an API possibly used to take screenshots"],"parent":null},{"tactic":"Collection","technique":"Local Data Staging","attck_id":"T1074.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["Contains ability to create directories (API string)","Writes log files","Calls an API typically used to create a directory"],"parent":{"technique":"Data Staged","attck_id":"T1074","attck_id_wiki":"https://attack.mitre.org/techniques/T1074"}},{"tactic":"Collection","technique":"Email Collection","attck_id":"T1114","attck_id_wiki":"https://attack.mitre.org/techniques/T1114","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Collection","technique":"Clipboard Data","attck_id":"T1115","attck_id_wiki":"https://attack.mitre.org/techniques/T1115","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to access clipboard data (API string)"],"parent":null},{"tactic":"Collection","technique":"Data from Local System","attck_id":"T1005","attck_id_wiki":"https://attack.mitre.org/techniques/T1005","malicious_identifiers_count":1,"malicious_identifiers":["Tries to steal browser sensitive information (file access)"],"suspicious_identifiers_count":3,"suspicious_identifiers":[],"informative_identifiers_count":3,"informative_identifiers":["May execute SQL queries","Writes files in a temp directory","Calls an API typically used to copy file from one location to another"],"parent":null},{"tactic":"Collection","technique":"Data from Information Repositories","attck_id":"T1213","attck_id_wiki":"https://attack.mitre.org/techniques/T1213","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains SQL queries"],"parent":null},{"tactic":"Collection","technique":"Archive Collected Data","attck_id":"T1560","attck_id_wiki":"https://attack.mitre.org/techniques/T1560","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":3,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Able to compress file/directory using PowerShell cmdlet"],"parent":null},{"tactic":"Collection","technique":"Automated Collection","attck_id":"T1119","attck_id_wiki":"https://attack.mitre.org/techniques/T1119","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Shows ability to send encrypted data to the internet"],"parent":null},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attck_id":"T1095","attck_id_wiki":"https://attack.mitre.org/techniques/T1095","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to communicate with C2 using Sockets (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573","malicious_identifiers_count":1,"malicious_identifiers":["Makes HTTPS connections using an insecure TLS/SSL version"],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Possibly tries to communicate over SSL connection (HTTPS)","Uses HTTPS for communication"],"parent":null},{"tactic":"Command and Control","technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":5,"informative_identifiers":["Found potential URL in binary/memory","Contains ability to communicate with network (API string)","Found potential IP address in binary/memory","Found potential URLs in memory dumps","Contacts server"],"parent":null},{"tactic":"Command and Control","technique":"Web Service","attck_id":"T1102","attck_id_wiki":"https://attack.mitre.org/techniques/T1102","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Found domain strings related to cloud services(possible C&C communication)"],"parent":null},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attck_id":"T1105","attck_id_wiki":"https://attack.mitre.org/techniques/T1105","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":3,"suspicious_identifiers":["Drops executable files"],"informative_identifiers_count":6,"informative_identifiers":["Contains ability to transfer data using curl","Contains ability to write files (API string)","Contains ability to get content from a webpage (Powershell command string)","Contains ability to copy items (Powershell command string)","Dropped files","Drops files with image extension"],"parent":null},{"tactic":"Command and Control","technique":"Non-Standard Port","attck_id":"T1571","attck_id_wiki":"https://attack.mitre.org/techniques/T1571","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to open a port and listen for incoming connection (API string)"],"parent":null},{"tactic":"Command and Control","technique":"Proxy","attck_id":"T1090","attck_id_wiki":"https://attack.mitre.org/techniques/T1090","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains references to RPC protocol sequence strings"],"parent":null},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attck_id":"T1573.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains reference to OpenSSL library string","Shows ability to use asymmetric encryption algorithm"],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Command and Control","technique":"Mail Protocols","attck_id":"T1071.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains reference to Mail transfer protocol","Found mail related domain names"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attck_id":"T1573.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to use AES encryption instructions","Shows ability to use encryption for command and control traffic"],"parent":{"technique":"Encrypted Channel","attck_id":"T1573","attck_id_wiki":"https://attack.mitre.org/techniques/T1573"}},{"tactic":"Command and Control","technique":"Web Protocols","attck_id":"T1071.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Sends traffic on typical HTTP outbound port, but without HTTP header"],"informative_identifiers_count":3,"informative_identifiers":["Found string related to HTTP headers","Found user-agent related strings","Uses cURL to communicate over HTTPS"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Data Encoding","attck_id":"T1132","attck_id_wiki":"https://attack.mitre.org/techniques/T1132","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform Base64 encoding/decoding"],"parent":null},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attck_id":"T1090.003","attck_id_wiki":"https://attack.mitre.org/techniques/T1090/003","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains Tor Onion URL"],"parent":{"technique":"Proxy","attck_id":"T1090","attck_id_wiki":"https://attack.mitre.org/techniques/T1090"}},{"tactic":"Command and Control","technique":"Internal Proxy","attck_id":"T1090.001","attck_id_wiki":"https://attack.mitre.org/techniques/T1090/001","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies proxy settings"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Proxy","attck_id":"T1090","attck_id_wiki":"https://attack.mitre.org/techniques/T1090"}},{"tactic":"Command and Control","technique":"DNS","attck_id":"T1071.004","attck_id_wiki":"https://attack.mitre.org/techniques/T1071/004","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries DNS server"],"parent":{"technique":"Application Layer Protocol","attck_id":"T1071","attck_id_wiki":"https://attack.mitre.org/techniques/T1071"}},{"tactic":"Command and Control","technique":"Steganography","attck_id":"T1001.002","attck_id_wiki":"https://attack.mitre.org/techniques/T1001/002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":{"technique":"Data Obfuscation","attck_id":"T1001","attck_id_wiki":"https://attack.mitre.org/techniques/T1001"}},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attck_id":"T1029","attck_id_wiki":"https://attack.mitre.org/techniques/T1029","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to perform scheduled transfer (API string)"],"parent":null},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attck_id":"T1567","attck_id_wiki":"https://attack.mitre.org/techniques/T1567","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Impact","technique":"Data Encrypted for Impact","attck_id":"T1486","attck_id_wiki":"https://attack.mitre.org/techniques/T1486","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains reference to cryptographic keys","Imports crypto-related APIs"],"parent":null},{"tactic":"Impact","technique":"Service Stop","attck_id":"T1489","attck_id_wiki":"https://attack.mitre.org/techniques/T1489","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":4,"informative_identifiers":["Able to retrieve/open a process (API string)","Contains ability to terminate a process (API string)","Contains ability to stop a service (Powershell command string)","Calls an API used to open a process handle"],"parent":null},{"tactic":"Impact","technique":"Data Manipulation","attck_id":"T1565","attck_id_wiki":"https://attack.mitre.org/techniques/T1565","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to modify data representation (Powershell command string)"],"parent":null},{"tactic":"Impact","technique":"System Shutdown/Reboot","attck_id":"T1529","attck_id_wiki":"https://attack.mitre.org/techniques/T1529","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to shutdown system"],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-333","type":2,"relevance":1,"name":"Able to delete items (Powershell command string)","description":"Found string \"Remove-Item\" (Indicator: \"Remove-Item\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Remove-Item\" (Indicator: \"Remove-Item\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Remove-Item\" (Indicator: \"Remove-Item\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-140","type":6,"relevance":3,"name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00002116)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00002116)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00002116)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00002116)","description_v2":["\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00002116)","\"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00002116)","\"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00002116)","\"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00002116)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00002116)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"api-139","type":6,"relevance":3,"name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2366908858369', 'hResInfo': '2366908859616'}\" (UID: 00000000-00002116)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2366908858369', 'hResInfo': '2366908859648'}\" (UID: 00000000-00002116)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2366908858369', 'hResInfo': '2366908859664'}\" (UID: 00000000-00002116)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2366908858369', 'hResInfo': '2366908859632'}\" (UID: 00000000-00002116)","description_v2":["\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2366908858369', 'hResInfo': '2366908859616'}\" (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2366908858369', 'hResInfo': '2366908859648'}\" (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2366908858369', 'hResInfo': '2366908859664'}\" (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2366908858369', 'hResInfo': '2366908859632'}\" (UID: 00000000-00002116)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2366908858369', 'hResInfo': '2366908859616'}\" (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2366908858369', 'hResInfo': '2366908859648'}\" (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2366908858369', 'hResInfo': '2366908859664'}\" (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2366908858369', 'hResInfo': '2366908859632'}\" (UID: 00000000-00002116)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-243","type":2,"relevance":1,"name":"Contains ability to clear Powershell session command history (Powershell command string)","description":"Found string \"Clear-History\" (Indicator: \"Clear-History\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Clear-History\" (Indicator: \"Clear-History\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Clear-History\" (Indicator: \"Clear-History\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-368","type":2,"relevance":1,"name":"Contains ability to clear content (Powershell command string)","description":"Found string \"Clear-Host\" (Indicator: \"Clear-Host\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")\n Found string \"Clear-Content\" (Indicator: \"Clear-Content\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")\n Found string \"Clear-ItemProperty\" (Indicator: \"Clear-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")\n Found string \"Clear-Variable\" (Indicator: \"Clear-Variable\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Clear-Host\" (Indicator: \"Clear-Host\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Clear-Content\" (Indicator: \"Clear-Content\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Clear-ItemProperty\" (Indicator: \"Clear-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Clear-Variable\" (Indicator: \"Clear-Variable\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Clear-Host\" (Indicator: \"Clear-Host\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Clear-Content\" (Indicator: \"Clear-Content\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Clear-ItemProperty\" (Indicator: \"Clear-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Clear-Variable\" (Indicator: \"Clear-Variable\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-397","type":2,"relevance":1,"name":"Contains ability to delay execution (Powershell command string)","description":"Found string \"Start-Sleep\" (Indicator: \"Start-Sleep\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Start-Sleep\" (Indicator: \"Start-Sleep\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Start-Sleep\" (Indicator: \"Start-Sleep\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-226","type":2,"relevance":1,"name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","description_v2":["Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-92","type":2,"relevance":1,"name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-318","type":2,"relevance":1,"name":"Contains ability to load/free library (API string)","description":"$26","description_v2":["Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1055.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-366","type":2,"relevance":1,"name":"Contains ability to modify data representation (Powershell command string)","description":"$27","description_v2":["file/memory contains long string with (Indicator: \"ConvertFrom-StringData\"; File: \"AMSI\")","Found string \"Format-Custom\" (Indicator: \"Format-Custom\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Format-List\" (Indicator: \"Format-List\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Format-Table\" (Indicator: \"Format-Table\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Format-Wide\" (Indicator: \"Format-Wide\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Convert-Path\" (Indicator: \"Convert-Path\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Export-Alias\" (Indicator: \"Export-Alias\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Export-Csv\" (Indicator: \"Export-Csv\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Export-ModuleMember\" (Indicator: \"Export-ModuleMember\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Export-Console\" (Indicator: \"Export-Console\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"file, use Export-Console in Windows PowerShell.\" (Indicator: \"Export-Console\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"ConvertFrom-StringData\"; File: \"AMSI\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Format-Custom\" (Indicator: \"Format-Custom\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Format-List\" (Indicator: \"Format-List\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Format-Table\" (Indicator: \"Format-Table\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Format-Wide\" (Indicator: \"Format-Wide\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Convert-Path\" (Indicator: \"Convert-Path\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Export-Alias\" (Indicator: \"Export-Alias\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Export-Csv\" (Indicator: \"Export-Csv\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Export-ModuleMember\" (Indicator: \"Export-ModuleMember\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Export-Console\" (Indicator: \"Export-Console\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"file, use Export-Console in Windows PowerShell.\" (Indicator: \"Export-Console\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1565","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1565","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-304","type":2,"relevance":1,"name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-338","type":2,"relevance":1,"name":"Contains ability to perform Base64 encoding/decoding","description":"$28","description_v2":["Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1132","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1132","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-381","type":2,"relevance":1,"name":"Contains ability to rename items (Powershell command string)","description":"Found string \"Rename-ItemProperty\" (Indicator: \"Rename-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Rename-ItemProperty\" (Indicator: \"Rename-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Rename-ItemProperty\" (Indicator: \"Rename-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1036.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1036/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-138","type":2,"relevance":2,"name":"Contains ability to use Cryptographic classes","description":"$29","description_v2":["Found reference to \"SHA384\" (Indicator: \"SHA384\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","file/memory contains long string with (Indicator: \"HMAC\"; File: \"edge_history_temp.db\")","Found reference to \"RC2-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"RC2-64-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"RC2-40-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"HMAC routines\" (Indicator: \"HMAC\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"RC2-ECB\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"RC2-CFB\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"RC2-OFB\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"PBE-SHA1-RC2-64\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"pbeWithSHA1AndRC2-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"pbeWithSHA1And3-KeyTripleDES-CBC\" (Indicator: \"TripleDES\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"pbeWithSHA1And2-KeyTripleDES-CBC\" (Indicator: \"TripleDES\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"PBE-SHA1-RC2-128\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"pbeWithSHA1And128BitRC2-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"PBE-SHA1-RC2-40\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"pbeWithSHA1And40BitRC2-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"PBE-MD2-RC2-64\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"pbeWithMD2AndRC2-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"PBE-MD5-RC2-64\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"pbeWithMD5AndRC2-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"id-smime-alg-ESDHwithRC2\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"id-smime-alg-RC2wrap\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"id-smime-alg-CMSRC2wrap\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to \"RSA-SHA384\" (Indicator: \"SHA384\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"],"description_v3":[{"type":"text","value":"Found reference to \"SHA384\" (Indicator: \"SHA384\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"HMAC\"; File: \"edge_history_temp.db\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RC2-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RC2-64-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RC2-40-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"HMAC routines\" (Indicator: \"HMAC\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RC2-ECB\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RC2-CFB\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RC2-OFB\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"PBE-SHA1-RC2-64\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"pbeWithSHA1AndRC2-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"pbeWithSHA1And3-KeyTripleDES-CBC\" (Indicator: \"TripleDES\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"pbeWithSHA1And2-KeyTripleDES-CBC\" (Indicator: \"TripleDES\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"PBE-SHA1-RC2-128\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"pbeWithSHA1And128BitRC2-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"PBE-SHA1-RC2-40\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"pbeWithSHA1And40BitRC2-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"PBE-MD2-RC2-64\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"pbeWithMD2AndRC2-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"PBE-MD5-RC2-64\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"pbeWithMD5AndRC2-CBC\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"id-smime-alg-ESDHwithRC2\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"id-smime-alg-RC2wrap\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"id-smime-alg-CMSRC2wrap\" (Indicator: \"RC2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to \"RSA-SHA384\" (Indicator: \"SHA384\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-331","type":2,"relevance":1,"name":"Contains ability to write/modify file content (Powershell command string)","description":"Found string \"Set-Content\" (Indicator: \"Set-Content\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Set-Content\" (Indicator: \"Set-Content\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Set-Content\" (Indicator: \"Set-Content\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1036.005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1036/005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-231","type":2,"relevance":1,"name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002116.00000000.115026.14E70000.00000004.mdmp\n Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002116.00000000.115026.17190000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002116.00000000.115026.17190000.00000004.mdmp\n Observed string: \":\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\n Observed string: \"werShell\\v1.0\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp","description_v2":["Observed string: \":\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002116.00000000.115026.14E70000.00000004.mdmp","Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002116.00000000.115026.17190000.00000004.mdmp","Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002116.00000000.115026.17190000.00000004.mdmp","Observed string: \":\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp","Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp","Observed string: \"werShell\\v1.0\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp"],"description_v3":[{"type":"text","value":"Observed string: %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002116.00000000.115026.14E70000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002116.00000000.115026.17190000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002116.00000000.115026.17190000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"Observed string: \":\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"werShell\\v1.0\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp"}],"origin":"File/Memory","attck_id":"T1562.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthiness","identifier":"string-145","type":2,"relevance":1,"name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\PSHost.133924137453095201.2116.DefaultAppDomain.powershell; Source: \"00000000-00002116-00000C57-805578030\")\n Found string - \\\\.\\pipe\\PSHost.133924138103163556.6864.DefaultAppDomain.powershell; Source: \"00000000-00006864-00000C57-817128004\")","description_v2":["Found string - \\\\.\\pipe\\PSHost.133924137453095201.2116.DefaultAppDomain.powershell; Source: \"00000000-00002116-00000C57-805578030\")","Found string - \\\\.\\pipe\\PSHost.133924138103163556.6864.DefaultAppDomain.powershell; Source: \"00000000-00006864-00000C57-817128004\")"],"description_v3":[{"type":"text","value":"Found string - \\\\.\\pipe\\PSHost.133924137453095201.2116.DefaultAppDomain.powershell; Source: \"00000000-00002116-00000C57-805578030\")"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\pipe\\PSHost.133924138103163556.6864.DefaultAppDomain.powershell; Source: \"00000000-00006864-00000C57-817128004\")"}],"origin":"File/Memory","attck_id":"T1564","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-183","type":2,"relevance":1,"name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","description_v2":["Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"],"description_v3":[{"type":"text","value":"Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"string-148","type":2,"relevance":1,"name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","description_v2":["Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"}],"origin":"File/Memory","attck_id":"T1622","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1622","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-656","type":2,"relevance":1,"name":"Able to compress file/directory using PowerShell cmdlet","description":"$2a","description_v2":["$2b","Found string \"powershell -Command \"Compress-Archive -Path 'C:\\Users\\9ZUGU2u\\AppData\\Local\\Temp\\runtime\\*' -DestinationPath 'C:\\Users\\9ZUGU2u\\AppData\\Local\\Temp\\runtime.zip' -Force\"\" (Source: \"00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp\")","Found string \"Compress-Archive -Path 'C:\\Users\\9ZUGU2u\\AppData\\Local\\Temp\\runtime\\*' -DestinationPath 'C:\\Users\\9ZUGU2u\\AppData\\Local\\Temp\\runtime.zip' -Force\" (Source: \"00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp, 00000000-00006864.00000000.115762.5B460000.00000004.mdmp, 00000000-00006864.00000000.115762.5CB00000.00000004.mdmp, 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"powershell -Command \"Compress-Archive -Path '\" (File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\"), Found string \"%WINDIR%\\system32\\cmd.exe /c powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -Destin\" (Source: \"00000000-00005044-00000C46-115678154006\"), Found string \"powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -DestinationPath '%TEMP%\\runtime\\*' -DestinationPath 'C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\runtime.zip' -Force\" (File: \"AMSI\"), Found string \"/c powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -DestinationPath '%TEMP%\\runtime.zip' -Force\"\" (File: \"cmd.exe\"), Found string \"powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -DestinationPath '%TEMP%\\runtime.zip' -Force\"\" (File: \"powershell.exe\"), Found string \"powershell -Command \"Compress-Archive -Path '\" (Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"powershell -Command \"Compress-Archive -Path 'C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\runtime\\*' -DestinationPath 'C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\runtime.zip' -Force\"\" (Source: \"00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Compress-Archive -Path 'C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\runtime\\*' -DestinationPath 'C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\runtime.zip' -Force\" (Source: \"00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp, 00000000-00006864.00000000.115762.5B460000.00000004.mdmp, 00000000-00006864.00000000.115762.5CB00000.00000004.mdmp, 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1560","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1560","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"stream-139","type":1,"relevance":0,"name":"Contains XOR operation loops [Stream disassembly]","description":"$2c","description_v2":["Assembly shows XOR instruction xor byte ptr [rcx]","bl in Stream UID: 11021-3090-000000014051C0C0","Assembly shows XOR instruction xor byte ptr [rax]","al in Stream UID: 11021-3090-000000014051C0C0","Assembly shows XOR instruction xor al","2Ch in Stream UID: 11021-4879-00000001404E1AE0","Assembly shows XOR instruction xor dword ptr [rbx]","56h in Stream UID: 11021-6122-00000001404BDD08","Assembly shows XOR instruction xor al","2Fh in Stream UID: 11021-6654-00000001404995C0","Assembly shows XOR instruction xor r13d","dword ptr [r8] in Stream UID: 11021-6654-00000001404995C0","Assembly shows XOR instruction xor ebp","dword ptr [rax] in Stream UID: 11021-6654-00000001404995C0","Assembly shows XOR instruction xor al","2Fh in Stream UID: 11021-6664-00000001404992C0","Assembly shows XOR instruction xor r13d","dword ptr [r8] in Stream UID: 11021-6664-00000001404992C0","Assembly shows XOR instruction xor ebp","dword ptr [rax] in Stream UID: 11021-6664-00000001404992C0","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8335-000000014041EF60","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8335-000000014041EF60","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8335-000000014041EF60","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8335-000000014041EF60","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8393-0000000140417FE0","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8393-0000000140417FE0","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8393-0000000140417FE0","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8393-0000000140417FE0","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8395-00000001403BF160","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8395-00000001403BF160","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8395-00000001403BF160","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8395-00000001403BF160","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8397-0000000140417460","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8397-0000000140417460","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8397-0000000140417460","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8397-0000000140417460","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8398-00000001403BE1C0","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8398-00000001403BE1C0","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8398-00000001403BE1C0","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8398-00000001403BE1C0","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8403-0000000140417890","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8403-0000000140417890","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8403-0000000140417890","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8403-0000000140417890","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8533-00000001403FDA70","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8533-00000001403FDA70","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8533-00000001403FDA70","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8533-00000001403FDA70","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8540-00000001403FCC60","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8540-00000001403FCC60","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8540-00000001403FCC60","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8540-00000001403FCC60","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8550-00000001403FC5F0","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8550-00000001403FC5F0","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8550-00000001403FC5F0","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8550-00000001403FC5F0","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8558-00000001403FC150","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8558-00000001403FC150","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8558-00000001403FC150","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8558-00000001403FC150","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8607-000000014041DFB0","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8607-000000014041DFB0","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8607-000000014041DFB0","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8607-000000014041DFB0","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8625-00000001403EFC60","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8625-00000001403EFC60","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8625-00000001403EFC60","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8625-00000001403EFC60","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8628-00000001403EFF70","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8628-00000001403EFF70","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8628-00000001403EFF70","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8628-00000001403EFF70","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8641-00000001403EEE50","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8641-00000001403EEE50","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8641-00000001403EEE50","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8641-00000001403EEE50","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8649-00000001403ECF40","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8649-00000001403ECF40","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8649-00000001403ECF40","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8649-00000001403ECF40","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8740-00000001403E0850","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8740-00000001403E0850","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8740-00000001403E0850","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8740-00000001403E0850","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8809-0000000140410A40","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8809-0000000140410A40","Assembly shows XOR instruction xor edx","eax in Stream UID: 11021-8809-0000000140410A40","Assembly shows XOR instruction xor eax","edi in Stream UID: 11021-8809-0000000140410A40","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8809-0000000140410A40","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8809-0000000140410A40","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8819-00000001403D3830","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8819-00000001403D3830","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8819-00000001403D3830","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8819-00000001403D3830","Assembly shows XOR instruction xor rax","rsp in Stream UID: 11021-8831-00000001403CE540","Assembly shows XOR instruction xor eax","esp in Stream UID: 11021-8831-00000001403CE540","Assembly shows XOR instruction xor rcx","rsp in Stream UID: 11021-8831-00000001403CE540","Assembly shows XOR instruction xor ecx","esp in Stream UID: 11021-8831-00000001403CE540","Assembly shows XOR instruction xor rax","rbp in Stream UID: 11021-9689-00000001402FD2F0","Assembly shows XOR instruction xor eax","ebp in Stream UID: 11021-9689-00000001402FD2F0","Assembly shows XOR instruction xor rcx","rbp in Stream UID: 11021-9689-00000001402FD2F0","Assembly shows XOR instruction xor ecx","ebp in Stream UID: 11021-9689-00000001402FD2F0"],"description_v3":[{"type":"text","value":"Assembly shows XOR instruction xor byte ptr [rcx]"},{"type":"linebreak"},{"type":"text","value":"bl in Stream UID: 11021-3090-000000014051C0C0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor byte ptr [rax]"},{"type":"linebreak"},{"type":"text","value":"al in Stream UID: 11021-3090-000000014051C0C0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor al"},{"type":"linebreak"},{"type":"text","value":"2Ch in Stream UID: 11021-4879-00000001404E1AE0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor dword ptr [rbx]"},{"type":"linebreak"},{"type":"text","value":"56h in Stream UID: 11021-6122-00000001404BDD08"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor al"},{"type":"linebreak"},{"type":"text","value":"2Fh in Stream UID: 11021-6654-00000001404995C0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor r13d"},{"type":"linebreak"},{"type":"text","value":"dword ptr [r8] in Stream UID: 11021-6654-00000001404995C0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ebp"},{"type":"linebreak"},{"type":"text","value":"dword ptr [rax] in Stream UID: 11021-6654-00000001404995C0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor al"},{"type":"linebreak"},{"type":"text","value":"2Fh in Stream UID: 11021-6664-00000001404992C0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor r13d"},{"type":"linebreak"},{"type":"text","value":"dword ptr [r8] in Stream UID: 11021-6664-00000001404992C0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ebp"},{"type":"linebreak"},{"type":"text","value":"dword ptr [rax] in Stream UID: 11021-6664-00000001404992C0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8335-000000014041EF60"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8335-000000014041EF60"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8335-000000014041EF60"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8335-000000014041EF60"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8393-0000000140417FE0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8393-0000000140417FE0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8393-0000000140417FE0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8393-0000000140417FE0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8395-00000001403BF160"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8395-00000001403BF160"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8395-00000001403BF160"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8395-00000001403BF160"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8397-0000000140417460"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8397-0000000140417460"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8397-0000000140417460"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8397-0000000140417460"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8398-00000001403BE1C0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8398-00000001403BE1C0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8398-00000001403BE1C0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8398-00000001403BE1C0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8403-0000000140417890"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8403-0000000140417890"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8403-0000000140417890"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8403-0000000140417890"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8533-00000001403FDA70"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8533-00000001403FDA70"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8533-00000001403FDA70"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8533-00000001403FDA70"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8540-00000001403FCC60"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8540-00000001403FCC60"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8540-00000001403FCC60"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8540-00000001403FCC60"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8550-00000001403FC5F0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8550-00000001403FC5F0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8550-00000001403FC5F0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8550-00000001403FC5F0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8558-00000001403FC150"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8558-00000001403FC150"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8558-00000001403FC150"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8558-00000001403FC150"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8607-000000014041DFB0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8607-000000014041DFB0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8607-000000014041DFB0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8607-000000014041DFB0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8625-00000001403EFC60"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8625-00000001403EFC60"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8625-00000001403EFC60"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8625-00000001403EFC60"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8628-00000001403EFF70"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8628-00000001403EFF70"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8628-00000001403EFF70"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8628-00000001403EFF70"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8641-00000001403EEE50"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8641-00000001403EEE50"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8641-00000001403EEE50"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8641-00000001403EEE50"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8649-00000001403ECF40"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8649-00000001403ECF40"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8649-00000001403ECF40"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8649-00000001403ECF40"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8740-00000001403E0850"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8740-00000001403E0850"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8740-00000001403E0850"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8740-00000001403E0850"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8809-0000000140410A40"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8809-0000000140410A40"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor edx"},{"type":"linebreak"},{"type":"text","value":"eax in Stream UID: 11021-8809-0000000140410A40"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"edi in Stream UID: 11021-8809-0000000140410A40"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8809-0000000140410A40"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8809-0000000140410A40"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8819-00000001403D3830"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8819-00000001403D3830"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8819-00000001403D3830"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8819-00000001403D3830"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8831-00000001403CE540"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8831-00000001403CE540"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rsp in Stream UID: 11021-8831-00000001403CE540"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"esp in Stream UID: 11021-8831-00000001403CE540"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rax"},{"type":"linebreak"},{"type":"text","value":"rbp in Stream UID: 11021-9689-00000001402FD2F0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor eax"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 11021-9689-00000001402FD2F0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor rcx"},{"type":"linebreak"},{"type":"text","value":"rbp in Stream UID: 11021-9689-00000001402FD2F0"},{"type":"linebreak"},{"type":"text","value":"Assembly shows XOR instruction xor ecx"},{"type":"linebreak"},{"type":"text","value":"ebp in Stream UID: 11021-9689-00000001402FD2F0"}],"origin":"Hybrid Analysis Technology","attck_id":"T1027.005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-213","type":2,"relevance":1,"name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-438","type":2,"relevance":3,"name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2d","description_v2":["Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptExportKey\" (Indicator: \"CryptExportKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptGetUserKey\" (Indicator: \"CryptGetUserKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptGetProvParam\" (Indicator: \"CryptGetProvParam\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptSignHashW\" (Indicator: \"CryptSignHash\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptEnumProvidersW\" (Indicator: \"CryptEnumProviders\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CertGetNameStringW\" (Indicator: \"CertGetNameString\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CertOpenSystemStoreW\" (Indicator: \"CertOpenSystemStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptDecodeObjectEx\" (Indicator: \"CryptDecodeObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CertFindCertificateInStore\" (Indicator: \"CertFindCertificateInStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"schannel: CryptDecodeObjectEx() returned no alternate name information.\" (Indicator: \"CryptDecodeObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"schannel: CertGetNameString() returned no certificate name information\" (Indicator: \"CertGetNameString\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptExportKey\" (Indicator: \"CryptExportKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptGetUserKey\" (Indicator: \"CryptGetUserKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptGetProvParam\" (Indicator: \"CryptGetProvParam\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptImportKey\" (Indicator: \"CryptImportKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptSignHashW\" (Indicator: \"CryptSignHash\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptEnumProvidersW\" (Indicator: \"CryptEnumProviders\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CertGetNameStringW\" (Indicator: \"CertGetNameString\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CertOpenSystemStoreW\" (Indicator: \"CertOpenSystemStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptDecodeObjectEx\" (Indicator: \"CryptDecodeObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CertFindCertificateInStore\" (Indicator: \"CertFindCertificateInStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"schannel: CryptDecodeObjectEx() returned no alternate name information.\" (Indicator: \"CryptDecodeObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"schannel: CertGetNameString() returned no certificate name information\" (Indicator: \"CertGetNameString\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-212","type":2,"relevance":1,"name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")\n Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-584","type":2,"relevance":3,"name":"Contains ability to use AES encryption instructions","description":"Found string \"AESNI-CBC+SHA1 stitch for x86_64, CRYPTOGAMS by \" (Indicator: \"AESNI\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found string \"AESNI-CBC+SHA256 stitch for x86_64, CRYPTOGAMS by \" (Indicator: \"AESNI\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found string \"AESNI-CBC+SHA1 stitch for x86_64, CRYPTOGAMS by \" (Indicator: \"AESNI\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found string \"AESNI-CBC+SHA256 stitch for x86_64, CRYPTOGAMS by \" (Indicator: \"AESNI\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found string \"AESNI-CBC+SHA1 stitch for x86_64, CRYPTOGAMS by \" (Indicator: \"AESNI\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"AESNI-CBC+SHA256 stitch for x86_64, CRYPTOGAMS by \" (Indicator: \"AESNI\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"AESNI-CBC+SHA1 stitch for x86_64, CRYPTOGAMS by \" (Indicator: \"AESNI\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"AESNI-CBC+SHA256 stitch for x86_64, CRYPTOGAMS by \" (Indicator: \"AESNI\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"AESNI-CBC+SHA1 stitch for x86_64, CRYPTOGAMS by \" (Indicator: \"AESNI\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"AESNI-CBC+SHA256 stitch for x86_64, CRYPTOGAMS by \" (Indicator: \"AESNI\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"AESNI-CBC+SHA1 stitch for x86_64, CRYPTOGAMS by \" (Indicator: \"AESNI\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"AESNI-CBC+SHA256 stitch for x86_64, CRYPTOGAMS by \" (Indicator: \"AESNI\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1573.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"string-280","type":2,"relevance":1,"name":"Contains reference to cryptographic keys","description":"$2e","description_v2":["Found string \"(TEST_ENG_OPENSSL_PKEY)Loading Private key %s\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"invalid dsa public key blob magic number\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"invalid public key blob\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"invalid rsa public key blob magic number\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"unsupported public key algorithm\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Set list options (1=summary,2=friendly name, 4=full printout, 8=PEM output, 16=XXX, 32=private key info)\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"No Private Key\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Private Key Info:\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"X509v3 Private Key Usage Period\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"X509v3 Subject Alternative Public Key Info\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"ANY PRIVATE KEY\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"PUBLIC KEY\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"PRIVATE KEY\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"ENCRYPTED PRIVATE KEY\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Public Key\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Subject Public Key Info:\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"%12sPublic Key Algorithm:\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"%12sUnable to load Public Key\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"unknown public key type\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"unsupported public key type\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"wrong public key type\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"private key too large\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"failed making public key\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"invalid private key\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"missing private key\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"],"description_v3":[{"type":"text","value":"Found string \"(TEST_ENG_OPENSSL_PKEY)Loading Private key %s\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"invalid dsa public key blob magic number\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"invalid public key blob\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"invalid rsa public key blob magic number\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"unsupported public key algorithm\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Set list options (1=summary,2=friendly name, 4=full printout, 8=PEM output, 16=XXX, 32=private key info)\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"No Private Key\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Private Key Info:\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"X509v3 Private Key Usage Period\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"X509v3 Subject Alternative Public Key Info\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ANY PRIVATE KEY\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"PUBLIC KEY\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"PRIVATE KEY\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ENCRYPTED PRIVATE KEY\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Public Key\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Subject Public Key Info:\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%12sPublic Key Algorithm:\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%12sUnable to load Public Key\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"unknown public key type\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"unsupported public key type\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"wrong public key type\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"private key too large\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"failed making public key\" (Indicator: \"public key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"invalid private key\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"missing private key\" (Indicator: \"private key\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"}],"origin":"File/Memory","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"static-82","type":0,"relevance":1,"name":"Imports crypto-related APIs","description":"Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]","description_v2":["Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]"],"description_v3":[{"type":"text","value":"Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]"}],"origin":"Static Parser","attck_id":"T1486","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1486","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-32","type":15,"relevance":1,"name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","description_v2":["The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","Matched sigs: Contains XOR operation loops [Stream disassembly]","Matched sigs: YARA signature match - AES encryption"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains XOR operation loops [Stream disassembly]"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - AES encryption"}],"origin":"Indicator Combinations","attck_id":"T1140","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1140","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-28","type":15,"relevance":1,"name":"Shows ability to obfuscate file or information","description":"$2f","description_v2":["The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)","Matched sigs: Contains key cryptographic functions (API string)","Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)","Matched sigs: Contains ability to encrypt/encode message (API string)","Matched sigs: Contains CRYPTO related strings","Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider","Matched sigs: Contains ability to use Cryptographic classes","Matched sigs: Contains ability to perform decryption (API string)","Matched sigs: Contains reference to cryptographic keys","Matched sigs: Contains ability to use AES encryption instructions","Matched sigs: Contains ability to perform Base64 encoding/decoding","Matched sigs: Possibly contains Public/Private key (encryption)","Matched sigs: Calls an API typically used to decrypt the data","Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP","Matched sigs: Calls an API typically used to import cryptographic keys into a CSP","Matched sigs: Reads the cryptographic machine GUID","Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","Matched sigs: Drops image files with high entropy (likely encrypted/compressed content)","Matched sigs: Imports crypto-related APIs","Matched sigs: Contains XOR operation loops [Stream disassembly]","Matched sigs: Contains key cryptographic functions of the CryptoAPI","Matched sigs: YARA signature match - AES encryption"],"description_v3":[{"type":"text","value":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains key cryptographic functions (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to import cryptographic keys (seen in ransomware)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to encrypt/encode message (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains CRYPTO related strings"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use Cryptographic classes"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform decryption (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains reference to cryptographic keys"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to use AES encryption instructions"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to perform Base64 encoding/decoding"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Possibly contains Public/Private key (encryption)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to decrypt the data"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Calls an API typically used to import cryptographic keys into a CSP"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Reads the cryptographic machine GUID"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Drops image files with high entropy (likely encrypted/compressed content)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Imports crypto-related APIs"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains XOR operation loops [Stream disassembly]"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains key cryptographic functions of the CryptoAPI"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - AES encryption"}],"origin":"Indicator Combinations","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-33","type":15,"relevance":1,"name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","description_v2":["The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)"],"description_v3":[{"type":"text","value":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)"}],"origin":"Indicator Combinations","attck_id":"T1573.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Cryptographic Related","identifier":"summary-31","type":15,"relevance":1,"name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","description_v2":["The analysis shows use of encryption","use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","Matched sigs: YARA signature match - AES encryption","Matched sigs: Found potential URL in binary/memory","Matched sigs: Contains ability to communicate with network (API string)","Matched sigs: Found potential IP address in binary/memory","Matched sigs: Found potential URLs in memory dumps","Matched sigs: Spawned process connects to a network","Matched sigs: Contacts server","Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)"],"description_v3":[{"type":"text","value":"The analysis shows use of encryption"},{"type":"linebreak"},{"type":"text","value":"use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: YARA signature match - AES encryption"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Found potential URL in binary/memory"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to communicate with network (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Found potential IP address in binary/memory"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Found potential URLs in memory dumps"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Spawned process connects to a network"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contacts server"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)"}],"origin":"Indicator Combinations","attck_id":"T1573.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-761","type":2,"relevance":1,"name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; File: \"edge_history_temp.db\")","description_v2":["file/memory contains long string with (Indicator: \"github.com\"; File: \"edge_history_temp.db\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"github.com\"; File: \"edge_history_temp.db\")"}],"origin":"File/Memory","attck_id":"T1590","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1590","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-659","type":2,"relevance":1,"name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002116-00000C2B-803075922\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002116-00000C2B-804407919\")","description_v2":["Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002116-00000C2B-803075922\")","Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002116-00000C2B-804407919\")"],"description_v3":[{"type":"text","value":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002116-00000C2B-803075922\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002116-00000C2B-804407919\")"}],"origin":"File/Memory","attck_id":"T1497.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-661","type":2,"relevance":1,"name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-662","type":2,"relevance":1,"name":"Able to identify virtual environment by using web history","description":"Found string \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\History\" (Source: \"00000000-00005044-00000C3C-113149263096\")\n Found string \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\History\" (Source: \"00000000-00005044-00000C3C-113451435456\")","description_v2":["Found string \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\History\" (Source: \"00000000-00005044-00000C3C-113149263096\")","Found string \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\History\" (Source: \"00000000-00005044-00000C3C-113451435456\")"],"description_v3":[{"type":"text","value":"Found string \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\History\" (Source: \"00000000-00005044-00000C3C-113149263096\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\History\" (Source: \"00000000-00005044-00000C3C-113451435456\")"}],"origin":"File/Memory","attck_id":"T1497.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-201","type":2,"relevance":1,"name":"Able to query system locale information (API string)","description":"$30","description_v2":["Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-739","type":2,"relevance":1,"name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-721","type":2,"relevance":1,"name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00002116-00000C2B-803526864\")\n Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00002116-00000C2B-803526922\")","description_v2":["Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00002116-00000C2B-803526864\")","Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00002116-00000C2B-803526922\")"],"description_v3":[{"type":"text","value":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"00000000-00002116-00000C2B-803526864\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"EnumWindowsW\" (Indicator: \"enumwindows\"; Source: \"00000000-00002116-00000C2B-803526922\")"}],"origin":"File/Memory","attck_id":"T1055.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-296","type":6,"relevance":3,"name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007984)\n \"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004104)\n \"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004276)\n \"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000796)\n \"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005688)","description_v2":["\"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007984)","\"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004104)","\"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004276)","\"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000796)","\"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005688)"],"description_v3":[{"type":"text","value":"\"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007984)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004104)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00004276)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000796)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005688)"}],"origin":"API Call","attck_id":"T1497","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-294","type":6,"relevance":3,"name":"Attempts to call APIs to gather system and hardware detail","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005044)\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005044)","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005044)"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00005044)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-297","type":6,"relevance":3,"name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005044)","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005044)"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005044)"}],"origin":"API Call","attck_id":"T1003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-142","type":6,"relevance":3,"name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005044)","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005044)"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005044)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-146","type":6,"relevance":3,"name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"2116\" - (UID: 00000000-00002116)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"6864\" - (UID: 00000000-00006864)","description_v2":["\"powershell.exe\" called \"IsWow64Process\" with parameter \"2116\" - (UID: 00000000-00002116)","\"powershell.exe\" called \"IsWow64Process\" with parameter \"6864\" - (UID: 00000000-00006864)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"2116\" - (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"6864\" - (UID: 00000000-00006864)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-152","type":6,"relevance":3,"name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002116)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006864)","description_v2":["\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002116)","\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006864)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006864)"}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-124","type":6,"relevance":3,"name":"Calls an API typically used to get product type","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005044)","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005044)"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005044)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-125","type":6,"relevance":3,"name":"Calls an API typically used to get system version information","description":"$31","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"RtlGetVersion\" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000000080edf2b73d00000000000000000000000000000000000000b8ecf2b73d0000000000000000000000000000000000000070fb1071fc7f00000900000009000000000000000000000019553f55fc7f00000000000000000000180000003d00000028eef2b73d000000704609b02402000020eef2b73d000000f0edf2b73d000000f5408860fc7f000080001040000000009c00009c0000000000000000000000009c00009c000000000000000000000000000000000000000000000000000000000100000000000000010000000000000020eef2b73d000000f0edf2b73d00000038eef2b73d000000707f55d51ac100003c711e6783f4000001000000 (UID: 00000000-00005044)"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"RtlGetVersion\" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"RtlGetVersion\" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f0000020000000000000080edf2b73d00000000000000000000000000000000000000b8ecf2b73d0000000000000000000000000000000000000070fb1071fc7f00000900000009000000000000000000000019553f55fc7f00000000000000000000180000003d00000028eef2b73d000000704609b02402000020eef2b73d000000f0edf2b73d000000f5408860fc7f000080001040000000009c00009c0000000000000000000000009c00009c000000000000000000000000000000000000000000000000000000000100000000000000010000000000000020eef2b73d000000f0edf2b73d00000038eef2b73d000000707f55d51ac100003c711e6783f4000001000000 (UID: 00000000-00005044)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-222","type":6,"relevance":2,"name":"Calls an API typically used to retrieve OS information","description":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000006f00a0b5e914270200000100000003000000010000006600740018000000650074000000000000000000000000000000000001000000360034000100000034002e0000000000000000000000000039005c0063006f0000000000000000000000000000000000010000002f00000000000000000000006600690067000000 (UID: 00000000-00002116)\n \"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00006864)","description_v2":["\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000006f00a0b5e914270200000100000003000000010000006600740018000000650074000000000000000000000000000000000001000000360034000100000034002e0000000000000000000000000039005c0063006f0000000000000000000000000000000000010000002f00000000000000000000006600690067000000 (UID: 00000000-00002116)","\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00006864)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000006f00a0b5e914270200000100000003000000010000006600740018000000650074000000000000000000000000000000000001000000360034000100000034002e0000000000000000000000000039005c0063006f0000000000000000000000000000000000010000002f00000000000000000000006600690067000000 (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000006f00770073005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b00360034005c00760034002e0030002e00330030003300310039005c0063006f006e006600690067005c006d0061006300680069006e0065002e0063006f006e006600690067000000 (UID: 00000000-00006864)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-148","type":6,"relevance":3,"name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002116)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002116)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006864)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006864)","description_v2":["\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002116)","\"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002116)","\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006864)","\"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006864)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006864)"}],"origin":"API Call","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-147","type":6,"relevance":3,"name":"Calls an API typically used to retrieve local language","description":"\"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007984)\n \"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004104)\n \"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004276)\n \"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00000796)\n \"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005688)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002116)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006864)","description_v2":["\"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007984)","\"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004104)","\"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004276)","\"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00000796)","\"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005688)","\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002116)","\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006864)"],"description_v3":[{"type":"text","value":"\"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00007984)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004104)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00004276)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00000796)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005688)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006864)"}],"origin":"API Call","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"static-190","type":0,"relevance":5,"name":"Calls an APIs used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]","description_v2":["Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]"],"description_v3":[{"type":"text","value":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]"}],"origin":"Static Parser","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-450","type":2,"relevance":1,"name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","description_v2":["Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-89","type":1,"relevance":3,"name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.dll at 11021-9689-00000001402FD2F0\n FindFirstFileExW@KERNEL32.dll at 11021-26218-00000001404513DE","description_v2":["FindFirstFileW@KERNEL32.dll at 11021-9689-00000001402FD2F0","FindFirstFileExW@KERNEL32.dll at 11021-26218-00000001404513DE"],"description_v3":[{"type":"text","value":"FindFirstFileW@KERNEL32.dll"},{"type":"stream","stream_uid":"11021-9689-00000001402FD2F0","modal_link":"/bff/report/682f1077421fe9a5d3046379/processes/00000000-00005044/streams/0/11021-9689-00000001402FD2F0","process":null},{"type":"linebreak"},{"type":"text","value":"FindFirstFileExW@KERNEL32.dll"},{"type":"stream","stream_uid":"11021-26218-00000001404513DE","modal_link":"/bff/report/682f1077421fe9a5d3046379/processes/00000000-00005044/streams/0/11021-26218-00000001404513DE","process":null}],"origin":"Hybrid Analysis Technology","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":{"modal_link":"/bff/report/682f1077421fe9a5d3046379/processes/00000000-00005044/streams/0/11021-9689-00000001402FD2F0","name":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe","pid":5044}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-365","type":2,"relevance":1,"name":"Contains ability to perform scheduled transfer (API string)","description":"$32","description_v2":["Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1029","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1029","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-71","type":1,"relevance":1,"name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 11021-10962-000000014025F520\n GetSystemTimeAsFileTime@KERNEL32.dll at 11021-31411-0000000140425BCD","description_v2":["GetSystemTimeAsFileTime@KERNEL32.dll at 11021-10962-000000014025F520","GetSystemTimeAsFileTime@KERNEL32.dll at 11021-31411-0000000140425BCD"],"description_v3":[{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.dll at 11021-10962-000000014025F520"},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.dll"},{"type":"stream","stream_uid":"11021-31411-0000000140425BCD","modal_link":"/bff/report/682f1077421fe9a5d3046379/processes/00000000-00005044/streams/0/11021-31411-0000000140425BCD","process":null}],"origin":"Hybrid Analysis Technology","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":{"modal_link":"/bff/report/682f1077421fe9a5d3046379/processes/00000000-00005044/streams/0/11021-31411-0000000140425BCD","name":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe","pid":5044}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-2","type":1,"relevance":1,"name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.dll at 11021-10676-000000014028B2F0\n GetSystemTimeAsFileTime@KERNEL32.dll at 11021-10962-000000014025F520\n GetSystemTimeAsFileTime@KERNEL32.dll at 11021-31411-0000000140425BCD","description_v2":["GetSystemTime@KERNEL32.dll at 11021-10676-000000014028B2F0","GetSystemTimeAsFileTime@KERNEL32.dll at 11021-10962-000000014025F520","GetSystemTimeAsFileTime@KERNEL32.dll at 11021-31411-0000000140425BCD"],"description_v3":[{"type":"text","value":"GetSystemTime@KERNEL32.dll at 11021-10676-000000014028B2F0"},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.dll at 11021-10962-000000014025F520"},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.dll"},{"type":"stream","stream_uid":"11021-31411-0000000140425BCD","modal_link":"/bff/report/682f1077421fe9a5d3046379/processes/00000000-00005044/streams/0/11021-31411-0000000140425BCD","process":null}],"origin":"Hybrid Analysis Technology","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":{"modal_link":"/bff/report/682f1077421fe9a5d3046379/processes/00000000-00005044/streams/0/11021-31411-0000000140425BCD","name":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe","pid":5044}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-49","type":1,"relevance":1,"name":"Contains ability to query the system locale","description":"GetLocaleInfoEx@KERNEL32.dll at 11021-25583-0000000140423309\n GetLocaleInfoW@KERNEL32.dll at 11021-26275-00000001404551CD\n GetLocaleInfoW@KERNEL32.dll at 11021-26276-00000001404555C8\n GetLocaleInfoW@KERNEL32.dll at 11021-26278-000000014045540D","description_v2":["GetLocaleInfoEx@KERNEL32.dll at 11021-25583-0000000140423309","GetLocaleInfoW@KERNEL32.dll at 11021-26275-00000001404551CD","GetLocaleInfoW@KERNEL32.dll at 11021-26276-00000001404555C8","GetLocaleInfoW@KERNEL32.dll at 11021-26278-000000014045540D"],"description_v3":[{"type":"text","value":"GetLocaleInfoEx@KERNEL32.dll at 11021-25583-0000000140423309"},{"type":"linebreak"},{"type":"text","value":"GetLocaleInfoW@KERNEL32.dll at 11021-26275-00000001404551CD"},{"type":"linebreak"},{"type":"text","value":"GetLocaleInfoW@KERNEL32.dll at 11021-26276-00000001404555C8"},{"type":"linebreak"},{"type":"text","value":"GetLocaleInfoW@KERNEL32.dll at 11021-26278-000000014045540D"}],"origin":"Hybrid Analysis Technology","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-193","type":2,"relevance":1,"name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-78","type":3,"relevance":1,"name":"Contains ability to read software policies","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","\"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-326","type":2,"relevance":1,"name":"Contains ability to retrieve environment variable settings","description":"$33","description_v2":["Found string \"SET NULL\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"SET DEFAULT\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"set list\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Set CSP by index\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Set CSP name, (default CSP used if not specified)\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Set CSP type, (default RSA_PROV_FULL)\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Set list options (1=summary,2=friendly name, 4=full printout, 8=PEM output, 16=XXX, 32=private key info)\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Set key lookup method (1=substring, 2=friendlyname, 3=container name)\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"set default property failure\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"set filename failed\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"set filter for listen socket fd=%qd ip=%s:%d\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"set timeouts for state %d; Total % lld, retry %d maxtry %d\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"],"description_v3":[{"type":"text","value":"Found string \"SET NULL\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SET DEFAULT\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"set list\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Set CSP by index\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Set CSP name, (default CSP used if not specified)\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Set CSP type, (default RSA_PROV_FULL)\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Set list options (1=summary,2=friendly name, 4=full printout, 8=PEM output, 16=XXX, 32=private key info)\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Set key lookup method (1=substring, 2=friendlyname, 3=container name)\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"set default property failure\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"set filename failed\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"set filter for listen socket fd=%qd ip=%s:%d\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"set timeouts for state %d; Total % lld, retry %d maxtry %d\" (Indicator: \"set \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-249","type":2,"relevance":1,"name":"Contains ability to retrieve file time (API string)","description":"$34","description_v2":["Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1070.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1070/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-575","type":2,"relevance":1,"name":"Contains ability to retrieve geographical location","description":"\"countryCode3c\" (Indicator: \"countrycode\") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\n \"countryCode3n\" (Indicator: \"countrycode\") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c","description_v2":["\"countryCode3c\" (Indicator: \"countrycode\") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c","\"countryCode3n\" (Indicator: \"countrycode\") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c"],"description_v3":[{"type":"text","value":"\"countryCode3c\" (Indicator: \"countrycode\") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c"},{"type":"linebreak"},{"type":"text","value":"\"countryCode3n\" (Indicator: \"countrycode\") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c"}],"origin":"File/Memory","attck_id":"T1614","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-89","type":2,"relevance":1,"name":"Contains ability to retrieve information about the current system (API string)","description":"$35","description_v2":["Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-247","type":2,"relevance":1,"name":"Contains ability to retrieve machine time (API string)","description":"$36","description_v2":["Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-248","type":2,"relevance":1,"name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-143","type":2,"relevance":1,"name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","description_v2":["Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1614.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1614/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-171","type":2,"relevance":1,"name":"Contains ability to retrieve the OS information (API string)","description":"$37","description_v2":["Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"RtlVerifyVersionInfo\" (Indicator: \"VerifyVersionInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"RtlVerifyVersionInfo\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RtlVerifyVersionInfo\" (Indicator: \"VerifyVersionInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RtlVerifyVersionInfo\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"string-167","type":2,"relevance":1,"name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","description_v2":["Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"}],"origin":"File/Memory","attck_id":"T1543","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-56","type":6,"relevance":10,"name":"Executes WMI queries","description":"\"WMIC.exe\" issued a query \"SELECT Model, serialnumber FROM Win32_DiskDrive\"\n \"WMIC.exe\" issued a query \"SELECT Description, DeviceID FROM Win32_Keyboard\"\n \"WMIC.exe\" issued a query \"SELECT Description, PNPDeviceID FROM Win32_PointingDevice\"\n \"WMIC.exe\" issued a query \"SELECT Description, PNPDeviceID FROM Win32_DesktopMonitor\"","description_v2":["\"WMIC.exe\" issued a query \"SELECT Model, serialnumber FROM Win32_DiskDrive\"","\"WMIC.exe\" issued a query \"SELECT Description, DeviceID FROM Win32_Keyboard\"","\"WMIC.exe\" issued a query \"SELECT Description, PNPDeviceID FROM Win32_PointingDevice\"","\"WMIC.exe\" issued a query \"SELECT Description, PNPDeviceID FROM Win32_DesktopMonitor\""],"description_v3":[{"type":"text","value":"\"WMIC.exe\" issued a query \"SELECT Model, serialnumber FROM Win32_DiskDrive\""},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" issued a query \"SELECT Description, DeviceID FROM Win32_Keyboard\""},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" issued a query \"SELECT Description, PNPDeviceID FROM Win32_PointingDevice\""},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" issued a query \"SELECT Description, PNPDeviceID FROM Win32_DesktopMonitor\""}],"origin":"API Call","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1047","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-11","type":6,"relevance":2,"name":"Queries volume information","description":"$38","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\runtime.zip\" at 00000000-00005044-00000C17-823987253","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002116-00000C17-804774347","\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00002116-00000C17-805852020","\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00002116-00000C17-805878737","\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll\" at 00000000-00002116-00000C17-806365352","\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00002116-00000C17-806779899","\"powershell.exe\" queries volume information of \"C:\\share\" at 00000000-00002116-00000C17-806781616","\"powershell.exe\" queries volume information of \"C:\\share\" at 00000000-00002116-00000C17-806874925","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002116-00000C17-807778711","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-816194195","\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00006864-00000C17-817267023","\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00006864-00000C17-817272879","\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll\" at 00000000-00006864-00000C17-817781802","\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006864-00000C17-818290822","\"powershell.exe\" queries volume information of \"C:\\share\" at 00000000-00006864-00000C17-818292671","\"powershell.exe\" queries volume information of \"C:\\share\" at 00000000-00006864-00000C17-818395166","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-819303475","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-819420618","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-819474835","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-819546993","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-819736887","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-819806280","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-819897614","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-820043527","\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-820158593"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" queries volume information of \"%TEMP%\\runtime.zip\" at 00000000-00005044-00000C17-823987253"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002116-00000C17-804774347"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00002116-00000C17-805852020"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00002116-00000C17-805878737"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll\" at 00000000-00002116-00000C17-806365352"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00002116-00000C17-806779899"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\share\" at 00000000-00002116-00000C17-806781616"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\share\" at 00000000-00002116-00000C17-806874925"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00002116-00000C17-807778711"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-816194195"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00006864-00000C17-817267023"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00006864-00000C17-817272879"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll\" at 00000000-00006864-00000C17-817781802"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006864-00000C17-818290822"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\share\" at 00000000-00006864-00000C17-818292671"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\share\" at 00000000-00006864-00000C17-818395166"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-819303475"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-819420618"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-819474835"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-819546993"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-819736887"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-819806280"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-819897614"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-820043527"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\Windows\\System32\\CatRoot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\" at 00000000-00006864-00000C17-820158593"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-39","type":6,"relevance":8,"name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00002116-00000C17-806779899\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006864-00000C17-818290822","description_v2":["\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00002116-00000C17-806779899","\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006864-00000C17-818290822"],"description_v3":[{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00002116-00000C17-806779899"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006864-00000C17-818290822"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":5,"name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-55","type":3,"relevance":10,"name":"Reads the registry for installed applications","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\UTIL.BAT\")","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\UTIL.BAT\")"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\UTIL.BAT\")"}],"origin":"Registry Access","attck_id":"T1518","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1518","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-174","type":3,"relevance":1,"name":"Tries to retrieve device driver information","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1652","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1652","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"External Systems","identifier":"suricata-0","type":18,"relevance":10,"name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\" (SID: 2033967, Rev: 2, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET HUNTING Telegram API Domain in DNS Lookup\" (SID: 2033966, Rev: 2, Severity: 3) categorized as \"Misc activity\"","description_v2":["Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","Detected alert \"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\" (SID: 2033967, Rev: 2, Severity: 3) categorized as \"Misc activity\"","Detected alert \"ET HUNTING Telegram API Domain in DNS Lookup\" (SID: 2033966, Rev: 2, Severity: 3) categorized as \"Misc activity\""],"description_v3":[{"type":"text","value":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\""},{"type":"linebreak"},{"type":"text","value":"Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\""},{"type":"linebreak"},{"type":"text","value":"Detected alert \"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\" (SID: 2033967, Rev: 2, Severity: 3) categorized as \"Misc activity\""},{"type":"linebreak"},{"type":"text","value":"Detected alert \"ET HUNTING Telegram API Domain in DNS Lookup\" (SID: 2033966, Rev: 2, Severity: 3) categorized as \"Misc activity\""}],"origin":"Suricata Alerts","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-18","type":3,"relevance":10,"name":"Accesses Software Policy Settings","description":"$39","description_v2":["\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\"; Key: \"\")","\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")"],"description_v3":[{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CRLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\CTLS\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-17","type":3,"relevance":10,"name":"Accesses System Certificates Settings","description":"$3a","description_v2":["\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\AUTOUPDATE\"; Key: \"DISALLOWEDCERTSYNCDELTATIME\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\104C63D2546B8021DD105E9FBA5A8D78169F6B32\"; Key: \"BLOB\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\247106A405B288A46E70A0262717162D0903E734\"; Key: \"BLOB\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\"; Key: \"BLOB\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\339CDD57CFD5B141169B615FF31428782D1DA639\"; Key: \"BLOB\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\4C27431717565A3A07F3E6D0032C4258949CF9EC\"; Key: \"BLOB\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D\"; Key: \"BLOB\")","\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7\"; Key: \"BLOB\")"],"description_v3":[{"type":"text","value":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\AUTOUPDATE\"; Key: \"DISALLOWEDCERTSYNCDELTATIME\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\104C63D2546B8021DD105E9FBA5A8D78169F6B32\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\247106A405B288A46E70A0262717162D0903E734\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\339CDD57CFD5B141169B615FF31428782D1DA639\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\4C27431717565A3A07F3E6D0032C4258949CF9EC\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D\"; Key: \"BLOB\")"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7\"; Key: \"BLOB\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-179","type":6,"relevance":1,"name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002116)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006864)","description_v2":["\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002116)","\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006864)"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006864)"}],"origin":"API Call","attck_id":"T1562.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-123","type":6,"relevance":3,"name":"Calls an API typically used to copy file from one location to another","description":"$3b","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CopyFileA\" to copy C:\\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe to new location %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CopyFileW\" to copy %LOCALAPPDATA%\\Google\\Chrome\\User Data\\default\\Login Data to new location chrome_Data.db (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CopyFileW\" to copy %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\default\\Login Data to new location edge_Data.db (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CopyFileW\" to copy %LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\History to new location chrome_history_temp.db (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CopyFileW\" to copy %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\History to new location edge_history_temp.db (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CopyFileW\" to copy %APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\places.sqlite to new location firefox_profile_temp.db (UID: 00000000-00005044)"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CopyFileA\" to copy C:\\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe to new location %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CopyFileW\" to copy %LOCALAPPDATA%\\Google\\Chrome\\User Data\\default\\Login Data to new location chrome_Data.db (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CopyFileW\" to copy %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\default\\Login Data to new location edge_Data.db (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CopyFileW\" to copy %LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\History to new location chrome_history_temp.db (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CopyFileW\" to copy %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\History to new location edge_history_temp.db (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CopyFileW\" to copy %APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\places.sqlite to new location firefox_profile_temp.db (UID: 00000000-00005044)"}],"origin":"API Call","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-122","type":6,"relevance":3,"name":"Calls an API typically used to create a directory","description":"$3c","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter C:\\Users (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\9ZUGU2u (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\runtime (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\runtime\\passwords (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\Runtime (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\Runtime\\history (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\runtime\\clipboard (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\Runtime (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\Runtime\\pic (UID: 00000000-00005044)"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter C:\\Users (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\9ZUGU2u (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Temp (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\runtime (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\runtime\\passwords (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\Runtime (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\Runtime\\history (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\runtime\\clipboard (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\Runtime (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\Runtime\\pic (UID: 00000000-00005044)"}],"origin":"API Call","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-128","type":6,"relevance":5,"name":"Calls an API typically used to create a process","description":"$3d","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c wmic diskdrive get model,serialnumber\" - (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_Keyboard get Description,DeviceID\" - (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID\" - (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" - (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c wmic get name\" - (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" - (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -Destin\" - (UID: 00000000-00005044), \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"\"C:\\util.bat\"\" - (UID: 00000000-00005044), \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic diskdrive get model","serialnumber\" - (UID: 00000000-00007612), \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic path Win32_Keyboard get Description","DeviceID\" - (UID: 00000000-00002092), \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic path Win32_PointingDevice get Description","PNPDeviceID\" - (UID: 00000000-00004448), \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic path Win32_PointingDevice get Description","PNPDeviceID\" - (UID: 00000000-00003012), \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic path Win32_DesktopMonitor get Description","PNPDeviceID\" - (UID: 00000000-00007884), \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic get name\" - (UID: 00000000-00002920), \"cmd.exe\" called \"CreateProcessW\" with parameter \"powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" - (UID: 00000000-00007200), \"cmd.exe\" called \"CreateProcessW\" with parameter \"powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -DestinationPath 'C:\\Users\\9ZUGU2u\\Ap\" - (UID: 00000000-00002124)","\"cmd.exe\" called \"CreateProcessW\" with parameter \"timeout /t 2 /nobreak\" - (UID: 00000000-00008036)"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c wmic diskdrive get model,serialnumber\" - (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_Keyboard get Description,DeviceID\" - (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID\" - (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" - (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c wmic get name\" - (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" - (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -Destin\" - (UID: 00000000-00005044), \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateProcessW\" with parameter \"\"C:\\util.bat\"\" - (UID: 00000000-00005044), \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic diskdrive get model"},{"type":"linebreak"},{"type":"text","value":"serialnumber\" - (UID: 00000000-00007612), \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic path Win32_Keyboard get Description"},{"type":"linebreak"},{"type":"text","value":"DeviceID\" - (UID: 00000000-00002092), \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic path Win32_PointingDevice get Description"},{"type":"linebreak"},{"type":"text","value":"PNPDeviceID\" - (UID: 00000000-00004448), \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic path Win32_PointingDevice get Description"},{"type":"linebreak"},{"type":"text","value":"PNPDeviceID\" - (UID: 00000000-00003012), \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic path Win32_DesktopMonitor get Description"},{"type":"linebreak"},{"type":"text","value":"PNPDeviceID\" - (UID: 00000000-00007884), \"cmd.exe\" called \"CreateProcessW\" with parameter \"wmic get name\" - (UID: 00000000-00002920), \"cmd.exe\" called \"CreateProcessW\" with parameter \"powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" - (UID: 00000000-00007200), \"cmd.exe\" called \"CreateProcessW\" with parameter \"powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -DestinationPath '%USERPROFILE%\\Ap\" - (UID: 00000000-00002124)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"CreateProcessW\" with parameter \"timeout /t 2 /nobreak\" - (UID: 00000000-00008036)"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-138","type":6,"relevance":3,"name":"Calls an API typically used to create an instance of a named pipe","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00005044)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133924137453095201.2116.DefaultAppDomain.powershell\" - (UID: 00000000-00002116)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133924138103163556.6864.DefaultAppDomain.powershell\" - (UID: 00000000-00006864)","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00005044)","\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133924137453095201.2116.DefaultAppDomain.powershell\" - (UID: 00000000-00002116)","\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133924138103163556.6864.DefaultAppDomain.powershell\" - (UID: 00000000-00006864)"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133924137453095201.2116.DefaultAppDomain.powershell\" - (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133924138103163556.6864.DefaultAppDomain.powershell\" - (UID: 00000000-00006864)"}],"origin":"API Call","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-175","type":6,"relevance":1,"name":"Calls an API typically used to load libraries","description":"$3e","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter secur32.dll (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter iphlpapi.dll (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005044)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007612)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007612)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007612)","\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007612)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007984)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007984)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007984)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007984)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00007984)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00007984)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002092)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002092)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002092)","\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00002092)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004104)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004104)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004104)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004104)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00004104)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00004104)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004448)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004448)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004448)","\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004448)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004276)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004276)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004276)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004276)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00004276)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00004276)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003012)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003012)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003012)","\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00003012)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000796)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000796)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000796)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00000796)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00000796)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00000796)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007884)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007884)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007884)","\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007884)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005688)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005688)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005688)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00005688)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00005688)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00005688)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002920)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002920)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002920)","\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00002920)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007968)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007968)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007968)","\"WMIC.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007968)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007200)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007200)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007200)","\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007200)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter SHLWAPI.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter VERSION.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter mscoree.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\combase.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter psapi.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter oleaut32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\b5ba37e1558ced178a99011a1d659b52\\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter OLEAUT32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\System.Management.Automation. (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter combase.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter version.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter wintrust.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\mscorrc.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en\\mscorrc.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\en-US\\tzres.dll.mui (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\7b1f35fb0c2d6955ce5af2bd372c65f2\\Microsoft.Management.Infrastr (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter CRYPT32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\b221af81285c1305324612e6dc9c88ff\\System.Management.ni.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\8ad4c0af5b3d51a0f3a4dac0d44d85d4\\System.DirectoryServices.ni.d (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\5ee35debfc22f727e70e4479ddcbc045\\System.Xml.ni.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\7bed49c46de9295a8453db205c60a028\\System.Data.ni.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\86cfd69ce1261baf4740e7606cade014\\System.Numerics.ni.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\7ff5199e757cb8af9ad949453f698d09\\Microsoft.PowerShell.Security (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\604272b0faec2e09d53d38e03bc89c6c\\System.Transactions.ni.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\System.Configuration.ni.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter secur32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter shlwapi.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wldp.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter wldp.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MPCLIENT.DLL (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MsMpLics.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\kernel32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter USERENV.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\d922445a828b30938c72d375a3b34a60\\Microsoft.PowerShell.Commands (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\120a0532577f871c2415502d9edacdd6\\System.Configuration.Install. (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll (UID: 00000000-00002116)","\"powershell.exe\" called \"LoadLibrary\" with a parameter bcrypt.dll (UID: 00000000-00002116)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002124)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002124)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002124)","\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00002124)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter SHLWAPI.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter VERSION.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter mscoree.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\combase.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter psapi.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter oleaut32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\b5ba37e1558ced178a99011a1d659b52\\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter OLEAUT32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\System.Management.Automation. (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter combase.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter version.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter wintrust.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\mscorrc.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en\\mscorrc.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter CRYPT32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\7b1f35fb0c2d6955ce5af2bd372c65f2\\Microsoft.Management.Infrastr (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\en-US\\tzres.dll.mui (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\b221af81285c1305324612e6dc9c88ff\\System.Management.ni.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\8ad4c0af5b3d51a0f3a4dac0d44d85d4\\System.DirectoryServices.ni.d (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\5ee35debfc22f727e70e4479ddcbc045\\System.Xml.ni.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\86cfd69ce1261baf4740e7606cade014\\System.Numerics.ni.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\7bed49c46de9295a8453db205c60a028\\System.Data.ni.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\7ff5199e757cb8af9ad949453f698d09\\Microsoft.PowerShell.Security (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\604272b0faec2e09d53d38e03bc89c6c\\System.Transactions.ni.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\System.Configuration.ni.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter secur32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter shlwapi.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wldp.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter wldp.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MPCLIENT.DLL (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MsMpLics.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\kernel32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter USERENV.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\df7d947a99cbcfaa726b127726f05476\\Microsoft.PowerShell.Commands (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\120a0532577f871c2415502d9edacdd6\\System.Configuration.Install. (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\d922445a828b30938c72d375a3b34a60\\Microsoft.PowerShell.Commands (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter KERNEL32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter GDI32.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1e72628c6f64bbea2f27e20f9f2cf3b4\\System.IO.Compression.ni.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\fa3056c0895561a08f7cf15a33efbbbd\\System.IO.Compression.FileSys (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clrcompression.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter oleaut32 (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll (UID: 00000000-00006864)","\"powershell.exe\" called \"LoadLibrary\" with a parameter bcrypt.dll (UID: 00000000-00006864)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008036)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008036)","\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008036)","\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00008036)"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter secur32.dll (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter iphlpapi.dll (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007612)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007612)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007612)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007612)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007984)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007984)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007984)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007984)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00007984)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00007984)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002092)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002092)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002092)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00002092)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004104)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004104)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004104)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004104)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00004104)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00004104)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004448)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004448)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004448)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004448)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004276)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004276)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004276)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00004276)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00004276)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00004276)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003012)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003012)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003012)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00003012)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000796)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000796)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000796)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00000796)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00000796)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00000796)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007884)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007884)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007884)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007884)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005688)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005688)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005688)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00005688)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00005688)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00005688)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002920)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002920)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002920)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00002920)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007968)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007968)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007968)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007968)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007200)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007200)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007200)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007200)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter SHLWAPI.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter VERSION.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter mscoree.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\combase.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter psapi.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter oleaut32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\b5ba37e1558ced178a99011a1d659b52\\Microsoft.PowerShell.ConsoleH (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter OLEAUT32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\System.Management.Automation. (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter combase.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter version.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter wintrust.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\mscorrc.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en\\mscorrc.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\en-US\\tzres.dll.mui (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\7b1f35fb0c2d6955ce5af2bd372c65f2\\Microsoft.Management.Infrastr (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter CRYPT32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\b221af81285c1305324612e6dc9c88ff\\System.Management.ni.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\8ad4c0af5b3d51a0f3a4dac0d44d85d4\\System.DirectoryServices.ni.d (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\5ee35debfc22f727e70e4479ddcbc045\\System.Xml.ni.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\7bed49c46de9295a8453db205c60a028\\System.Data.ni.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\86cfd69ce1261baf4740e7606cade014\\System.Numerics.ni.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\7ff5199e757cb8af9ad949453f698d09\\Microsoft.PowerShell.Security (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\604272b0faec2e09d53d38e03bc89c6c\\System.Transactions.ni.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\System.Configuration.ni.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter secur32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter shlwapi.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wldp.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter wldp.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MPCLIENT.DLL (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MsMpLics.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\kernel32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter USERENV.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\d922445a828b30938c72d375a3b34a60\\Microsoft.PowerShell.Commands (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\120a0532577f871c2415502d9edacdd6\\System.Configuration.Install. (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter bcrypt.dll (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002124)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002124)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002124)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00002124)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ADVAPI32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter SHLWAPI.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter VERSION.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter USER32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter mscoree.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\combase.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter psapi.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ole32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter oleaut32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pb378ec07#\\b5ba37e1558ced178a99011a1d659b52\\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter OLEAUT32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Manaa57fc8cc#\\6da01910c256231d1c50ad0aacee5941\\System.Management.Automation. (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter combase.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter advapi32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter ntdll.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter kernel32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter version.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter shell32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter wintrust.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter user32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\mscorrc.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en\\mscorrc.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter amsi.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\version.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter crypt32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter CRYPT32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Mf49f6405#\\7b1f35fb0c2d6955ce5af2bd372c65f2\\Microsoft.Management.Infrastr (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\en-US\\tzres.dll.mui (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\b221af81285c1305324612e6dc9c88ff\\System.Management.ni.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Dired13b18a9#\\8ad4c0af5b3d51a0f3a4dac0d44d85d4\\System.DirectoryServices.ni.d (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Xml\\5ee35debfc22f727e70e4479ddcbc045\\System.Xml.ni.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Numerics\\86cfd69ce1261baf4740e7606cade014\\System.Numerics.ni.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Data\\7bed49c46de9295a8453db205c60a028\\System.Data.ni.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P6f792626#\\7ff5199e757cb8af9ad949453f698d09\\Microsoft.PowerShell.Security (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Transactions\\604272b0faec2e09d53d38e03bc89c6c\\System.Transactions.ni.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Configuration\\4beb1eeca20b27d4bd1bb9880f03cc2a\\System.Configuration.ni.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter secur32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter shlwapi.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wldp.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter wldp.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MPCLIENT.DLL (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %ALLUSERSPROFILE%\\Microsoft\\Windows Defender\\platform\\4.12.17007.18022-0\\MsMpLics.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\kernel32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter USERENV.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\system32\\advapi32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\df7d947a99cbcfaa726b127726f05476\\Microsoft.PowerShell.Commands (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Confe64a9051#\\120a0532577f871c2415502d9edacdd6\\System.Configuration.Install. (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.Pae3498d9#\\d922445a828b30938c72d375a3b34a60\\Microsoft.PowerShell.Commands (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter KERNEL32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter GDI32.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cb3b124c8#\\1e72628c6f64bbea2f27e20f9f2cf3b4\\System.IO.Compression.ni.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.IO.Cf61e09c5#\\fa3056c0895561a08f7cf15a33efbbbd\\System.IO.Compression.FileSys (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clrcompression.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter oleaut32 (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter %WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"LoadLibrary\" with a parameter bcrypt.dll (UID: 00000000-00006864)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008036)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008036)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008036)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00008036)"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-176","type":6,"relevance":1,"name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","description_v2":["details too long to display"],"description_v3":[{"type":"text","value":"details too long to display"}],"origin":"API Call","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-1","type":7,"relevance":1,"name":"Contacts server","description":"\"149.154.167.220:443\"","description_v2":["\"149.154.167.220:443\""],"description_v3":[{"type":"text","value":"\"149.154.167.220:443\""}],"origin":"Network Traffic","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-7","type":2,"relevance":1,"name":"Contains PDB pathways","description":"\"C:\\Users\\sheepy\\source\\repos\\SHUYAL_telegram\\x64\\Release\\SHUYAL.pdb\"","description_v2":["\"C:\\Users\\sheepy\\source\\repos\\SHUYAL_telegram\\x64\\Release\\SHUYAL.pdb\""],"description_v3":[{"type":"text","value":"\"%USERPROFILE%\\source\\repos\\SHUYAL_telegram\\x64\\Release\\SHUYAL.pdb\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-16","type":2,"relevance":2,"name":"Contains SQL queries","description":"$3f","description_v2":["\"SELECT*FROM\"%w\".%s WHERE %s ORDER BY rowid\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"select*from\"%w\".%s where %s order by rowid\")","$40","name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update %q.sqlite_master set tbl_name = %q","name = case when type='table' then %q when name like 'sqlitex_autoindex%%' escape 'x' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q collate nocase and (type='table' or type='index' or type='trigger');\"), \"UPDATE \"%w\".sqlite_sequence set name = %Q WHERE name = %Q\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update \"%w\".sqlite_sequence set name = %q where name = %q\"), \"UPDATE sqlite_temp_schema SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, 1)","tbl_name = CASE WHEN tbl_name=%Q COLLATE nocase AND sqlite_rename_test(%Q, sql, type, name, 1, 'after rename', 0) THEN %Q ELSE tbl_name END WHERE type IN ('view', 'trigger')\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update sqlite_temp_schema set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, 1)","$41","idx","stat FROM %Q.sqlite_stat1\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"select tbl","idx","stat from %q.sqlite_stat1\"), \"CREATE TABLE\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"create table\"), \"UPDATE %Q.sqlite_master SET type='%s'","name=%Q","tbl_name=%Q","rootpage=#%d","sql=%Q WHERE rowid=#%d\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update %q.sqlite_master set type='%s'","name=%q","tbl_name=%q","rootpage=#%d","sql=%q where rowid=#%d\"), \"CREATE TABLE %Q.sqlite_sequence(name,seq)\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"create table %q.sqlite_sequence(name,seq)\"), \"SELECT*FROM\"%w\".\"%w\"\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"select*from\"%w\".\"%w\"\"), \"UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d\"), \"DELETE FROM %Q.sqlite_sequence WHERE name=%Q\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"delete from %q.sqlite_sequence where name=%q\"), \"DELETE FROM %Q.sqlite_master WHERE tbl_name=%Q and type!='trigger'\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"delete from %q.sqlite_master where tbl_name=%q and type!='trigger'\")"],"description_v3":[{"type":"text","value":"\"SELECT*FROM\"%w\".%s WHERE %s ORDER BY rowid\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"select*from\"%w\".%s where %s order by rowid\")"},{"type":"linebreak"},{"type":"text","value":"$42"},{"type":"linebreak"},{"type":"text","value":"name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update %q.sqlite_master set tbl_name = %q"},{"type":"linebreak"},{"type":"text","value":"name = case when type='table' then %q when name like 'sqlitex_autoindex%%' escape 'x' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q collate nocase and (type='table' or type='index' or type='trigger');\"), \"UPDATE \"%w\".sqlite_sequence set name = %Q WHERE name = %Q\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update \"%w\".sqlite_sequence set name = %q where name = %q\"), \"UPDATE sqlite_temp_schema SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, 1)"},{"type":"linebreak"},{"type":"text","value":"tbl_name = CASE WHEN tbl_name=%Q COLLATE nocase AND sqlite_rename_test(%Q, sql, type, name, 1, 'after rename', 0) THEN %Q ELSE tbl_name END WHERE type IN ('view', 'trigger')\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update sqlite_temp_schema set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, 1)"},{"type":"linebreak"},{"type":"text","value":"$43"},{"type":"linebreak"},{"type":"text","value":"idx"},{"type":"linebreak"},{"type":"text","value":"stat FROM %Q.sqlite_stat1\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"select tbl"},{"type":"linebreak"},{"type":"text","value":"idx"},{"type":"linebreak"},{"type":"text","value":"stat from %q.sqlite_stat1\"), \"CREATE TABLE\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"create table\"), \"UPDATE %Q.sqlite_master SET type='%s'"},{"type":"linebreak"},{"type":"text","value":"name=%Q"},{"type":"linebreak"},{"type":"text","value":"tbl_name=%Q"},{"type":"linebreak"},{"type":"text","value":"rootpage=#%d"},{"type":"linebreak"},{"type":"text","value":"sql=%Q WHERE rowid=#%d\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update %q.sqlite_master set type='%s'"},{"type":"linebreak"},{"type":"text","value":"name=%q"},{"type":"linebreak"},{"type":"text","value":"tbl_name=%q"},{"type":"linebreak"},{"type":"text","value":"rootpage=#%d"},{"type":"linebreak"},{"type":"text","value":"sql=%q where rowid=#%d\"), \"CREATE TABLE %Q.sqlite_sequence(name,seq)\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"create table %q.sqlite_sequence(name,seq)\"), \"SELECT*FROM\"%w\".\"%w\"\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"select*from\"%w\".\"%w\"\"), \"UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d\"), \"DELETE FROM %Q.sqlite_sequence WHERE name=%Q\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"delete from %q.sqlite_sequence where name=%q\"), \"DELETE FROM %Q.sqlite_master WHERE tbl_name=%Q and type!='trigger'\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"delete from %q.sqlite_master where tbl_name=%q and type!='trigger'\")"}],"origin":"File/Memory","attck_id":"T1213","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1213","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-348","type":2,"relevance":1,"name":"Contains ability to add modules to the current session (Powershell command string)","description":"Found string \"Import-Module\" (Indicator: \"Import-Module\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Import-Module\" (Indicator: \"Import-Module\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Import-Module\" (Indicator: \"Import-Module\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-296","type":2,"relevance":1,"name":"Contains ability to call WMI method (Powershell command string)","description":"Found string \"Invoke-WMIMethod\" (Indicator: \"Invoke-WmiMethod\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Invoke-WMIMethod\" (Indicator: \"Invoke-WmiMethod\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Invoke-WMIMethod\" (Indicator: \"Invoke-WmiMethod\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1047","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-204","type":2,"relevance":1,"name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-423","type":2,"relevance":1,"name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-307","type":2,"relevance":1,"name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-315","type":2,"relevance":1,"name":"Contains ability to create/open files (API string)","description":"$44","description_v2":["Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CreateFile2\" (Indicator: \"CreateFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CreateFileMappingFromApp\" (Indicator: \"CreateFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","file/memory contains long string with (Indicator: \"CreateFile\"; File: \"AMSI\")","Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"CreateFile2\" (Indicator: \"CreateFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"CreateFileMappingFromApp\" (Indicator: \"CreateFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFile2\" (Indicator: \"CreateFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingFromApp\" (Indicator: \"CreateFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"file/memory contains long string with (Indicator: \"CreateFile\"; File: \"AMSI\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFile2\" (Indicator: \"CreateFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingFromApp\" (Indicator: \"CreateFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"stream-103","type":1,"relevance":3,"name":"Contains ability to delay the execution of current thread","description":"WaitForMultipleObjects@KERNEL32.dll at 11021-8533-00000001403FDA70\n SleepEx@KERNEL32.dll at 11021-8729-00000001403E1730\n WaitForSingleObject@KERNEL32.dll at 11021-11055-00000001402503D0\n WaitForSingleObject@KERNEL32.dll at 11021-17717-00000001402506E0","description_v2":["WaitForMultipleObjects@KERNEL32.dll at 11021-8533-00000001403FDA70","SleepEx@KERNEL32.dll at 11021-8729-00000001403E1730","WaitForSingleObject@KERNEL32.dll at 11021-11055-00000001402503D0","WaitForSingleObject@KERNEL32.dll at 11021-17717-00000001402506E0"],"description_v3":[{"type":"text","value":"WaitForMultipleObjects@KERNEL32.dll"},{"type":"stream","stream_uid":"11021-8533-00000001403FDA70","modal_link":"/bff/report/682f1077421fe9a5d3046379/processes/00000000-00005044/streams/0/11021-8533-00000001403FDA70","process":null},{"type":"linebreak"},{"type":"text","value":"SleepEx@KERNEL32.dll at 11021-8729-00000001403E1730"},{"type":"linebreak"},{"type":"text","value":"WaitForSingleObject@KERNEL32.dll at 11021-11055-00000001402503D0"},{"type":"linebreak"},{"type":"text","value":"WaitForSingleObject@KERNEL32.dll"},{"type":"stream","stream_uid":"11021-17717-00000001402506E0","modal_link":"/bff/report/682f1077421fe9a5d3046379/processes/00000000-00005044/streams/0/11021-17717-00000001402506E0","process":null}],"origin":"Hybrid Analysis Technology","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":{"modal_link":"/bff/report/682f1077421fe9a5d3046379/processes/00000000-00005044/streams/0/11021-8533-00000001403FDA70","name":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe","pid":5044}},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-345","type":2,"relevance":1,"name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","description_v2":["Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1112","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-79","type":0,"relevance":1,"name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c)","description_v2":["Found GetProcAddress() and LoadLibraryA() in an import section (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c)"],"description_v3":[{"type":"text","value":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c)"}],"origin":"Static Parser","attck_id":"T1027.007","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027/007","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"stream-108","type":1,"relevance":3,"name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 11021-10951-0000000140260C30\n LoadLibraryW@KERNEL32.dll at 11021-19541-00000001402C1D42","description_v2":["LoadLibraryA@KERNEL32.dll at 11021-10951-0000000140260C30","LoadLibraryW@KERNEL32.dll at 11021-19541-00000001402C1D42"],"description_v3":[{"type":"text","value":"LoadLibraryA@KERNEL32.dll"},{"type":"stream","stream_uid":"11021-10951-0000000140260C30","modal_link":"/bff/report/682f1077421fe9a5d3046379/processes/00000000-00005044/streams/0/11021-10951-0000000140260C30","process":null},{"type":"linebreak"},{"type":"text","value":"LoadLibraryW@KERNEL32.dll"},{"type":"stream","stream_uid":"11021-19541-00000001402C1D42","modal_link":"/bff/report/682f1077421fe9a5d3046379/processes/00000000-00005044/streams/0/11021-19541-00000001402C1D42","process":null}],"origin":"Hybrid Analysis Technology","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":{"modal_link":"/bff/report/682f1077421fe9a5d3046379/processes/00000000-00005044/streams/0/11021-10951-0000000140260C30","name":"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe","pid":5044}},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-101","type":2,"relevance":1,"name":"Contains ability to execute Windows APIs","description":"$45","description_v2":["Found reference to API (Indicator: \"RegCloseKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptDecrypt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptCreateHash\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptSetHashParam\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"ReportEventW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptExportKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptHashData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptAcquireContextW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"RegSetValueExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptGenRandom\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptEncrypt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptGetUserKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"RegisterEventSourceW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptGetProvParam\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptImportKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptReleaseContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptSignHashW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptGetHashParam\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"RegCreateKeyExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptEnumProvidersW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptDestroyKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"DeregisterEventSource\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptDestroyHash\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CertOpenStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CertAddCertificateContextToStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CertFreeCertificateChainEngine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CertEnumCertificatesInStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CertGetNameStringW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CertGetCertificateContextProperty\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"PFXImportCertStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptStringToBinaryW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CertGetCertificateChain\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CertOpenSystemStoreW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptDecodeObjectEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptQueryObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptUnprotectData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CertFindCertificateInStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CertCreateCertificateChainEngine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CertFreeCertificateChain\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CertCloseStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CertFindExtension\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CertDuplicateCertificateContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CertFreeCertificateContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"BitBlt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreateCompatibleDC\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreateCompatibleBitmap\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"DeleteDC\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SelectObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"DeleteObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SystemTimeToFileTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetProcessHeap\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"LCMapStringEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"UnlockFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"HeapValidate\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetSystemDirectoryA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"LoadLibraryA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FindNextFileW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"TlsSetValue\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"OpenProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetEnvironmentVariableA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetCommandLineA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetFileSizeEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetSystemTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FlsSetValue\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FindClose\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"TlsAlloc\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"RtlPcToFileHeader\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetStartupInfoW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"HeapCreate\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetEnvironmentVariableW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetFileSize\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"DeleteFileW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"InitializeSListHead\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"MapViewOfFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"ReleaseSRWLockShared\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetStdHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"IsValidLocale\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"LocalFree\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetDateFormatW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"VerSetConditionMask\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"Process32NextW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SetConsoleCtrlHandler\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetEnvironmentStringsW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreateProcessW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"WaitForSingleObjectEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"HeapSize\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetLocaleInfoW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"WaitForMultipleObjects\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"OutputDebugStringA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SetConsoleMode\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"AreFileApisANSI\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"PeekNamedPipe\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CloseHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"LoadLibraryExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreateDirectoryA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"InitializeSRWLock\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetTempPathW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetCurrentDirectoryW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FindFirstFileExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetFileAttributesExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CopyFileA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"UnhandledExceptionFilter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetModuleFileNameA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"Sleep\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"RaiseException\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"MoveFileExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FlsFree\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"DeleteCriticalSection\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FlushFileBuffers\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"QueryPerformanceFrequency\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetUserDefaultLCID\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetTempPathA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"Process32FirstW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"ReadConsoleA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetExitCodeThread\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"ReadFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"IsDebuggerPresent\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"ReleaseSemaphore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SetFilePointer\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FindFirstFileW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetCPInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"EnumSystemLocalesW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"HeapFree\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"ExitProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CompareStringW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"DecodePointer\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GlobalLock\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"TerminateProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"InitializeCriticalSection\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"LoadLibraryW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"LCMapStringW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FlsAlloc\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"HeapDestroy\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"DuplicateHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FormatMessageW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"HeapReAlloc\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"EncodePointer\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"HeapCompact\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FormatMessageA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SetFileInformationByHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"RtlVirtualUnwind\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SystemTimeToTzSpecificLocalTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"ReadConsoleW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreateDirectoryW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FlsGetValue\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"VirtualProtect\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SetEndOfFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreateThread\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetFullPathNameW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"RtlCaptureContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetProcAddress\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetModuleFileNameW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetSystemInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"HeapAlloc\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"LockFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SetEnvironmentVariableW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"AcquireSRWLockExclusive\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"DeleteFileA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreateFileMappingW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FileTimeToSystemTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetFileInformationByHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreateMutexW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetTimeFormatW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"IsValidCodePage\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetDriveTypeW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreateSemaphoreA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"OutputDebugStringW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SetStdHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FreeLibraryAndExitThread\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreateToolhelp32Snapshot\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreateFileW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CompareStringEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetTimeZoneInformation\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetFileAttributesA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetDiskFreeSpaceW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"AcquireSRWLockShared\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetTickCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"WriteFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetStringTypeW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreatePipe\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CopyFileW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SleepEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"WriteConsoleW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetFullPathNameA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreateFileA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetExitCodeProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetConsoleOutputCP\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"TryEnterCriticalSection\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetDiskFreeSpaceA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetSystemDirectoryW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetLocaleInfoEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetModuleHandleA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetCommandLineW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"TlsGetValue\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FlushViewOfFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetACP\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetModuleHandleExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"TlsFree\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"UnlockFileEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"RtlUnwind\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"UnmapViewOfFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetConsoleMode\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"LockFileEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetOEMCP\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"VirtualFree\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetFileType\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"VerifyVersionInfoW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FreeLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GlobalUnlock\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"ExitThread\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"ShellExecuteA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SHGetFolderPathA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"SHGetSpecialFolderPathA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetClipboardData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"OpenClipboard\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"ReleaseDC\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"MessageBoxW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CloseClipboard\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetDC\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetSystemMetrics\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetUserObjectInformationW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetProcessWindowStation\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"inet_addr\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"gethostbyname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"WSASetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"getpeername\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"ntohs\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"getsockopt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"gethostname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"WSAStartup\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"getservbyname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"getsockname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"gethostbyaddr\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"WSAGetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"ioctlsocket\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"__WSAFDIsSet\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"WSACleanup\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"htonl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"closesocket\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"recvfrom\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"WSAIoctl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"getservbyport\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"htons\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"inet_ntoa\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"BCryptGenRandom\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CharLowerW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CharUpperW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreateFileMappingA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"FileTimeToLocalFileTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetVersionExA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetVersionExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreateEventExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CreateFile2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetTickCount64\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetNativeSystemInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"InterlockedCompareExchange\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"UuidCreate\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"UuidCreateSequential\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"Module32First\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"Module32Next\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"AddDllDirectory\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"RtlVerifyVersionInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"InitializeSecurityContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"QueryContextAttributes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"EncryptMessage\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"DecryptMessage\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"EnumSystemLocalesEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetDateFormatEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetTimeFormatEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"IsValidLocaleName\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"LCIDToLocaleName\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"LocaleNameToLCID\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptExportKey\"; Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found reference to API (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptImportKey\"; Source: \"00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"AreFileApisANSI\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CharLowerW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CharUpperW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateFileA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateFileMappingA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateFileMappingW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateMutexW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteFileA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteFileW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FlushFileBuffers\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FormatMessageA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FormatMessageW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetDiskFreeSpaceA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetDiskFreeSpaceW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileSize\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFullPathNameA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFullPathNameW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTempPathA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTempPathW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTickCount\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetVersionExA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetVersionExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapCreate\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapDestroy\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapReAlloc\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapSize\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapValidate\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapCompact\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadLibraryA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadLibraryW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"LocalFree\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"LockFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"LockFileEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"MapViewOfFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"MultiByteToWideChar\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"ReadFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SetEndOfFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SetFilePointer\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"UnlockFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"UnlockFileEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"UnmapViewOfFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"WideCharToMultiByte\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateEventExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SetFilePointerEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateFile2\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTickCount64\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"OutputDebugStringA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"OutputDebugStringW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"InterlockedCompareExchange\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"UuidCreate\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"UuidCreateSequential\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FlushViewOfFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"WSAStartup\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"Module32First\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"Module32Next\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadLibraryExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"AddDllDirectory\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlVerifyVersionInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"AcquireCredentialsHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeSecurityContext\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"QueryContextAttributes\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"EncryptMessage\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"DecryptMessage\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FlsAlloc\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FlsFree\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FlsGetValue\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FlsSetValue\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CompareStringEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"EnumSystemLocalesEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetDateFormatEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetLocaleInfoEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTimeFormatEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"IsValidLocaleName\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"LCMapStringEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"LCIDToLocaleName\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"LocaleNameToLCID\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GlobalLock\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GlobalUnlock\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleFileNameA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CopyFileA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetStdHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SetConsoleMode\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"OpenProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetConsoleMode\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"Process32NextW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"Process32FirstW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateDirectoryA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"RaiseException\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSection\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"TryEnterCriticalSection\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeSRWLock\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"ReleaseSRWLockShared\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"AcquireSRWLockExclusive\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"AcquireSRWLockShared\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"TlsAlloc\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"TlsGetValue\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"TlsSetValue\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"TlsFree\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"VirtualProtect\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"VirtualFree\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetEnvironmentVariableW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileType\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlVirtualUnwind\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"ReleaseSemaphore\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetExitCodeThread\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateSemaphoreA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemDirectoryA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetACP\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FindClose\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FindFirstFileW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FindNextFileW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"ReadConsoleA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"ReadConsoleW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetClipboardData\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CloseClipboard\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"OpenClipboard\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"MessageBoxW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"ReleaseDC\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetDC\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetUserObjectInformationW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteObject\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteDC\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SelectObject\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"BitBlt\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"RegSetValueExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"RegCreateKeyExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"RegCloseKey\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptAcquireContextW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptReleaseContext\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptDestroyKey\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptSetHashParam\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptGetProvParam\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptGetUserKey\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptExportKey\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptCreateHash\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptDestroyHash\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptSignHashW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptEnumProvidersW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"DeregisterEventSource\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"RegisterEventSourceW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"ReportEventW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptGenRandom\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SHGetFolderPathA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SHGetSpecialFolderPathA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"ShellExecuteA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"BCryptGenRandom\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CertOpenStore\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CertCloseStore\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CertEnumCertificatesInStore\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CertFindCertificateInStore\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CertDuplicateCertificateContext\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CertFreeCertificateContext\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CertGetCertificateContextProperty\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CertOpenSystemStoreW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptStringToBinaryW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"PFXImportCertStore\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptDecodeObjectEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CertAddCertificateContextToStore\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CertFindExtension\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CertGetNameStringW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptQueryObject\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CertCreateCertificateChainEngine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CertFreeCertificateChainEngine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CertGetCertificateChain\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CertFreeCertificateChain\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"WSAIoctl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemDirectoryW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SleepEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"MoveFileExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetEnvironmentVariableA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"VerifyVersionInfoW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileSizeEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentDirectoryW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateDirectoryW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FindFirstFileExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SetFileInformationByHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CopyFileW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"EncodePointer\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"DecodePointer\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCPInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetStringTypeW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetStartupInfoW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeSListHead\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlPcToFileHeader\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"DuplicateHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateProcessW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"ExitProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateThread\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"ExitThread\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FreeLibraryAndExitThread\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SetConsoleCtrlHandler\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SystemTimeToTzSpecificLocalTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetConsoleOutputCP\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetExitCodeProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CreatePipe\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetDateFormatW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTimeFormatW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CompareStringW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"LCMapStringW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetLocaleInfoW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"IsValidLocale\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"EnumSystemLocalesW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SetStdHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"IsValidCodePage\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetOEMCP\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCommandLineA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCommandLineW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"GetEnvironmentStringsW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"SetEnvironmentVariableW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"WriteConsoleW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptGetHashParam\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptHashData\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptEncrypt\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlUnwind\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API (Indicator: \"CryptEncrypt\"; Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found reference to API (Indicator: \"CryptImportKey\"; Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found reference to API (Indicator: \"InitializeConditionVariable\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"SleepConditionVariableCS\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"WakeAllConditionVariable\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"EventRegister\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"EventUnregister\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileVersionInfoSizeExW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileVersionInfoSizeW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileVersionInfoW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileVersionInfoExW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"VerQueryValueW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"RaiseException\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSection\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadLibraryExW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcessTimes\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetVersionExW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTickCount\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlVirtualUnwind\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleExW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"CoCreateInstance\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"CoTaskMemFree\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"StringFromGUID2\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileSizeEx\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetTempPathW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemDirectoryW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateEventW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"DisableThreadLibraryCalls\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"EncodePointer\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"DecodePointer\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"CoTaskMemAlloc\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"SizeofResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"LockResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"FindResourceW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API (Indicator: \"GetStartupInfoW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"FindFirstFileW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"RegQueryValueExW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"CoInitialize\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"CompareStringW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetStdHandle\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"ExpandEnvironmentStringsW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"CoUninitialize\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"SetThreadUILanguage\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"RegGetValueW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"RegOpenKeyExW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"FindClose\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"FormatMessageW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"LoadStringW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"WriteConsoleW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"LocalFree\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"CoInitializeEx\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"RegCloseKey\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"VerifyVersionInfoW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetFileType\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"SetConsoleTitleW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"IsWow64Process\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"SetEvent\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"ResetEvent\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"SearchPathW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"GetLocaleInfoW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"UnmapViewOfFile\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"FindResourceExW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"CreateFileMappingW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"MapViewOfFile\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"SetErrorMode\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API (Indicator: \"RegEnumKeyExW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API (Indicator: \"RegCloseKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDecrypt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptCreateHash\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptSetHashParam\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReportEventW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptExportKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptHashData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptAcquireContextW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegSetValueExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptGenRandom\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptEncrypt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptGetUserKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterEventSourceW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptGetProvParam\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptImportKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptReleaseContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptSignHashW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptGetHashParam\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCreateKeyExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptEnumProvidersW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDestroyKey\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeregisterEventSource\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDestroyHash\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertOpenStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertAddCertificateContextToStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFreeCertificateChainEngine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertEnumCertificatesInStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertGetNameStringW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertGetCertificateContextProperty\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PFXImportCertStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptStringToBinaryW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertGetCertificateChain\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertOpenSystemStoreW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDecodeObjectEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptQueryObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptUnprotectData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFindCertificateInStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertCreateCertificateChainEngine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFreeCertificateChain\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertCloseStore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFindExtension\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertDuplicateCertificateContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFreeCertificateContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"BitBlt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateCompatibleDC\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateCompatibleBitmap\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteDC\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SelectObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemTimeToFileTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessHeap\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnlockFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapValidate\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemDirectoryA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindNextFileW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsSetValue\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentVariableA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSizeEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsSetValue\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindClose\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsAlloc\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlPcToFileHeader\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStartupInfoW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapCreate\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentVariableW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSize\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSListHead\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MapViewOfFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseSRWLockShared\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStdHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidLocale\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocalFree\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDateFormatW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerSetConditionMask\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Process32NextW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetConsoleCtrlHandler\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentStringsW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateProcessW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObjectEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapSize\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForMultipleObjects\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OutputDebugStringA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetConsoleMode\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AreFileApisANSI\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PeekNamedPipe\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MultiByteToWideChar\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSRWLock\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceCounter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentDirectoryW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyFileA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhandledExceptionFilter\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RaiseException\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MoveFileExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsFree\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteCriticalSection\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushFileBuffers\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceFrequency\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLCID\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Process32FirstW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadConsoleA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeThread\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsDebuggerPresent\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseSemaphore\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointer\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCPInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumSystemLocalesW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapFree\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DecodePointer\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalLock\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WideCharToMultiByte\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSection\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LeaveCriticalSection\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsAlloc\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapDestroy\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DuplicateHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FormatMessageW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapReAlloc\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EncodePointer\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapCompact\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FormatMessageA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileInformationByHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlVirtualUnwind\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemTimeToTzSpecificLocalTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadConsoleW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObject\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsGetValue\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualProtect\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEndOfFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThread\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFullPathNameW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlCaptureContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapAlloc\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnterCriticalSection\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LockFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEnvironmentVariableW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AcquireSRWLockExclusive\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileMappingW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FileTimeToSystemTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileInformationByHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessId\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateMutexW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeFormatW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidCodePage\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDriveTypeW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateSemaphoreA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OutputDebugStringW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThreadId\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetStdHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibraryAndExitThread\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateToolhelp32Snapshot\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeZoneInformation\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDiskFreeSpaceW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AcquireSRWLockShared\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStringTypeW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreatePipe\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyFileW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteConsoleW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFullPathNameA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleOutputCP\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TryEnterCriticalSection\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDiskFreeSpaceA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemDirectoryW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsGetValue\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushViewOfFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetACP\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsFree\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnlockFileEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlUnwind\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnmapViewOfFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleMode\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LockFileEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetOEMCP\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointerEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualFree\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileType\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerifyVersionInfoW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalUnlock\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitThread\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShellExecuteA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHGetFolderPathA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHGetSpecialFolderPathA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetClipboardData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenClipboard\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseDC\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBoxW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseClipboard\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDC\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemMetrics\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserObjectInformationW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessWindowStation\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"inet_addr\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"gethostbyname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSASetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getpeername\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ntohs\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getsockopt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"gethostname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAStartup\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getservbyname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getsockname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"gethostbyaddr\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAGetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ioctlsocket\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"__WSAFDIsSet\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSACleanup\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"htonl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"closesocket\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"recvfrom\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAIoctl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"getservbyport\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"htons\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"inet_ntoa\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"BCryptGenRandom\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CharLowerW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CharUpperW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileMappingA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FileTimeToLocalFileTime\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetVersionExA\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetVersionExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventExW\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFile2\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount64\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetNativeSystemInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedCompareExchange\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UuidCreate\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UuidCreateSequential\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Module32First\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Module32Next\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AddDllDirectory\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlVerifyVersionInfo\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSecurityContext\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryContextAttributes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EncryptMessage\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DecryptMessage\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumSystemLocalesEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDateFormatEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeFormatEx\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidLocaleName\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCIDToLocaleName\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocaleNameToLCID\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptExportKey\"; Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptImportKey\"; Source: \"00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp, 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AreFileApisANSI\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CharLowerW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CharUpperW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileMappingA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileMappingW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateMutexW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteFileW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushFileBuffers\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FormatMessageA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FormatMessageW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDiskFreeSpaceA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDiskFreeSpaceW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSize\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFullPathNameA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFullPathNameW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetVersionExA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetVersionExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapCreate\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapDestroy\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapReAlloc\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapSize\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapValidate\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapCompact\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocalFree\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LockFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LockFileEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MapViewOfFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MultiByteToWideChar\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEndOfFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointer\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnlockFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnlockFileEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnmapViewOfFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WideCharToMultiByte\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFilePointerEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileInformationByHandleEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFile2\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount64\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OutputDebugStringA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OutputDebugStringW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InterlockedCompareExchange\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UuidCreate\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UuidCreateSequential\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlushViewOfFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAStartup\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Module32First\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Module32Next\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AddDllDirectory\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlVerifyVersionInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AcquireCredentialsHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSecurityContext\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryContextAttributes\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EncryptMessage\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DecryptMessage\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsAlloc\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsFree\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsGetValue\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FlsSetValue\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumSystemLocalesEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDateFormatEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeFormatEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidLocaleName\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCIDToLocaleName\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocaleNameToLCID\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalLock\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GlobalUnlock\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyFileA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStdHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetConsoleMode\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleMode\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Process32NextW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Process32FirstW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RaiseException\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSection\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TryEnterCriticalSection\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSRWLock\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseSRWLockExclusive\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseSRWLockShared\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AcquireSRWLockExclusive\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"AcquireSRWLockShared\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsAlloc\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsGetValue\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsSetValue\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TlsFree\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualProtect\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VirtualFree\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentVariableW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileType\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlVirtualUnwind\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseSemaphore\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeThread\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateSemaphoreA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemDirectoryA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetACP\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindClose\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindNextFileW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadConsoleA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReadConsoleW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetClipboardData\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseClipboard\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"OpenClipboard\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MessageBoxW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReleaseDC\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDC\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserObjectInformationW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteObject\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteDC\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SelectObject\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"BitBlt\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegSetValueExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCreateKeyExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCloseKey\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptAcquireContextW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptReleaseContext\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDestroyKey\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptSetHashParam\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptGetProvParam\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptGetUserKey\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptExportKey\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDecrypt\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptCreateHash\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDestroyHash\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptSignHashW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptEnumProvidersW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeregisterEventSource\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegisterEventSourceW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ReportEventW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptGenRandom\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHGetFolderPathA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SHGetSpecialFolderPathA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ShellExecuteA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"BCryptGenRandom\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertOpenStore\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertCloseStore\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertEnumCertificatesInStore\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFindCertificateInStore\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertDuplicateCertificateContext\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFreeCertificateContext\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertGetCertificateContextProperty\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertOpenSystemStoreW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptStringToBinaryW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PFXImportCertStore\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptDecodeObjectEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertAddCertificateContextToStore\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFindExtension\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertGetNameStringW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptQueryObject\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertCreateCertificateChainEngine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFreeCertificateChainEngine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertGetCertificateChain\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CertFreeCertificateChain\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WSAIoctl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemDirectoryW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MoveFileExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentVariableA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerifyVersionInfoW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSizeEx\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentDirectoryW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateDirectoryW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileExW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetFileInformationByHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CopyFileW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EncodePointer\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DecodePointer\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCPInfo\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStringTypeW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStartupInfoW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeSListHead\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlPcToFileHeader\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DuplicateHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateProcessW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateThread\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExitThread\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibraryAndExitThread\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetConsoleCtrlHandler\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SystemTimeToTzSpecificLocalTime\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetConsoleOutputCP\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetExitCodeProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreatePipe\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetDateFormatW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeFormatW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LCMapStringW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidLocale\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnumSystemLocalesW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetStdHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsValidCodePage\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetOEMCP\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineA\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCommandLineW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetEnvironmentStringsW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeEnvironmentStringsW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEnvironmentVariableW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteConsoleW\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptGetHashParam\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptHashData\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptEncrypt\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlUnwind\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptEncrypt\"; Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CryptImportKey\"; Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeConditionVariable\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SleepConditionVariableCS\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WakeAllConditionVariable\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EventRegister\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EventUnregister\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileVersionInfoSizeExW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileVersionInfoSizeW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileVersionInfoW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileVersionInfoExW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerQueryValueW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimePreciseAsFileTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DeleteCriticalSection\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RaiseException\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSection\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EnterCriticalSection\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LeaveCriticalSection\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CloseHandle\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadLibraryExW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FreeLibrary\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcessId\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessTimes\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLastError\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"Sleep\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetVersionExW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentThreadId\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTickCount\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlCaptureContext\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlLookupFunctionEntry\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlVirtualUnwind\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnhandledExceptionFilter\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"TerminateProcess\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleExW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcAddress\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoCreateInstance\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoTaskMemFree\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"StringFromGUID2\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"InitializeCriticalSectionAndSpinCount\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileSizeEx\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetLastError\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteFile\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleFileNameW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetTempPathW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileAttributesW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemDirectoryW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateEventW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetModuleHandleW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DisableThreadLibraryCalls\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"EncodePointer\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"DecodePointer\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsDebuggerPresent\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsProcessorFeaturePresent\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoTaskMemAlloc\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SizeofResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LockResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindResourceW\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapFree\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"HeapAlloc\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStartupInfoW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindFirstFileW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegQueryValueExW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoInitialize\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CompareStringW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetStdHandle\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ExpandEnvironmentStringsW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoUninitialize\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetThreadUILanguage\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegGetValueW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegOpenKeyExW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindClose\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FormatMessageW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LoadStringW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WriteConsoleW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"LocalFree\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CoInitializeEx\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegCloseKey\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"VerifyVersionInfoW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetFileType\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetConsoleTitleW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"IsWow64Process\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetEvent\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"ResetEvent\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SearchPathW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"GetLocaleInfoW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"UnmapViewOfFile\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"FindResourceExW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"CreateFileMappingW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"MapViewOfFile\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"SetErrorMode\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API (Indicator: \"RegEnumKeyExW\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-240","type":2,"relevance":1,"name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-174","type":2,"relevance":1,"name":"Contains ability to executes commands or batch file","description":"$46","description_v2":["Found string \"%WINDIR%\\system32\\cmd.exe /c wmic diskdrive get model,serialnumber\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044-00000C46-2412053458\")","Found string \"%WINDIR%\\system32\\cmd.exe /c wmic diskdrive get model,serialnumber\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044-00000C46-2412053458\")","Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_Keyboard get Description,DeviceID\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044-00000C46-16681831658\")","Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_Keyboard get Description,DeviceID\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044-00000C46-16681831658\")","Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044-00000C46-31025008696\")","Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044-00000C46-31025008696\")","Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044-00000C46-59868927018\")","Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044-00000C46-59868927018\")","Found string \"%WINDIR%\\system32\\cmd.exe /c wmic get name\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044-00000C46-74155484504\")","Found string \"%WINDIR%\\system32\\cmd.exe /c wmic get name\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044-00000C46-74155484504\")","Found string \"%WINDIR%\\system32\\cmd.exe /c powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044-00000C46-88337136890\")","Found string \"%WINDIR%\\system32\\cmd.exe /c powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044-00000C46-88337136890\")","Found string \"%WINDIR%\\system32\\cmd.exe /c powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -Destin\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044-00000C46-115678154006\"), Found string \"%WINDIR%\\system32\\cmd.exe /c powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -Destin\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044-00000C46-115678154006\")","Found string \"C:\\WINDOWS\\system32\\cmd.exe /c wmic diskdrive get model,serialnumber\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp\")","Found string \"C:\\WINDOWS\\system32\\cmd.exe /c wmic diskdrive get model,serialnumber\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp\")","Found string \":\\WINDOWS\\system32\\cmd.exe /c wmic get name\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")","Found string \":\\WINDOWS\\system32\\cmd.exe /c wmic get name\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")","Found string \"C:\\WINDOWS\\system32\\cmd.exe /c wmic get name\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")","Found string \"C:\\WINDOWS\\system32\\cmd.exe /c wmic get name\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")","Found string \"C:\\WINDOWS\\system32\\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")","Found string \"C:\\WINDOWS\\system32\\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")","Found string \"C:\\WINDOWS\\system32\\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")","Found string \"C:\\WINDOWS\\system32\\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c wmic diskdrive get model,serialnumber\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044-00000C46-2412053458\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c wmic diskdrive get model,serialnumber\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044-00000C46-2412053458\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_Keyboard get Description,DeviceID\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044-00000C46-16681831658\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_Keyboard get Description,DeviceID\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044-00000C46-16681831658\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044-00000C46-31025008696\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044-00000C46-31025008696\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044-00000C46-59868927018\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044-00000C46-59868927018\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c wmic get name\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044-00000C46-74155484504\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c wmic get name\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044-00000C46-74155484504\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044-00000C46-88337136890\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044-00000C46-88337136890\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -Destin\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044-00000C46-115678154006\"), Found string \"%WINDIR%\\system32\\cmd.exe /c powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -Destin\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044-00000C46-115678154006\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c wmic diskdrive get model,serialnumber\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"C:\\WINDOWS\\system32\\cmd.exe /c wmic diskdrive get model,serialnumber\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\system32\\cmd.exe /c wmic get name\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \":\\WINDOWS\\system32\\cmd.exe /c wmic get name\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"C:\\WINDOWS\\system32\\cmd.exe /c wmic get name\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"C:\\WINDOWS\\system32\\cmd.exe /c wmic get name\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"C:\\WINDOWS\\system32\\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"C:\\WINDOWS\\system32\\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"C:\\WINDOWS\\system32\\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"C:\\WINDOWS\\system32\\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-550","type":2,"relevance":1,"name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","description_v2":["Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-322","type":2,"relevance":1,"name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-206","type":2,"relevance":1,"name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-161","type":2,"relevance":1,"name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-272","type":2,"relevance":1,"name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","description_v2":["Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-287","type":2,"relevance":1,"name":"Contains ability to run commands (Powershell command string)","description":"Found string \"Invoke-Command\" (Indicator: \"Invoke-Command\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Invoke-Command\" (Indicator: \"Invoke-Command\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Invoke-Command\" (Indicator: \"Invoke-Command\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-288","type":2,"relevance":1,"name":"Contains ability to run commands or expressions (Powershell command string)","description":"Found string \"Invoke-Expression\" (Indicator: \"Invoke-Expression\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Invoke-Expression\" (Indicator: \"Invoke-Expression\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Invoke-Expression\" (Indicator: \"Invoke-Expression\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-319","type":2,"relevance":1,"name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$47","description_v2":["Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-208","type":2,"relevance":1,"name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"[Parameter(ParameterSetName='ShowWindow', Mandatory=$true)]\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")\n Found reference to API \"${ShowWindow})\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found reference to API \"[Parameter(ParameterSetName='ShowWindow', Mandatory=$true)]\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found reference to API \"${ShowWindow})\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"[Parameter(ParameterSetName='ShowWindow', Mandatory=$true)]\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"${ShowWindow})\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1564.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1564/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-250","type":2,"relevance":1,"name":"Contains ability to start a process (Powershell command string)","description":"Found string \"Start-Process\" (Indicator: \"Start-Process\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Start-Process\" (Indicator: \"Start-Process\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Start-Process\" (Indicator: \"Start-Process\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-332","type":2,"relevance":1,"name":"Contains ability to start services (Powershell command string)","description":"Found string \"Start-Service\" (Indicator: \"Start-Service\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Start-Service\" (Indicator: \"Start-Service\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Start-Service\" (Indicator: \"Start-Service\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1569.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1569/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-265","type":2,"relevance":1,"name":"Contains reference to Windows Startup folder","description":"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe\" (Indicator: \"%appdata%\\microsoft\\windows\\start menu\\programs\\startup\\svchost.exe\") in Source: 00000000-00005044-00000C3B-112939186840\n \"/c \"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\util.bat\" \"\" (Indicator: \"/c \"\"%appdata%\\microsoft\\windows\\start menu\\programs\\startup\\util.bat\" \"\") in Source: cmd.exe","description_v2":["\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe\" (Indicator: \"%appdata%\\microsoft\\windows\\start menu\\programs\\startup\\svchost.exe\") in Source: 00000000-00005044-00000C3B-112939186840","\"/c \"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\util.bat\" \"\" (Indicator: \"/c \"\"%appdata%\\microsoft\\windows\\start menu\\programs\\startup\\util.bat\" \"\") in Source: cmd.exe"],"description_v3":[{"type":"text","value":"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe\" (Indicator: \"%appdata%\\microsoft\\windows\\start menu\\programs\\startup\\svchost.exe\") in Source: 00000000-00005044-00000C3B-112939186840"},{"type":"linebreak"},{"type":"text","value":"\"/c \"\"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\util.bat\" \"\" (Indicator: \"/c \"\"%appdata%\\microsoft\\windows\\start menu\\programs\\startup\\util.bat\" \"\") in Source: cmd.exe"}],"origin":"File/Memory","attck_id":"T1547.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1547/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-120","type":2,"relevance":1,"name":"Contains registry location strings","description":"$48","description_v2":["\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c","\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00002116.00000000.115026.14E70000.00000004.mdmp","\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00002116.00000000.115026.14E70000.00000004.mdmp","\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00002116.00000000.115026.17190000.00000004.mdmp","\"System\\CurrentControlSet\\Control\\Nls\\RegionMapping\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","\"SOFTWARE\\Microsoft\\.NETFramework\\AppContext\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","\"System\\CurrentControlSet\\Control\\MiniNT\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","\"Software\\Microsoft\\PowerShell\\\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\WSMAN\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WSMAN\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","\"Software\\Microsoft\\PowerShell\\3\\PowerShellEngine\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PowerShell\\3\\PowerShellEngine\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Windows\\PowerShell\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","\"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","\"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","\"Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","\"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","\"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp","\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp","\"y\\Machine\\Software\\Classes\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp","\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp","\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp","\"SOFTWARE\\Microsoft\\PowerShell\\%1!ls!\\PowerShellEngine\" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp","\"SOFTWARE\\Microsoft\\PowerShell\" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp","\"SOFTWARE\\Microsoft\\PowerShell\\%1!ls!\" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp","\"SYSTEM\\CurrentControlSet\\Control\\MiniNT\" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp","\"SOFTWARE\\Microsoft\\PowerShell\\3\" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp","\"Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}\" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp"],"description_v3":[{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c"},{"type":"linebreak"},{"type":"text","value":"\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00002116.00000000.115026.14E70000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00002116.00000000.115026.14E70000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00002116.00000000.115026.17190000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\Nls\\RegionMapping\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\.NETFramework\\AppContext\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"System\\CurrentControlSet\\Control\\MiniNT\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\PowerShell\\\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\WSMAN\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WSMAN\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\PowerShell\\3\\PowerShellEngine\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PowerShell\\3\\PowerShellEngine\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\PowerShell\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription\" in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\" in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"\\REGISTRY\\USER\\S-1-5-21-735145574-\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"y\\Machine\\Software\\Classes\\CLSID\\{00000323-0000-0000-C000-000000000046}\" in Source: 00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o enable assembly bind failure logging, set the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog] (DWORD) to 1.\" in Source: 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"o turn this feature off, remove the registry value [HKLM\\Software\\Microsoft\\Fusion!EnableLog].\" in Source: 00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\PowerShell\\%1!ls!\\PowerShellEngine\" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\PowerShell\" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\PowerShell\\%1!ls!\" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SYSTEM\\CurrentControlSet\\Control\\MiniNT\" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"SOFTWARE\\Microsoft\\PowerShell\\3\" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}\" in Source: 00000000-00006864.00000000.115762.B822A000.00000002.mdmp"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5044:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:5044:120:WilError_01\"\n \"\\BaseNamedObjects\\SyncRootManager\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5044:120:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\SM0:5044:120:WilError_01\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\SM0:5044:304:WilStaging_02\"\n \"SM0:5044:120:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:7984:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7984:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7984:120:WilError_01\"\n \"Local\\SM0:7984:304:WilStaging_02\"","description_v2":["\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5044:304:WilStaging_02\"","\"\\Sessions\\1\\BaseNamedObjects\\SM0:5044:120:WilError_01\"","\"\\BaseNamedObjects\\SyncRootManager\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5044:120:WilError_01\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","\"Local\\ZonesLockedCacheCounterMutex\"","\"Local\\SM0:5044:120:WilError_01\"","\"Local\\ZonesCacheCounterMutex\"","\"Local\\SM0:5044:304:WilStaging_02\"","\"SM0:5044:120:WilError_01\"","\"\\Sessions\\1\\BaseNamedObjects\\SM0:7984:304:WilStaging_02\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7984:304:WilStaging_02\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7984:120:WilError_01\"","\"Local\\SM0:7984:304:WilStaging_02\""],"description_v3":[{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5044:304:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:5044:120:WilError_01\""},{"type":"linebreak"},{"type":"text","value":"\"\\BaseNamedObjects\\SyncRootManager\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5044:120:WilError_01\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\SM0:5044:120:WilError_01\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\SM0:5044:304:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"\"SM0:5044:120:WilError_01\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\SM0:7984:304:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7984:304:WilStaging_02\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7984:120:WilError_01\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\SM0:7984:304:WilStaging_02\""}],"origin":"Created Mutant","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-486","type":9,"relevance":1,"name":"Executes Powershell command strings","description":"Process \"powershell.exe\" with commandline \"powershell -Command \"Compress-Archive -Path '%TEMP%\\\\runtime\\\\*' -DestinationPath '%TEMP%\\\\runtime.zip' -Force\"\" (UID: 00000000-00006864)\n Process \"powershell.exe\" with commandline \"powershell -Command \"Compress-Archive -Path '%TEMP%\\\\runtime\\\\*' -DestinationPath '%TEMP%\\\\runtime.zip' -Force\"\" (UID: 00000000-00007088)","description_v2":["Process \"powershell.exe\" with commandline \"powershell -Command \"Compress-Archive -Path '%TEMP%\\\\runtime\\\\*' -DestinationPath '%TEMP%\\\\runtime.zip' -Force\"\" (UID: 00000000-00006864)","Process \"powershell.exe\" with commandline \"powershell -Command \"Compress-Archive -Path '%TEMP%\\\\runtime\\\\*' -DestinationPath '%TEMP%\\\\runtime.zip' -Force\"\" (UID: 00000000-00007088)"],"description_v3":[{"type":"text","value":"Process \"powershell.exe\" with commandline \"powershell -Command \"Compress-Archive -Path '%TEMP%\\\\runtime\\\\*' -DestinationPath '%TEMP%\\\\runtime.zip' -Force\"\""},{"type":"process","process_uid":"00000000-00006864","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"powershell.exe\" with commandline \"powershell -Command \"Compress-Archive -Path '%TEMP%\\\\runtime\\\\*' -DestinationPath '%TEMP%\\\\runtime.zip' -Force\"\""},{"type":"process","process_uid":"00000000-00007088","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1059.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-220","type":9,"relevance":3,"name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\util.bat\" \"\" (UID: 00000000-00008036)\n Process \"cmd.exe\" with commandline \"/c \"\"%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\util.bat\" \"\" (UID: 00000000-00008116)","description_v2":["Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\util.bat\" \"\" (UID: 00000000-00008036)","Process \"cmd.exe\" with commandline \"/c \"\"%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\util.bat\" \"\" (UID: 00000000-00008116)"],"description_v3":[{"type":"text","value":"Process \"cmd.exe\" with commandline \"/c \"\"C:\\\\util.bat\" \"\""},{"type":"process","process_uid":"00000000-00008036","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\" with commandline \"/c \"\"%APPDATA%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\util.bat\" \"\""},{"type":"process","process_uid":"00000000-00008116","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1059","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-22","type":6,"relevance":1,"name":"Fails to load modules at runtime","description":"$49","description_v2":["\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wldp.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll\" - [base:0; Status:ffffffffc0000135]","\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\" - [base:0; Status:ffffffffc0000135]"],"description_v3":[{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\secur32.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\shlwapi.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wldp.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll\" - [base:0; Status:ffffffffc0000135]"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" failed to load missing module \"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\bcrypt.dll\" - [base:0; Status:ffffffffc0000135]"}],"origin":"API Call","attck_id":"T1574.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1574/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-154","type":0,"relevance":0,"name":"File contains dynamic base/NX flags","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE","IMAGE_DLLCHARACTERISTICS_NX_COMPAT","IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_NX_COMPAT"},{"type":"linebreak"},{"type":"text","value":"IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-146","type":2,"relevance":1,"name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.133924137453095201.2116.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.133924138103163556.6864.DefaultAppDomain.powershell","description_v2":["Found string - \\\\.\\pipe\\PSHost.133924137453095201.2116.DefaultAppDomain.powershell","Found string - \\\\.\\pipe\\PSHost.133924138103163556.6864.DefaultAppDomain.powershell"],"description_v3":[{"type":"text","value":"Found string - \\\\.\\pipe\\PSHost.133924137453095201.2116.DefaultAppDomain.powershell"},{"type":"linebreak"},{"type":"text","value":"Found string - \\\\.\\pipe\\PSHost.133924138103163556.6864.DefaultAppDomain.powershell"}],"origin":"File/Memory","attck_id":"T1559","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1559","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-127","type":2,"relevance":1,"name":"Found user-agent related strings","description":"Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-7","type":6,"relevance":1,"name":"Loads modules at runtime","description":"$4a","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ffc75e20000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ffc75e20000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ffc75e20000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"KERNEL32\" at base 7ffc78ca0000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffc4ee20000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-2\" at base 7ffc75e20000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 7ffc75e20000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 7ffc75e20000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 7ffc75e20000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"NTDLL.DLL\" at base 7ffc78f00000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"KERNEL32.DLL\" at base 7ffc78ca0000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"RPCRT4.DLL\" at base 7ffc776e0000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 7ffc73890000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\WINSXS\\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\\GDIPLUS.DLL\" at base 7ffc553f0000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"WINDOWSCODECS.DLL\" at base 7ffc710b0000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"SECUR32.DLL\" at base 7ffc6b790000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"IPHLPAPI.DLL\" at base 7ffc74860000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 7ffc75370000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSWSOCK.DLL\" at base 7ffc74ae0000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-2\" at base 7ffc75250000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RASADHLP.DLL\" at base 7ffc6cda0000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\FWPUCLNT.DLL\" at base 7ffc6d3c0000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"SSPICLI.DLL\" at base 7ffc75180000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\SCHANNEL.DLL\" at base 7ffc745d0000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\PROPSYS.DLL\" at base 7ffc71650000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"SHELL32.DLL\" at base 7ffc77800000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\\\WINDOWS.STATEREPOSITORYPS.DLL\" at base 7ffc60150000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\SHELL32.DLL\" at base 7ffc77800000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"USER32.DLL\" at base 7ffc773b0000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\URLMON.DLL\" at base 7ffc69c30000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"MSISO.DLL\" at base 7ffc63ae0000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-URL-L1-1-0.DLL\" at base 7ffc75e20000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINDOWS.STORAGE.DLL\" at base 7ffc753f0000","\"cmd.exe\" loaded module \"KERNEL32\" at base 7ffc78ca0000","\"cmd.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 7ffc75e20000","\"cmd.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 7ffc75e20000","\"cmd.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 7ffc75e20000","\"cmd.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 7ffc78e40000","\"cmd.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ffc75e20000","\"cmd.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ffc75e20000","\"cmd.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ffc75e20000","\"cmd.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffc4ee20000","\"cmd.exe\" loaded module \"KERNEL32.DLL\" at base 7ffc78ca0000","\"cmd.exe\" loaded module \"NTDLL.DLL\" at base 7ffc78f00000","\"WMIC.exe\" loaded module \"KERNEL32\" at base 7ffc78ca0000","\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 7ffc75e20000","\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 7ffc75e20000","\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 7ffc75e20000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 7ffc78e40000","\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ffc75e20000","\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ffc75e20000","\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ffc75e20000","\"WMIC.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffc4ee20000","\"WMIC.exe\" loaded module \"RPCRT4.DLL\" at base 7ffc776e0000","\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL\" at base 7ffc75e20000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\WBEMPROX.DLL\" at base 7ffc6a5b0000","\"WMIC.exe\" loaded module \"SSPICLI.DLL\" at base 7ffc75180000","\"WMIC.exe\" loaded module \"KERNEL32.DLL\" at base 7ffc78ca0000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSXML6.DLL\" at base 7ffc64770000","\"WMIC.exe\" loaded module \"USER32.DLL\" at base 7ffc773b0000","\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-URL-L1-1-0.DLL\" at base 7ffc75e20000","\"WMIC.exe\" loaded module \"MSISO.DLL\" at base 7ffc63ae0000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 7ffc73890000","\"WMIC.exe\" loaded module \"%COMMONPROGRAMFILES%\\MICROSOFT SHARED\\OFFICE14\\MSOXMLMF.DLL\" at base 7ffc62310000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\WBEMSVC.DLL\" at base 7ffc68d70000","\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL\" at base 7ffc75e20000","\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL\" at base 7ffc75e20000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\FASTPROX.DLL\" at base 7ffc685c0000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\WMIUTILS.DLL\" at base 7ffc68590000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\XML\\WMI2XML.DLL\" at base 7ffc62040000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\VBSCRIPT.DLL\" at base 7ffc47bd0000","\"WMIC.exe\" loaded module \"AMSI.DLL\" at base 7ffc61c70000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\VERSION.DLL\" at base 7ffc6c590000","\"WMIC.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.12.17007.18022-0\\MPOAV.DLL\" at base 7ffc61550000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\82845NH2.DLL\" at base 7ffc5a290000","\"WMIC.exe\" loaded module \"%COMMONPROGRAMFILES%\\MICROSOFT SHARED\\OFFICE14\\MSOXMLMF.DLL\" at base 7ffc6e530000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\XML\\WMI2XML.DLL\" at base 7ffc62310000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\VBSCRIPT.DLL\" at base 7ffc5a240000","\"WMIC.exe\" loaded module \"AMSI.DLL\" at base 7ffc62040000","\"WMIC.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.12.17007.18022-0\\MPOAV.DLL\" at base 7ffc6ae90000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\82845NH2.DLL\" at base 7ffc6ae40000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\XML\\WMI2XML.DLL\" at base 7ffc6ae90000","\"WMIC.exe\" loaded module \"AMSI.DLL\" at base 7ffc6ae70000","\"WMIC.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.12.17007.18022-0\\MPOAV.DLL\" at base 7ffc6ae50000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\82845NH2.DLL\" at base 7ffc5a1f0000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\VBSCRIPT.DLL\" at base 7ffc607d0000","\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\82845NH2.DLL\" at base 7ffc62f70000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ffc75e20000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ffc75e20000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ffc75e20000","\"powershell.exe\" loaded module \"KERNEL32\" at base 7ffc78ca0000","\"powershell.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffc4ee20000","\"powershell.exe\" loaded module \"KERNEL32.DLL\" at base 7ffc78ca0000","\"powershell.exe\" loaded module \"ADVAPI32.DLL\" at base 7ffc77300000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\MSCOREEI.DLL\" at base 7ffc620d0000","\"powershell.exe\" loaded module \"SHLWAPI.DLL\" at base 7ffc76f90000","\"powershell.exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL\" at base 7ffc75250000","\"powershell.exe\" loaded module \"VERSION.DLL\" at base 7ffc6c590000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\CLR.DLL\" at base 7ffc471a0000","\"powershell.exe\" loaded module \"USER32.DLL\" at base 7ffc773b0000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL\" at base 7ffc75e20000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\MSCOREE.DLL\" at base 0","\"powershell.exe\" loaded module \"MSCOREE.DLL\" at base 7ffc63a30000","\"powershell.exe\" loaded module \"NTDLL\" at base 7ffc78f00000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\COMBASE.DLL\" at base 7ffc763e0000","\"powershell.exe\" loaded module \"PSAPI.DLL\" at base 227150f0000","\"powershell.exe\" loaded module \"RPCRT4.DLL\" at base 7ffc776e0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MSCORLIB\\FE2524177EB3088C77BE666722039F52\\MSCORLIB.NI.DLL\" at base 7ffc45ba0000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\OLE32.DLL\" at base 0","\"powershell.exe\" loaded module \"OLE32.DLL\" at base 7ffc77110000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\API-MS-WIN-CORE-WINRT-L1-1-0.DLL\" at base 0","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-L1-1-0.DLL\" at base 7ffc763e0000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\MSCORLIB\\V4.0_4.0.0.0__B77A5C561934E089\\OLEAUT32.DLL\" at base 0","\"powershell.exe\" loaded module \"OLEAUT32.DLL\" at base 7ffc76be0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM\\E43DD9C73AB5615E461BF5109C3FACD6\\SYSTEM.NI.DLL\" at base 7ffc44f30000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.CORE\\0D59B0E237D7519417DE10CD84BDA4E7\\SYSTEM.CORE.NI.DLL\" at base 7ffc444b0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.PB378EC07#\\B5BA37E1558CED178A99011A1D659B52\\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL\" at base 7ffc607c0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 7ffc74690000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 7ffc75370000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\OLEAUT32.DLL\" at base 0","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.MANAA57FC8CC#\\6DA01910C256231D1C50AD0AACEE5941\\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL\" at base 7ffc42440000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\MSCORLIB\\V4.0_4.0.0.0__B77A5C561934E089\\COMBASE.DLL\" at base 0","\"powershell.exe\" loaded module \"COMBASE.DLL\" at base 7ffc763e0000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL\" at base 7ffc763e0000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL\" at base 0","\"powershell.exe\" loaded module \"NTDLL.DLL\" at base 7ffc78f00000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\PSAPI.DLL\" at base 0","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\MSCORLIB\\V4.0_4.0.0.0__B77A5C561934E089\\SHELL32.DLL\" at base 0","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\NTDLL.DLL\" at base 0","\"powershell.exe\" loaded module \"SHELL32.DLL\" at base 7ffc77800000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM.MANAGEMENT.AUTOMATION\\V4.0_3.0.0.0__31BF3856AD364E35\\WINTRUST.DLL\" at base 0","\"powershell.exe\" loaded module \"WINTRUST.DLL\" at base 7ffc75b40000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINTRUST.DLL\" at base 7ffc75b40000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPT32.DLL\" at base 7ffc75c50000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM.MANAGEMENT.AUTOMATION\\V4.0_3.0.0.0__31BF3856AD364E35\\AMSI.DLL\" at base 0","\"powershell.exe\" loaded module \"CRYPT32.DLL\" at base 7ffc75c50000","\"powershell.exe\" loaded module \"AMSI.DLL\" at base 7ffc6e530000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\CRYPT32.DLL\" at base 0","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\VERSION.DLL\" at base 7ffc6c590000","\"powershell.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.12.17007.18022-0\\MPOAV.DLL\" at base 7ffc6ae90000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\82845NH2.DLL\" at base 7ffc6ae40000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\CRYPT32.DLL\" at base 0","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.MF49F6405#\\7B1F35FB0C2D6955CE5AF2BD372C65F2\\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL\" at base 7ffc60720000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.MANAGEMENT\\B221AF81285C1305324612E6DC9C88FF\\SYSTEM.MANAGEMENT.NI.DLL\" at base 7ffc54c00000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.DIRED13B18A9#\\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\\SYSTEM.DIRECTORYSERVICES.NI.DLL\" at base 7ffc422d0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.XML\\5EE35DEBFC22F727E70E4479DDCBC045\\SYSTEM.XML.NI.DLL\" at base 7ffc41a20000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.DATA\\7BED49C46DE9295A8453DB205C60A028\\SYSTEM.DATA.NI.DLL\" at base 7ffc410b0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.NUMERICS\\86CFD69CE1261BAF4740E7606CADE014\\SYSTEM.NUMERICS.NI.DLL\" at base 7ffc62f60000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\SYSTEM.DATA\\V4.0_4.0.0.0__B77A5C561934E089\\SYSTEM.DATA.DLL\" at base 7ffc40d40000","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-XSTATE-L2-1-0.DLL\" at base 7ffc75e20000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\CLRJIT.DLL\" at base 7ffc40bf0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.P6F792626#\\7FF5199E757CB8AF9AD949453F698D09\\MICROSOFT.POWERSHELL.SECURITY.NI.DLL\" at base 7ffc5a270000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.TRANSACTIONS\\604272B0FAEC2E09D53D38E03BC89C6C\\SYSTEM.TRANSACTIONS.NI.DLL\" at base 7ffc40b10000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.CONFIGURATION\\4BEB1EECA20B27D4BD1BB9880F03CC2A\\SYSTEM.CONFIGURATION.NI.DLL\" at base 7ffc409d0000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\SYSTEM.TRANSACTIONS\\V4.0_4.0.0.0__B77A5C561934E089\\SYSTEM.TRANSACTIONS.DLL\" at base 7ffc5a220000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\MSCORLIB\\V4.0_4.0.0.0__B77A5C561934E089\\SECUR32.DLL\" at base 0","\"powershell.exe\" loaded module \"SECUR32.DLL\" at base 7ffc6b790000","\"powershell.exe\" loaded module \"SSPICLI.DLL\" at base 7ffc75180000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM.MANAGEMENT.AUTOMATION\\V4.0_3.0.0.0__31BF3856AD364E35\\SHLWAPI.DLL\" at base 0","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM.MANAGEMENT.AUTOMATION\\V4.0_3.0.0.0__31BF3856AD364E35\\WLDP.DLL\" at base 0","\"powershell.exe\" loaded module \"WLDP.DLL\" at base 7ffc742b0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 7ffc73890000","\"powershell.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.12.17007.18022-0\\MPCLIENT.DLL\" at base 7ffc408f0000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\KERNEL32.DLL\" at base 7ffc78ca0000","\"powershell.exe\" loaded module \"USERENV.DLL\" at base 7ffc75150000","\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\ADVAPI32.DLL\" at base 7ffc77300000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL\" at base 0","\"powershell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL\" at base 7ffc763e0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.PAE3498D9#\\D922445A828B30938C72D375A3B34A60\\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL\" at base 7ffc406b0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.CONFE64A9051#\\120A0532577F871C2415502D9EDACDD6\\SYSTEM.CONFIGURATION.INSTALL.NI.DLL\" at base 7ffc679e0000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\MSCORLIB\\V4.0_4.0.0.0__B77A5C561934E089\\BCRYPT.DLL\" at base 0","\"powershell.exe\" loaded module \"BCRYPT.DLL\" at base 7ffc74db0000","\"powershell.exe\" loaded module \"PSAPI.DLL\" at base 1dd5cad0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.P521220EA#\\DF7D947A99CBCFAA726B127726F05476\\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL\" at base 7ffc3fbe0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.PAE3498D9#\\D922445A828B30938C72D375A3B34A60\\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL\" at base 7ffc3f9a0000","\"powershell.exe\" loaded module \"GDI32.DLL\" at base 7ffc772d0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.IO.CB3B124C8#\\1E72628C6F64BBEA2F27E20F9F2CF3B4\\SYSTEM.IO.COMPRESSION.NI.DLL\" at base 7ffc5a1e0000","\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.IO.CF61E09C5#\\FA3056C0895561A08F7CF15A33EFBBBD\\SYSTEM.IO.COMPRESSION.FILESYSTEM.NI.DLL\" at base 7ffc736e0000","\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\CLRCOMPRESSION.DLL\" at base 7ffc62f30000","\"powershell.exe\" loaded module \"OLEAUT32\" at base 7ffc76be0000","\"cmd.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffc6e650000"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"KERNEL32\" at base 7ffc78ca0000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffc4ee20000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-2\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"NTDLL.DLL\" at base 7ffc78f00000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"KERNEL32.DLL\" at base 7ffc78ca0000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"RPCRT4.DLL\" at base 7ffc776e0000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 7ffc73890000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\WINSXS\\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\\GDIPLUS.DLL\" at base 7ffc553f0000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"WINDOWSCODECS.DLL\" at base 7ffc710b0000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"SECUR32.DLL\" at base 7ffc6b790000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"IPHLPAPI.DLL\" at base 7ffc74860000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 7ffc75370000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSWSOCK.DLL\" at base 7ffc74ae0000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-2\" at base 7ffc75250000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RASADHLP.DLL\" at base 7ffc6cda0000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\FWPUCLNT.DLL\" at base 7ffc6d3c0000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"SSPICLI.DLL\" at base 7ffc75180000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\SCHANNEL.DLL\" at base 7ffc745d0000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\PROPSYS.DLL\" at base 7ffc71650000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"SHELL32.DLL\" at base 7ffc77800000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\\\WINDOWS.STATEREPOSITORYPS.DLL\" at base 7ffc60150000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\SHELL32.DLL\" at base 7ffc77800000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"USER32.DLL\" at base 7ffc773b0000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\URLMON.DLL\" at base 7ffc69c30000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"MSISO.DLL\" at base 7ffc63ae0000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"API-MS-WIN-CORE-URL-L1-1-0.DLL\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINDOWS.STORAGE.DLL\" at base 7ffc753f0000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"KERNEL32\" at base 7ffc78ca0000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 7ffc78e40000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffc4ee20000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"KERNEL32.DLL\" at base 7ffc78ca0000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"NTDLL.DLL\" at base 7ffc78f00000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"KERNEL32\" at base 7ffc78ca0000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-STRING-L1-1-0\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-DATETIME-L1-1-1\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 7ffc78e40000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffc4ee20000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"RPCRT4.DLL\" at base 7ffc776e0000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\WBEMPROX.DLL\" at base 7ffc6a5b0000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"SSPICLI.DLL\" at base 7ffc75180000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"KERNEL32.DLL\" at base 7ffc78ca0000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\MSXML6.DLL\" at base 7ffc64770000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"USER32.DLL\" at base 7ffc773b0000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-URL-L1-1-0.DLL\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"MSISO.DLL\" at base 7ffc63ae0000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 7ffc73890000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%COMMONPROGRAMFILES%\\MICROSOFT SHARED\\OFFICE14\\MSOXMLMF.DLL\" at base 7ffc62310000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\WBEMSVC.DLL\" at base 7ffc68d70000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\FASTPROX.DLL\" at base 7ffc685c0000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\WMIUTILS.DLL\" at base 7ffc68590000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\XML\\WMI2XML.DLL\" at base 7ffc62040000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\VBSCRIPT.DLL\" at base 7ffc47bd0000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"AMSI.DLL\" at base 7ffc61c70000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\VERSION.DLL\" at base 7ffc6c590000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.12.17007.18022-0\\MPOAV.DLL\" at base 7ffc61550000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\82845NH2.DLL\" at base 7ffc5a290000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%COMMONPROGRAMFILES%\\MICROSOFT SHARED\\OFFICE14\\MSOXMLMF.DLL\" at base 7ffc6e530000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\XML\\WMI2XML.DLL\" at base 7ffc62310000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\VBSCRIPT.DLL\" at base 7ffc5a240000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"AMSI.DLL\" at base 7ffc62040000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.12.17007.18022-0\\MPOAV.DLL\" at base 7ffc6ae90000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\82845NH2.DLL\" at base 7ffc6ae40000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WBEM\\XML\\WMI2XML.DLL\" at base 7ffc6ae90000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"AMSI.DLL\" at base 7ffc6ae70000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.12.17007.18022-0\\MPOAV.DLL\" at base 7ffc6ae50000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\82845NH2.DLL\" at base 7ffc5a1f0000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\VBSCRIPT.DLL\" at base 7ffc607d0000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\SYSTEM32\\82845NH2.DLL\" at base 7ffc62f70000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"KERNEL32\" at base 7ffc78ca0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffc4ee20000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"KERNEL32.DLL\" at base 7ffc78ca0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"ADVAPI32.DLL\" at base 7ffc77300000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\MSCOREEI.DLL\" at base 7ffc620d0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"SHLWAPI.DLL\" at base 7ffc76f90000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL\" at base 7ffc75250000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"VERSION.DLL\" at base 7ffc6c590000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\CLR.DLL\" at base 7ffc471a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"USER32.DLL\" at base 7ffc773b0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\MSCOREE.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"MSCOREE.DLL\" at base 7ffc63a30000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"NTDLL\" at base 7ffc78f00000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\COMBASE.DLL\" at base 7ffc763e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"PSAPI.DLL\" at base 227150f0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"RPCRT4.DLL\" at base 7ffc776e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MSCORLIB\\FE2524177EB3088C77BE666722039F52\\MSCORLIB.NI.DLL\" at base 7ffc45ba0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\OLE32.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"OLE32.DLL\" at base 7ffc77110000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\API-MS-WIN-CORE-WINRT-L1-1-0.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-L1-1-0.DLL\" at base 7ffc763e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\MSCORLIB\\V4.0_4.0.0.0__B77A5C561934E089\\OLEAUT32.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"OLEAUT32.DLL\" at base 7ffc76be0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM\\E43DD9C73AB5615E461BF5109C3FACD6\\SYSTEM.NI.DLL\" at base 7ffc44f30000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.CORE\\0D59B0E237D7519417DE10CD84BDA4E7\\SYSTEM.CORE.NI.DLL\" at base 7ffc444b0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.PB378EC07#\\B5BA37E1558CED178A99011A1D659B52\\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL\" at base 7ffc607c0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\RSAENH.DLL\" at base 7ffc74690000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\BCRYPTPRIMITIVES.DLL\" at base 7ffc75370000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\OLEAUT32.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.MANAA57FC8CC#\\6DA01910C256231D1C50AD0AACEE5941\\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL\" at base 7ffc42440000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\MSCORLIB\\V4.0_4.0.0.0__B77A5C561934E089\\COMBASE.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"COMBASE.DLL\" at base 7ffc763e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL\" at base 7ffc763e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"NTDLL.DLL\" at base 7ffc78f00000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\PSAPI.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\MSCORLIB\\V4.0_4.0.0.0__B77A5C561934E089\\SHELL32.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\NTDLL.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"SHELL32.DLL\" at base 7ffc77800000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM.MANAGEMENT.AUTOMATION\\V4.0_3.0.0.0__31BF3856AD364E35\\WINTRUST.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"WINTRUST.DLL\" at base 7ffc75b40000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\WINTRUST.DLL\" at base 7ffc75b40000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\CRYPT32.DLL\" at base 7ffc75c50000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM.MANAGEMENT.AUTOMATION\\V4.0_3.0.0.0__31BF3856AD364E35\\AMSI.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"CRYPT32.DLL\" at base 7ffc75c50000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"AMSI.DLL\" at base 7ffc6e530000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM\\V4.0_4.0.0.0__B77A5C561934E089\\CRYPT32.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\VERSION.DLL\" at base 7ffc6c590000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.12.17007.18022-0\\MPOAV.DLL\" at base 7ffc6ae90000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\82845NH2.DLL\" at base 7ffc6ae40000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\CRYPT32.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.MF49F6405#\\7B1F35FB0C2D6955CE5AF2BD372C65F2\\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL\" at base 7ffc60720000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.MANAGEMENT\\B221AF81285C1305324612E6DC9C88FF\\SYSTEM.MANAGEMENT.NI.DLL\" at base 7ffc54c00000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.DIRED13B18A9#\\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\\SYSTEM.DIRECTORYSERVICES.NI.DLL\" at base 7ffc422d0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.XML\\5EE35DEBFC22F727E70E4479DDCBC045\\SYSTEM.XML.NI.DLL\" at base 7ffc41a20000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.DATA\\7BED49C46DE9295A8453DB205C60A028\\SYSTEM.DATA.NI.DLL\" at base 7ffc410b0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.NUMERICS\\86CFD69CE1261BAF4740E7606CADE014\\SYSTEM.NUMERICS.NI.DLL\" at base 7ffc62f60000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\SYSTEM.DATA\\V4.0_4.0.0.0__B77A5C561934E089\\SYSTEM.DATA.DLL\" at base 7ffc40d40000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-XSTATE-L2-1-0.DLL\" at base 7ffc75e20000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\CLRJIT.DLL\" at base 7ffc40bf0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.P6F792626#\\7FF5199E757CB8AF9AD949453F698D09\\MICROSOFT.POWERSHELL.SECURITY.NI.DLL\" at base 7ffc5a270000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.TRANSACTIONS\\604272B0FAEC2E09D53D38E03BC89C6C\\SYSTEM.TRANSACTIONS.NI.DLL\" at base 7ffc40b10000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.CONFIGURATION\\4BEB1EECA20B27D4BD1BB9880F03CC2A\\SYSTEM.CONFIGURATION.NI.DLL\" at base 7ffc409d0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\SYSTEM.TRANSACTIONS\\V4.0_4.0.0.0__B77A5C561934E089\\SYSTEM.TRANSACTIONS.DLL\" at base 7ffc5a220000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\MSCORLIB\\V4.0_4.0.0.0__B77A5C561934E089\\SECUR32.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"SECUR32.DLL\" at base 7ffc6b790000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"SSPICLI.DLL\" at base 7ffc75180000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM.MANAGEMENT.AUTOMATION\\V4.0_3.0.0.0__31BF3856AD364E35\\SHLWAPI.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_MSIL\\SYSTEM.MANAGEMENT.AUTOMATION\\V4.0_3.0.0.0__31BF3856AD364E35\\WLDP.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"WLDP.DLL\" at base 7ffc742b0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 7ffc73890000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%ALLUSERSPROFILE%\\MICROSOFT\\WINDOWS DEFENDER\\PLATFORM\\4.12.17007.18022-0\\MPCLIENT.DLL\" at base 7ffc408f0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\KERNEL32.DLL\" at base 7ffc78ca0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"USERENV.DLL\" at base 7ffc75150000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\SYSTEM32\\ADVAPI32.DLL\" at base 7ffc77300000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL\" at base 7ffc763e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.PAE3498D9#\\D922445A828B30938C72D375A3B34A60\\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL\" at base 7ffc406b0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.CONFE64A9051#\\120A0532577F871C2415502D9EDACDD6\\SYSTEM.CONFIGURATION.INSTALL.NI.DLL\" at base 7ffc679e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\ASSEMBLY\\GAC_64\\MSCORLIB\\V4.0_4.0.0.0__B77A5C561934E089\\BCRYPT.DLL\" at base 0"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"BCRYPT.DLL\" at base 7ffc74db0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"PSAPI.DLL\" at base 1dd5cad0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.P521220EA#\\DF7D947A99CBCFAA726B127726F05476\\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL\" at base 7ffc3fbe0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\MICROSOFT.PAE3498D9#\\D922445A828B30938C72D375A3B34A60\\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL\" at base 7ffc3f9a0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"GDI32.DLL\" at base 7ffc772d0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.IO.CB3B124C8#\\1E72628C6F64BBEA2F27E20F9F2CF3B4\\SYSTEM.IO.COMPRESSION.NI.DLL\" at base 7ffc5a1e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\ASSEMBLY\\NATIVEIMAGES_V4.0.30319_64\\SYSTEM.IO.CF61E09C5#\\FA3056C0895561A08F7CF15A33EFBBBD\\SYSTEM.IO.COMPRESSION.FILESYSTEM.NI.DLL\" at base 7ffc736e0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK64\\V4.0.30319\\CLRCOMPRESSION.DLL\" at base 7ffc62f30000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"OLEAUT32\" at base 7ffc76be0000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffc6e650000"}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-3","type":10,"relevance":0,"name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 45BA0000","description_v2":["\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 45BA0000"],"description_v3":[{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 45BA0000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-8","type":10,"relevance":0,"name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 61C70000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 62040000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 6AE70000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 6E530000","description_v2":["\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 61C70000","\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 62040000","\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 6AE70000","\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 6E530000"],"description_v3":[{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 61C70000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 62040000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 6AE70000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 6E530000"}],"origin":"Loaded Module","attck_id":"T1562.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1562/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-9","type":10,"relevance":0,"name":"Loads the Bcrypt module DLL","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 75370000\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74DB0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 75370000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 75370000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74DB0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 75370000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74DB0000","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 75370000","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74DB0000","\"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 75370000","\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 75370000","\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74DB0000","\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 75370000","\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74DB0000"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 75370000"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74DB0000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 75370000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 75370000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74DB0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 75370000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74DB0000"}],"origin":"Loaded Module","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-7","type":10,"relevance":0,"name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 471A0000","description_v2":["\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 471A0000"],"description_v3":[{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 471A0000"}],"origin":"Loaded Module","attck_id":"T1620","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1620","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"module-10","type":10,"relevance":0,"name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 776E0000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 776E0000\n \"WMIC.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 776E0000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 776E0000\n \"timeout.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 776E0000","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 776E0000","\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 776E0000","\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 776E0000","\"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 776E0000","\"timeout.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 776E0000"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 776E0000"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 776E0000"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 776E0000"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 776E0000"},{"type":"linebreak"},{"type":"text","value":"\"timeout.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 776E0000"}],"origin":"Loaded Module","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-8","type":6,"relevance":1,"name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7f975fc7f0000@ntdll.dll\"\n \"220023000000000018c7f975fc7f0000@ntdll.dll\"\n \"19001a00a600000040c7f975fc7f0000@ntdll.dll\"\n \"22002300a600000018c7f975fc7f0000@ntdll.dll\"\n \"19001a00b100000040c7f975fc7f0000@ntdll.dll\"\n \"22002300b100000018c7f975fc7f0000@ntdll.dll\"\n \"19001a00c500000040c7f975fc7f0000@ntdll.dll\"\n \"22002300c500000018c7f975fc7f0000@ntdll.dll\"\n \"19001a009900000040c7f975fc7f0000@ntdll.dll\"\n \"220023009900000018c7f975fc7f0000@ntdll.dll\"\n \"19001a003f00000040c7f975fc7f0000@ntdll.dll\"\n \"\"#?@ntdll.dll\", \"19001a00e800000040c7f975fc7f0000@ntdll.dll\", \"22002300e800000018c7f975fc7f0000@ntdll.dll\"","description_v2":["\"19001a000000000040c7f975fc7f0000@ntdll.dll\"","\"220023000000000018c7f975fc7f0000@ntdll.dll\"","\"19001a00a600000040c7f975fc7f0000@ntdll.dll\"","\"22002300a600000018c7f975fc7f0000@ntdll.dll\"","\"19001a00b100000040c7f975fc7f0000@ntdll.dll\"","\"22002300b100000018c7f975fc7f0000@ntdll.dll\"","\"19001a00c500000040c7f975fc7f0000@ntdll.dll\"","\"22002300c500000018c7f975fc7f0000@ntdll.dll\"","\"19001a009900000040c7f975fc7f0000@ntdll.dll\"","\"220023009900000018c7f975fc7f0000@ntdll.dll\"","\"19001a003f00000040c7f975fc7f0000@ntdll.dll\"","\"\"#?@ntdll.dll\", \"19001a00e800000040c7f975fc7f0000@ntdll.dll\", \"22002300e800000018c7f975fc7f0000@ntdll.dll\""],"description_v3":[{"type":"text","value":"\"19001a000000000040c7f975fc7f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"220023000000000018c7f975fc7f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"19001a00a600000040c7f975fc7f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"22002300a600000018c7f975fc7f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"19001a00b100000040c7f975fc7f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"22002300b100000018c7f975fc7f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"19001a00c500000040c7f975fc7f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"22002300c500000018c7f975fc7f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"19001a009900000040c7f975fc7f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"220023009900000018c7f975fc7f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"19001a003f00000040c7f975fc7f0000@ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"\"#?@ntdll.dll\", \"19001a00e800000040c7f975fc7f0000@ntdll.dll\", \"22002300e800000018c7f975fc7f0000@ntdll.dll\""}],"origin":"API Call","attck_id":"T1129","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1129","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-157","type":0,"relevance":0,"name":"Matched Compiler/Packer signature (DIE)","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" was detected as \"Microsoft Linker\" and name: \"Linker\"","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" was detected as \"Microsoft Linker\" and name: \"Linker\""],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" was detected as \"Microsoft Linker\" and name: \"Linker\""}],"origin":"Static Parser","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-605","type":2,"relevance":1,"name":"May execute SQL queries","description":"$4b","description_v2":["\"SELECT*FROM\"%w\".%s WHERE %s ORDER BY rowid\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"select*from\"%w\".%s where %s order by rowid\")","$4c","name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update %q.sqlite_master set tbl_name = %q","name = case when type='table' then %q when name like 'sqlitex_autoindex%%' escape 'x' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q collate nocase and (type='table' or type='index' or type='trigger');\"), \"UPDATE \"%w\".sqlite_sequence set name = %Q WHERE name = %Q\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update \"%w\".sqlite_sequence set name = %q where name = %q\"), \"UPDATE sqlite_temp_schema SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, 1)","tbl_name = CASE WHEN tbl_name=%Q COLLATE nocase AND sqlite_rename_test(%Q, sql, type, name, 1, 'after rename', 0) THEN %Q ELSE tbl_name END WHERE type IN ('view', 'trigger')\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update sqlite_temp_schema set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, 1)","$4d","idx","stat FROM %Q.sqlite_stat1\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"select tbl","idx","stat from %q.sqlite_stat1\"), \"CREATE TABLE\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"create table\"), \"UPDATE %Q.sqlite_master SET type='%s'","name=%Q","tbl_name=%Q","rootpage=#%d","sql=%Q WHERE rowid=#%d\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update %q.sqlite_master set type='%s'","name=%q","tbl_name=%q","rootpage=#%d","sql=%q where rowid=#%d\"), \"CREATE TABLE %Q.sqlite_sequence(name,seq)\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"create table %q.sqlite_sequence(name,seq)\"), \"SELECT*FROM\"%w\".\"%w\"\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"select*from\"%w\".\"%w\"\"), \"UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d\"), \"DELETE FROM %Q.sqlite_sequence WHERE name=%Q\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"delete from %q.sqlite_sequence where name=%q\"), \"DELETE FROM %Q.sqlite_master WHERE tbl_name=%Q and type!='trigger'\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"delete from %q.sqlite_master where tbl_name=%q and type!='trigger'\")"],"description_v3":[{"type":"text","value":"\"SELECT*FROM\"%w\".%s WHERE %s ORDER BY rowid\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"select*from\"%w\".%s where %s order by rowid\")"},{"type":"linebreak"},{"type":"text","value":"$4e"},{"type":"linebreak"},{"type":"text","value":"name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update %q.sqlite_master set tbl_name = %q"},{"type":"linebreak"},{"type":"text","value":"name = case when type='table' then %q when name like 'sqlitex_autoindex%%' escape 'x' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q collate nocase and (type='table' or type='index' or type='trigger');\"), \"UPDATE \"%w\".sqlite_sequence set name = %Q WHERE name = %Q\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update \"%w\".sqlite_sequence set name = %q where name = %q\"), \"UPDATE sqlite_temp_schema SET sql = sqlite_rename_table(%Q, type, name, sql, %Q, %Q, 1)"},{"type":"linebreak"},{"type":"text","value":"tbl_name = CASE WHEN tbl_name=%Q COLLATE nocase AND sqlite_rename_test(%Q, sql, type, name, 1, 'after rename', 0) THEN %Q ELSE tbl_name END WHERE type IN ('view', 'trigger')\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update sqlite_temp_schema set sql = sqlite_rename_table(%q, type, name, sql, %q, %q, 1)"},{"type":"linebreak"},{"type":"text","value":"$4f"},{"type":"linebreak"},{"type":"text","value":"idx"},{"type":"linebreak"},{"type":"text","value":"stat FROM %Q.sqlite_stat1\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"select tbl"},{"type":"linebreak"},{"type":"text","value":"idx"},{"type":"linebreak"},{"type":"text","value":"stat from %q.sqlite_stat1\"), \"CREATE TABLE\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"create table\"), \"UPDATE %Q.sqlite_master SET type='%s'"},{"type":"linebreak"},{"type":"text","value":"name=%Q"},{"type":"linebreak"},{"type":"text","value":"tbl_name=%Q"},{"type":"linebreak"},{"type":"text","value":"rootpage=#%d"},{"type":"linebreak"},{"type":"text","value":"sql=%Q WHERE rowid=#%d\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update %q.sqlite_master set type='%s'"},{"type":"linebreak"},{"type":"text","value":"name=%q"},{"type":"linebreak"},{"type":"text","value":"tbl_name=%q"},{"type":"linebreak"},{"type":"text","value":"rootpage=#%d"},{"type":"linebreak"},{"type":"text","value":"sql=%q where rowid=#%d\"), \"CREATE TABLE %Q.sqlite_sequence(name,seq)\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"create table %q.sqlite_sequence(name,seq)\"), \"SELECT*FROM\"%w\".\"%w\"\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"select*from\"%w\".\"%w\"\"), \"UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d\"), \"DELETE FROM %Q.sqlite_sequence WHERE name=%Q\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"delete from %q.sqlite_sequence where name=%q\"), \"DELETE FROM %Q.sqlite_master WHERE tbl_name=%Q and type!='trigger'\" (Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c, Indicator: \"delete from %q.sqlite_master where tbl_name=%q and type!='trigger'\")"}],"origin":"File/Memory","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-187","type":2,"relevance":1,"name":"Observed Powershell command strings","description":"$50","description_v2":["$51","00000000-00006864.00000000.115762.5B460000.00000004.mdmp","00000000-00006864.00000000.115762.5CB00000.00000004.mdmp","00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"$52"},{"type":"linebreak"},{"type":"text","value":"00000000-00006864.00000000.115762.5B460000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006864.00000000.115762.5CB00000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-72","type":3,"relevance":3,"name":"Overview of unique CLSIDs touched in registry","description":"$53","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched \"Sync root manager\" (Path: \"HKCU\\CLSID\\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\\INSTANCE\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\\TREATAS\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched \"Security Manager\" (Path: \"HKCU\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\TREATAS\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched \"ShellItemArray Shell Namespace helper\" (Path: \"HKCU\\CLSID\\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\\TREATAS\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched \"ShellItem Shell Namespace helper\" (Path: \"HKCU\\CLSID\\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\\TREATAS\")","\"WMIC.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\")","\"WMIC.exe\" touched \"Free Threaded XML DOM Document 6.0\" (Path: \"HKCU\\CLSID\\{88D96A06-F192-11D4-A65F-0040963251E5}\\TREATAS\")","\"WMIC.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")","\"WMIC.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\TREATAS\")","\"WMIC.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")","\"WMIC.exe\" touched \"Microsoft WBEM WbemClassObject Marshalling proxy\" (Path: \"HKCU\\CLSID\\{4590F812-1D3A-11D0-891F-00AA004B2E24}\\TREATAS\")","\"WMIC.exe\" touched \"Microsoft WBEM WMI Object Factory\" (Path: \"HKCU\\CLSID\\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\\TREATAS\")","\"WMIC.exe\" touched \"Microsoft WBEM Call Context\" (Path: \"HKCU\\CLSID\\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\\TREATAS\")","\"WMIC.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject\" (Path: \"HKCU\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TREATAS\")","\"WMIC.exe\" touched \"WbemQuery\" (Path: \"HKCU\\CLSID\\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}\\TREATAS\")","\"WMIC.exe\" touched \"XSL Template 6.0\" (Path: \"HKCU\\CLSID\\{88D96A08-F192-11D4-A65F-0040963251E5}\\TREATAS\")","\"WMIC.exe\" touched \"VB Script Language\" (Path: \"HKCU\\CLSID\\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\\TREATAS\")","\"WMIC.exe\" touched \"Component Categories Manager\" (Path: \"HKCU\\CLSID\\{0002E005-0000-0000-C000-000000000046}\\TREATAS\")","\"WMIC.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched \"Sync root manager\" (Path: \"HKCU\\CLSID\\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\\INSTANCE\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched \"Security Manager\" (Path: \"HKCU\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched \"ShellItemArray Shell Namespace helper\" (Path: \"HKCU\\CLSID\\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched \"ShellItem Shell Namespace helper\" (Path: \"HKCU\\CLSID\\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" touched \"Free Threaded XML DOM Document 6.0\" (Path: \"HKCU\\CLSID\\{88D96A06-F192-11D4-A65F-0040963251E5}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" touched \"Microsoft WBEM WbemClassObject Marshalling proxy\" (Path: \"HKCU\\CLSID\\{4590F812-1D3A-11D0-891F-00AA004B2E24}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" touched \"Microsoft WBEM WMI Object Factory\" (Path: \"HKCU\\CLSID\\{8D1C559D-84F0-4BB3-A7D5-56A7435A9BA6}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" touched \"Microsoft WBEM Call Context\" (Path: \"HKCU\\CLSID\\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject\" (Path: \"HKCU\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" touched \"WbemQuery\" (Path: \"HKCU\\CLSID\\{EAC8A024-21E2-4523-AD73-A71A0AA2F56A}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" touched \"XSL Template 6.0\" (Path: \"HKCU\\CLSID\\{88D96A08-F192-11D4-A65F-0040963251E5}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" touched \"VB Script Language\" (Path: \"HKCU\\CLSID\\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" touched \"Component Categories Manager\" (Path: \"HKCU\\CLSID\\{0002E005-0000-0000-C000-000000000046}\\TREATAS\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")"}],"origin":"Registry Access","attck_id":"T1546.015","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1546/015","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-146","type":0,"relevance":0,"name":"PE file contains Debug data directory","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\""],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-80","type":0,"relevance":1,"name":"PE file contains executable sections","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has an executable section named \".text\"","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has an executable section named \".text\""],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has an executable section named \".text\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-95","type":0,"relevance":0,"name":"PE file contains writable sections","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has an writable section named \".data\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has an writable section named \".fptable\"","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has an writable section named \".data\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has an writable section named \".fptable\""],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has an writable section named \".data\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has an writable section named \".fptable\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-96","type":0,"relevance":0,"name":"PE file entrypoint instructions","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x140425bac,add\trsp, 0x28,jmp\t0x140425394,int3\t,int3\t,sub\trsp, 0x28,mov\tr8, qword ptr [r9 + 0x38],mov\trcx, rdx,mov\trdx, r9,call\t0x14042553c,mov\teax, 1,add\trsp, 0x28,ret\t,int3\t,int3\t,int3\t,push\trbx,mov\tr11d, dword ptr [r8],mov\trbx, rdx,and\tr11d, 0xfffffff8,mov\tr9, rcx,test\tbyte ptr [r8], 4,mov\tr10, rcx,je\t0x140425567,mov\teax, dword ptr [r8 + 8],movsxd\tr10, dword ptr [r8 + 4],neg\teax,add\tr10, rcx,movsxd\trcx, eax,and\tr10, rcx,movsxd\trax, r11d,\"","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x140425bac,add\trsp, 0x28,jmp\t0x140425394,int3\t,int3\t,sub\trsp, 0x28,mov\tr8, qword ptr [r9 + 0x38],mov\trcx, rdx,mov\trdx, r9,call\t0x14042553c,mov\teax, 1,add\trsp, 0x28,ret\t,int3\t,int3\t,int3\t,push\trbx,mov\tr11d, dword ptr [r8],mov\trbx, rdx,and\tr11d, 0xfffffff8,mov\tr9, rcx,test\tbyte ptr [r8], 4,mov\tr10, rcx,je\t0x140425567,mov\teax, dword ptr [r8 + 8],movsxd\tr10, dword ptr [r8 + 4],neg\teax,add\tr10, rcx,movsxd\trcx, eax,and\tr10, rcx,movsxd\trax, r11d,\""],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" file has an entrypoint instructions - \"sub\trsp, 0x28,call\t0x140425bac,add\trsp, 0x28,jmp\t0x140425394,int3\t,int3\t,sub\trsp, 0x28,mov\tr8, qword ptr [r9 + 0x38],mov\trcx, rdx,mov\trdx, r9,call\t0x14042553c,mov\teax, 1,add\trsp, 0x28,ret\t,int3\t,int3\t,int3\t,push\trbx,mov\tr11d, dword ptr [r8],mov\trbx, rdx,and\tr11d, 0xfffffff8,mov\tr9, rcx,test\tbyte ptr [r8], 4,mov\tr10, rcx,je\t0x140425567,mov\teax, dword ptr [r8 + 8],movsxd\tr10, dword ptr [r8 + 4],neg\teax,add\tr10, rcx,movsxd\trcx, eax,and\tr10, rcx,movsxd\trax, r11d,\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-125","type":0,"relevance":3,"name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x462a00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x142800\" greater than 0x100000","description_v2":["Raw size of \".text\" is \"0x462a00\" greater than 0x100000","Raw size of \".rdata\" is \"0x142800\" greater than 0x100000"],"description_v3":[{"type":"text","value":"Raw size of \".text\" is \"0x462a00\" greater than 0x100000"},{"type":"linebreak"},{"type":"text","value":"Raw size of \".rdata\" is \"0x142800\" greater than 0x100000"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-124","type":0,"relevance":3,"name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x4628d4\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x1426ec\" greater than 0x100000","description_v2":["Virtual size of \".text\" is \"0x4628d4\" greater than 0x100000","Virtual size of \".rdata\" is \"0x1426ec\" greater than 0x100000"],"description_v3":[{"type":"text","value":"Virtual size of \".text\" is \"0x4628d4\" greater than 0x100000"},{"type":"linebreak"},{"type":"text","value":"Virtual size of \".rdata\" is \"0x1426ec\" greater than 0x100000"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"static-93","type":0,"relevance":1,"name":"PE file has a high image base","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has high imagebase \"0x140000000\"","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has high imagebase \"0x140000000\""],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\" has high imagebase \"0x140000000\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-170","type":2,"relevance":1,"name":"Possibly uses system binaries (Windows LOLbins)","description":"$54","description_v2":["Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00005044-00000BC0-763447693]","Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00005044-00000C46-2412053458]","Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c wmic diskdrive get model,serialnumber\" [Source: 00000000-00005044-00000C46-2412053458]","Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_Keyboard get Description,DeviceID\" [Source: 00000000-00005044-00000C46-16681831658]","Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID\" [Source: 00000000-00005044-00000C46-31025008696]","Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" [Source: 00000000-00005044-00000C46-59868927018]","Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c wmic get name\" [Source: 00000000-00005044-00000C46-74155484504]","Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" [Source: 00000000-00005044-00000C46-88337136890]","Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -Destin\" [Source: 00000000-00005044-00000C46-115678154006], Observed system executable string:\"%WINDIR%\\System32\\wbem\\WMIC.exe\" [Source: 00000000-00007612-00000BC0-764352274], Observed system executable string:\"%WINDIR%\\System32\\Wbem\\WMIC.exe\" [Source: 00000000-00007612-00000C46-1976778904], Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00007200-00000BC0-800129871], Observed system executable string:\"%WINDIR%\\System32\\timeout.exe\" [Source: 00000000-00008036-00000BC0-826851749], Observed system executable string:\"%WINDIR%\\system32\\timeout.exe\" [Source: 00000000-00008036-00000C46-1581919611]"],"description_v3":[{"type":"text","value":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 00000000-00005044-00000BC0-763447693]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00005044-00000C46-2412053458]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c wmic diskdrive get model,serialnumber\" [Source: 00000000-00005044-00000C46-2412053458]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_Keyboard get Description,DeviceID\" [Source: 00000000-00005044-00000C46-16681831658]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID\" [Source: 00000000-00005044-00000C46-31025008696]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" [Source: 00000000-00005044-00000C46-59868927018]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c wmic get name\" [Source: 00000000-00005044-00000C46-74155484504]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" [Source: 00000000-00005044-00000C46-88337136890]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -Destin\" [Source: 00000000-00005044-00000C46-115678154006], Observed system executable string:\"%WINDIR%\\System32\\wbem\\WMIC.exe\" [Source: 00000000-00007612-00000BC0-764352274], Observed system executable string:\"%WINDIR%\\System32\\Wbem\\WMIC.exe\" [Source: 00000000-00007612-00000C46-1976778904], Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00007200-00000BC0-800129871], Observed system executable string:\"%WINDIR%\\System32\\timeout.exe\" [Source: 00000000-00008036-00000BC0-826851749], Observed system executable string:\"%WINDIR%\\system32\\timeout.exe\" [Source: 00000000-00008036-00000C46-1581919611]"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-67","type":9,"relevance":10,"name":"Process launched with changed environment","description":"$55","description_v2":["Process \"cmd.exe\" (UID: 00000000-00007612) was launched with new environment variables: \"USERDNSDOMAIN=\"lb6ws07SE5TLjxf\"\"","Process \"cmd.exe\" (UID: 00000000-00007612) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","Process \"WMIC.exe\" (UID: 00000000-00007984) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","Process \"cmd.exe\" (UID: 00000000-00002092) was launched with missing environment variables: \"PROMPT\"","Process \"WMIC.exe\" (UID: 00000000-00004104) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","Process \"cmd.exe\" (UID: 00000000-00004448) was launched with missing environment variables: \"PROMPT\"","Process \"WMIC.exe\" (UID: 00000000-00004276) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","Process \"cmd.exe\" (UID: 00000000-00003012) was launched with missing environment variables: \"PROMPT\"","Process \"WMIC.exe\" (UID: 00000000-00000796) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","Process \"WMIC.exe\" (UID: 00000000-00000796) was launched with modified environment variables: \"PSModulePath, Path, PATHEXT, NUMBER_OF_PROCESSORS\"","Process \"cmd.exe\" (UID: 00000000-00007884) was launched with modified environment variables: \"PSModulePath, Path, PATHEXT, NUMBER_OF_PROCESSORS\"","Process \"cmd.exe\" (UID: 00000000-00007884) was launched with missing environment variables: \"PROMPT\"","Process \"WMIC.exe\" (UID: 00000000-00005688) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","Process \"cmd.exe\" (UID: 00000000-00002920) was launched with missing environment variables: \"PROMPT\"","Process \"WMIC.exe\" (UID: 00000000-00007968) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","Process \"cmd.exe\" (UID: 00000000-00007200) was launched with missing environment variables: \"PROMPT\"","Process \"powershell.exe\" (UID: 00000000-00002116) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","Process \"cmd.exe\" (UID: 00000000-00002124) was launched with missing environment variables: \"PROMPT\"","Process \"powershell.exe\" (UID: 00000000-00006864) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","Process \"cmd.exe\" (UID: 00000000-00008036) was launched with missing environment variables: \"PROMPT\"","Process \"timeout.exe\" (UID: 00000000-00005028) was launched with new environment variables: \"PROMPT=\"$P$G\"\"","Process \"svchost.exe\" (UID: 00000000-00001060) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"","Process \"svchost.exe\" (UID: 00000000-00001060) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles, NUMBER_OF_PROCESSORS\"","Process \"svchost.exe\" (UID: 00000000-00001060) was launched with missing environment variables: \"USERDNSDOMAIN\"","Process \"cmd.exe\" (UID: 00000000-00007552) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","Process \"cmd.exe\" (UID: 00000000-00007552) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\""],"description_v3":[{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00000000-00007612","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"USERDNSDOMAIN=\"lb6ws07SE5TLjxf\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00000000-00007612","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\""},{"type":"linebreak"},{"type":"text","value":"Process \"WMIC.exe\""},{"type":"process","process_uid":"00000000-00007984","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROMPT=\"$P$G\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00000000-00002092","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROMPT\""},{"type":"linebreak"},{"type":"text","value":"Process \"WMIC.exe\""},{"type":"process","process_uid":"00000000-00004104","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROMPT=\"$P$G\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00000000-00004448","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROMPT\""},{"type":"linebreak"},{"type":"text","value":"Process \"WMIC.exe\""},{"type":"process","process_uid":"00000000-00004276","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROMPT=\"$P$G\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00000000-00003012","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROMPT\""},{"type":"linebreak"},{"type":"text","value":"Process \"WMIC.exe\""},{"type":"process","process_uid":"00000000-00000796","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROMPT=\"$P$G\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"WMIC.exe\""},{"type":"process","process_uid":"00000000-00000796","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"PSModulePath, Path, PATHEXT, NUMBER_OF_PROCESSORS\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00000000-00007884","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"PSModulePath, Path, PATHEXT, NUMBER_OF_PROCESSORS\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00000000-00007884","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROMPT\""},{"type":"linebreak"},{"type":"text","value":"Process \"WMIC.exe\""},{"type":"process","process_uid":"00000000-00005688","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROMPT=\"$P$G\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00000000-00002920","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROMPT\""},{"type":"linebreak"},{"type":"text","value":"Process \"WMIC.exe\""},{"type":"process","process_uid":"00000000-00007968","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROMPT=\"$P$G\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00000000-00007200","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROMPT\""},{"type":"linebreak"},{"type":"text","value":"Process \"powershell.exe\""},{"type":"process","process_uid":"00000000-00002116","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROMPT=\"$P$G\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00000000-00002124","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROMPT\""},{"type":"linebreak"},{"type":"text","value":"Process \"powershell.exe\""},{"type":"process","process_uid":"00000000-00006864","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROMPT=\"$P$G\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00000000-00008036","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROMPT\""},{"type":"linebreak"},{"type":"text","value":"Process \"timeout.exe\""},{"type":"process","process_uid":"00000000-00005028","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROMPT=\"$P$G\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"svchost.exe\""},{"type":"process","process_uid":"00000000-00001060","label":"Show Process"},{"type":"text","value":"was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\""},{"type":"linebreak"},{"type":"text","value":"Process \"svchost.exe\""},{"type":"process","process_uid":"00000000-00001060","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles, NUMBER_OF_PROCESSORS\""},{"type":"linebreak"},{"type":"text","value":"Process \"svchost.exe\""},{"type":"process","process_uid":"00000000-00001060","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"USERDNSDOMAIN\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00000000-00007552","label":"Show Process"},{"type":"text","value":"was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\""},{"type":"linebreak"},{"type":"text","value":"Process \"cmd.exe\""},{"type":"process","process_uid":"00000000-00007552","label":"Show Process"},{"type":"text","value":"was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\""}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-51","type":7,"relevance":1,"name":"Queries DNS server","description":"\"api.telegram.org\"","description_v2":["\"api.telegram.org\""],"description_v3":[{"type":"text","value":"\"api.telegram.org\""}],"origin":"Network Traffic","attck_id":"T1071.004","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/004","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-20","type":3,"relevance":5,"name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","description_v2":["\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")"],"description_v3":[{"type":"text","value":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")","\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-625","type":2,"relevance":1,"name":"References Windows file paths for DLLs (possible dropped files)","description":"$56","description_v2":["Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00007984-00000C2A-765859497]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00002116-00000C2A-800894708]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" [Source: 00000000-00002116-00000C2A-801222452]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll\" [Source: 00000000-00002116-00000C2A-801330834]","Observed system executable string:\"%WINDIR%\\system32\\combase.dll\" [Source: 00000000-00002116-00000C2A-801418287]","Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" [Source: 00000000-00002116-00000C2A-801742686]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll\" [Source: 00000000-00002116-00000C2A-801799645]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" [Source: 00000000-00002116-00000C2A-801897289]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll\" [Source: 00000000-00002116-00000C2A-801993092]","Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll\" [Source: 00000000-00002116-00000C2A-802159516]","Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll\" [Source: 00000000-00002116-00000C2A-802249479]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll\" [Source: 00000000-00002116-00000C2A-802410558]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll\" [Source: 00000000-00002116-00000C2A-802780340]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll\" [Source: 00000000-00002116-00000C2A-802916136]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll\" [Source: 00000000-00002116-00000C2A-803171867]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll\" [Source: 00000000-00002116-00000C2A-803285172]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll\" [Source: 00000000-00002116-00000C2A-803528196]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll\" [Source: 00000000-00002116-00000C2A-803943132]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\mscorrc.dll\" [Source: 00000000-00002116-00000C2A-804377191]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en\\mscorrc.dll\" [Source: 00000000-00002116-00000C2A-804439884]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll\" [Source: 00000000-00002116-00000C2A-804485549]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll\" [Source: 00000000-00002116-00000C2A-804633742]","Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" [Source: 00000000-00002116-00000C2A-804896566]","Observed system executable string:\"%WINDIR%\\system32\\en-US\\tzres.dll.mui\" [Source: 00000000-00002116-00000C2A-805353239]","Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll\" [Source: 00000000-00002116-00000C2A-805388194]"],"description_v3":[{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00007984-00000C2A-765859497]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00002116-00000C2A-800894708]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" [Source: 00000000-00002116-00000C2A-801222452]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoree.dll\" [Source: 00000000-00002116-00000C2A-801330834]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\combase.dll\" [Source: 00000000-00002116-00000C2A-801418287]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" [Source: 00000000-00002116-00000C2A-801742686]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\ole32.dll\" [Source: 00000000-00002116-00000C2A-801799645]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-l1-1-0.dll\" [Source: 00000000-00002116-00000C2A-801897289]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\oleaut32.dll\" [Source: 00000000-00002116-00000C2A-801993092]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System\\e43dd9c73ab5615e461bf5109c3facd6\\System.ni.dll\" [Source: 00000000-00002116-00000C2A-802159516]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0d59b0e237d7519417de10cd84bda4e7\\System.Core.ni.dll\" [Source: 00000000-00002116-00000C2A-802249479]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\OLEAUT32.dll\" [Source: 00000000-00002116-00000C2A-802410558]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\combase.dll\" [Source: 00000000-00002116-00000C2A-802780340]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\api-ms-win-core-winrt-string-l1-1-0.dll\" [Source: 00000000-00002116-00000C2A-802916136]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\psapi.dll\" [Source: 00000000-00002116-00000C2A-803171867]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_64\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\shell32.dll\" [Source: 00000000-00002116-00000C2A-803285172]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\ntdll.dll\" [Source: 00000000-00002116-00000C2A-803528196]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\wintrust.dll\" [Source: 00000000-00002116-00000C2A-803943132]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\mscorrc.dll\" [Source: 00000000-00002116-00000C2A-804377191]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\en\\mscorrc.dll\" [Source: 00000000-00002116-00000C2A-804439884]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll\" [Source: 00000000-00002116-00000C2A-804485549]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\amsi.dll\" [Source: 00000000-00002116-00000C2A-804633742]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.Net\\assembly\\GAC_MSIL\\System\\v4.0_4.0.0.0__b77a5c561934e089\\crypt32.dll\" [Source: 00000000-00002116-00000C2A-804896566]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\system32\\en-US\\tzres.dll.mui\" [Source: 00000000-00002116-00000C2A-805353239]"},{"type":"linebreak"},{"type":"text","value":"Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\CRYPT32.dll\" [Source: 00000000-00002116-00000C2A-805388194]"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-25","type":9,"relevance":3,"name":"Spawns new processes","description":"$57","description_v2":["Spawned process \"cmd.exe\" with commandline \"/c wmic diskdrive get model,serialnumber\" (UID: 00000000-00007612)","Spawned process \"WMIC.exe\" with commandline \"wmic diskdrive get model,serialnumber\" (UID: 00000000-00007984)","Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_Keyboard get Description,DeviceID\" (UID: 00000000-00002092)","Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_Keyboard get Description,DeviceID\" (UID: 00000000-00004104)","Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description,PNPDeviceID\" (UID: 00000000-00004448)","Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_PointingDevice get Description,PNPDeviceID\" (UID: 00000000-00004276)","Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description,PNPDeviceID\" (UID: 00000000-00003012)","Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_PointingDevice get Description,PNPDeviceID\" (UID: 00000000-00000796)","Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (UID: 00000000-00007884)","Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (UID: 00000000-00005688)","Spawned process \"cmd.exe\" with commandline \"/c wmic get name\" (UID: 00000000-00002920)","Spawned process \"WMIC.exe\" with commandline \"wmic get name\" (UID: 00000000-00007968)","Spawned process \"cmd.exe\" with commandline \"/c powershell -command \"(Get-ItemProperty 'HKCU:\\\\Control Panel\\ ...\" (UID: 00000000-00007200)","Spawned process \"powershell.exe\" with commandline \"powershell -command \"(Get-ItemProperty 'HKCU:\\\\Control Panel\\\\D ...\" (UID: 00000000-00002116)","Spawned process \"cmd.exe\" with commandline \"/c powershell -Command \"Compress-Archive -Path '%TEMP%\\\\runtime\\ ...\" (UID: 00000000-00002124), Spawned process \"powershell.exe\" with commandline \"powershell -Command \"Compress-Archive -Path '%TEMP%\\\\runtime\\\\* ...\" (UID: 00000000-00006864), Spawned process \"cmd.exe\" with commandline \"/c \"\"C:\\\\util.bat\" \"\" (UID: 00000000-00008036), Spawned process \"timeout.exe\" with commandline \"timeout /t 2 /nobreak\" (UID: 00000000-00005028), Spawned process \"cmd.exe\" with commandline \"/c wmic diskdrive get model","serialnumber\" (UID: 00000000-00007552), Spawned process \"WMIC.exe\" with commandline \"wmic diskdrive get model","serialnumber\" (UID: 00000000-00000692), Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_Keyboard get Description","DeviceID\" (UID: 00000000-00002024), Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_Keyboard get Description","DeviceID\" (UID: 00000000-00001260), Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description","PNPDeviceID\" (UID: 00000000-00005676), Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_PointingDevice get Description","PNPDeviceID\" (UID: 00000000-00006364), Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description","PNPDeviceID\" (UID: 00000000-00006804)"],"description_v3":[{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wmic diskdrive get model,serialnumber\""},{"type":"process","process_uid":"00000000-00007612","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic diskdrive get model,serialnumber\""},{"type":"process","process_uid":"00000000-00007984","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_Keyboard get Description,DeviceID\""},{"type":"process","process_uid":"00000000-00002092","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_Keyboard get Description,DeviceID\""},{"type":"process","process_uid":"00000000-00004104","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description,PNPDeviceID\""},{"type":"process","process_uid":"00000000-00004448","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_PointingDevice get Description,PNPDeviceID\""},{"type":"process","process_uid":"00000000-00004276","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description,PNPDeviceID\""},{"type":"process","process_uid":"00000000-00003012","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_PointingDevice get Description,PNPDeviceID\""},{"type":"process","process_uid":"00000000-00000796","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\""},{"type":"process","process_uid":"00000000-00007884","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_DesktopMonitor get Description,PNPDeviceID\""},{"type":"process","process_uid":"00000000-00005688","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wmic get name\""},{"type":"process","process_uid":"00000000-00002920","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic get name\""},{"type":"process","process_uid":"00000000-00007968","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c powershell -command \"(Get-ItemProperty 'HKCU:\\\\Control Panel\\ ...\""},{"type":"process","process_uid":"00000000-00007200","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"powershell.exe\" with commandline \"powershell -command \"(Get-ItemProperty 'HKCU:\\\\Control Panel\\\\D ...\""},{"type":"process","process_uid":"00000000-00002116","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c powershell -Command \"Compress-Archive -Path '%TEMP%\\\\runtime\\ ...\""},{"type":"process","process_uid":"00000000-00002124","label":"Show Process"},{"type":"text","value":", Spawned process \"powershell.exe\" with commandline \"powershell -Command \"Compress-Archive -Path '%TEMP%\\\\runtime\\\\* ...\""},{"type":"process","process_uid":"00000000-00006864","label":"Show Process"},{"type":"text","value":", Spawned process \"cmd.exe\" with commandline \"/c \"\"C:\\\\util.bat\" \"\""},{"type":"process","process_uid":"00000000-00008036","label":"Show Process"},{"type":"text","value":", Spawned process \"timeout.exe\" with commandline \"timeout /t 2 /nobreak\""},{"type":"process","process_uid":"00000000-00005028","label":"Show Process"},{"type":"text","value":", Spawned process \"cmd.exe\" with commandline \"/c wmic diskdrive get model"},{"type":"linebreak"},{"type":"text","value":"serialnumber\""},{"type":"process","process_uid":"00000000-00007552","label":"Show Process"},{"type":"text","value":", Spawned process \"WMIC.exe\" with commandline \"wmic diskdrive get model"},{"type":"linebreak"},{"type":"text","value":"serialnumber\""},{"type":"process","process_uid":"00000000-00000692","label":"Show Process"},{"type":"text","value":", Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_Keyboard get Description"},{"type":"linebreak"},{"type":"text","value":"DeviceID\""},{"type":"process","process_uid":"00000000-00002024","label":"Show Process"},{"type":"text","value":", Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_Keyboard get Description"},{"type":"linebreak"},{"type":"text","value":"DeviceID\""},{"type":"process","process_uid":"00000000-00001260","label":"Show Process"},{"type":"text","value":", Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description"},{"type":"linebreak"},{"type":"text","value":"PNPDeviceID\""},{"type":"process","process_uid":"00000000-00005676","label":"Show Process"},{"type":"text","value":", Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_PointingDevice get Description"},{"type":"linebreak"},{"type":"text","value":"PNPDeviceID\""},{"type":"process","process_uid":"00000000-00006364","label":"Show Process"},{"type":"text","value":", Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description"},{"type":"linebreak"},{"type":"text","value":"PNPDeviceID\""},{"type":"process","process_uid":"00000000-00006804","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-103","type":9,"relevance":3,"name":"Spawns new processes that are not known child processes","description":"$58","description_v2":["Spawned process \"cmd.exe\" with commandline \"/c wmic diskdrive get model,serialnumber\" (UID: 00000000-00007612)","Spawned process \"WMIC.exe\" with commandline \"wmic diskdrive get model,serialnumber\" (UID: 00000000-00007984)","Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_Keyboard get Description,DeviceID\" (UID: 00000000-00002092)","Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_Keyboard get Description,DeviceID\" (UID: 00000000-00004104)","Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description,PNPDeviceID\" (UID: 00000000-00004448)","Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_PointingDevice get Description,PNPDeviceID\" (UID: 00000000-00004276)","Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description,PNPDeviceID\" (UID: 00000000-00003012)","Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_PointingDevice get Description,PNPDeviceID\" (UID: 00000000-00000796)","Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (UID: 00000000-00007884)","Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (UID: 00000000-00005688)","Spawned process \"cmd.exe\" with commandline \"/c wmic get name\" (UID: 00000000-00002920)","Spawned process \"WMIC.exe\" with commandline \"wmic get name\" (UID: 00000000-00007968)","Spawned process \"cmd.exe\" with commandline \"/c powershell -command \"(Get-ItemProperty 'HKCU:\\\\Control Panel\\ ...\" (UID: 00000000-00007200)","Spawned process \"powershell.exe\" with commandline \"powershell -command \"(Get-ItemProperty 'HKCU:\\\\Control Panel\\\\D ...\" (UID: 00000000-00002116)","Spawned process \"cmd.exe\" with commandline \"/c powershell -Command \"Compress-Archive -Path '%TEMP%\\\\runtime\\ ...\" (UID: 00000000-00002124), Spawned process \"powershell.exe\" with commandline \"powershell -Command \"Compress-Archive -Path '%TEMP%\\\\runtime\\\\* ...\" (UID: 00000000-00006864), Spawned process \"cmd.exe\" with commandline \"/c \"\"C:\\\\util.bat\" \"\" (UID: 00000000-00008036), Spawned process \"timeout.exe\" with commandline \"timeout /t 2 /nobreak\" (UID: 00000000-00005028), Spawned process \"cmd.exe\" with commandline \"/c wmic diskdrive get model","serialnumber\" (UID: 00000000-00007552), Spawned process \"WMIC.exe\" with commandline \"wmic diskdrive get model","serialnumber\" (UID: 00000000-00000692), Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_Keyboard get Description","DeviceID\" (UID: 00000000-00002024), Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_Keyboard get Description","DeviceID\" (UID: 00000000-00001260), Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description","PNPDeviceID\" (UID: 00000000-00005676), Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_PointingDevice get Description","PNPDeviceID\" (UID: 00000000-00006364), Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description","PNPDeviceID\" (UID: 00000000-00006804)"],"description_v3":[{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wmic diskdrive get model,serialnumber\""},{"type":"process","process_uid":"00000000-00007612","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic diskdrive get model,serialnumber\""},{"type":"process","process_uid":"00000000-00007984","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_Keyboard get Description,DeviceID\""},{"type":"process","process_uid":"00000000-00002092","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_Keyboard get Description,DeviceID\""},{"type":"process","process_uid":"00000000-00004104","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description,PNPDeviceID\""},{"type":"process","process_uid":"00000000-00004448","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_PointingDevice get Description,PNPDeviceID\""},{"type":"process","process_uid":"00000000-00004276","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description,PNPDeviceID\""},{"type":"process","process_uid":"00000000-00003012","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_PointingDevice get Description,PNPDeviceID\""},{"type":"process","process_uid":"00000000-00000796","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\""},{"type":"process","process_uid":"00000000-00007884","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_DesktopMonitor get Description,PNPDeviceID\""},{"type":"process","process_uid":"00000000-00005688","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wmic get name\""},{"type":"process","process_uid":"00000000-00002920","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic get name\""},{"type":"process","process_uid":"00000000-00007968","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c powershell -command \"(Get-ItemProperty 'HKCU:\\\\Control Panel\\ ...\""},{"type":"process","process_uid":"00000000-00007200","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"powershell.exe\" with commandline \"powershell -command \"(Get-ItemProperty 'HKCU:\\\\Control Panel\\\\D ...\""},{"type":"process","process_uid":"00000000-00002116","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c powershell -Command \"Compress-Archive -Path '%TEMP%\\\\runtime\\ ...\""},{"type":"process","process_uid":"00000000-00002124","label":"Show Process"},{"type":"text","value":", Spawned process \"powershell.exe\" with commandline \"powershell -Command \"Compress-Archive -Path '%TEMP%\\\\runtime\\\\* ...\""},{"type":"process","process_uid":"00000000-00006864","label":"Show Process"},{"type":"text","value":", Spawned process \"cmd.exe\" with commandline \"/c \"\"C:\\\\util.bat\" \"\""},{"type":"process","process_uid":"00000000-00008036","label":"Show Process"},{"type":"text","value":", Spawned process \"timeout.exe\" with commandline \"timeout /t 2 /nobreak\""},{"type":"process","process_uid":"00000000-00005028","label":"Show Process"},{"type":"text","value":", Spawned process \"cmd.exe\" with commandline \"/c wmic diskdrive get model"},{"type":"linebreak"},{"type":"text","value":"serialnumber\""},{"type":"process","process_uid":"00000000-00007552","label":"Show Process"},{"type":"text","value":", Spawned process \"WMIC.exe\" with commandline \"wmic diskdrive get model"},{"type":"linebreak"},{"type":"text","value":"serialnumber\""},{"type":"process","process_uid":"00000000-00000692","label":"Show Process"},{"type":"text","value":", Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_Keyboard get Description"},{"type":"linebreak"},{"type":"text","value":"DeviceID\""},{"type":"process","process_uid":"00000000-00002024","label":"Show Process"},{"type":"text","value":", Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_Keyboard get Description"},{"type":"linebreak"},{"type":"text","value":"DeviceID\""},{"type":"process","process_uid":"00000000-00001260","label":"Show Process"},{"type":"text","value":", Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description"},{"type":"linebreak"},{"type":"text","value":"PNPDeviceID\""},{"type":"process","process_uid":"00000000-00005676","label":"Show Process"},{"type":"text","value":", Spawned process \"WMIC.exe\" with commandline \"wmic path Win32_PointingDevice get Description"},{"type":"linebreak"},{"type":"text","value":"PNPDeviceID\""},{"type":"process","process_uid":"00000000-00006364","label":"Show Process"},{"type":"text","value":", Spawned process \"cmd.exe\" with commandline \"/c wmic path Win32_PointingDevice get Description"},{"type":"linebreak"},{"type":"text","value":"PNPDeviceID\""},{"type":"process","process_uid":"00000000-00006804","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"certificate-0","type":17,"relevance":10,"name":"The input sample is signed with a certificate","description":"$59","description_v2":["The input sample is signed with a certificate issued by \"CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O=\"GoDaddy.com","Inc.\", L=Scottsdale, ST=Arizona, C=US\" (SHA1: 8B:AA:E2:A3:48:3C:0E:62:9D:B5:49:3A:BD:47:60:BA:AD:18:AA:8D; see report for more information)","The input sample is signed with a certificate issued by \"CN=Go Daddy Root Certificate Authority - G2, O=\"GoDaddy.com","Inc.\", L=Scottsdale, ST=Arizona, C=US\" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information)","The input sample is signed with a certificate issued by \"OU=Go Daddy Class 2 Certification Authority, O=\"The Go Daddy Group","Inc.\", C=US\" (SHA1: 34:0B:28:80:F4:46:FC:C0:4E:59:ED:33:F5:2B:3D:08:D6:24:29:64; see report for more information)","The input sample is signed with a certificate issued by \"OU=Go Daddy Class 2 Certification Authority, O=\"The Go Daddy Group","Inc.\", C=US\" (SHA1: 27:96:BA:E6:3F:18:01:E2:77:26:1B:A0:D7:77:70:02:8F:20:EE:E4; see report for more information)","The input sample is signed with a certificate issued by \"CN=Microsoft Corporation\" (SHA1: 02:49:73:49:72:A7:2C:8C:7A:49:A8:3E:AB:A5:D7:28:5D:5D:69:15; see report for more information)","The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information)","The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: B6:C8:AF:83:4D:4E:53:B6:73:C7:68:72:AA:8C:95:0C:7C:54:DF:5F; see report for more information)","The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA, O=\"DigiCert","Inc.\", C=US\" (SHA1: DB:D3:85:EE:62:DB:D2:3E:7B:E4:F6:71:48:50:87:24:D5:86:5B:45; see report for more information)"],"description_v3":[{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O=\"GoDaddy.com"},{"type":"linebreak"},{"type":"text","value":"Inc.\", L=Scottsdale, ST=Arizona, C=US\" (SHA1: 8B:AA:E2:A3:48:3C:0E:62:9D:B5:49:3A:BD:47:60:BA:AD:18:AA:8D; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=Go Daddy Root Certificate Authority - G2, O=\"GoDaddy.com"},{"type":"linebreak"},{"type":"text","value":"Inc.\", L=Scottsdale, ST=Arizona, C=US\" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"OU=Go Daddy Class 2 Certification Authority, O=\"The Go Daddy Group"},{"type":"linebreak"},{"type":"text","value":"Inc.\", C=US\" (SHA1: 34:0B:28:80:F4:46:FC:C0:4E:59:ED:33:F5:2B:3D:08:D6:24:29:64; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"OU=Go Daddy Class 2 Certification Authority, O=\"The Go Daddy Group"},{"type":"linebreak"},{"type":"text","value":"Inc.\", C=US\" (SHA1: 27:96:BA:E6:3F:18:01:E2:77:26:1B:A0:D7:77:70:02:8F:20:EE:E4; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=Microsoft Corporation\" (SHA1: 02:49:73:49:72:A7:2C:8C:7A:49:A8:3E:AB:A5:D7:28:5D:5D:69:15; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: B6:C8:AF:83:4D:4E:53:B6:73:C7:68:72:AA:8C:95:0C:7C:54:DF:5F; see report for more information)"},{"type":"linebreak"},{"type":"text","value":"The input sample is signed with a certificate issued by \"CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA, O=\"DigiCert"},{"type":"linebreak"},{"type":"text","value":"Inc.\", C=US\" (SHA1: DB:D3:85:EE:62:DB:D2:3E:7B:E4:F6:71:48:50:87:24:D5:86:5B:45; see report for more information)"}],"origin":"Certificate Data","attck_id":"T1553.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1553/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-267","type":6,"relevance":1,"name":"Writes files in a temp directory","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\runtime\\history\\history.txt\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\runtime\\clipboard\\clipboard.txt\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\runtime\\pic\\ss.png\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\runtime\\browser\\debug_log.txt\"","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\runtime\\history\\history.txt\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\runtime\\clipboard\\clipboard.txt\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\runtime\\pic\\ss.png\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\runtime\\browser\\debug_log.txt\""],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes to a file \"%TEMP%\\runtime\\history\\history.txt\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes to a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\runtime\\clipboard\\clipboard.txt\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes to a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\runtime\\pic\\ss.png\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes to a file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\runtime\\browser\\debug_log.txt\""}],"origin":"API Call","attck_id":"T1005","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1005","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-396","type":2,"relevance":1,"name":"Contains ability to create/modify Windows services (Powershell command string)","description":"$5a","description_v2":["Found string \"Add-Content\" (Indicator: \"Add-Content\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Import-Alias\" (Indicator: \"Import-Alias\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Import-Csv\" (Indicator: \"Import-Csv\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"New-Alias\" (Indicator: \"New-Alias\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"New-PSDrive\" (Indicator: \"New-PSDrive\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"New-Variable\" (Indicator: \"New-Variable\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"New-Module\" (Indicator: \"New-Module\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Add-PSSnapIn\" (Indicator: \"Add-PSSnapIn\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Add-History\" (Indicator: \"Add-History\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"New-ModuleManifest\" (Indicator: \"New-ModuleManifest\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"New-PSRoleCapabilityFile\" (Indicator: \"New-PSRoleCapabilityFile\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"New-PSTransportOption\" (Indicator: \"New-PSTransportOption\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Register-ArgumentCompleter\" (Indicator: \"Register-ArgumentCompleter\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Add-PSSnapin\" (Indicator: \"Add-PSSnapIn\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Add-Content\" (Indicator: \"Add-Content\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Import-Alias\" (Indicator: \"Import-Alias\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Import-Csv\" (Indicator: \"Import-Csv\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"New-Alias\" (Indicator: \"New-Alias\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"New-PSDrive\" (Indicator: \"New-PSDrive\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"New-Variable\" (Indicator: \"New-Variable\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"New-Module\" (Indicator: \"New-Module\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Add-PSSnapIn\" (Indicator: \"Add-PSSnapIn\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Add-History\" (Indicator: \"Add-History\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"New-ModuleManifest\" (Indicator: \"New-ModuleManifest\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"New-PSRoleCapabilityFile\" (Indicator: \"New-PSRoleCapabilityFile\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"New-PSTransportOption\" (Indicator: \"New-PSTransportOption\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Register-ArgumentCompleter\" (Indicator: \"Register-ArgumentCompleter\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Add-PSSnapin\" (Indicator: \"Add-PSSnapIn\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1543.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1543/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-336","type":2,"relevance":1,"name":"Contains ability to create/update instances of WMI classes (Powershell command string)","description":"Found string \"Set-WMIInstance\" (Indicator: \"Set-WmiInstance\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Set-WMIInstance\" (Indicator: \"Set-WmiInstance\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Set-WMIInstance\" (Indicator: \"Set-WmiInstance\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1546.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1546/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-310","type":2,"relevance":1,"name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","description_v2":["Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-375","type":2,"relevance":1,"name":"Contains reference to background jobs (Powershell command string)","description":"Found string \"Get-Job\" (Indicator: \"Get-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")\n Found string \"Receive-Job\" (Indicator: \"Receive-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")\n Found string \"Remove-Job\" (Indicator: \"Remove-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")\n Found string \"Stop-Job\" (Indicator: \"Stop-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")\n Found string \"Wait-Job\" (Indicator: \"Wait-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")\n Found string \"Resume-Job\" (Indicator: \"Resume-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")\n Found string \"Start-Job\" (Indicator: \"Start-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")\n Found string \"Debug-Job\" (Indicator: \"Debug-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Get-Job\" (Indicator: \"Get-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Receive-Job\" (Indicator: \"Receive-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Remove-Job\" (Indicator: \"Remove-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Stop-Job\" (Indicator: \"Stop-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Wait-Job\" (Indicator: \"Wait-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Resume-Job\" (Indicator: \"Resume-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Start-Job\" (Indicator: \"Start-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Debug-Job\" (Indicator: \"Debug-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Get-Job\" (Indicator: \"Get-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Receive-Job\" (Indicator: \"Receive-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Remove-Job\" (Indicator: \"Remove-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Stop-Job\" (Indicator: \"Stop-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Wait-Job\" (Indicator: \"Wait-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Resume-Job\" (Indicator: \"Resume-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Start-Job\" (Indicator: \"Start-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Debug-Job\" (Indicator: \"Debug-Job\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1197","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1197","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-264","type":6,"relevance":3,"name":"Creates a thread in a self process","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"WMIC.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","\"WMIC.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)"}],"origin":"API Call","attck_id":"T1055.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1055/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"$5b","description_v2":["\"svchost.exe.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows 7 sections\"- [targetUID: N/A]","\"svchost.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows 7 sections\"- Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe]- [targetUID: 00000000-00005044]","\"util.bat\" has type \"DOS batch file ASCII text with CRLF line terminators\"- Location: [C:\\util.bat]- [targetUID: 00000000-00005044]","\"firefox_profile_temp.db\" has type \"SQLite 3.x database user version 52 last written using SQLite version 3025001 page size 32768 writer version 2 read version 2 file counter 5 database pages 39 cookie 0x21 schema 4 UTF-8 version-valid-for 5\"- Location: [C:\\firefox_profile_temp.db]- [targetUID: 00000000-00005044]","\"ss.png\" has type \"PNG image data 1280 x 1024 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\runtime\\pic\\ss.png]- [targetUID: 00000000-00006864]","\"runtime.zip\" has type \"Zip archive data at least v2.0 to extract compression method=deflate\"- Location: [%TEMP%\\runtime.zip]- [targetUID: 00000000-00006864]","\"edge_history_temp.db\" has type \"SQLite 3.x database last written using SQLite version 3039003 file counter 17 database pages 41 cookie 0x39 schema 4 UTF-8 version-valid-for 17\"- Location: [C:\\edge_history_temp.db]- [targetUID: 00000000-00005044]","\"chrome_history_temp.db\" has type \"SQLite 3.x database last written using SQLite version 3044002 file counter 1 database pages 40 cookie 0x21 schema 4 UTF-8 version-valid-for 1\"- Location: [C:\\chrome_history_temp.db]- [targetUID: 00000000-00005044]","\"edge_Data.db\" has type \"SQLite 3.x database last written using SQLite version 3038005 page size 2048 file counter 2 database pages 27 cookie 0x10 schema 4 UTF-8 version-valid-for 2\"- Location: [C:\\edge_Data.db]- [targetUID: 00000000-00005044]","\"chrome_Data.db\" has type \"SQLite 3.x database last written using SQLite version 3044002 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1\"- Location: [C:\\chrome_Data.db]- [targetUID: 00000000-00005044]","\"history.txt\" has type \"ASCII text with very long lines (1728) with CRLF line terminators\"- Location: [%TEMP%\\runtime\\history\\history.txt]- [targetUID: 00000000-00006864]","\"debug_log.txt\" has type \"ASCII text with CRLF line terminators\"- Location: [%TEMP%\\runtime\\browser\\debug_log.txt]- [targetUID: 00000000-00006864]","\"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002116]","\"clipboard.txt\" has type \"ASCII text with no line terminators\"- Location: [%TEMP%\\runtime\\clipboard\\clipboard.txt]- [targetUID: 00000000-00006864]","\"svchost.exe%3AZone.Identifier\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]","\"tokens.txt\" has type \"ASCII text with CRLF line terminators\"- Location: [%TEMP%\\runtime\\browser\\tokens.txt]- [targetUID: 00000000-00006864]"],"description_v3":[{"type":"text","value":"\"svchost.exe.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows 7 sections\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows 7 sections\"- Location: [%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe]- [targetUID: 00000000-00005044]"},{"type":"linebreak"},{"type":"text","value":"\"util.bat\" has type \"DOS batch file ASCII text with CRLF line terminators\"- Location: [C:\\util.bat]- [targetUID: 00000000-00005044]"},{"type":"linebreak"},{"type":"text","value":"\"firefox_profile_temp.db\" has type \"SQLite 3.x database user version 52 last written using SQLite version 3025001 page size 32768 writer version 2 read version 2 file counter 5 database pages 39 cookie 0x21 schema 4 UTF-8 version-valid-for 5\"- Location: [C:\\firefox_profile_temp.db]- [targetUID: 00000000-00005044]"},{"type":"linebreak"},{"type":"text","value":"\"ss.png\" has type \"PNG image data 1280 x 1024 8-bit/color RGBA non-interlaced\"- Location: [%TEMP%\\runtime\\pic\\ss.png]- [targetUID: 00000000-00006864]"},{"type":"linebreak"},{"type":"text","value":"\"runtime.zip\" has type \"Zip archive data at least v2.0 to extract compression method=deflate\"- Location: [%TEMP%\\runtime.zip]- [targetUID: 00000000-00006864]"},{"type":"linebreak"},{"type":"text","value":"\"edge_history_temp.db\" has type \"SQLite 3.x database last written using SQLite version 3039003 file counter 17 database pages 41 cookie 0x39 schema 4 UTF-8 version-valid-for 17\"- Location: [C:\\edge_history_temp.db]- [targetUID: 00000000-00005044]"},{"type":"linebreak"},{"type":"text","value":"\"chrome_history_temp.db\" has type \"SQLite 3.x database last written using SQLite version 3044002 file counter 1 database pages 40 cookie 0x21 schema 4 UTF-8 version-valid-for 1\"- Location: [C:\\chrome_history_temp.db]- [targetUID: 00000000-00005044]"},{"type":"linebreak"},{"type":"text","value":"\"edge_Data.db\" has type \"SQLite 3.x database last written using SQLite version 3038005 page size 2048 file counter 2 database pages 27 cookie 0x10 schema 4 UTF-8 version-valid-for 2\"- Location: [C:\\edge_Data.db]- [targetUID: 00000000-00005044]"},{"type":"linebreak"},{"type":"text","value":"\"chrome_Data.db\" has type \"SQLite 3.x database last written using SQLite version 3044002 page size 2048 file counter 1 database pages 20 cookie 0xb schema 4 UTF-8 version-valid-for 1\"- Location: [C:\\chrome_Data.db]- [targetUID: 00000000-00005044]"},{"type":"linebreak"},{"type":"text","value":"\"history.txt\" has type \"ASCII text with very long lines (1728) with CRLF line terminators\"- Location: [%TEMP%\\runtime\\history\\history.txt]- [targetUID: 00000000-00006864]"},{"type":"linebreak"},{"type":"text","value":"\"debug_log.txt\" has type \"ASCII text with CRLF line terminators\"- Location: [%TEMP%\\runtime\\browser\\debug_log.txt]- [targetUID: 00000000-00006864]"},{"type":"linebreak"},{"type":"text","value":"\"StartupProfileData-NonInteractive\" has type \"data\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00002116]"},{"type":"linebreak"},{"type":"text","value":"\"clipboard.txt\" has type \"ASCII text with no line terminators\"- Location: [%TEMP%\\runtime\\clipboard\\clipboard.txt]- [targetUID: 00000000-00006864]"},{"type":"linebreak"},{"type":"text","value":"\"svchost.exe%3AZone.Identifier\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]"},{"type":"linebreak"},{"type":"text","value":"\"tokens.txt\" has type \"ASCII text with CRLF line terminators\"- Location: [%TEMP%\\runtime\\browser\\tokens.txt]- [targetUID: 00000000-00006864]"}],"origin":"Binary File","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-177","type":3,"relevance":1,"name":"Opens registry keys","description":"$5c","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\\CUSTOMATTRIBUTES\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\\DIAGNOSIS\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\DEBUGINFORMATION\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\\CUSTOMATTRIBUTES\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\PACKAGEDCOM\\TREATASCLASSINDEX\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\PACKAGEDCOM\\CLASSINDEX\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{00000339-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00000339-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{00000339-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{00000339-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\PACKAGEDCOM\\CLASSINDEX\\{00000339-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\\CUSTOMATTRIBUTES\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\OLE\\DIAGNOSIS\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\DEBUGINFORMATION\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\\CUSTOMATTRIBUTES\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\PACKAGEDCOM\\TREATASCLASSINDEX\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\PACKAGEDCOM\\CLASSINDEX\\{0000032A-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CLSID\\{00000339-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00000339-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\WOW6432NODE\\CLSID\\{00000339-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{00000339-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\PACKAGEDCOM\\CLASSINDEX\\{00000339-0000-0000-C000-000000000046}\"; Key: \"\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-235","type":6,"relevance":1,"name":"Queries basic information of the specified process","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" queries basic process information of the \"C:\\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (UID: 5044)","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" queries basic process information of the \"C:\\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (UID: 5044)"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" queries basic process information of the \"C:\\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (UID: 5044)"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"registry-172","type":3,"relevance":1,"name":"Queries registry keys","description":"$5d","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"ACTIVATIONTYPE\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"SERVER\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"DLLPATH\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"THREADING\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"TRUSTLEVEL\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"REMOTESERVER\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"ACTIVATEASUSER\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"ACTIVATEINSHAREDBROKER\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"PERMISSIONS\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"EXEPATH\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"COMMANDLINE\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"IDENTITYTYPE\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"PERMISSIONS\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"ACTIVATABLECLASSES\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"SERVERTYPE\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"APPID\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"IDENTITY\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"SERVICENAME\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"EXPLICITPSMACTIVATIONTYPE\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\\PROXYSTUBCLSID32\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\"; Key: \"\"; Value: \"\")","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\\INPROCSERVER32\"; Key: \"INPROCSERVER32\"; Value: \"\")"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"ACTIVATIONTYPE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"SERVER\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"DLLPATH\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"THREADING\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"TRUSTLEVEL\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"REMOTESERVER\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"ACTIVATEASUSER\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"ACTIVATEINSHAREDBROKER\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\ACTIVATABLECLASSID\\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\"; Key: \"PERMISSIONS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"EXEPATH\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"COMMANDLINE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"IDENTITYTYPE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"PERMISSIONS\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"ACTIVATABLECLASSES\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"SERVERTYPE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"APPID\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"IDENTITY\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"SERVICENAME\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWSRUNTIME\\SERVER\\STATEREPOSITORY\"; Key: \"EXPLICITPSMACTIVATIONTYPE\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\INTERFACE\\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\\PROXYSTUBCLSID32\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\"; Key: \"\"; Value: \"\")"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\\INPROCSERVER32\"; Key: \"INPROCSERVER32\"; Value: \"\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-243","type":6,"relevance":1,"name":"Reads files","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" reads file \"c:\\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" reads file \"c:\\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe:zone.identifier\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\local state\"","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" reads file \"c:\\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" reads file \"c:\\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe:zone.identifier\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\google\\chrome\\user data\\local state\""],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" reads file \"c:\\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" reads file \"c:\\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe:zone.identifier\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" reads file \"%LOCALAPPDATA%\\google\\chrome\\user data\\local state\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"string-185","type":2,"relevance":1,"name":"References powershell process","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" (Indicator: \"cmd.exe /c powershell\"; Source: \"00000000-00005044-00000C46-88337136890\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -Destin\" (Indicator: \"cmd.exe /c powershell\"; Source: \"00000000-00005044-00000C46-115678154006\")","description_v2":["Found string \"%WINDIR%\\system32\\cmd.exe /c powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" (Indicator: \"cmd.exe /c powershell\"; Source: \"00000000-00005044-00000C46-88337136890\")","Found string \"%WINDIR%\\system32\\cmd.exe /c powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -Destin\" (Indicator: \"cmd.exe /c powershell\"; Source: \"00000000-00005044-00000C46-115678154006\")"],"description_v3":[{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" (Indicator: \"cmd.exe /c powershell\"; Source: \"00000000-00005044-00000C46-88337136890\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"%WINDIR%\\system32\\cmd.exe /c powershell -Command \"Compress-Archive -Path '%TEMP%\\runtime\\*' -Destin\" (Indicator: \"cmd.exe /c powershell\"; Source: \"00000000-00005044-00000C46-115678154006\")"}],"origin":"File/Memory","attck_id":"T1059.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"summary-29","type":15,"relevance":1,"name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using web history\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution (Powershell command string)\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: The input sample contains a known anti-VM trick\n Matched sigs: Contains ability to delay the execution of current thread","description_v2":["The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)","Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)","Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)","Matched sigs: Able to identify virtual environment by using web history","Matched sigs: Able to identify virtual environment by using API string","Matched sigs: Contains ability to delay execution (Powershell command string)","Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","Matched sigs: The input sample contains a known anti-VM trick","Matched sigs: Contains ability to delay the execution of current thread"],"description_v3":[{"type":"text","value":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to identify virtual environment by using web history"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Able to identify virtual environment by using API string"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to delay execution (Powershell command string)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: The input sample contains a known anti-VM trick"},{"type":"linebreak"},{"type":"text","value":"Matched sigs: Contains ability to delay the execution of current thread"}],"origin":"Indicator Combinations","attck_id":"T1480","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1480","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-263","type":6,"relevance":1,"name":"Touches files","description":"$5e","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\810D4850EE216DF639648A37004A0D4D1275A194924FA53312D3403BE97EDF5C.EXE.LOCAL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_46b9c4e9edf1cfa5\\GdiPlus.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\BCRYPT.DLL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\bcrypt.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\ucrtbase.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\msasn1.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\crypt32.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\win32u.dll\""],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"%WINDIR%\\System32\\apphelp.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\810D4850EE216DF639648A37004A0D4D1275A194924FA53312D3403BE97EDF5C.EXE.LOCAL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_46b9c4e9edf1cfa5\\GdiPlus.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\BCRYPT.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\bcrypt.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\ucrtbase.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\msasn1.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\crypt32.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to touch file \"C:\\Windows\\System32\\win32u.dll\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-55","type":6,"relevance":7,"name":"Touches files in the Windows directory","description":"$5f","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe:Zone.Identifier\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe:Zone.Identifier\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"","\"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","\"powershell.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\"","\"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\""],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe:Zone.Identifier\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe:Zone.Identifier\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-173","type":6,"relevance":1,"name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","description_v2":["\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"","\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","\"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"","\"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","\"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"","\"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","\"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"","\"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\""],"description_v3":[{"type":"text","value":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" trying to access file \"C:\\Users\\%USERNAME%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\""},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-126","type":6,"relevance":3,"name":"Tries to access non-existent files (executable)","description":"$60","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\BCRYPT.DLL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\DPAPI.DLL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\DPAPI.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CRYPTBASE.DLL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CRYPTBASE.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\WINDOWSCODECS.DLL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\WindowsCodecs.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CLDAPI.DLL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CLDAPI.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\AEPIC.DLL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\AEPIC.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\PROPSYS.DLL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\PROPSYS.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\EDPUTIL.DLL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\edputil.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\URLMON.DLL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\urlmon.dll\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\IERTUTIL.DLL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\iertutil.dll\"","\"WMIC.exe\" trying to access non-existent file \"C:\\Windows\\System32\\wbem\\IPHLPAPI.DLL\"","\"WMIC.exe\" trying to access non-existent file \"C:\\Windows\\System32\\wbem\\FRAMEDYNOS.DLL\"","\"WMIC.exe\" trying to access non-existent file \"C:\\Windows\\System32\\wbem\\SSPICLI.DLL\"","\"WMIC.exe\" trying to access non-existent file \"C:\\Windows\\System32\\wbem\\FLTLIB.DLL\""],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\BCRYPT.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\DPAPI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\DPAPI.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CRYPTBASE.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CRYPTBASE.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"%WINDIR%\\ODECS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\WindowsCodecs.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CLDAPI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CLDAPI.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\AEPIC.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\AEPIC.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\PROPSYS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\PROPSYS.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\EDPUTIL.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\edputil.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\URLMON.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\urlmon.dll\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\IERTUTIL.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\iertutil.dll\""},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" trying to access non-existent file \"C:\\Windows\\System32\\wbem\\IPHLPAPI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" trying to access non-existent file \"C:\\Windows\\System32\\wbem\\FRAMEDYNOS.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" trying to access non-existent file \"C:\\Windows\\System32\\wbem\\SSPICLI.DLL\""},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" trying to access non-existent file \"C:\\Windows\\System32\\wbem\\FLTLIB.DLL\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-161","type":6,"relevance":3,"name":"Tries to access non-existent files (non-executable)","description":"$61","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\810D4850EE216DF639648A37004A0D4D1275A194924FA53312D3403BE97EDF5C.EXE.LOCAL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CHROME_DATA.DB-JOURNAL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CHROME_DATA.DB-WAL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\EDGE_DATA.DB-JOURNAL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\EDGE_DATA.DB-WAL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CHROME_HISTORY_TEMP.DB-JOURNAL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CHROME_HISTORY_TEMP.DB-WAL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\EDGE_HISTORY_TEMP.DB-JOURNAL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\EDGE_HISTORY_TEMP.DB-WAL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\FIREFOX_PROFILE_TEMP.DB-JOURNAL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\FIREFOX_PROFILE_TEMP.DB-WAL\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\FIREFOX_PROFILE_TEMP.DB-SHM\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\runtime\\HISTORY\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\runtime\\CLIPBOARD\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\DISCORD\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\DISCORDCANARY\""],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\810D4850EE216DF639648A37004A0D4D1275A194924FA53312D3403BE97EDF5C.EXE.LOCAL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CHROME_DATA.DB-JOURNAL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CHROME_DATA.DB-WAL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\EDGE_DATA.DB-JOURNAL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\EDGE_DATA.DB-WAL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CHROME_HISTORY_TEMP.DB-JOURNAL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\CHROME_HISTORY_TEMP.DB-WAL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\EDGE_HISTORY_TEMP.DB-JOURNAL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\EDGE_HISTORY_TEMP.DB-WAL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\FIREFOX_PROFILE_TEMP.DB-JOURNAL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\FIREFOX_PROFILE_TEMP.DB-WAL\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\FIREFOX_PROFILE_TEMP.DB-SHM\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"%TEMP%\\runtime\\HISTORY\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\runtime\\CLIPBOARD\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\DISCORD\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" trying to access non-existent file \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\DISCORDCANARY\""}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-242","type":6,"relevance":1,"name":"Writes files","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\svchost.exe\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\svchost.exe:zone.identifier\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\chrome_data.db\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\edge_data.db\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\chrome_history_temp.db\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\edge_history_temp.db\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\firefox_profile_temp.db\"","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\svchost.exe\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\svchost.exe:zone.identifier\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\chrome_data.db\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\edge_data.db\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\chrome_history_temp.db\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\edge_history_temp.db\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\firefox_profile_temp.db\""],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"%APPDATA%\\microsoft\\windows\\start menu\\programs\\startup\\svchost.exe\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"C:\\Users\\%USERNAME%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\svchost.exe:zone.identifier\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\chrome_data.db\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\edge_data.db\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\chrome_history_temp.db\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\edge_history_temp.db\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes file \"c:\\firefox_profile_temp.db\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistence","identifier":"api-159","type":6,"relevance":1,"name":"Writes log files","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes a file \"C:\\chrome_Data.db\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes a file \"C:\\edge_Data.db\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes a file \"C:\\chrome_history_temp.db\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes a file \"C:\\edge_history_temp.db\"\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes a file \"C:\\firefox_profile_temp.db\"","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes a file \"C:\\chrome_Data.db\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes a file \"C:\\edge_Data.db\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes a file \"C:\\chrome_history_temp.db\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes a file \"C:\\edge_history_temp.db\"","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes a file \"C:\\firefox_profile_temp.db\""],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes a file \"C:\\chrome_Data.db\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes a file \"C:\\edge_Data.db\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes a file \"C:\\chrome_history_temp.db\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes a file \"C:\\edge_history_temp.db\""},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" writes a file \"C:\\firefox_profile_temp.db\""}],"origin":"API Call","attck_id":"T1074.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1074/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-176","type":2,"relevance":1,"name":"Contains Tor Onion URL","description":"\".onion\" (Indicator: \".onion\") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\n \".onion.\" (Indicator: \".onion\") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\n \"Not resolving .onion address (RFC 7686)\" (Indicator: \".onion\") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\n \".onion\" (Indicator: \".onion\") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\n \".onion.\" (Indicator: \".onion\") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\n \"Not resolving .onion address (RFC 7686)\" (Indicator: \".onion\") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp","description_v2":["\".onion\" (Indicator: \".onion\") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c","\".onion.\" (Indicator: \".onion\") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c","\"Not resolving .onion address (RFC 7686)\" (Indicator: \".onion\") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c","\".onion\" (Indicator: \".onion\") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp","\".onion.\" (Indicator: \".onion\") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp","\"Not resolving .onion address (RFC 7686)\" (Indicator: \".onion\") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp"],"description_v3":[{"type":"text","value":"\".onion\" (Indicator: \".onion\") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c"},{"type":"linebreak"},{"type":"text","value":"\".onion.\" (Indicator: \".onion\") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c"},{"type":"linebreak"},{"type":"text","value":"\"Not resolving .onion address (RFC 7686)\" (Indicator: \".onion\") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c"},{"type":"linebreak"},{"type":"text","value":"\".onion\" (Indicator: \".onion\") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\".onion.\" (Indicator: \".onion\") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"\"Not resolving .onion address (RFC 7686)\" (Indicator: \".onion\") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp"}],"origin":"File/Memory","attck_id":"T1090.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1090/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-228","type":2,"relevance":1,"name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1095","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1095","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-601","type":2,"relevance":1,"name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-377","type":2,"relevance":1,"name":"Contains ability to copy items (Powershell command string)","description":"Found string \"Copy-ItemProperty\" (Indicator: \"Copy-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Copy-ItemProperty\" (Indicator: \"Copy-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Copy-ItemProperty\" (Indicator: \"Copy-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-210","type":2,"relevance":1,"name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1559","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1559","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-282","type":2,"relevance":1,"name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"Invoke-WebRequest\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Invoke-WebRequest\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Invoke-WebRequest\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-378","type":2,"relevance":1,"name":"Contains ability to move items (Powershell command string)","description":"Found string \"Move-ItemProperty\" (Indicator: \"Move-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Move-ItemProperty\" (Indicator: \"Move-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Move-ItemProperty\" (Indicator: \"Move-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1570","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1570","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-419","type":2,"relevance":1,"name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"calling setsockopt()\" (Indicator: \"setsockopt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"calling setsockopt()\" (Indicator: \"setsockopt\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"calling setsockopt()\" (Indicator: \"setsockopt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"calling setsockopt()\" (Indicator: \"setsockopt\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"calling setsockopt()\" (Indicator: \"setsockopt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"calling setsockopt()\" (Indicator: \"setsockopt\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1571","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1571","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-576","type":2,"relevance":1,"name":"Contains ability to transfer data using curl","description":"Observed string: \"ALPN: curl offers %s\" (Indicator: \" curl \") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\n Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp\n Observed string: \"ALPN: curl offers %s\" (Indicator: \" curl \") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\n Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp","description_v2":["Observed string: \"ALPN: curl offers %s\" (Indicator: \" curl \") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c","Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp","Observed string: \"ALPN: curl offers %s\" (Indicator: \" curl \") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp","Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp"],"description_v3":[{"type":"text","value":"Observed string: \"ALPN: curl offers %s\" (Indicator: \" curl \") in Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00002116.00000000.115026.172D0000.00000004.mdmp"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"ALPN: curl offers %s\" (Indicator: \" curl \") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp"},{"type":"linebreak"},{"type":"text","value":"Observed string: \"curl\" (Indicator: \"curl\") in Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp"}],"origin":"File/Memory","attck_id":"T1105","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1105","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-499","type":2,"relevance":1,"name":"Contains reference to Mail transfer protocol","description":"$62","description_v2":["Found string \"id-on-SmtpUTF8Mailbox\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Smtp UTF8 Mailbox\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"othername: SmtpUTF8Mailbox\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"othername:SmtpUTF8Mailbox:%.*s\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"smtp.\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"smtps\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"cr-smtp-eob\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"SMTPUTF8\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Got unexpected smtp-server response: %d\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"smtp_done(status=%d, premature=%d) -> %d\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"smtp_perform(), start\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"smtp_perform() -> %d, connected=%d, done=%d\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"smtp_do() -> %d, done=%d\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"smtp_disconnect(), finished\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"smtp_doing() -> %d, done=%d\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"smtp_regular_transfer() -> %d, done=%d\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"smtp_setup_connection() -> %d\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"],"description_v3":[{"type":"text","value":"Found string \"id-on-SmtpUTF8Mailbox\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Smtp UTF8 Mailbox\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"othername: SmtpUTF8Mailbox\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"othername:SmtpUTF8Mailbox:%.*s\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"smtp.\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"smtps\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"cr-smtp-eob\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"SMTPUTF8\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Got unexpected smtp-server response: %d\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"smtp_done(status=%d, premature=%d) -> %d\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"smtp_perform(), start\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"smtp_perform() -> %d, connected=%d, done=%d\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"smtp_do() -> %d, done=%d\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"smtp_disconnect(), finished\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"smtp_doing() -> %d, done=%d\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"smtp_regular_transfer() -> %d, done=%d\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"smtp_setup_connection() -> %d\" (Indicator: \"smtp\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"}],"origin":"File/Memory","attck_id":"T1071.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-494","type":2,"relevance":1,"name":"Contains reference to OpenSSL library string","description":"Found string \"openssl-version\" (Indicator: \"openssl-\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found string \"openssl-version\" (Indicator: \"openssl-\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found string \"openssl-version\" (Indicator: \"openssl-\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"openssl-version\" (Indicator: \"openssl-\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"openssl-version\" (Indicator: \"openssl-\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"openssl-version\" (Indicator: \"openssl-\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1573.002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573/002","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-186","type":2,"relevance":1,"name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"edge_history_temp.db\")\n Found string \"api.telegram.org\" (Indicator: \"api.telegram.org\"; File: \"PCAP\")\n Found string \"https://api.telegram.org/bot\" (Indicator: \"api.telegram.org\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found string \"https://api.telegram.org/bot\" (Indicator: \"api.telegram.org\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"edge_history_temp.db\")","Found string \"api.telegram.org\" (Indicator: \"api.telegram.org\"; File: \"PCAP\")","Found string \"https://api.telegram.org/bot\" (Indicator: \"api.telegram.org\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"https://api.telegram.org/bot\" (Indicator: \"api.telegram.org\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"file/memory contains long string with (Indicator: \"githubusercontent.com\"; File: \"edge_history_temp.db\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"api.telegram.org\" (Indicator: \"api.telegram.org\"; File: \"PCAP\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"https://api.telegram.org/bot\" (Indicator: \"api.telegram.org\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"https://api.telegram.org/bot\" (Indicator: \"api.telegram.org\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1102","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1102","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-169","type":2,"relevance":1,"name":"Found mail related domain names","description":"Observed email domain:\"imap.\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]\n Observed email domain:\"smtp.\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]\n Observed email domain:\"pop3.\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]\n Observed email domain:\"imap.\" [Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp]\n Observed email domain:\"smtp.\" [Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp]\n Observed email domain:\"pop3.\" [Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp]","description_v2":["Observed email domain:\"imap.\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]","Observed email domain:\"smtp.\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]","Observed email domain:\"pop3.\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]","Observed email domain:\"imap.\" [Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp]","Observed email domain:\"smtp.\" [Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp]","Observed email domain:\"pop3.\" [Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp]"],"description_v3":[{"type":"text","value":"Observed email domain:\"imap.\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]"},{"type":"linebreak"},{"type":"text","value":"Observed email domain:\"smtp.\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]"},{"type":"linebreak"},{"type":"text","value":"Observed email domain:\"pop3.\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]"},{"type":"linebreak"},{"type":"text","value":"Observed email domain:\"imap.\" [Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed email domain:\"smtp.\" [Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp]"},{"type":"linebreak"},{"type":"text","value":"Observed email domain:\"pop3.\" [Source: 00000000-00005044.00000001.114529.BDF04000.00000002.mdmp]"}],"origin":"File/Memory","attck_id":"T1071.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-14","type":2,"relevance":0,"name":"Found potential IP address in binary/memory","description":"$63","description_v2":["Potential IP \"1.3.101.110\" found in string \"X25519:1.3.101.110\"","Potential IP \"1.3.101.111\" found in string \"X448:1.3.101.111\"","Potential IP \"1.3.101.112\" found in string \"ED25519:1.3.101.112\"","Potential IP \"1.3.101.113\" found in string \"ED448:1.3.101.113\"","\"1.2.0.4\"","Potential IP \"127.0.0.1\" found in string \"127.0.0.1/\"","\"127.0.0.1\"","\"2.5.29.17\"","\"2.5.4.3\"","\"2.5.4.4\"","\"2.5.4.5\"","\"2.5.4.6\"","\"2.5.4.7\"","\"2.5.4.8\"","\"2.5.4.9\"","\"2.5.4.10\"","\"2.5.4.11\"","\"2.5.4.12\"","\"2.5.4.13\"","\"2.5.4.17\"","\"2.5.4.41\"","\"2.5.4.42\"","\"2.5.4.43\"","\"2.5.4.44\"","\"2.5.4.45\"","\"2.5.4.46\"","\"2.5.4.65\"","\"2.5.4.72\"","\"2.5.29.18\"","\"2.5.29.19\"","\"2.5.29.37\"","\"2.5.29.35\"","\"192.168.0.2\"","Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\"","Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\"","Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"","\"2.5.29.31\"","\"2.5.29.14\"","Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"","\"2.5.29.32\"","\"2.5.29.15\"","\"2.5.29.1\"","\"2.5.29.10\"","\"2.5.29.16\"","\"1.1.0.1\"","\"3.0.0.0\"","Potential IP \"1.0.0.0\" found in string \"icrosoft.Management.Infrastructure,1.0.0.0,,31bf3856ad364e35\""],"description_v3":[{"type":"text","value":"Potential IP \"1.3.101.110\" found in string \"X25519:1.3.101.110\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"1.3.101.111\" found in string \"X448:1.3.101.111\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"1.3.101.112\" found in string \"ED25519:1.3.101.112\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"1.3.101.113\" found in string \"ED448:1.3.101.113\""},{"type":"linebreak"},{"type":"text","value":"\"1.2.0.4\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"127.0.0.1\" found in string \"127.0.0.1/\""},{"type":"linebreak"},{"type":"text","value":"\"127.0.0.1\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.17\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.3\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.4\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.5\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.6\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.7\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.8\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.9\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.10\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.11\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.12\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.13\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.17\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.41\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.42\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.43\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.44\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.45\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.46\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.65\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.4.72\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.18\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.19\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.37\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.35\""},{"type":"linebreak"},{"type":"text","value":"\"192.168.0.2\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"3.0.0.0\" found in string \"ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.31\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.14\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.32\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.15\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.1\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.10\""},{"type":"linebreak"},{"type":"text","value":"\"2.5.29.16\""},{"type":"linebreak"},{"type":"text","value":"\"1.1.0.1\""},{"type":"linebreak"},{"type":"text","value":"\"3.0.0.0\""},{"type":"linebreak"},{"type":"text","value":"Potential IP \"1.0.0.0\" found in string \"icrosoft.Management.Infrastructure,1.0.0.0,,31bf3856ad364e35\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":3,"name":"Found potential URL in binary/memory","description":"$64","description_v2":["Pattern match: \"support.mozilla.org/en-us/products/firefoxgro.allizom.troppus.inzda42ct3f8+https://app.vssps.visualstudio.com/_signin?realm=my.visualstudio.com&reply_to=https%3a%2f%2fmy.visualstudio.com%2fbenefits%3fwt.mc_id%3do~msft~vscom~nav%26campaign%3do~msft~vscom~na\"","Pattern match: \"cd.-m.rpwy/l2=szgdvi&i@n'?@_+'o{8a\"","Pattern match: \"8t.ni/n8k&-4a=f]3s\\zu9i8;h{8ft2\"","Pattern match: \"www.msn.com/http://www.msn.com/application/pdfapplication/pdf1g==6d0c0e84-9621-41fc-a654-a231247bd648c:\\users\\hapubws\\downloads\\chromesetup.exec:\\users\\hapubws\\downloads\\chromesetup.exe.6ghttps://www.google.com/https://www.google.com/chrome/bsem/download/e\"","Pattern match: \"https://www.msn.com/en-ca\"","Pattern match: \"www.instagram.com/justinbieber\"","Heuristic match: \"api.telegram.org\"","Pattern match: \"https://curl.se/docs/http-cookies.html#\"","Heuristic match: \"ftp@example.com\"","Pattern match: \"https://curl.se/docs/alt-svc.html#\"","Pattern match: \"https://curl.se/docs/hsts.html#\"","Heuristic match: \".onion\"","Pattern match: \"https://api.telegram.org/bot\"","Pattern match: \"microsoft.net/framework64/v4.0.30319/\"","Heuristic match: \"microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Heuristic match: \"microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Pattern match: \"http://www.microsoft.com0\"","Pattern match: \"www.digicert.com1$0\"","Pattern match: \"http://www.microsoft.com/windows\"","Pattern match: \"crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z\"","Pattern match: \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0\"","Pattern match: \"www.microsoft.com/pki/docs/cps/default.htm0@\"","Pattern match: \"crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z\"","Pattern match: \"http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0\"","Heuristic match: \".0.0.0.net\"","Heuristic match: \"c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Heuristic match: \":\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Pattern match: \"microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll\"","Heuristic match: \":\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Heuristic match: \"??\\c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Heuristic match: \"ntrust.net\"","Pattern match: \"http://crl.comodoca.com/comodorsacertificationauthority.crl0q\"","Pattern match: \"http://crt.comodoca.com/comodorsaaddtrustca.crt0$\"","Pattern match: \"http://ocsp.comodoca.com0\"","Pattern match: \"http://certs.godaddy.com/repository/1301\"","Pattern match: \"http://ocsp.godaddy.com/05\"","Pattern match: \"http://crl.godaddy.com/gdroot-g2.crl0f\"","Pattern match: \"https://certs.godaddy.com/repository/0\"","Pattern match: \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v\"","Pattern match: \"crt.usertrust.com/usertrustrsaaddtrustca.crt0%\"","Pattern match: \"http://ocsp.usertrust.com0\"","Pattern match: \"http://ocsp.thawte.com0\"","Pattern match: \"https://www.thawte.com/cps07\"","Pattern match: \"http://crl.thawte.com/thawtepca-g3.crl0\"","Pattern match: \"https://www.alphassl.com/repository/03\"","Pattern match: \"http://crl.globalsign.net/root.crl0=\"","Pattern match: \"http://ocsp.globalsign.com/rootr10\"","Pattern match: \"http://g1.symcb.com/crls/gtglobal.crl0/\"","Pattern match: \"http://g2.symcb.com0l\"","Pattern match: \"http://www.geotrust.com/resources/cps0\"","Pattern match: \"www.digicert.com1+0\"","Pattern match: \"www.digicert.com1/0-\"","Pattern match: \"http://ocsp.digicert.com0k\"","Pattern match: \"http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=\"","Pattern match: \"https://www.digicert.com/cps0\"","Pattern match: \"https://www.globalsign.com/repository/03\"","Pattern match: \"http://s2.symcb.com0\"","Pattern match: \"http://www.symauth.com/cps0\"","Pattern match: \"http://www.symauth.com/rpa00\"","Pattern match: \"http://s1.symcb.com/pca3-g5.crl0\"","Pattern match: \"www.digicert.com1\"","Pattern match: \"http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=\"","Pattern match: \"crl.usertrust.com/addtrustexternalcaroot.crl05\"","Pattern match: \"crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^\"","Pattern match: \"www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0\"","Pattern match: \"http://s2.symcb.com0k\"","Pattern match: \"http://www.symauth.com/rpa0\"","Pattern match: \"www.verisign.com/cps\"","Pattern match: \"https://www.verisign.com/cps04\"","Pattern match: \"http://crl.verisign.com/pca3.crl0\"","Pattern match: \"www.microsoft.com/pkiops/docs/repository.htm\"","Pattern match: \"http://crl.globalsign.net/root-r2.crl0\"","Pattern match: \"http://crl.securetrust.com/stca.crl0\"","Pattern match: \"http://logo.verisign.com/vslogo.gif0\"","Pattern match: \"http://cert.startcom.org/sfsca-crl.crl0+\"","Pattern match: \"http://crl.startcom.org/sfsca-crl.crl0\"","Pattern match: \"http://cert.startcom.org/policy.pdf05\"","Pattern match: \"http://cert.startcom.org/intermediate.pdf0\"","Pattern match: \"http://cert.startcom.org/policy.pdf0\"","Pattern match: \"7www.entrust.net/cps_2048\"","Pattern match: \"http://www.certplus.com/crl/class2.crl0\"","Pattern match: \"www.entrust.net/legal-terms1907\"","Pattern match: \"0www.entrust.net/cps\"","Pattern match: \"crl.comodoca.com/aaacertificateservices.crl06\"","Pattern match: \"crl.comodo.net/aaacertificateservices.crl0\"","Pattern match: \"http://repository.swisssign.com/0\"","Pattern match: \"www.digicert.com1!0\"","Pattern match: \"crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0\"","Pattern match: \"www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0\"","Pattern match: \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07\"","Pattern match: \"www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a\"","Pattern match: \"www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0\"","Pattern match: \"http://www.microsoft.com/windows0\"","Pattern match: \"microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll\"","Pattern match: \"https://go.microsoft.com/fwlink/?linkid=225750\"","Pattern match: \"https://go.microsoft.com/fwlink/?linkid=113316\"","Pattern match: \"https://go.microsoft.com/fwlink/?linkid=160712\"","Pattern match: \"http://schemas.microsoft.com/powershell/microsoft.powershell\"","Heuristic match: \"set-location $myinvocation.mycommand.name\"","Pattern match: \"https://go.microsoft.com/fwlink/?linkid=225747\"","Heuristic match: \"get-content $file | more.com\"","Pattern match: \"microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll\"","Pattern match: \"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\"","Pattern match: \"http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid\"","Pattern match: \"http://www.w3.org/2001/xmlschema#string\"","Pattern match: \"http://schemas.microsoft.com/ws/2008/06/identity/claims/role\"","Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","Heuristic match: \"lg.hk\"","Pattern match: \"https://curl.se/docs/http-cookies.html\"","Pattern match: \"https://curl.se/docs/alt-svc.html\"","Pattern match: \"https://curl.se/docs/hsts.html\"","Heuristic match: \"ystem.ni\"","Heuristic match: \"data.ad\"","Heuristic match: \"00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\"","Heuristic match: \"icrosoft.powershell.co\"","Pattern match: \"http://www.validationtest.contoso.com/test%d.html\"","Pattern match: \"http://schemas.microsoft.com/smi/2016/windowssettings\""],"description_v3":[{"type":"text","value":"Pattern match: \"support.mozilla.org/en-us/products/firefoxgro.allizom.troppus.inzda42ct3f8+https://app.vssps.visualstudio.com/_signin?realm=my.visualstudio.com&reply_to=https%3a%2f%2fmy.visualstudio.com%2fbenefits%3fwt.mc_id%3do~msft~vscom~nav%26campaign%3do~msft~vscom~na\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"cd.-m.rpwy/l2=szgdvi&i@n'?@_+'o{8a\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"8t.ni/n8k&-4a=f]3s\\zu9i8;h{8ft2\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.msn.com/http://www.msn.com/application/pdfapplication/pdf1g==6d0c0e84-9621-41fc-a654-a231247bd648%USERPROFILE%\\downloads\\chromesetup.exeC:\\Users\\%USERNAME%\\downloads\\chromesetup.exe.6ghttps://www.google.com/https://www.google.com/chrome/bsem/download/e\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.msn.com/en-ca\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.instagram.com/justinbieber\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"api.telegram.org\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://curl.se/docs/http-cookies.html#\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ftp@example.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://curl.se/docs/alt-svc.html#\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://curl.se/docs/hsts.html#\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \".onion\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://api.telegram.org/bot\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"microsoft.net/framework64/v4.0.30319/\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1$0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/windows\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pki/docs/cps/default.htm0@\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \".0.0.0.net\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \":\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \":\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-wow64-package0017~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"??\\c:\\windows\\system32\\catroot\\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\\microsoft-windows-client-features-package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ntrust.net\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.comodoca.com/comodorsacertificationauthority.crl0q\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crt.comodoca.com/comodorsaaddtrustca.crt0$\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.comodoca.com0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://certs.godaddy.com/repository/1301\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.godaddy.com/05\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.godaddy.com/gdroot-g2.crl0f\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://certs.godaddy.com/repository/0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crt.usertrust.com/usertrustrsaaddtrustca.crt0%\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.usertrust.com0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.thawte.com0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.thawte.com/cps07\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.thawte.com/thawtepca-g3.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.alphassl.com/repository/03\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.globalsign.net/root.crl0=\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.globalsign.com/rootr10\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://g1.symcb.com/crls/gtglobal.crl0/\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://g2.symcb.com0l\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.geotrust.com/resources/cps0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1+0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1/0-\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://ocsp.digicert.com0k\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.digicert.com/cps0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.globalsign.com/repository/03\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://s2.symcb.com0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.symauth.com/cps0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.symauth.com/rpa00\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://s1.symcb.com/pca3-g5.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.usertrust.com/addtrustexternalcaroot.crl05\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://s2.symcb.com0k\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.symauth.com/rpa0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.verisign.com/cps\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://www.verisign.com/cps04\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.verisign.com/pca3.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pkiops/docs/repository.htm\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.globalsign.net/root-r2.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.securetrust.com/stca.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://logo.verisign.com/vslogo.gif0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://cert.startcom.org/sfsca-crl.crl0+\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://crl.startcom.org/sfsca-crl.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://cert.startcom.org/policy.pdf05\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://cert.startcom.org/intermediate.pdf0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://cert.startcom.org/policy.pdf0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"7www.entrust.net/cps_2048\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.certplus.com/crl/class2.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.entrust.net/legal-terms1907\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"0www.entrust.net/cps\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.comodoca.com/aaacertificateservices.crl06\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.comodo.net/aaacertificateservices.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://repository.swisssign.com/0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.digicert.com1!0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0a\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.microsoft.com/windows0\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"microsoft.net/assembly/gac_msil/system.management.automation/v4.0_3.0.0.0__31bf3856ad364e35/system.management.automation.dll\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://go.microsoft.com/fwlink/?linkid=225750\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://go.microsoft.com/fwlink/?linkid=113316\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://go.microsoft.com/fwlink/?linkid=160712\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://schemas.microsoft.com/powershell/microsoft.powershell\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"set-location $myinvocation.mycommand.name\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://go.microsoft.com/fwlink/?linkid=225747\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"get-content $file | more.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"microsoft.net/assembly/gac_msil/microsoft.powershell.consolehost/v4.0_3.0.0.0__31bf3856ad364e35/microsoft.powershell.consolehost.dll\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/xmlschema#string\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://schemas.microsoft.com/ws/2008/06/identity/claims/role\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.w3.org/2001/xmlschema-instance\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"lg.hk\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://curl.se/docs/http-cookies.html\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://curl.se/docs/alt-svc.html\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://curl.se/docs/hsts.html\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"ystem.ni\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"data.ad\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"icrosoft.powershell.co\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.validationtest.contoso.com/test%d.html\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://schemas.microsoft.com/smi/2016/windowssettings\""}],"origin":"File/Memory","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"memorydump-2","type":20,"relevance":1,"name":"Found potential URLs in memory dumps","description":"$65","description_v2":["Found URL \"http://www.microsoft.com0rcv\" - Source: \"00000000-00002116.00000000.115026.14E70000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft\" - Source: \"00000000-00002116.00000000.115026.151B0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00002116.00000000.115026.151B0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00002116.00000000.115026.151B0000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://certs.godaddy.com/repository/1301*go\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e,czc%wvf[(;1:w$=jwdecdgreater\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"https://www.alphassl.com/repository/03,0*0(\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://g1.symcb.com/crls/gtglobal.crl0/\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigi)h\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://s1.symcb.com/pca3-g5.crl0\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://s2.symcb.com0kd0b0\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0eris$vkt7\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://www.microsoft.com0rcv\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>decd%lkcvuqiudecdwashington1redmond1microsoft\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windows0qst*&pj>e\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>n+\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","Found URL \"https://go.microsoft.com/fwlink/?linkid=225750\" - Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found URL \"https://go.microsoft.com/fwlink/?linkid=113316')]param(\" - Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found URL \"https://go.microsoft.com/fwlink/?linkid=160712\" - Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp\")","Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")","Found URL \"https://curl.se/docs/http-cookies.html\" - Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found URL \"https://curl.se/docs/alt-svc.html\" - Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found URL \"https://curl.se/docs/hsts.html\" - Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found URL \"https://api.telegram.org/boterror\" - Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00006864.00000000.115762.5B460000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00006864.00000000.115762.5B460000.00000004.mdmp\")","Found URL \"https://www.alphassl.com/repository/03,0*0(\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://certs.godaddy.com/repository/1301*go\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcjy\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"https://www.globalsign.com/repository/03,0*0(\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://s2.symcb.com0^0\\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://s1.symcb.com/pca3-g5.crl0\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://s2.symcb.com0kd0b0\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://crl.verisign.com/pca3.crl0p:/]uz_](t.]mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/windows0qst*&pj>e\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>km7]rm7]wn7]yo7]pf/](x7]\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")","Found URL \"http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan\" - Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found URL \"http://www.microsoft.com0rcv\" - Source: \"00000000-00002116.00000000.115026.14E70000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft\" - Source: \"00000000-00002116.00000000.115026.151B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00002116.00000000.115026.151B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00002116.00000000.115026.151B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://certs.godaddy.com/repository/1301*go\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e,czc%wvf[(;1:w$=jwdecdgreater\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.alphassl.com/repository/03,0*0(\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g1.symcb.com/crls/gtglobal.crl0/\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcaucooe:j9_($nnew\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.%ydigi)h\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s1.symcb.com/pca3-g5.crl0\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s2.symcb.com0kd0b0\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0eris$vkt7\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com0rcv\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>decd%lkcvuqiudecdwashington1redmond1microsoft\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windows0qst*&pj>e\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>n+\" - Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://go.microsoft.com/fwlink/?linkid=225750\" - Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://go.microsoft.com/fwlink/?linkid=113316')]param(\" - Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://go.microsoft.com/fwlink/?linkid=160712\" - Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00005044.00000000.112609.AE6B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.w3.org/2001/xmlschema-instance\" - Source: \"00000000-00005044.00000001.114529.AE6B0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://curl.se/docs/http-cookies.html\" - Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://curl.se/docs/alt-svc.html\" - Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://curl.se/docs/hsts.html\" - Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://api.telegram.org/boterror\" - Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00006864.00000000.115762.5B460000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00006864.00000000.115762.5B460000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.alphassl.com/repository/03,0*0(\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://certs.godaddy.com/repository/1301*go\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcjy\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.globalsign.com/repository/03,0*0(\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s2.symcb.com0^0\\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s1.symcb.com/pca3-g5.crl0\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://s2.symcb.com0kd0b0\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"https://www.verisign.com/cps04*0(0&\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.verisign.com/pca3.crl0p:/]uz_](t.]mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/windows0qst*&pj>e\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>washington1redmond1microsoft\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt08.ek@26vtlp0xr!s4zs9_>km7]rm7]wn7]yo7]pf/](x7]\" - Source: \"00000000-00006864.00000000.115762.5D2D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found URL \"http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan\" - Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"}],"origin":"Memory Dumps","attck_id":"T1071","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-457","type":2,"relevance":1,"name":"Found string related to HTTP headers","description":"$66","description_v2":["Found string \"installing subfilter for HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Forcing HTTP/1.1 for NTLM\" (Indicator: \"HTTP/1.1\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"HTTP/1.0 connection set to keep alive\" (Indicator: \"HTTP/1.0\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"HTTP/1.0 proxy connection set to keep alive\" (Indicator: \"HTTP/1.0\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"HTTP/1.1 proxy connection set close\" (Indicator: \"HTTP/1.1\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"installing subfilter for HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"Forcing HTTP/1.1 for NTLM\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"HTTP/1.0 connection set to keep alive\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"HTTP/1.0 proxy connection set to keep alive\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"HTTP/1.1 proxy connection set close\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"installing subfilter for HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Forcing HTTP/1.1 for NTLM\" (Indicator: \"HTTP/1.1\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"HTTP/1.0 connection set to keep alive\" (Indicator: \"HTTP/1.0\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"HTTP/1.0 proxy connection set to keep alive\" (Indicator: \"HTTP/1.0\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"HTTP/1.1 proxy connection set close\" (Indicator: \"HTTP/1.1\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"installing subfilter for HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Forcing HTTP/1.1 for NTLM\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"HTTP/1.0 connection set to keep alive\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"HTTP/1.0 proxy connection set to keep alive\" (Indicator: \"HTTP/1.0\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"HTTP/1.1 proxy connection set close\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-55","type":7,"relevance":1,"name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","description_v2":["Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb"],"description_v3":[{"type":"text","value":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb"}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-98","type":2,"relevance":1,"name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://curl.se\"\n Found HTTPS url \"https://api.telegram.org\"","description_v2":["Found HTTPS url \"https://curl.se\"","Found HTTPS url \"https://api.telegram.org\""],"description_v3":[{"type":"text","value":"Found HTTPS url \"https://curl.se\""},{"type":"linebreak"},{"type":"text","value":"Found HTTPS url \"https://api.telegram.org\""}],"origin":"File/Memory","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"summary-27","type":15,"relevance":2,"name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","description_v2":["Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network"],"description_v3":[{"type":"text","value":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network"}],"origin":"Indicator Combinations","attck_id":"T1119","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1119","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"network-38","type":7,"relevance":3,"name":"Uses HTTPS for communication","description":"HTTPS traffic to \"149.154.167.220\" on port \"443\"","description_v2":["HTTPS traffic to \"149.154.167.220\" on port \"443\""],"description_v3":[{"type":"text","value":"HTTPS traffic to \"149.154.167.220\" on port \"443\""}],"origin":"Network Traffic","attck_id":"T1573","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1573","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-722","type":2,"relevance":1,"name":"Uses cURL to communicate over HTTPS","description":"$67","description_v2":["Found string \"A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"A libcurl function was given a bad argument\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"An unknown option was passed in to libcurl\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"libcurl lacks IDN support\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"# Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"# Your alt-svc cache. https://curl.se/docs/alt-svc.html# This file was generated by libcurl! Edit at your own risk.\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"# Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk.\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Unrecognized content encoding type. libcurl understands %s content encodings.\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"CLIENT libcurl 8.11.0-DEVMATCH %s %s %sQUIT\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"CLIENT libcurl 8.11.0-DEVDEFINE %s %sQUIT\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"CLIENT libcurl 8.11.0-DEV%sQUIT\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"A libcurl function was given a bad argument\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"An unknown option was passed in to libcurl\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"libcurl lacks IDN support\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"# This file was generated by libcurl! Edit at your own risk.\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"Unrecognized content encoding type. libcurl understands %s content encodings.\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found string \"CLIENT libcurl 8.11.0-DEV\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"A libcurl function was given a bad argument\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"An unknown option was passed in to libcurl\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"libcurl lacks IDN support\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"# Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"# Your alt-svc cache. https://curl.se/docs/alt-svc.html# This file was generated by libcurl! Edit at your own risk.\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"# Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk.\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Unrecognized content encoding type. libcurl understands %s content encodings.\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"CLIENT libcurl 8.11.0-DEVMATCH %s %s %sQUIT\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"CLIENT libcurl 8.11.0-DEVDEFINE %s %sQUIT\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"CLIENT libcurl 8.11.0-DEV%sQUIT\" (Indicator: \"libcurl\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"A libcurl function was given a bad argument\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"An unknown option was passed in to libcurl\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"libcurl lacks IDN support\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"# This file was generated by libcurl! Edit at your own risk.\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Unrecognized content encoding type. libcurl understands %s content encodings.\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"CLIENT libcurl 8.11.0-DEV\" (Indicator: \"libcurl\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1071.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1071/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Pattern Matching","identifier":"yara-103","type":13,"relevance":5,"name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"svchost.exe\"\n YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on file \"svchost.exe.bin\"\n YARA signature for AES encryption matched on process \"00000000-00005044\"","description_v2":["YARA signature for AES encryption matched on file \"svchost.exe\"","YARA signature for AES encryption matched on file \"sample.bin\"","YARA signature for AES encryption matched on file \"svchost.exe.bin\"","YARA signature for AES encryption matched on process \"00000000-00005044\""],"description_v3":[{"type":"text","value":"YARA signature for AES encryption matched on file \"svchost.exe\""},{"type":"linebreak"},{"type":"text","value":"YARA signature for AES encryption matched on file \"sample.bin\""},{"type":"linebreak"},{"type":"text","value":"YARA signature for AES encryption matched on file \"svchost.exe.bin\""},{"type":"linebreak"},{"type":"text","value":"YARA signature for AES encryption matched on process \"00000000-00005044\""}],"origin":"YARA Signature","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Pattern Matching","identifier":"yara-542","type":13,"relevance":5,"name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"svchost.exe\"\n YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"\n YARA signature for Djb2 Hash Algorithm matched on file \"svchost.exe.bin\"","description_v2":["YARA signature for Djb2 Hash Algorithm matched on file \"svchost.exe\"","YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","YARA signature for Djb2 Hash Algorithm matched on file \"svchost.exe.bin\""],"description_v3":[{"type":"text","value":"YARA signature for Djb2 Hash Algorithm matched on file \"svchost.exe\""},{"type":"linebreak"},{"type":"text","value":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\""},{"type":"linebreak"},{"type":"text","value":"YARA signature for Djb2 Hash Algorithm matched on file \"svchost.exe.bin\""}],"origin":"YARA Signature","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Remote Access Related","identifier":"string-289","type":2,"relevance":1,"name":"Contains ability to receive remote commands (Powershell command string)","description":"Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Enable-PSRemoting\" (Indicator: \"Enable-PSRemoting\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1059.001","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1059/001","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Remote Access Related","identifier":"string-154","type":2,"relevance":1,"name":"Contains reference to remote powershell session activity (Powershell command string)","description":"$68","description_v2":["Found string \"Exit-PSSession\" (Indicator: \"Exit-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"New-PSSessionConfigurationFile\" (Indicator: \"New-PSSessionConfigurationFile\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Import-PSSession\" (Indicator: \"Import-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Export-PSSession\" (Indicator: \"Export-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Connect-PSSession\" (Indicator: \"Connect-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Disconnect-PSSession\" (Indicator: \"Disconnect-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"New-PSSession\" (Indicator: \"New-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-PSSession\" (Indicator: \"Get-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Remove-PSSession\" (Indicator: \"Remove-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Enter-PSSession\" (Indicator: \"Enter-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Receive-PSSession\" (Indicator: \"Receive-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Disable-PSSessionConfiguration\" (Indicator: \"Disable-PSSessionConfiguration\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Enable-PSSessionConfiguration\" (Indicator: \"Enable-PSSessionConfiguration\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-PSSessionCapability\" (Indicator: \"Get-PSSessionCapability\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"New-PSSessionOption\" (Indicator: \"New-PSSessionOption\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Register-PSSessionConfiguration\" (Indicator: \"Register-PSSessionConfiguration\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Set-PSSessionConfiguration\" (Indicator: \"Set-PSSessionConfiguration\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Test-PSSessionConfigurationFile\" (Indicator: \"Test-PSSessionConfigurationFile\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Unregister-PSSessionConfiguration\" (Indicator: \"Unregister-PSSessionConfiguration\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Exit-PSSession\" (Indicator: \"Exit-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"New-PSSessionConfigurationFile\" (Indicator: \"New-PSSessionConfigurationFile\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Import-PSSession\" (Indicator: \"Import-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Export-PSSession\" (Indicator: \"Export-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Connect-PSSession\" (Indicator: \"Connect-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Disconnect-PSSession\" (Indicator: \"Disconnect-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"New-PSSession\" (Indicator: \"New-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-PSSession\" (Indicator: \"Get-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Remove-PSSession\" (Indicator: \"Remove-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Enter-PSSession\" (Indicator: \"Enter-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Receive-PSSession\" (Indicator: \"Receive-PSSession\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Disable-PSSessionConfiguration\" (Indicator: \"Disable-PSSessionConfiguration\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Enable-PSSessionConfiguration\" (Indicator: \"Enable-PSSessionConfiguration\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-PSSessionCapability\" (Indicator: \"Get-PSSessionCapability\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"New-PSSessionOption\" (Indicator: \"New-PSSessionOption\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Register-PSSessionConfiguration\" (Indicator: \"Register-PSSessionConfiguration\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Set-PSSessionConfiguration\" (Indicator: \"Set-PSSessionConfiguration\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Test-PSSessionConfigurationFile\" (Indicator: \"Test-PSSessionConfigurationFile\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Unregister-PSSessionConfiguration\" (Indicator: \"Unregister-PSSessionConfiguration\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1021.006","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1021/006","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Remote Access Related","identifier":"string-531","type":2,"relevance":1,"name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE332682A05973200EEDF66AFB65D1]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002116.00000000.115026.14E70000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE56E9B2267F58A7C943EB3677221E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp\")","description_v2":["Found string \"+ncalrpc:[OLE332682A05973200EEDF66AFB65D1]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002116.00000000.115026.14E70000.00000004.mdmp\")","Found string \"+ncalrpc:[OLE56E9B2267F58A7C943EB3677221E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"+ncalrpc:[OLE332682A05973200EEDF66AFB65D1]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002116.00000000.115026.14E70000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"+ncalrpc:[OLE56E9B2267F58A7C943EB3677221E]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00006864.00000000.115762.5B0B0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1090","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1090","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-647","type":2,"relevance":1,"name":"Able to retrieve security-related event logs (PowerShell command string)","description":"Found string \"PowerShell -Command {Get-EventLog -LogName security}\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")\n Found string \"PowerShell -Command \"& {Get-EventLog -LogName security}\"\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"PowerShell -Command {Get-EventLog -LogName security}\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"PowerShell -Command \"& {Get-EventLog -LogName security}\"\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"PowerShell -Command {Get-EventLog -LogName security}\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"PowerShell -Command \"& {Get-EventLog -LogName security}\"\" (Indicator: \"Get-EventLog\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1654","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1654","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"target-289","type":9,"relevance":1,"name":"Attempts to get system information using PowerShell","description":"Process \"powershell.exe\" with commandline \"powershell -command \"(Get-ItemProperty 'HKCU:\\\\Control Panel\\\\Desktop').Wallpaper\"\" (UID: 00000000-00002116)\n Process \"powershell.exe\" with commandline \"powershell -command \"(Get-ItemProperty 'HKCU:\\\\Control Panel\\\\Desktop').Wallpaper\"\" (UID: 00000000-00001036)","description_v2":["Process \"powershell.exe\" with commandline \"powershell -command \"(Get-ItemProperty 'HKCU:\\\\Control Panel\\\\Desktop').Wallpaper\"\" (UID: 00000000-00002116)","Process \"powershell.exe\" with commandline \"powershell -command \"(Get-ItemProperty 'HKCU:\\\\Control Panel\\\\Desktop').Wallpaper\"\" (UID: 00000000-00001036)"],"description_v3":[{"type":"text","value":"Process \"powershell.exe\" with commandline \"powershell -command \"(Get-ItemProperty 'HKCU:\\\\Control Panel\\\\Desktop').Wallpaper\"\""},{"type":"process","process_uid":"00000000-00002116","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Process \"powershell.exe\" with commandline \"powershell -command \"(Get-ItemProperty 'HKCU:\\\\Control Panel\\\\Desktop').Wallpaper\"\""},{"type":"process","process_uid":"00000000-00001036","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-105","type":6,"relevance":3,"name":"Calls an API possibly used to take screenshots","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"ffffffffb201090e\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"38010500\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"c0108c4\"\n \"cx\": \"1280\"\n \"cy\": \"1024\"}","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"ffffffffb201090e\"","\"cx\": \"1\"","\"cy\": \"1\"}","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"38010500\"","\"cx\": \"1\"","\"cy\": \"1\"}","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"c0108c4\"","\"cx\": \"1280\"","\"cy\": \"1024\"}"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"ffffffffb201090e\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"1\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"1\"}"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"38010500\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"1\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"1\"}"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"c0108c4\""},{"type":"linebreak"},{"type":"text","value":"\"cx\": \"1280\""},{"type":"linebreak"},{"type":"text","value":"\"cy\": \"1024\"}"}],"origin":"API Call","attck_id":"T1113","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1113","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-102","type":6,"relevance":5,"name":"Calls an API typically used for searching a directory for files","description":"$69","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter ywzu7870.default (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter addons.json (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter addonStartup.json.lz4 (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter AlternateServices.txt (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter blocklist.xml (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter bookmarkbackups (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter bookmarks-2018-07-17_14_h9TF3aB2ySWViawDed7AOw==.jsonlz4 (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter bo (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter cert9.db (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter compatibility.ini (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter containers.json (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter content-prefs.sqlite (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter cookies.sqlite (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter crashes (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter events (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter store.json.mozlz4 (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter st (UID: 00000000-00005044)","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter datareporting (UID: 00000000-00005044)"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter ywzu7870.default (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter addons.json (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter addonStartup.json.lz4 (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter AlternateServices.txt (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter blocklist.xml (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter bookmarkbackups (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter bookmarks-2018-07-17_14_h9TF3aB2ySWViawDed7AOw==.jsonlz4 (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter bo (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter cert9.db (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter compatibility.ini (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter containers.json (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter content-prefs.sqlite (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter cookies.sqlite (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter crashes (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter events (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter store.json.mozlz4 (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter st (UID: 00000000-00005044)"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"FindNextFileW\" with parameter datareporting (UID: 00000000-00005044)"}],"origin":"API Call","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-103","type":6,"relevance":3,"name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WMIC.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}","\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"","\"th32ProcessID\": \"0\"}","\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}","\"WMIC.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"","\"th32ProcessID\": \"0\"}"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\""},{"type":"linebreak"},{"type":"text","value":"\"th32ProcessID\": \"0\"}"}],"origin":"API Call","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-141","type":6,"relevance":2,"name":"Calls an API typically used to retrieve computer name","description":"\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00007984)\n \"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00004104)\n \"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00004276)\n \"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00000796)\n \"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00005688)\n \"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00007968)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00002116)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006864)","description_v2":["\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00007984)","\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00004104)","\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00004276)","\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00000796)","\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00005688)","\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00007968)","\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00002116)","\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006864)"],"description_v3":[{"type":"text","value":"\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00007984)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00004104)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00004276)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00000796)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00005688)"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" called \"GetComputerNameW\" (UID: 00000000-00007968)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006864)"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-108","type":6,"relevance":3,"name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","description_v2":["\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}"],"description_v3":[{"type":"text","value":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}"}],"origin":"API Call","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"api-135","type":6,"relevance":2,"name":"Calls an API typically used to retrieve user name","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00002116)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006864)","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","\"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00002116)","\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","\"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006864)"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00002116)"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}"},{"type":"linebreak"},{"type":"text","value":"\"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006864)"}],"origin":"API Call","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-57","type":2,"relevance":3,"name":"Contains CRYPTO related strings","description":"$6a","description_v2":["Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"CHACHA20_POLY1305\" (Indicator: \"chacha\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aesni_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"crypto\\evp\\e_aes.c\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aesni_gcm_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aesni_xts_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aesni_ccm_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aesni_ocb_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aes_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aes_gcm_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aes_gcm_tls_cipher\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aes_xts_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aes_xts_cipher\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aes_ccm_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aes_wrap_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aes_wrap_cipher\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aes_ocb_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aes_ocb_cipher\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"AES-256-CTR\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"id-smime-alg-CMS3DESwrap\" (Indicator: \"3des\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"blowfish\" (Indicator: \"blowfish\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"CAST5-CBC\" (Indicator: \"cast5\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"id-aes128-wrap\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"id-aes128-wrap\" (Indicator: \"aes128\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aes128-wrap\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"aes128-wrap\" (Indicator: \"aes128\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"id-aes128-wrap-pad\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"id-aes128-wrap-pad\" (Indicator: \"aes128\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"],"description_v3":[{"type":"text","value":"Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"CHACHA20_POLY1305\" (Indicator: \"chacha\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aesni_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"crypto\\evp\\e_aes.c\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aesni_gcm_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aesni_xts_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aesni_ccm_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aesni_ocb_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aes_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aes_gcm_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aes_gcm_tls_cipher\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aes_xts_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aes_xts_cipher\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aes_ccm_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aes_wrap_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aes_wrap_cipher\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aes_ocb_init_key\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aes_ocb_cipher\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"AES-256-CTR\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"id-smime-alg-CMS3DESwrap\" (Indicator: \"3des\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"blowfish\" (Indicator: \"blowfish\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"CAST5-CBC\" (Indicator: \"cast5\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"id-aes128-wrap\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"id-aes128-wrap\" (Indicator: \"aes128\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aes128-wrap\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"aes128-wrap\" (Indicator: \"aes128\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"id-aes128-wrap-pad\" (Indicator: \"aes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"id-aes128-wrap-pad\" (Indicator: \"aes128\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"}],"origin":"File/Memory","attck_id":"T1027","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1027","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-188","type":2,"relevance":1,"name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1115","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1115","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-78","type":2,"relevance":1,"name":"Contains ability to capture screen (API string)","description":"$6b","description_v2":["Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1113","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1113","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-80","type":2,"relevance":1,"name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-83","type":2,"relevance":1,"name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","description_v2":["Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-374","type":2,"relevance":1,"name":"Contains ability to enumerate objects (Powershell command string)","description":"$6c","description_v2":["Found string \"Select-Object\" (Indicator: \"Select-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Measure-Object\" (Indicator: \"Measure-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Microsoft.PowerShell.Core\\Where-Object {$_.Name -match '^Verbs.'} |\" (Indicator: \"Where-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Microsoft.PowerShell.Utility\\Select-Object @{\" (Indicator: \"Select-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"$allVerbs | Microsoft.PowerShell.Core\\Where-Object { $_.Verb -like $v }\" (Indicator: \"Where-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"ForEach-Object\" (Indicator: \"ForEach-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Where-Object\" (Indicator: \"Where-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Compare-Object\" (Indicator: \"Compare-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Group-Object\" (Indicator: \"Group-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Sort-Object\" (Indicator: \"Sort-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Tee-Object\" (Indicator: \"Tee-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Select-Object\" (Indicator: \"Select-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Measure-Object\" (Indicator: \"Measure-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Microsoft.PowerShell.Core\\Where-Object {$_.Name -match '^Verbs.'} |\" (Indicator: \"Where-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Microsoft.PowerShell.Utility\\Select-Object @{\" (Indicator: \"Select-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"$allVerbs | Microsoft.PowerShell.Core\\Where-Object { $_.Verb -like $v }\" (Indicator: \"Where-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ForEach-Object\" (Indicator: \"ForEach-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Where-Object\" (Indicator: \"Where-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Compare-Object\" (Indicator: \"Compare-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Group-Object\" (Indicator: \"Group-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Sort-Object\" (Indicator: \"Sort-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Tee-Object\" (Indicator: \"Tee-Object\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-85","type":2,"relevance":1,"name":"Contains ability to enumerate process and/or its information (API string)","description":"$6d","description_v2":["Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"Module32First\" (Indicator: \"Module32First\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"Module32Next\" (Indicator: \"Module32Next\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"Module32First\" (Indicator: \"Module32First\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"Module32Next\" (Indicator: \"Module32Next\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Module32First\" (Indicator: \"Module32First\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Module32Next\" (Indicator: \"Module32Next\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Module32First\" (Indicator: \"Module32First\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Module32Next\" (Indicator: \"Module32Next\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Process32NextW\" (Indicator: \"Process32Next\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"Process32FirstW\" (Indicator: \"Process32First\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-229","type":2,"relevance":1,"name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")\n Found reference to API \"RegGetValueW\" (Indicator: \"RegGetValue\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","description_v2":["Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"RegGetValueW\" (Indicator: \"RegGetValue\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegGetValueW\" (Indicator: \"RegGetValue\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-534","type":2,"relevance":0,"name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-427","type":2,"relevance":1,"name":"Contains ability to retrieve a module handle (API string)","description":"$6e","description_v2":["Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-317","type":2,"relevance":1,"name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","description_v2":["Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-207","type":2,"relevance":1,"name":"Contains ability to retrieve file and directory information (API string)","description":"$6f","description_v2":["Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetTempPath2W\" (Indicator: \"GetTempPath\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTempPath2W\" (Indicator: \"GetTempPath\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-484","type":2,"relevance":1,"name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where the quotation marks indicate a string and the invoke operator (&)\" (Indicator: \"where \"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"where the quotation marks indicate a string and the invoke operator (&)\" (Indicator: \"where \"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"where the quotation marks indicate a string and the invoke operator (&)\" (Indicator: \"where \"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-86","type":2,"relevance":1,"name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","description_v2":["Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-328","type":2,"relevance":1,"name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir\" (Indicator: \"dir\"; Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")","description_v2":["Found string \"dir\" (Indicator: \"dir\"; Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"dir\" (Indicator: \"dir\"; Source: \"00000000-00002116.00000000.115026.17190000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1083","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-291","type":2,"relevance":1,"name":"Contains ability to retrieve processes (Powershell command string)","description":"Found string \"Get-Process\" (Indicator: \"Get-Process\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","description_v2":["Found string \"Get-Process\" (Indicator: \"Get-Process\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"Get-Process\" (Indicator: \"Get-Process\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1057","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1057","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-394","type":2,"relevance":1,"name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$70","description_v2":["Found string \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\" (Indicator: \"Get-ItemProperty\"; File: \"AMSI\")","Found string \"/c powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" (Indicator: \"Get-ItemProperty\"; File: \"cmd.exe\")","Found string \"powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" (Indicator: \"Get-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.14E70000.00000004.mdmp\")","Found string \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\" (Indicator: \"Get-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.14E70000.00000004.mdmp, 00000000-00002116.00000000.115026.15040000.00000004.mdmp, 00000000-00002116.00000000.115026.151B0000.00000004.mdmp, 00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-Command\" (Indicator: \"Get-Command\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-Module\" (Indicator: \"Get-Module\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-FormatData\" (Indicator: \"Get-FormatData\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-Help\" (Indicator: \"Get-Help\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \".FORWARDHELPTARGETNAME Get-Help\" (Indicator: \"Get-Help\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-Help @PSBoundParameters | more\" (Indicator: \"Get-Help\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Microsoft.PowerShell.Utility\\Get-Member -type Properties -static |\" (Indicator: \"Get-Member\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-PSBreakpoint\" (Indicator: \"Get-PSBreakpoint\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-Variable\" (Indicator: \"Get-Variable\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-Content $file | more.com\" (Indicator: \"Get-Content\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-Verb\" (Indicator: \"Get-Verb\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"$null = Read-Host '\" (Indicator: \"Read-Host\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"$null = Read-Host 'Press Enter to continue...'\" (Indicator: \"Read-Host\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-Alias\" (Indicator: \"Get-Alias\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-Content\" (Indicator: \"Get-Content\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-ChildItem\" (Indicator: \"Get-ChildItem\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-PSDrive\" (Indicator: \"Get-PSDrive\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-PSCallStack\" (Indicator: \"Get-PSCallStack\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-History\" (Indicator: \"Get-History\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-Location\" (Indicator: \"Get-Location\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")","Found string \"Get-Member\" (Indicator: \"Get-Member\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"],"description_v3":[{"type":"text","value":"Found string \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\" (Indicator: \"Get-ItemProperty\"; File: \"AMSI\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"/c powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" (Indicator: \"Get-ItemProperty\"; File: \"cmd.exe\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"powershell -command \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\"\" (Indicator: \"Get-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.14E70000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"(Get-ItemProperty 'HKCU:\\Control Panel\\Desktop').Wallpaper\" (Indicator: \"Get-ItemProperty\"; Source: \"00000000-00002116.00000000.115026.14E70000.00000004.mdmp, 00000000-00002116.00000000.115026.15040000.00000004.mdmp, 00000000-00002116.00000000.115026.151B0000.00000004.mdmp, 00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-Command\" (Indicator: \"Get-Command\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-Module\" (Indicator: \"Get-Module\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-FormatData\" (Indicator: \"Get-FormatData\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-Help\" (Indicator: \"Get-Help\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \".FORWARDHELPTARGETNAME Get-Help\" (Indicator: \"Get-Help\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-Help @PSBoundParameters | more\" (Indicator: \"Get-Help\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Microsoft.PowerShell.Utility\\Get-Member -type Properties -static |\" (Indicator: \"Get-Member\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-PSBreakpoint\" (Indicator: \"Get-PSBreakpoint\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-Variable\" (Indicator: \"Get-Variable\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-Content $file | more.com\" (Indicator: \"Get-Content\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-Verb\" (Indicator: \"Get-Verb\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"$null = Read-Host '\" (Indicator: \"Read-Host\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"$null = Read-Host 'Press Enter to continue...'\" (Indicator: \"Read-Host\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-Alias\" (Indicator: \"Get-Alias\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-Content\" (Indicator: \"Get-Content\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-ChildItem\" (Indicator: \"Get-ChildItem\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-PSDrive\" (Indicator: \"Get-PSDrive\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-PSCallStack\" (Indicator: \"Get-PSCallStack\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-History\" (Indicator: \"Get-History\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-Location\" (Indicator: \"Get-Location\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Get-Member\" (Indicator: \"Get-Member\"; Source: \"00000000-00002116.00000000.115026.172D0000.00000004.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-164","type":2,"relevance":1,"name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","description_v2":["Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-532","type":2,"relevance":1,"name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","description_v2":["Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"],"description_v3":[{"type":"text","value":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-107","type":2,"relevance":1,"name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-224","type":2,"relevance":1,"name":"Contains ability to retrieve the local name for a socket (API string)","description":"$71","description_v2":["Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"getsockname error\" (Indicator: \"getsockname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"getsockname truncated address\" (Indicator: \"getsockname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"getsockname error\" (Indicator: \"getsockname\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"getsockname truncated address\" (Indicator: \"getsockname\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"getsockname error\" (Indicator: \"getsockname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"getsockname truncated address\" (Indicator: \"getsockname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"getsockname error\" (Indicator: \"getsockname\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"getsockname truncated address\" (Indicator: \"getsockname\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1016","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1016","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-131","type":2,"relevance":1,"name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-205","type":2,"relevance":1,"name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")","description_v2":["Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp, 00000000-00006864.00000000.115762.B822A000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1497.003","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1497/003","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-121","type":2,"relevance":1,"name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","description_v2":["Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")","Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"},{"type":"linebreak"},{"type":"text","value":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00005044.00000001.114529.BDF04000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":"T1033","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1033","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-82","type":2,"relevance":1,"name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")","description_v2":["Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"],"description_v3":[{"type":"text","value":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006864.00000000.115762.6AEA2000.00000002.mdmp\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-475","type":2,"relevance":1,"name":"Contains string like password/secret","description":"$72","description_v2":["Found string \"secretBag\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"secretary\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"password based MAC\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"invalid secret\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"invalid secret length\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"bad password read\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"problems getting password\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"no password\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"missing pbm secret\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"missing secret\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"ossl_pw_set_pem_password_cb\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"No password method specified\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"hexsecret\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"PEM password callback wrapper\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"shared_secret\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"secretsz invalid\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"derive_secret\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"*secretlen too small\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"empty password\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"maybe wrong password\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"No password part in the URL\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Bad password\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"Excessive password length for proxy auth\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"password\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")","Found string \"schannel: Failed to import cert file %s, password is bad\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"],"description_v3":[{"type":"text","value":"Found string \"secretBag\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"secretary\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"password based MAC\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"invalid secret\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"invalid secret length\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"bad password read\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"problems getting password\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"no password\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"missing pbm secret\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"missing secret\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"ossl_pw_set_pem_password_cb\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"No password method specified\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"hexsecret\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"PEM password callback wrapper\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"shared_secret\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"secretsz invalid\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"derive_secret\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"*secretlen too small\" (Indicator: \"secret\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"empty password\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"maybe wrong password\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"No password part in the URL\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Bad password\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"Excessive password length for proxy auth\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"password\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"},{"type":"linebreak"},{"type":"text","value":"Found string \"schannel: Failed to import cert file %s, password is bad\" (Indicator: \"password\"; File: \"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c\")"}],"origin":"File/Memory","attck_id":"T1555","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1555","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"static-88","type":0,"relevance":1,"name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]","description_v2":["Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]"],"description_v3":[{"type":"text","value":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c]"}],"origin":"Static Parser","attck_id":"T1106","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1106","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"registry-106","type":3,"relevance":3,"name":"Reads system-defined device setup information from registry","description":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","description_v2":["\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")"],"description_v3":[{"type":"text","value":"\"810d4850ee216df639648a37004a0d4d1275a194924fa53312d3403be97edf5c.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")"}],"origin":"Registry Access","attck_id":"T1082","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/techniques/T1082","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"string-507","type":2,"relevance":1,"name":"References to WMI query strings used for information discovery","description":"$73","description_v2":["Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_Keyboard get Description,DeviceID\" (Indicator: \" Win32_Keyboard\"; Source: \"00000000-00005044-00000C46-16681831658\")","Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_PointingDevice get Description,PNPDeviceID\" (Indicator: \" Win32_PointingDevice\"; Source: \"00000000-00005044-00000C46-31025008696\")","Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (Indicator: \" Win32_Desktop\"; Source: \"00000000-00005044-00000C46-59868927018\")","Found string \"%WINDIR%\\system32\\cmd.exe /c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (Indicator: \" Win32_DesktopMonitor\"; Source: \"00000000-00005044-00000C46-59868927018\")","Found string \"wmic path Win32_Keyboard get Description,DeviceID\" (Indicator: \" Win32_Keyboard\"; Source: \"00000000-00002092-00000C46-1867756336\")","Found string \"wmic path Win32_PointingDevice get Description,PNPDeviceID\" (Indicator: \" Win32_PointingDevice\"; Source: \"00000000-00004448-00000C46-1966431293\")","Found string \"wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (Indicator: \" Win32_Desktop\"; Source: \"00000000-00007884-00000C46-1955230033\")","Found string \"wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (Indicator: \" Win32_DesktopMonitor\"; Source: \"00000000-00007884-00000C46-1955230033\")","Found string \"/c wmic path Win32_Keyboard get Description,DeviceID\" (Indicator: \" Win32_Keyboard\"; File: \"cmd.exe\")","Found string \"/c wmic path Win32_PointingDevice get Description,PNPDeviceID\" (Indicator: \" Win32_PointingDevice\"; File: \"cmd.exe\")","Found string \"/c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (Indicator: \" Win32_Desktop\"; File: \"cmd.exe\")","Found string \"/c wmic path Win32_DesktopMonitor get Description,PNPDeviceID\" (Indicator: \" Win32_DesktopMonitor\"; File: \"cmd.exe\")","Found string \"